]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-3.1.7-201201031759.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-3.1.7-201201031759.patch
CommitLineData
68201d93
PK		 1diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2index dfa6fc6..0095943 100644
3--- a/Documentation/dontdiff
4+++ b/Documentation/dontdiff
5@@ -5,6 +5,7 @@
6 *.cis
7 *.cpio
8 *.csp
9+*.dbg
10 *.dsp
11 *.dvi
12 *.elf
13@@ -14,6 +15,7 @@
14 *.gcov
15 *.gen.S
16 *.gif
17+*.gmo
18 *.grep
19 *.grp
20 *.gz
21@@ -48,9 +50,11 @@
22 *.tab.h
23 *.tex
24 *.ver
25+*.vim
26 *.xml
27 *.xz
28 *_MODULES
29+*_reg_safe.h
30 *_vga16.c
31 *~
32 \#*#
33@@ -70,6 +74,7 @@ Kerntypes
34 Module.markers
35 Module.symvers
36 PENDING
37+PERF*
38 SCCS
39 System.map*
40 TAGS
41@@ -93,19 +98,24 @@ bounds.h
42 bsetup
43 btfixupprep
44 build
45+builtin-policy.h
46 bvmlinux
47 bzImage*
48 capability_names.h
49 capflags.c
50 classlist.h*
51+clut_vga16.c
52+common-cmds.h
53 comp*.log
54 compile.h*
55 conf
56 config
57 config-*
58 config_data.h*
59+config.c
60 config.mak
61 config.mak.autogen
62+config.tmp
63 conmakehash
64 consolemap_deftbl.c*
65 cpustr.h
66@@ -119,6 +129,7 @@ dslm
67 elf2ecoff
68 elfconfig.h*
69 evergreen_reg_safe.h
70+exception_policy.conf
71 fixdep
72 flask.h
73 fore200e_mkfirm
74@@ -126,12 +137,15 @@ fore200e_pca_fw.c*
75 gconf
76 gconf.glade.h
77 gen-devlist
78+gen-kdb_cmds.c
79 gen_crc32table
80 gen_init_cpio
81 generated
82 genheaders
83 genksyms
84 *_gray256.c
85+hash
86+hid-example
87 hpet_example
88 hugepage-mmap
89 hugepage-shm
90@@ -146,7 +160,7 @@ int32.c
91 int4.c
92 int8.c
93 kallsyms
94-kconfig
95+kern_constants.h
96 keywords.c
97 ksym.c*
98 ksym.h*
99@@ -154,7 +168,6 @@ kxgettext
100 lkc_defs.h
101 lex.c
102 lex.*.c
103-linux
104 logo_*.c
105 logo_*_clut224.c
106 logo_*_mono.c
107@@ -166,14 +179,15 @@ machtypes.h
108 map
109 map_hugetlb
110 maui_boot.h
111-media
112 mconf
113+mdp
114 miboot*
115 mk_elfconfig
116 mkboot
117 mkbugboot
118 mkcpustr
119 mkdep
120+mkpiggy
121 mkprep
122 mkregtable
123 mktables
124@@ -209,6 +223,7 @@ r300_reg_safe.h
125 r420_reg_safe.h
126 r600_reg_safe.h
127 recordmcount
128+regdb.c
129 relocs
130 rlim_names.h
131 rn50_reg_safe.h
132@@ -219,6 +234,7 @@ setup
133 setup.bin
134 setup.elf
135 sImage
136+slabinfo
137 sm_tbl*
138 split-include
139 syscalltab.h
140@@ -229,6 +245,7 @@ tftpboot.img
141 timeconst.h
142 times.h*
143 trix_boot.h
144+user_constants.h
145 utsrelease.h*
146 vdso-syms.lds
147 vdso.lds
148@@ -246,7 +263,9 @@ vmlinux
149 vmlinux-*
150 vmlinux.aout
151 vmlinux.bin.all
152+vmlinux.bin.bz2
153 vmlinux.lds
154+vmlinux.relocs
155 vmlinuz
156 voffset.h
157 vsyscall.lds
158@@ -254,9 +273,11 @@ vsyscall_32.lds
159 wanxlfw.inc
160 uImage
161 unifdef
162+utsrelease.h
163 wakeup.bin
164 wakeup.elf
165 wakeup.lds
166 zImage*
167 zconf.hash.c
168+zconf.lex.c
169 zoffset.h
170diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
171index d6e6724..a024ce8 100644
172--- a/Documentation/kernel-parameters.txt
173+++ b/Documentation/kernel-parameters.txt
174@@ -1898,6 +1898,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
175 the specified number of seconds. This is to be used if
176 your oopses keep scrolling off the screen.
177
178+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
179+ virtualization environments that don't cope well with the
180+ expand down segment used by UDEREF on X86-32 or the frequent
181+ page table updates on X86-64.
182+
183+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
184+
185 pcbit= [HW,ISDN]
186
187 pcd. [PARIDE]
188diff --git a/Makefile b/Makefile
189index 96c48df..f811964 100644
190--- a/Makefile
191+++ b/Makefile
192@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
193
194 HOSTCC = gcc
195 HOSTCXX = g++
196-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
197-HOSTCXXFLAGS = -O2
198+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
199+HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
200+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
201
202 # Decide whether to build built-in, modular, or both.
203 # Normally, just do built-in.
204@@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
205 # Rules shared between *config targets and build targets
206
207 # Basic helpers built in scripts/
208-PHONY += scripts_basic
209-scripts_basic:
210+PHONY += scripts_basic gcc-plugins
211+scripts_basic: gcc-plugins
212 $(Q)$(MAKE) $(build)=scripts/basic
213 $(Q)rm -f .tmp_quiet_recordmcount
214
215@@ -564,6 +565,42 @@ else
216 KBUILD_CFLAGS += -O2
217 endif
218
219+ifndef DISABLE_PAX_PLUGINS
220+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
221+ifndef DISABLE_PAX_CONSTIFY_PLUGIN
222+CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
223+endif
224+ifdef CONFIG_PAX_MEMORY_STACKLEAK
225+STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
226+STACKLEAK_PLUGIN += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
227+endif
228+ifdef CONFIG_KALLOCSTAT_PLUGIN
229+KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
230+endif
231+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
232+KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
233+KERNEXEC_PLUGIN += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD)
234+endif
235+ifdef CONFIG_CHECKER_PLUGIN
236+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
237+CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
238+endif
239+endif
240+GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
241+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
242+gcc-plugins:
243+ $(Q)$(MAKE) $(build)=tools/gcc
244+else
245+gcc-plugins:
246+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
247+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
248+else
249+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
250+endif
251+ $(Q)echo "PAX_MEMORY_STACKLEAK and other features will be less secure"
252+endif
253+endif
254+
255 include $(srctree)/arch/$(SRCARCH)/Makefile
256
257 ifneq ($(CONFIG_FRAME_WARN),0)
258@@ -708,7 +745,7 @@ export mod_strip_cmd
259
260
261 ifeq ($(KBUILD_EXTMOD),)
262-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
263+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
264
265 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
266 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
267@@ -932,6 +969,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
268
269 # The actual objects are generated when descending,
270 # make sure no implicit rule kicks in
271+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
272 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
273
274 # Handle descending into subdirectories listed in $(vmlinux-dirs)
275@@ -941,7 +979,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
276 # Error messages still appears in the original language
277
278 PHONY += $(vmlinux-dirs)
279-$(vmlinux-dirs): prepare scripts
280+$(vmlinux-dirs): gcc-plugins prepare scripts
281 $(Q)$(MAKE) $(build)=$@
282
283 # Store (new) KERNELRELASE string in include/config/kernel.release
284@@ -986,6 +1024,7 @@ prepare0: archprepare FORCE
285 $(Q)$(MAKE) $(build)=. missing-syscalls
286
287 # All the preparing..
288+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
289 prepare: prepare0
290
291 # Generate some files
292@@ -1087,6 +1126,7 @@ all: modules
293 # using awk while concatenating to the final file.
294
295 PHONY += modules
296+modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
297 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
298 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
299 @$(kecho) ' Building modules, stage 2.';
300@@ -1102,7 +1142,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
301
302 # Target to prepare building external modules
303 PHONY += modules_prepare
304-modules_prepare: prepare scripts
305+modules_prepare: gcc-plugins prepare scripts
306
307 # Target to install modules
308 PHONY += modules_install
309@@ -1198,7 +1238,7 @@ distclean: mrproper
310 @find $(srctree) $(RCS_FIND_IGNORE) \
311 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
312 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
313- -o -name '.*.rej' -o -size 0 \
314+ -o -name '.*.rej' -o -name '*.so' -o -size 0 \
315 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
316 -type f -print | xargs rm -f
317
318@@ -1360,6 +1400,7 @@ PHONY += $(module-dirs) modules
319 $(module-dirs): crmodverdir $(objtree)/Module.symvers
320 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
321
322+modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
323 modules: $(module-dirs)
324 @$(kecho) ' Building modules, stage 2.';
325 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
326@@ -1486,17 +1527,19 @@ else
327 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
328 endif
329
330-%.s: %.c prepare scripts FORCE
331+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
332+%.s: %.c gcc-plugins prepare scripts FORCE
333 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
334 %.i: %.c prepare scripts FORCE
335 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
336-%.o: %.c prepare scripts FORCE
337+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
338+%.o: %.c gcc-plugins prepare scripts FORCE
339 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
340 %.lst: %.c prepare scripts FORCE
341 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
342-%.s: %.S prepare scripts FORCE
343+%.s: %.S gcc-plugins prepare scripts FORCE
344 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
345-%.o: %.S prepare scripts FORCE
346+%.o: %.S gcc-plugins prepare scripts FORCE
347 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
348 %.symtypes: %.c prepare scripts FORCE
349 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
350@@ -1506,11 +1549,13 @@ endif
351 $(cmd_crmodverdir)
352 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
353 $(build)=$(build-dir)
354-%/: prepare scripts FORCE
355+%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
356+%/: gcc-plugins prepare scripts FORCE
357 $(cmd_crmodverdir)
358 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
359 $(build)=$(build-dir)
360-%.ko: prepare scripts FORCE
361+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
362+%.ko: gcc-plugins prepare scripts FORCE
363 $(cmd_crmodverdir)
364 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
365 $(build)=$(build-dir) $(@:.ko=.o)
366diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
367index da5449e..7418343 100644
368--- a/arch/alpha/include/asm/elf.h
369+++ b/arch/alpha/include/asm/elf.h
370@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
371
372 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
373
374+#ifdef CONFIG_PAX_ASLR
375+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
376+
377+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
378+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
379+#endif
380+
381 /* $0 is set by ld.so to a pointer to a function which might be
382 registered using atexit. This provides a mean for the dynamic
383 linker to call DT_FINI functions for shared libraries that have
384diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
385index de98a73..bd4f1f8 100644
386--- a/arch/alpha/include/asm/pgtable.h
387+++ b/arch/alpha/include/asm/pgtable.h
388@@ -101,6 +101,17 @@ struct vm_area_struct;
389 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
390 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
391 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
392+
393+#ifdef CONFIG_PAX_PAGEEXEC
394+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
395+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
396+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
397+#else
398+# define PAGE_SHARED_NOEXEC PAGE_SHARED
399+# define PAGE_COPY_NOEXEC PAGE_COPY
400+# define PAGE_READONLY_NOEXEC PAGE_READONLY
401+#endif
402+
403 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
404
405 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
406diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
407index 2fd00b7..cfd5069 100644
408--- a/arch/alpha/kernel/module.c
409+++ b/arch/alpha/kernel/module.c
410@@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
411
412 /* The small sections were sorted to the end of the segment.
413 The following should definitely cover them. */
414- gp = (u64)me->module_core + me->core_size - 0x8000;
415+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
416 got = sechdrs[me->arch.gotsecindex].sh_addr;
417
418 for (i = 0; i < n; i++) {
419diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
420index 01e8715..be0e80f 100644
421--- a/arch/alpha/kernel/osf_sys.c
422+++ b/arch/alpha/kernel/osf_sys.c
423@@ -1147,7 +1147,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
424 /* At this point: (!vma || addr < vma->vm_end). */
425 if (limit - len < addr)
426 return -ENOMEM;
427- if (!vma || addr + len <= vma->vm_start)
428+ if (check_heap_stack_gap(vma, addr, len))
429 return addr;
430 addr = vma->vm_end;
431 vma = vma->vm_next;
432@@ -1183,6 +1183,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
433 merely specific addresses, but regions of memory -- perhaps
434 this feature should be incorporated into all ports? */
435
436+#ifdef CONFIG_PAX_RANDMMAP
437+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
438+#endif
439+
440 if (addr) {
441 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
442 if (addr != (unsigned long) -ENOMEM)
443@@ -1190,8 +1194,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
444 }
445
446 /* Next, try allocating at TASK_UNMAPPED_BASE. */
447- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
448- len, limit);
449+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
450+
451 if (addr != (unsigned long) -ENOMEM)
452 return addr;
453
454diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
455index fadd5f8..904e73a 100644
456--- a/arch/alpha/mm/fault.c
457+++ b/arch/alpha/mm/fault.c
458@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
459 __reload_thread(pcb);
460 }
461
462+#ifdef CONFIG_PAX_PAGEEXEC
463+/*
464+ * PaX: decide what to do with offenders (regs->pc = fault address)
465+ *
466+ * returns 1 when task should be killed
467+ * 2 when patched PLT trampoline was detected
468+ * 3 when unpatched PLT trampoline was detected
469+ */
470+static int pax_handle_fetch_fault(struct pt_regs *regs)
471+{
472+
473+#ifdef CONFIG_PAX_EMUPLT
474+ int err;
475+
476+ do { /* PaX: patched PLT emulation #1 */
477+ unsigned int ldah, ldq, jmp;
478+
479+ err = get_user(ldah, (unsigned int *)regs->pc);
480+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
481+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
482+
483+ if (err)
484+ break;
485+
486+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
487+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
488+ jmp == 0x6BFB0000U)
489+ {
490+ unsigned long r27, addr;
491+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
492+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
493+
494+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
495+ err = get_user(r27, (unsigned long *)addr);
496+ if (err)
497+ break;
498+
499+ regs->r27 = r27;
500+ regs->pc = r27;
501+ return 2;
502+ }
503+ } while (0);
504+
505+ do { /* PaX: patched PLT emulation #2 */
506+ unsigned int ldah, lda, br;
507+
508+ err = get_user(ldah, (unsigned int *)regs->pc);
509+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
510+ err |= get_user(br, (unsigned int *)(regs->pc+8));
511+
512+ if (err)
513+ break;
514+
515+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
516+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
517+ (br & 0xFFE00000U) == 0xC3E00000U)
518+ {
519+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
520+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
521+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
522+
523+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
524+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
525+ return 2;
526+ }
527+ } while (0);
528+
529+ do { /* PaX: unpatched PLT emulation */
530+ unsigned int br;
531+
532+ err = get_user(br, (unsigned int *)regs->pc);
533+
534+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
535+ unsigned int br2, ldq, nop, jmp;
536+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
537+
538+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
539+ err = get_user(br2, (unsigned int *)addr);
540+ err |= get_user(ldq, (unsigned int *)(addr+4));
541+ err |= get_user(nop, (unsigned int *)(addr+8));
542+ err |= get_user(jmp, (unsigned int *)(addr+12));
543+ err |= get_user(resolver, (unsigned long *)(addr+16));
544+
545+ if (err)
546+ break;
547+
548+ if (br2 == 0xC3600000U &&
549+ ldq == 0xA77B000CU &&
550+ nop == 0x47FF041FU &&
551+ jmp == 0x6B7B0000U)
552+ {
553+ regs->r28 = regs->pc+4;
554+ regs->r27 = addr+16;
555+ regs->pc = resolver;
556+ return 3;
557+ }
558+ }
559+ } while (0);
560+#endif
561+
562+ return 1;
563+}
564+
565+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
566+{
567+ unsigned long i;
568+
569+ printk(KERN_ERR "PAX: bytes at PC: ");
570+ for (i = 0; i < 5; i++) {
571+ unsigned int c;
572+ if (get_user(c, (unsigned int *)pc+i))
573+ printk(KERN_CONT "???????? ");
574+ else
575+ printk(KERN_CONT "%08x ", c);
576+ }
577+ printk("\n");
578+}
579+#endif
580
581 /*
582 * This routine handles page faults. It determines the address,
583@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
584 good_area:
585 si_code = SEGV_ACCERR;
586 if (cause < 0) {
587- if (!(vma->vm_flags & VM_EXEC))
588+ if (!(vma->vm_flags & VM_EXEC)) {
589+
590+#ifdef CONFIG_PAX_PAGEEXEC
591+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
592+ goto bad_area;
593+
594+ up_read(&mm->mmap_sem);
595+ switch (pax_handle_fetch_fault(regs)) {
596+
597+#ifdef CONFIG_PAX_EMUPLT
598+ case 2:
599+ case 3:
600+ return;
601+#endif
602+
603+ }
604+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
605+ do_group_exit(SIGKILL);
606+#else
607 goto bad_area;
608+#endif
609+
610+ }
611 } else if (!cause) {
612 /* Allow reads even for write-only mappings */
613 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
614diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
615index 86976d0..8a57797 100644
616--- a/arch/arm/include/asm/atomic.h
617+++ b/arch/arm/include/asm/atomic.h
618@@ -239,6 +239,14 @@ typedef struct {
619 u64 __aligned(8) counter;
620 } atomic64_t;
621
622+#ifdef CONFIG_PAX_REFCOUNT
623+typedef struct {
624+ u64 __aligned(8) counter;
625+} atomic64_unchecked_t;
626+#else
627+typedef atomic64_t atomic64_unchecked_t;
628+#endif
629+
630 #define ATOMIC64_INIT(i) { (i) }
631
632 static inline u64 atomic64_read(atomic64_t *v)
633diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
634index 0e9ce8d..6ef1e03 100644
635--- a/arch/arm/include/asm/elf.h
636+++ b/arch/arm/include/asm/elf.h
637@@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
638 the loader. We need to make sure that it is out of the way of the program
639 that it will "exec", and that there is sufficient room for the brk. */
640
641-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
642+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
643+
644+#ifdef CONFIG_PAX_ASLR
645+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
646+
647+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
648+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
649+#endif
650
651 /* When the program starts, a1 contains a pointer to a function to be
652 registered with atexit, as per the SVR4 ABI. A value of 0 means we
653@@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
654 extern void elf_set_personality(const struct elf32_hdr *);
655 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
656
657-struct mm_struct;
658-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
659-#define arch_randomize_brk arch_randomize_brk
660-
661 extern int vectors_user_mapping(void);
662 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
663 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
664diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
665index e51b1e8..32a3113 100644
666--- a/arch/arm/include/asm/kmap_types.h
667+++ b/arch/arm/include/asm/kmap_types.h
668@@ -21,6 +21,7 @@ enum km_type {
669 KM_L1_CACHE,
670 KM_L2_CACHE,
671 KM_KDB,
672+ KM_CLEARPAGE,
673 KM_TYPE_NR
674 };
675
676diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
677index b293616..96310e5 100644
678--- a/arch/arm/include/asm/uaccess.h
679+++ b/arch/arm/include/asm/uaccess.h
680@@ -22,6 +22,8 @@
681 #define VERIFY_READ 0
682 #define VERIFY_WRITE 1
683
684+extern void check_object_size(const void *ptr, unsigned long n, bool to);
685+
686 /*
687 * The exception table consists of pairs of addresses: the first is the
688 * address of an instruction that is allowed to fault, and the second is
689@@ -387,8 +389,23 @@ do { \
690
691
692 #ifdef CONFIG_MMU
693-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
694-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
695+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
696+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
697+
698+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
699+{
700+ if (!__builtin_constant_p(n))
701+ check_object_size(to, n, false);
702+ return ___copy_from_user(to, from, n);
703+}
704+
705+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
706+{
707+ if (!__builtin_constant_p(n))
708+ check_object_size(from, n, true);
709+ return ___copy_to_user(to, from, n);
710+}
711+
712 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
713 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
714 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
715@@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
716
717 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
718 {
719+ if ((long)n < 0)
720+ return n;
721+
722 if (access_ok(VERIFY_READ, from, n))
723 n = __copy_from_user(to, from, n);
724 else /* security hole - plug it */
725@@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
726
727 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
728 {
729+ if ((long)n < 0)
730+ return n;
731+
732 if (access_ok(VERIFY_WRITE, to, n))
733 n = __copy_to_user(to, from, n);
734 return n;
735diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
736index aeef960..2966009 100644
737--- a/arch/arm/kernel/armksyms.c
738+++ b/arch/arm/kernel/armksyms.c
739@@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
740 #ifdef CONFIG_MMU
741 EXPORT_SYMBOL(copy_page);
742
743-EXPORT_SYMBOL(__copy_from_user);
744-EXPORT_SYMBOL(__copy_to_user);
745+EXPORT_SYMBOL(___copy_from_user);
746+EXPORT_SYMBOL(___copy_to_user);
747 EXPORT_SYMBOL(__clear_user);
748
749 EXPORT_SYMBOL(__get_user_1);
750diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
751index c9d11ea..5078081 100644
752--- a/arch/arm/kernel/process.c
753+++ b/arch/arm/kernel/process.c
754@@ -28,7 +28,6 @@
755 #include <linux/tick.h>
756 #include <linux/utsname.h>
757 #include <linux/uaccess.h>
758-#include <linux/random.h>
759 #include <linux/hw_breakpoint.h>
760 #include <linux/cpuidle.h>
761
762@@ -484,12 +483,6 @@ unsigned long get_wchan(struct task_struct *p)
763 return 0;
764 }
765
766-unsigned long arch_randomize_brk(struct mm_struct *mm)
767-{
768- unsigned long range_end = mm->brk + 0x02000000;
769- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
770-}
771-
772 #ifdef CONFIG_MMU
773 /*
774 * The vectors page is always readable from user space for the
775diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
776index bc9f9da..c75d826 100644
777--- a/arch/arm/kernel/traps.c
778+++ b/arch/arm/kernel/traps.c
779@@ -257,6 +257,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
780
781 static DEFINE_SPINLOCK(die_lock);
782
783+extern void gr_handle_kernel_exploit(void);
784+
785 /*
786 * This function is protected against re-entrancy.
787 */
788@@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs *regs, int err)
789 panic("Fatal exception in interrupt");
790 if (panic_on_oops)
791 panic("Fatal exception");
792+
793+ gr_handle_kernel_exploit();
794+
795 if (ret != NOTIFY_STOP)
796 do_exit(SIGSEGV);
797 }
798diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
799index 66a477a..bee61d3 100644
800--- a/arch/arm/lib/copy_from_user.S
801+++ b/arch/arm/lib/copy_from_user.S
802@@ -16,7 +16,7 @@
803 /*
804 * Prototype:
805 *
806- * size_t __copy_from_user(void *to, const void *from, size_t n)
807+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
808 *
809 * Purpose:
810 *
811@@ -84,11 +84,11 @@
812
813 .text
814
815-ENTRY(__copy_from_user)
816+ENTRY(___copy_from_user)
817
818 #include "copy_template.S"
819
820-ENDPROC(__copy_from_user)
821+ENDPROC(___copy_from_user)
822
823 .pushsection .fixup,"ax"
824 .align 0
825diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
826index d066df6..df28194 100644
827--- a/arch/arm/lib/copy_to_user.S
828+++ b/arch/arm/lib/copy_to_user.S
829@@ -16,7 +16,7 @@
830 /*
831 * Prototype:
832 *
833- * size_t __copy_to_user(void *to, const void *from, size_t n)
834+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
835 *
836 * Purpose:
837 *
838@@ -88,11 +88,11 @@
839 .text
840
841 ENTRY(__copy_to_user_std)
842-WEAK(__copy_to_user)
843+WEAK(___copy_to_user)
844
845 #include "copy_template.S"
846
847-ENDPROC(__copy_to_user)
848+ENDPROC(___copy_to_user)
849 ENDPROC(__copy_to_user_std)
850
851 .pushsection .fixup,"ax"
852diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
853index d0ece2a..5ae2f39 100644
854--- a/arch/arm/lib/uaccess.S
855+++ b/arch/arm/lib/uaccess.S
856@@ -20,7 +20,7 @@
857
858 #define PAGE_SHIFT 12
859
860-/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
861+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
862 * Purpose : copy a block to user memory from kernel memory
863 * Params : to - user memory
864 * : from - kernel memory
865@@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May fault
866 sub r2, r2, ip
867 b .Lc2u_dest_aligned
868
869-ENTRY(__copy_to_user)
870+ENTRY(___copy_to_user)
871 stmfd sp!, {r2, r4 - r7, lr}
872 cmp r2, #4
873 blt .Lc2u_not_enough
874@@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May fault
875 ldrgtb r3, [r1], #0
876 USER( T(strgtb) r3, [r0], #1) @ May fault
877 b .Lc2u_finished
878-ENDPROC(__copy_to_user)
879+ENDPROC(___copy_to_user)
880
881 .pushsection .fixup,"ax"
882 .align 0
883 9001: ldmfd sp!, {r0, r4 - r7, pc}
884 .popsection
885
886-/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
887+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
888 * Purpose : copy a block from user memory to kernel memory
889 * Params : to - kernel memory
890 * : from - user memory
891@@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May fault
892 sub r2, r2, ip
893 b .Lcfu_dest_aligned
894
895-ENTRY(__copy_from_user)
896+ENTRY(___copy_from_user)
897 stmfd sp!, {r0, r2, r4 - r7, lr}
898 cmp r2, #4
899 blt .Lcfu_not_enough
900@@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May fault
901 USER( T(ldrgtb) r3, [r1], #1) @ May fault
902 strgtb r3, [r0], #1
903 b .Lcfu_finished
904-ENDPROC(__copy_from_user)
905+ENDPROC(___copy_from_user)
906
907 .pushsection .fixup,"ax"
908 .align 0
909diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
910index 8b9b136..70d5100 100644
911--- a/arch/arm/lib/uaccess_with_memcpy.c
912+++ b/arch/arm/lib/uaccess_with_memcpy.c
913@@ -103,7 +103,7 @@ out:
914 }
915
916 unsigned long
917-__copy_to_user(void __user *to, const void *from, unsigned long n)
918+___copy_to_user(void __user *to, const void *from, unsigned long n)
919 {
920 /*
921 * This test is stubbed out of the main function above to keep
922diff --git a/arch/arm/mach-ux500/mbox-db5500.c b/arch/arm/mach-ux500/mbox-db5500.c
923index 2b2d51c..0127490 100644
924--- a/arch/arm/mach-ux500/mbox-db5500.c
925+++ b/arch/arm/mach-ux500/mbox-db5500.c
926@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct device *dev,
927 return sprintf(buf, "0x%X\n", mbox_value);
928 }
929
930-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
931+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
932
933 static int mbox_show(struct seq_file *s, void *data)
934 {
935diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
936index 3b5ea68..42fc9af 100644
937--- a/arch/arm/mm/fault.c
938+++ b/arch/arm/mm/fault.c
939@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
940 }
941 #endif
942
943+#ifdef CONFIG_PAX_PAGEEXEC
944+ if (fsr & FSR_LNX_PF) {
945+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
946+ do_group_exit(SIGKILL);
947+ }
948+#endif
949+
950 tsk->thread.address = addr;
951 tsk->thread.error_code = fsr;
952 tsk->thread.trap_no = 14;
953@@ -383,6 +390,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
954 }
955 #endif /* CONFIG_MMU */
956
957+#ifdef CONFIG_PAX_PAGEEXEC
958+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
959+{
960+ long i;
961+
962+ printk(KERN_ERR "PAX: bytes at PC: ");
963+ for (i = 0; i < 20; i++) {
964+ unsigned char c;
965+ if (get_user(c, (__force unsigned char __user *)pc+i))
966+ printk(KERN_CONT "?? ");
967+ else
968+ printk(KERN_CONT "%02x ", c);
969+ }
970+ printk("\n");
971+
972+ printk(KERN_ERR "PAX: bytes at SP-4: ");
973+ for (i = -1; i < 20; i++) {
974+ unsigned long c;
975+ if (get_user(c, (__force unsigned long __user *)sp+i))
976+ printk(KERN_CONT "???????? ");
977+ else
978+ printk(KERN_CONT "%08lx ", c);
979+ }
980+ printk("\n");
981+}
982+#endif
983+
984 /*
985 * First Level Translation Fault Handler
986 *
987diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
988index 74be05f..f605b8c 100644
989--- a/arch/arm/mm/mmap.c
990+++ b/arch/arm/mm/mmap.c
991@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
992 if (len > TASK_SIZE)
993 return -ENOMEM;
994
995+#ifdef CONFIG_PAX_RANDMMAP
996+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
997+#endif
998+
999 if (addr) {
1000 if (do_align)
1001 addr = COLOUR_ALIGN(addr, pgoff);
1002@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
1003 addr = PAGE_ALIGN(addr);
1004
1005 vma = find_vma(mm, addr);
1006- if (TASK_SIZE - len >= addr &&
1007- (!vma || addr + len <= vma->vm_start))
1008+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1009 return addr;
1010 }
1011 if (len > mm->cached_hole_size) {
1012- start_addr = addr = mm->free_area_cache;
1013+ start_addr = addr = mm->free_area_cache;
1014 } else {
1015- start_addr = addr = TASK_UNMAPPED_BASE;
1016- mm->cached_hole_size = 0;
1017+ start_addr = addr = mm->mmap_base;
1018+ mm->cached_hole_size = 0;
1019 }
1020 /* 8 bits of randomness in 20 address space bits */
1021 if ((current->flags & PF_RANDOMIZE) &&
1022@@ -100,14 +103,14 @@ full_search:
1023 * Start a new search - just in case we missed
1024 * some holes.
1025 */
1026- if (start_addr != TASK_UNMAPPED_BASE) {
1027- start_addr = addr = TASK_UNMAPPED_BASE;
1028+ if (start_addr != mm->mmap_base) {
1029+ start_addr = addr = mm->mmap_base;
1030 mm->cached_hole_size = 0;
1031 goto full_search;
1032 }
1033 return -ENOMEM;
1034 }
1035- if (!vma || addr + len <= vma->vm_start) {
1036+ if (check_heap_stack_gap(vma, addr, len)) {
1037 /*
1038 * Remember the place where we stopped the search:
1039 */
1040diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
1041index 3b3159b..425ea94 100644
1042--- a/arch/avr32/include/asm/elf.h
1043+++ b/arch/avr32/include/asm/elf.h
1044@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
1045 the loader. We need to make sure that it is out of the way of the program
1046 that it will "exec", and that there is sufficient room for the brk. */
1047
1048-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1049+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1050
1051+#ifdef CONFIG_PAX_ASLR
1052+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1053+
1054+#define PAX_DELTA_MMAP_LEN 15
1055+#define PAX_DELTA_STACK_LEN 15
1056+#endif
1057
1058 /* This yields a mask that user programs can use to figure out what
1059 instruction set this CPU supports. This could be done in user space,
1060diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
1061index b7f5c68..556135c 100644
1062--- a/arch/avr32/include/asm/kmap_types.h
1063+++ b/arch/avr32/include/asm/kmap_types.h
1064@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1065 D(11) KM_IRQ1,
1066 D(12) KM_SOFTIRQ0,
1067 D(13) KM_SOFTIRQ1,
1068-D(14) KM_TYPE_NR
1069+D(14) KM_CLEARPAGE,
1070+D(15) KM_TYPE_NR
1071 };
1072
1073 #undef D
1074diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
1075index f7040a1..db9f300 100644
1076--- a/arch/avr32/mm/fault.c
1077+++ b/arch/avr32/mm/fault.c
1078@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
1079
1080 int exception_trace = 1;
1081
1082+#ifdef CONFIG_PAX_PAGEEXEC
1083+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1084+{
1085+ unsigned long i;
1086+
1087+ printk(KERN_ERR "PAX: bytes at PC: ");
1088+ for (i = 0; i < 20; i++) {
1089+ unsigned char c;
1090+ if (get_user(c, (unsigned char *)pc+i))
1091+ printk(KERN_CONT "???????? ");
1092+ else
1093+ printk(KERN_CONT "%02x ", c);
1094+ }
1095+ printk("\n");
1096+}
1097+#endif
1098+
1099 /*
1100 * This routine handles page faults. It determines the address and the
1101 * problem, and then passes it off to one of the appropriate routines.
1102@@ -156,6 +173,16 @@ bad_area:
1103 up_read(&mm->mmap_sem);
1104
1105 if (user_mode(regs)) {
1106+
1107+#ifdef CONFIG_PAX_PAGEEXEC
1108+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1109+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1110+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1111+ do_group_exit(SIGKILL);
1112+ }
1113+ }
1114+#endif
1115+
1116 if (exception_trace && printk_ratelimit())
1117 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1118 "sp %08lx ecr %lu\n",
1119diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
1120index f8e16b2..c73ff79 100644
1121--- a/arch/frv/include/asm/kmap_types.h
1122+++ b/arch/frv/include/asm/kmap_types.h
1123@@ -23,6 +23,7 @@ enum km_type {
1124 KM_IRQ1,
1125 KM_SOFTIRQ0,
1126 KM_SOFTIRQ1,
1127+ KM_CLEARPAGE,
1128 KM_TYPE_NR
1129 };
1130
1131diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
1132index 385fd30..6c3d97e 100644
1133--- a/arch/frv/mm/elf-fdpic.c
1134+++ b/arch/frv/mm/elf-fdpic.c
1135@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1136 if (addr) {
1137 addr = PAGE_ALIGN(addr);
1138 vma = find_vma(current->mm, addr);
1139- if (TASK_SIZE - len >= addr &&
1140- (!vma || addr + len <= vma->vm_start))
1141+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1142 goto success;
1143 }
1144
1145@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1146 for (; vma; vma = vma->vm_next) {
1147 if (addr > limit)
1148 break;
1149- if (addr + len <= vma->vm_start)
1150+ if (check_heap_stack_gap(vma, addr, len))
1151 goto success;
1152 addr = vma->vm_end;
1153 }
1154@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1155 for (; vma; vma = vma->vm_next) {
1156 if (addr > limit)
1157 break;
1158- if (addr + len <= vma->vm_start)
1159+ if (check_heap_stack_gap(vma, addr, len))
1160 goto success;
1161 addr = vma->vm_end;
1162 }
1163diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
1164index b5298eb..67c6e62 100644
1165--- a/arch/ia64/include/asm/elf.h
1166+++ b/arch/ia64/include/asm/elf.h
1167@@ -42,6 +42,13 @@
1168 */
1169 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1170
1171+#ifdef CONFIG_PAX_ASLR
1172+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1173+
1174+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1175+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1176+#endif
1177+
1178 #define PT_IA_64_UNWIND 0x70000001
1179
1180 /* IA-64 relocations: */
1181diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
1182index 1a97af3..7529d31 100644
1183--- a/arch/ia64/include/asm/pgtable.h
1184+++ b/arch/ia64/include/asm/pgtable.h
1185@@ -12,7 +12,7 @@
1186 * David Mosberger-Tang <davidm@hpl.hp.com>
1187 */
1188
1189-
1190+#include <linux/const.h>
1191 #include <asm/mman.h>
1192 #include <asm/page.h>
1193 #include <asm/processor.h>
1194@@ -143,6 +143,17 @@
1195 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1196 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1197 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1198+
1199+#ifdef CONFIG_PAX_PAGEEXEC
1200+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1201+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1202+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1203+#else
1204+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1205+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1206+# define PAGE_COPY_NOEXEC PAGE_COPY
1207+#endif
1208+
1209 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1210 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1211 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1212diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
1213index b77768d..e0795eb 100644
1214--- a/arch/ia64/include/asm/spinlock.h
1215+++ b/arch/ia64/include/asm/spinlock.h
1216@@ -72,7 +72,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
1217 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1218
1219 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1220- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1221+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1222 }
1223
1224 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1225diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
1226index 449c8c0..432a3d2 100644
1227--- a/arch/ia64/include/asm/uaccess.h
1228+++ b/arch/ia64/include/asm/uaccess.h
1229@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1230 const void *__cu_from = (from); \
1231 long __cu_len = (n); \
1232 \
1233- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1234+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1235 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1236 __cu_len; \
1237 })
1238@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1239 long __cu_len = (n); \
1240 \
1241 __chk_user_ptr(__cu_from); \
1242- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1243+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1244 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1245 __cu_len; \
1246 })
1247diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
1248index 24603be..948052d 100644
1249--- a/arch/ia64/kernel/module.c
1250+++ b/arch/ia64/kernel/module.c
1251@@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
1252 void
1253 module_free (struct module *mod, void *module_region)
1254 {
1255- if (mod && mod->arch.init_unw_table &&
1256- module_region == mod->module_init) {
1257+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1258 unw_remove_unwind_table(mod->arch.init_unw_table);
1259 mod->arch.init_unw_table = NULL;
1260 }
1261@@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
1262 }
1263
1264 static inline int
1265+in_init_rx (const struct module *mod, uint64_t addr)
1266+{
1267+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1268+}
1269+
1270+static inline int
1271+in_init_rw (const struct module *mod, uint64_t addr)
1272+{
1273+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1274+}
1275+
1276+static inline int
1277 in_init (const struct module *mod, uint64_t addr)
1278 {
1279- return addr - (uint64_t) mod->module_init < mod->init_size;
1280+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1281+}
1282+
1283+static inline int
1284+in_core_rx (const struct module *mod, uint64_t addr)
1285+{
1286+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1287+}
1288+
1289+static inline int
1290+in_core_rw (const struct module *mod, uint64_t addr)
1291+{
1292+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1293 }
1294
1295 static inline int
1296 in_core (const struct module *mod, uint64_t addr)
1297 {
1298- return addr - (uint64_t) mod->module_core < mod->core_size;
1299+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1300 }
1301
1302 static inline int
1303@@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
1304 break;
1305
1306 case RV_BDREL:
1307- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1308+ if (in_init_rx(mod, val))
1309+ val -= (uint64_t) mod->module_init_rx;
1310+ else if (in_init_rw(mod, val))
1311+ val -= (uint64_t) mod->module_init_rw;
1312+ else if (in_core_rx(mod, val))
1313+ val -= (uint64_t) mod->module_core_rx;
1314+ else if (in_core_rw(mod, val))
1315+ val -= (uint64_t) mod->module_core_rw;
1316 break;
1317
1318 case RV_LTV:
1319@@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
1320 * addresses have been selected...
1321 */
1322 uint64_t gp;
1323- if (mod->core_size > MAX_LTOFF)
1324+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1325 /*
1326 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1327 * at the end of the module.
1328 */
1329- gp = mod->core_size - MAX_LTOFF / 2;
1330+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1331 else
1332- gp = mod->core_size / 2;
1333- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1334+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1335+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1336 mod->arch.gp = gp;
1337 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1338 }
1339diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
1340index 609d500..7dde2a8 100644
1341--- a/arch/ia64/kernel/sys_ia64.c
1342+++ b/arch/ia64/kernel/sys_ia64.c
1343@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1344 if (REGION_NUMBER(addr) == RGN_HPAGE)
1345 addr = 0;
1346 #endif
1347+
1348+#ifdef CONFIG_PAX_RANDMMAP
1349+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1350+ addr = mm->free_area_cache;
1351+ else
1352+#endif
1353+
1354 if (!addr)
1355 addr = mm->free_area_cache;
1356
1357@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1358 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1359 /* At this point: (!vma || addr < vma->vm_end). */
1360 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1361- if (start_addr != TASK_UNMAPPED_BASE) {
1362+ if (start_addr != mm->mmap_base) {
1363 /* Start a new search --- just in case we missed some holes. */
1364- addr = TASK_UNMAPPED_BASE;
1365+ addr = mm->mmap_base;
1366 goto full_search;
1367 }
1368 return -ENOMEM;
1369 }
1370- if (!vma || addr + len <= vma->vm_start) {
1371+ if (check_heap_stack_gap(vma, addr, len)) {
1372 /* Remember the address where we stopped this search: */
1373 mm->free_area_cache = addr + len;
1374 return addr;
1375diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
1376index 53c0ba0..2accdde 100644
1377--- a/arch/ia64/kernel/vmlinux.lds.S
1378+++ b/arch/ia64/kernel/vmlinux.lds.S
1379@@ -199,7 +199,7 @@ SECTIONS {
1380 /* Per-cpu data: */
1381 . = ALIGN(PERCPU_PAGE_SIZE);
1382 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1383- __phys_per_cpu_start = __per_cpu_load;
1384+ __phys_per_cpu_start = per_cpu_load;
1385 /*
1386 * ensure percpu data fits
1387 * into percpu page size
1388diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
1389index 20b3593..1ce77f0 100644
1390--- a/arch/ia64/mm/fault.c
1391+++ b/arch/ia64/mm/fault.c
1392@@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned long address)
1393 return pte_present(pte);
1394 }
1395
1396+#ifdef CONFIG_PAX_PAGEEXEC
1397+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1398+{
1399+ unsigned long i;
1400+
1401+ printk(KERN_ERR "PAX: bytes at PC: ");
1402+ for (i = 0; i < 8; i++) {
1403+ unsigned int c;
1404+ if (get_user(c, (unsigned int *)pc+i))
1405+ printk(KERN_CONT "???????? ");
1406+ else
1407+ printk(KERN_CONT "%08x ", c);
1408+ }
1409+ printk("\n");
1410+}
1411+#endif
1412+
1413 void __kprobes
1414 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1415 {
1416@@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
1417 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1418 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1419
1420- if ((vma->vm_flags & mask) != mask)
1421+ if ((vma->vm_flags & mask) != mask) {
1422+
1423+#ifdef CONFIG_PAX_PAGEEXEC
1424+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1425+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1426+ goto bad_area;
1427+
1428+ up_read(&mm->mmap_sem);
1429+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1430+ do_group_exit(SIGKILL);
1431+ }
1432+#endif
1433+
1434 goto bad_area;
1435
1436+ }
1437+
1438 /*
1439 * If for any reason at all we couldn't handle the fault, make
1440 * sure we exit gracefully rather than endlessly redo the
1441diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
1442index 5ca674b..e0e1b70 100644
1443--- a/arch/ia64/mm/hugetlbpage.c
1444+++ b/arch/ia64/mm/hugetlbpage.c
1445@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
1446 /* At this point: (!vmm || addr < vmm->vm_end). */
1447 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1448 return -ENOMEM;
1449- if (!vmm || (addr + len) <= vmm->vm_start)
1450+ if (check_heap_stack_gap(vmm, addr, len))
1451 return addr;
1452 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1453 }
1454diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
1455index 00cb0e2..2ad8024 100644
1456--- a/arch/ia64/mm/init.c
1457+++ b/arch/ia64/mm/init.c
1458@@ -120,6 +120,19 @@ ia64_init_addr_space (void)
1459 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1460 vma->vm_end = vma->vm_start + PAGE_SIZE;
1461 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1462+
1463+#ifdef CONFIG_PAX_PAGEEXEC
1464+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1465+ vma->vm_flags &= ~VM_EXEC;
1466+
1467+#ifdef CONFIG_PAX_MPROTECT
1468+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1469+ vma->vm_flags &= ~VM_MAYEXEC;
1470+#endif
1471+
1472+ }
1473+#endif
1474+
1475 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1476 down_write(&current->mm->mmap_sem);
1477 if (insert_vm_struct(current->mm, vma)) {
1478diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
1479index 82abd15..d95ae5d 100644
1480--- a/arch/m32r/lib/usercopy.c
1481+++ b/arch/m32r/lib/usercopy.c
1482@@ -14,6 +14,9 @@
1483 unsigned long
1484 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1485 {
1486+ if ((long)n < 0)
1487+ return n;
1488+
1489 prefetch(from);
1490 if (access_ok(VERIFY_WRITE, to, n))
1491 __copy_user(to,from,n);
1492@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1493 unsigned long
1494 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1495 {
1496+ if ((long)n < 0)
1497+ return n;
1498+
1499 prefetchw(to);
1500 if (access_ok(VERIFY_READ, from, n))
1501 __copy_user_zeroing(to,from,n);
1502diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
1503index 455c0ac..ad65fbe 100644
1504--- a/arch/mips/include/asm/elf.h
1505+++ b/arch/mips/include/asm/elf.h
1506@@ -372,13 +372,16 @@ extern const char *__elf_platform;
1507 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1508 #endif
1509
1510+#ifdef CONFIG_PAX_ASLR
1511+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1512+
1513+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1514+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1515+#endif
1516+
1517 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1518 struct linux_binprm;
1519 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
1520 int uses_interp);
1521
1522-struct mm_struct;
1523-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1524-#define arch_randomize_brk arch_randomize_brk
1525-
1526 #endif /* _ASM_ELF_H */
1527diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
1528index e59cd1a..8e329d6 100644
1529--- a/arch/mips/include/asm/page.h
1530+++ b/arch/mips/include/asm/page.h
1531@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
1532 #ifdef CONFIG_CPU_MIPS32
1533 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1534 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1535- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1536+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1537 #else
1538 typedef struct { unsigned long long pte; } pte_t;
1539 #define pte_val(x) ((x).pte)
1540diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
1541index 6018c80..7c37203 100644
1542--- a/arch/mips/include/asm/system.h
1543+++ b/arch/mips/include/asm/system.h
1544@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1545 */
1546 #define __ARCH_WANT_UNLOCKED_CTXSW
1547
1548-extern unsigned long arch_align_stack(unsigned long sp);
1549+#define arch_align_stack(x) ((x) & ~0xfUL)
1550
1551 #endif /* _ASM_SYSTEM_H */
1552diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
1553index 9fdd8bc..4bd7f1a 100644
1554--- a/arch/mips/kernel/binfmt_elfn32.c
1555+++ b/arch/mips/kernel/binfmt_elfn32.c
1556@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1557 #undef ELF_ET_DYN_BASE
1558 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1559
1560+#ifdef CONFIG_PAX_ASLR
1561+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1562+
1563+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1564+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1565+#endif
1566+
1567 #include <asm/processor.h>
1568 #include <linux/module.h>
1569 #include <linux/elfcore.h>
1570diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
1571index ff44823..97f8906 100644
1572--- a/arch/mips/kernel/binfmt_elfo32.c
1573+++ b/arch/mips/kernel/binfmt_elfo32.c
1574@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1575 #undef ELF_ET_DYN_BASE
1576 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1577
1578+#ifdef CONFIG_PAX_ASLR
1579+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1580+
1581+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1582+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1583+#endif
1584+
1585 #include <asm/processor.h>
1586
1587 /*
1588diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
1589index b30cb25..454c0a9 100644
1590--- a/arch/mips/kernel/process.c
1591+++ b/arch/mips/kernel/process.c
1592@@ -481,15 +481,3 @@ unsigned long get_wchan(struct task_struct *task)
1593 out:
1594 return pc;
1595 }
1596-
1597-/*
1598- * Don't forget that the stack pointer must be aligned on a 8 bytes
1599- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1600- */
1601-unsigned long arch_align_stack(unsigned long sp)
1602-{
1603- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1604- sp -= get_random_int() & ~PAGE_MASK;
1605-
1606- return sp & ALMASK;
1607-}
1608diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
1609index 937cf33..adb39bb 100644
1610--- a/arch/mips/mm/fault.c
1611+++ b/arch/mips/mm/fault.c
1612@@ -28,6 +28,23 @@
1613 #include <asm/highmem.h> /* For VMALLOC_END */
1614 #include <linux/kdebug.h>
1615
1616+#ifdef CONFIG_PAX_PAGEEXEC
1617+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1618+{
1619+ unsigned long i;
1620+
1621+ printk(KERN_ERR "PAX: bytes at PC: ");
1622+ for (i = 0; i < 5; i++) {
1623+ unsigned int c;
1624+ if (get_user(c, (unsigned int *)pc+i))
1625+ printk(KERN_CONT "???????? ");
1626+ else
1627+ printk(KERN_CONT "%08x ", c);
1628+ }
1629+ printk("\n");
1630+}
1631+#endif
1632+
1633 /*
1634 * This routine handles page faults. It determines the address,
1635 * and the problem, and then passes it off to one of the appropriate
1636diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
1637index 302d779..7d35bf8 100644
1638--- a/arch/mips/mm/mmap.c
1639+++ b/arch/mips/mm/mmap.c
1640@@ -95,6 +95,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1641 do_color_align = 1;
1642
1643 /* requesting a specific address */
1644+
1645+#ifdef CONFIG_PAX_RANDMMAP
1646+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1647+#endif
1648+
1649 if (addr) {
1650 if (do_color_align)
1651 addr = COLOUR_ALIGN(addr, pgoff);
1652@@ -102,8 +107,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1653 addr = PAGE_ALIGN(addr);
1654
1655 vma = find_vma(mm, addr);
1656- if (TASK_SIZE - len >= addr &&
1657- (!vma || addr + len <= vma->vm_start))
1658+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
1659 return addr;
1660 }
1661
1662@@ -118,7 +122,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1663 /* At this point: (!vma || addr < vma->vm_end). */
1664 if (TASK_SIZE - len < addr)
1665 return -ENOMEM;
1666- if (!vma || addr + len <= vma->vm_start)
1667+ if (check_heap_stack_gap(vmm, addr, len))
1668 return addr;
1669 addr = vma->vm_end;
1670 if (do_color_align)
1671@@ -145,7 +149,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1672 /* make sure it can fit in the remaining address space */
1673 if (likely(addr > len)) {
1674 vma = find_vma(mm, addr - len);
1675- if (!vma || addr <= vma->vm_start) {
1676+ if (check_heap_stack_gap(vmm, addr - len, len))
1677 /* cache the address as a hint for next time */
1678 return mm->free_area_cache = addr - len;
1679 }
1680@@ -165,7 +169,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1681 * return with success:
1682 */
1683 vma = find_vma(mm, addr);
1684- if (likely(!vma || addr + len <= vma->vm_start)) {
1685+ if (check_heap_stack_gap(vmm, addr, len)) {
1686 /* cache the address as a hint for next time */
1687 return mm->free_area_cache = addr;
1688 }
1689@@ -242,30 +246,3 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
1690 mm->unmap_area = arch_unmap_area_topdown;
1691 }
1692 }
1693-
1694-static inline unsigned long brk_rnd(void)
1695-{
1696- unsigned long rnd = get_random_int();
1697-
1698- rnd = rnd << PAGE_SHIFT;
1699- /* 8MB for 32bit, 256MB for 64bit */
1700- if (TASK_IS_32BIT_ADDR)
1701- rnd = rnd & 0x7ffffful;
1702- else
1703- rnd = rnd & 0xffffffful;
1704-
1705- return rnd;
1706-}
1707-
1708-unsigned long arch_randomize_brk(struct mm_struct *mm)
1709-{
1710- unsigned long base = mm->brk;
1711- unsigned long ret;
1712-
1713- ret = PAGE_ALIGN(base + brk_rnd());
1714-
1715- if (ret < mm->brk)
1716- return mm->brk;
1717-
1718- return ret;
1719-}
1720diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
1721index 19f6cb1..6c78cf2 100644
1722--- a/arch/parisc/include/asm/elf.h
1723+++ b/arch/parisc/include/asm/elf.h
1724@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
1725
1726 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1727
1728+#ifdef CONFIG_PAX_ASLR
1729+#define PAX_ELF_ET_DYN_BASE 0x10000UL
1730+
1731+#define PAX_DELTA_MMAP_LEN 16
1732+#define PAX_DELTA_STACK_LEN 16
1733+#endif
1734+
1735 /* This yields a mask that user programs can use to figure out what
1736 instruction set this CPU supports. This could be done in user space,
1737 but it's not easy, and we've already done it here. */
1738diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
1739index 22dadeb..f6c2be4 100644
1740--- a/arch/parisc/include/asm/pgtable.h
1741+++ b/arch/parisc/include/asm/pgtable.h
1742@@ -210,6 +210,17 @@ struct vm_area_struct;
1743 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1744 #define PAGE_COPY PAGE_EXECREAD
1745 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1746+
1747+#ifdef CONFIG_PAX_PAGEEXEC
1748+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1749+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1750+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1751+#else
1752+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1753+# define PAGE_COPY_NOEXEC PAGE_COPY
1754+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1755+#endif
1756+
1757 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1758 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
1759 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
1760diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
1761index 5e34ccf..672bc9c 100644
1762--- a/arch/parisc/kernel/module.c
1763+++ b/arch/parisc/kernel/module.c
1764@@ -98,16 +98,38 @@
1765
1766 /* three functions to determine where in the module core
1767 * or init pieces the location is */
1768+static inline int in_init_rx(struct module *me, void *loc)
1769+{
1770+ return (loc >= me->module_init_rx &&
1771+ loc < (me->module_init_rx + me->init_size_rx));
1772+}
1773+
1774+static inline int in_init_rw(struct module *me, void *loc)
1775+{
1776+ return (loc >= me->module_init_rw &&
1777+ loc < (me->module_init_rw + me->init_size_rw));
1778+}
1779+
1780 static inline int in_init(struct module *me, void *loc)
1781 {
1782- return (loc >= me->module_init &&
1783- loc <= (me->module_init + me->init_size));
1784+ return in_init_rx(me, loc) || in_init_rw(me, loc);
1785+}
1786+
1787+static inline int in_core_rx(struct module *me, void *loc)
1788+{
1789+ return (loc >= me->module_core_rx &&
1790+ loc < (me->module_core_rx + me->core_size_rx));
1791+}
1792+
1793+static inline int in_core_rw(struct module *me, void *loc)
1794+{
1795+ return (loc >= me->module_core_rw &&
1796+ loc < (me->module_core_rw + me->core_size_rw));
1797 }
1798
1799 static inline int in_core(struct module *me, void *loc)
1800 {
1801- return (loc >= me->module_core &&
1802- loc <= (me->module_core + me->core_size));
1803+ return in_core_rx(me, loc) || in_core_rw(me, loc);
1804 }
1805
1806 static inline int in_local(struct module *me, void *loc)
1807@@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
1808 }
1809
1810 /* align things a bit */
1811- me->core_size = ALIGN(me->core_size, 16);
1812- me->arch.got_offset = me->core_size;
1813- me->core_size += gots * sizeof(struct got_entry);
1814+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1815+ me->arch.got_offset = me->core_size_rw;
1816+ me->core_size_rw += gots * sizeof(struct got_entry);
1817
1818- me->core_size = ALIGN(me->core_size, 16);
1819- me->arch.fdesc_offset = me->core_size;
1820- me->core_size += fdescs * sizeof(Elf_Fdesc);
1821+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1822+ me->arch.fdesc_offset = me->core_size_rw;
1823+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1824
1825 me->arch.got_max = gots;
1826 me->arch.fdesc_max = fdescs;
1827@@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1828
1829 BUG_ON(value == 0);
1830
1831- got = me->module_core + me->arch.got_offset;
1832+ got = me->module_core_rw + me->arch.got_offset;
1833 for (i = 0; got[i].addr; i++)
1834 if (got[i].addr == value)
1835 goto out;
1836@@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1837 #ifdef CONFIG_64BIT
1838 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1839 {
1840- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1841+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1842
1843 if (!value) {
1844 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1845@@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1846
1847 /* Create new one */
1848 fdesc->addr = value;
1849- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1850+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1851 return (Elf_Addr)fdesc;
1852 }
1853 #endif /* CONFIG_64BIT */
1854@@ -845,7 +867,7 @@ register_unwind_table(struct module *me,
1855
1856 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1857 end = table + sechdrs[me->arch.unwind_section].sh_size;
1858- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1859+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1860
1861 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1862 me->arch.unwind_section, table, end, gp);
1863diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
1864index c9b9322..02d8940 100644
1865--- a/arch/parisc/kernel/sys_parisc.c
1866+++ b/arch/parisc/kernel/sys_parisc.c
1867@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
1868 /* At this point: (!vma || addr < vma->vm_end). */
1869 if (TASK_SIZE - len < addr)
1870 return -ENOMEM;
1871- if (!vma || addr + len <= vma->vm_start)
1872+ if (check_heap_stack_gap(vma, addr, len))
1873 return addr;
1874 addr = vma->vm_end;
1875 }
1876@@ -79,7 +79,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
1877 /* At this point: (!vma || addr < vma->vm_end). */
1878 if (TASK_SIZE - len < addr)
1879 return -ENOMEM;
1880- if (!vma || addr + len <= vma->vm_start)
1881+ if (check_heap_stack_gap(vma, addr, len))
1882 return addr;
1883 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1884 if (addr < vma->vm_end) /* handle wraparound */
1885@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
1886 if (flags & MAP_FIXED)
1887 return addr;
1888 if (!addr)
1889- addr = TASK_UNMAPPED_BASE;
1890+ addr = current->mm->mmap_base;
1891
1892 if (filp) {
1893 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1894diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
1895index f19e660..414fe24 100644
1896--- a/arch/parisc/kernel/traps.c
1897+++ b/arch/parisc/kernel/traps.c
1898@@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
1899
1900 down_read(&current->mm->mmap_sem);
1901 vma = find_vma(current->mm,regs->iaoq[0]);
1902- if (vma && (regs->iaoq[0] >= vma->vm_start)
1903- && (vma->vm_flags & VM_EXEC)) {
1904-
1905+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1906 fault_address = regs->iaoq[0];
1907 fault_space = regs->iasq[0];
1908
1909diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
1910index 18162ce..94de376 100644
1911--- a/arch/parisc/mm/fault.c
1912+++ b/arch/parisc/mm/fault.c
1913@@ -15,6 +15,7 @@
1914 #include <linux/sched.h>
1915 #include <linux/interrupt.h>
1916 #include <linux/module.h>
1917+#include <linux/unistd.h>
1918
1919 #include <asm/uaccess.h>
1920 #include <asm/traps.h>
1921@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
1922 static unsigned long
1923 parisc_acctyp(unsigned long code, unsigned int inst)
1924 {
1925- if (code == 6 || code == 16)
1926+ if (code == 6 || code == 7 || code == 16)
1927 return VM_EXEC;
1928
1929 switch (inst & 0xf0000000) {
1930@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
1931 }
1932 #endif
1933
1934+#ifdef CONFIG_PAX_PAGEEXEC
1935+/*
1936+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1937+ *
1938+ * returns 1 when task should be killed
1939+ * 2 when rt_sigreturn trampoline was detected
1940+ * 3 when unpatched PLT trampoline was detected
1941+ */
1942+static int pax_handle_fetch_fault(struct pt_regs *regs)
1943+{
1944+
1945+#ifdef CONFIG_PAX_EMUPLT
1946+ int err;
1947+
1948+ do { /* PaX: unpatched PLT emulation */
1949+ unsigned int bl, depwi;
1950+
1951+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1952+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1953+
1954+ if (err)
1955+ break;
1956+
1957+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1958+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1959+
1960+ err = get_user(ldw, (unsigned int *)addr);
1961+ err |= get_user(bv, (unsigned int *)(addr+4));
1962+ err |= get_user(ldw2, (unsigned int *)(addr+8));
1963+
1964+ if (err)
1965+ break;
1966+
1967+ if (ldw == 0x0E801096U &&
1968+ bv == 0xEAC0C000U &&
1969+ ldw2 == 0x0E881095U)
1970+ {
1971+ unsigned int resolver, map;
1972+
1973+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1974+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1975+ if (err)
1976+ break;
1977+
1978+ regs->gr[20] = instruction_pointer(regs)+8;
1979+ regs->gr[21] = map;
1980+ regs->gr[22] = resolver;
1981+ regs->iaoq[0] = resolver | 3UL;
1982+ regs->iaoq[1] = regs->iaoq[0] + 4;
1983+ return 3;
1984+ }
1985+ }
1986+ } while (0);
1987+#endif
1988+
1989+#ifdef CONFIG_PAX_EMUTRAMP
1990+
1991+#ifndef CONFIG_PAX_EMUSIGRT
1992+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1993+ return 1;
1994+#endif
1995+
1996+ do { /* PaX: rt_sigreturn emulation */
1997+ unsigned int ldi1, ldi2, bel, nop;
1998+
1999+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
2000+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
2001+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
2002+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
2003+
2004+ if (err)
2005+ break;
2006+
2007+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
2008+ ldi2 == 0x3414015AU &&
2009+ bel == 0xE4008200U &&
2010+ nop == 0x08000240U)
2011+ {
2012+ regs->gr[25] = (ldi1 & 2) >> 1;
2013+ regs->gr[20] = __NR_rt_sigreturn;
2014+ regs->gr[31] = regs->iaoq[1] + 16;
2015+ regs->sr[0] = regs->iasq[1];
2016+ regs->iaoq[0] = 0x100UL;
2017+ regs->iaoq[1] = regs->iaoq[0] + 4;
2018+ regs->iasq[0] = regs->sr[2];
2019+ regs->iasq[1] = regs->sr[2];
2020+ return 2;
2021+ }
2022+ } while (0);
2023+#endif
2024+
2025+ return 1;
2026+}
2027+
2028+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2029+{
2030+ unsigned long i;
2031+
2032+ printk(KERN_ERR "PAX: bytes at PC: ");
2033+ for (i = 0; i < 5; i++) {
2034+ unsigned int c;
2035+ if (get_user(c, (unsigned int *)pc+i))
2036+ printk(KERN_CONT "???????? ");
2037+ else
2038+ printk(KERN_CONT "%08x ", c);
2039+ }
2040+ printk("\n");
2041+}
2042+#endif
2043+
2044 int fixup_exception(struct pt_regs *regs)
2045 {
2046 const struct exception_table_entry *fix;
2047@@ -192,8 +303,33 @@ good_area:
2048
2049 acc_type = parisc_acctyp(code,regs->iir);
2050
2051- if ((vma->vm_flags & acc_type) != acc_type)
2052+ if ((vma->vm_flags & acc_type) != acc_type) {
2053+
2054+#ifdef CONFIG_PAX_PAGEEXEC
2055+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2056+ (address & ~3UL) == instruction_pointer(regs))
2057+ {
2058+ up_read(&mm->mmap_sem);
2059+ switch (pax_handle_fetch_fault(regs)) {
2060+
2061+#ifdef CONFIG_PAX_EMUPLT
2062+ case 3:
2063+ return;
2064+#endif
2065+
2066+#ifdef CONFIG_PAX_EMUTRAMP
2067+ case 2:
2068+ return;
2069+#endif
2070+
2071+ }
2072+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2073+ do_group_exit(SIGKILL);
2074+ }
2075+#endif
2076+
2077 goto bad_area;
2078+ }
2079
2080 /*
2081 * If for any reason at all we couldn't handle the fault, make
2082diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
2083index 3bf9cca..e7457d0 100644
2084--- a/arch/powerpc/include/asm/elf.h
2085+++ b/arch/powerpc/include/asm/elf.h
2086@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
2087 the loader. We need to make sure that it is out of the way of the program
2088 that it will "exec", and that there is sufficient room for the brk. */
2089
2090-extern unsigned long randomize_et_dyn(unsigned long base);
2091-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2092+#define ELF_ET_DYN_BASE (0x20000000)
2093+
2094+#ifdef CONFIG_PAX_ASLR
2095+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2096+
2097+#ifdef __powerpc64__
2098+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
2099+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
2100+#else
2101+#define PAX_DELTA_MMAP_LEN 15
2102+#define PAX_DELTA_STACK_LEN 15
2103+#endif
2104+#endif
2105
2106 /*
2107 * Our registers are always unsigned longs, whether we're a 32 bit
2108@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2109 (0x7ff >> (PAGE_SHIFT - 12)) : \
2110 (0x3ffff >> (PAGE_SHIFT - 12)))
2111
2112-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2113-#define arch_randomize_brk arch_randomize_brk
2114-
2115 #endif /* __KERNEL__ */
2116
2117 /*
2118diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
2119index bca8fdc..61e9580 100644
2120--- a/arch/powerpc/include/asm/kmap_types.h
2121+++ b/arch/powerpc/include/asm/kmap_types.h
2122@@ -27,6 +27,7 @@ enum km_type {
2123 KM_PPC_SYNC_PAGE,
2124 KM_PPC_SYNC_ICACHE,
2125 KM_KDB,
2126+ KM_CLEARPAGE,
2127 KM_TYPE_NR
2128 };
2129
2130diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
2131index d4a7f64..451de1c 100644
2132--- a/arch/powerpc/include/asm/mman.h
2133+++ b/arch/powerpc/include/asm/mman.h
2134@@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
2135 }
2136 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
2137
2138-static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
2139+static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
2140 {
2141 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
2142 }
2143diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
2144index 2cd664e..1d2e8a7 100644
2145--- a/arch/powerpc/include/asm/page.h
2146+++ b/arch/powerpc/include/asm/page.h
2147@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
2148 * and needs to be executable. This means the whole heap ends
2149 * up being executable.
2150 */
2151-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2152- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2153+#define VM_DATA_DEFAULT_FLAGS32 \
2154+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2155+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2156
2157 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2158 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2159@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
2160 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2161 #endif
2162
2163+#define ktla_ktva(addr) (addr)
2164+#define ktva_ktla(addr) (addr)
2165+
2166 #ifndef __ASSEMBLY__
2167
2168 #undef STRICT_MM_TYPECHECKS
2169diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
2170index 9356262..ea96148 100644
2171--- a/arch/powerpc/include/asm/page_64.h
2172+++ b/arch/powerpc/include/asm/page_64.h
2173@@ -155,15 +155,18 @@ do { \
2174 * stack by default, so in the absence of a PT_GNU_STACK program header
2175 * we turn execute permission off.
2176 */
2177-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2178- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2179+#define VM_STACK_DEFAULT_FLAGS32 \
2180+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2181+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2182
2183 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2184 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2185
2186+#ifndef CONFIG_PAX_PAGEEXEC
2187 #define VM_STACK_DEFAULT_FLAGS \
2188 (is_32bit_task() ? \
2189 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2190+#endif
2191
2192 #include <asm-generic/getorder.h>
2193
2194diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
2195index 88b0bd9..e32bc67 100644
2196--- a/arch/powerpc/include/asm/pgtable.h
2197+++ b/arch/powerpc/include/asm/pgtable.h
2198@@ -2,6 +2,7 @@
2199 #define _ASM_POWERPC_PGTABLE_H
2200 #ifdef __KERNEL__
2201
2202+#include <linux/const.h>
2203 #ifndef __ASSEMBLY__
2204 #include <asm/processor.h> /* For TASK_SIZE */
2205 #include <asm/mmu.h>
2206diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
2207index 4aad413..85d86bf 100644
2208--- a/arch/powerpc/include/asm/pte-hash32.h
2209+++ b/arch/powerpc/include/asm/pte-hash32.h
2210@@ -21,6 +21,7 @@
2211 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2212 #define _PAGE_USER 0x004 /* usermode access allowed */
2213 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2214+#define _PAGE_EXEC _PAGE_GUARDED
2215 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2216 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2217 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2218diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
2219index 559da19..7e5835c 100644
2220--- a/arch/powerpc/include/asm/reg.h
2221+++ b/arch/powerpc/include/asm/reg.h
2222@@ -212,6 +212,7 @@
2223 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2224 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2225 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2226+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2227 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2228 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2229 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2230diff --git a/arch/powerpc/include/asm/system.h b/arch/powerpc/include/asm/system.h
2231index e30a13d..2b7d994 100644
2232--- a/arch/powerpc/include/asm/system.h
2233+++ b/arch/powerpc/include/asm/system.h
2234@@ -530,7 +530,7 @@ __cmpxchg_local(volatile void *ptr, unsigned long old, unsigned long new,
2235 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2236 #endif
2237
2238-extern unsigned long arch_align_stack(unsigned long sp);
2239+#define arch_align_stack(x) ((x) & ~0xfUL)
2240
2241 /* Used in very early kernel initialization. */
2242 extern unsigned long reloc_offset(void);
2243diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
2244index bd0fb84..a42a14b 100644
2245--- a/arch/powerpc/include/asm/uaccess.h
2246+++ b/arch/powerpc/include/asm/uaccess.h
2247@@ -13,6 +13,8 @@
2248 #define VERIFY_READ 0
2249 #define VERIFY_WRITE 1
2250
2251+extern void check_object_size(const void *ptr, unsigned long n, bool to);
2252+
2253 /*
2254 * The fs value determines whether argument validity checking should be
2255 * performed or not. If get_fs() == USER_DS, checking is performed, with
2256@@ -327,52 +329,6 @@ do { \
2257 extern unsigned long __copy_tofrom_user(void __user *to,
2258 const void __user *from, unsigned long size);
2259
2260-#ifndef __powerpc64__
2261-
2262-static inline unsigned long copy_from_user(void *to,
2263- const void __user *from, unsigned long n)
2264-{
2265- unsigned long over;
2266-
2267- if (access_ok(VERIFY_READ, from, n))
2268- return __copy_tofrom_user((__force void __user *)to, from, n);
2269- if ((unsigned long)from < TASK_SIZE) {
2270- over = (unsigned long)from + n - TASK_SIZE;
2271- return __copy_tofrom_user((__force void __user *)to, from,
2272- n - over) + over;
2273- }
2274- return n;
2275-}
2276-
2277-static inline unsigned long copy_to_user(void __user *to,
2278- const void *from, unsigned long n)
2279-{
2280- unsigned long over;
2281-
2282- if (access_ok(VERIFY_WRITE, to, n))
2283- return __copy_tofrom_user(to, (__force void __user *)from, n);
2284- if ((unsigned long)to < TASK_SIZE) {
2285- over = (unsigned long)to + n - TASK_SIZE;
2286- return __copy_tofrom_user(to, (__force void __user *)from,
2287- n - over) + over;
2288- }
2289- return n;
2290-}
2291-
2292-#else /* __powerpc64__ */
2293-
2294-#define __copy_in_user(to, from, size) \
2295- __copy_tofrom_user((to), (from), (size))
2296-
2297-extern unsigned long copy_from_user(void *to, const void __user *from,
2298- unsigned long n);
2299-extern unsigned long copy_to_user(void __user *to, const void *from,
2300- unsigned long n);
2301-extern unsigned long copy_in_user(void __user *to, const void __user *from,
2302- unsigned long n);
2303-
2304-#endif /* __powerpc64__ */
2305-
2306 static inline unsigned long __copy_from_user_inatomic(void *to,
2307 const void __user *from, unsigned long n)
2308 {
2309@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
2310 if (ret == 0)
2311 return 0;
2312 }
2313+
2314+ if (!__builtin_constant_p(n))
2315+ check_object_size(to, n, false);
2316+
2317 return __copy_tofrom_user((__force void __user *)to, from, n);
2318 }
2319
2320@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
2321 if (ret == 0)
2322 return 0;
2323 }
2324+
2325+ if (!__builtin_constant_p(n))
2326+ check_object_size(from, n, true);
2327+
2328 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2329 }
2330
2331@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
2332 return __copy_to_user_inatomic(to, from, size);
2333 }
2334
2335+#ifndef __powerpc64__
2336+
2337+static inline unsigned long __must_check copy_from_user(void *to,
2338+ const void __user *from, unsigned long n)
2339+{
2340+ unsigned long over;
2341+
2342+ if ((long)n < 0)
2343+ return n;
2344+
2345+ if (access_ok(VERIFY_READ, from, n)) {
2346+ if (!__builtin_constant_p(n))
2347+ check_object_size(to, n, false);
2348+ return __copy_tofrom_user((__force void __user *)to, from, n);
2349+ }
2350+ if ((unsigned long)from < TASK_SIZE) {
2351+ over = (unsigned long)from + n - TASK_SIZE;
2352+ if (!__builtin_constant_p(n - over))
2353+ check_object_size(to, n - over, false);
2354+ return __copy_tofrom_user((__force void __user *)to, from,
2355+ n - over) + over;
2356+ }
2357+ return n;
2358+}
2359+
2360+static inline unsigned long __must_check copy_to_user(void __user *to,
2361+ const void *from, unsigned long n)
2362+{
2363+ unsigned long over;
2364+
2365+ if ((long)n < 0)
2366+ return n;
2367+
2368+ if (access_ok(VERIFY_WRITE, to, n)) {
2369+ if (!__builtin_constant_p(n))
2370+ check_object_size(from, n, true);
2371+ return __copy_tofrom_user(to, (__force void __user *)from, n);
2372+ }
2373+ if ((unsigned long)to < TASK_SIZE) {
2374+ over = (unsigned long)to + n - TASK_SIZE;
2375+ if (!__builtin_constant_p(n))
2376+ check_object_size(from, n - over, true);
2377+ return __copy_tofrom_user(to, (__force void __user *)from,
2378+ n - over) + over;
2379+ }
2380+ return n;
2381+}
2382+
2383+#else /* __powerpc64__ */
2384+
2385+#define __copy_in_user(to, from, size) \
2386+ __copy_tofrom_user((to), (from), (size))
2387+
2388+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2389+{
2390+ if ((long)n < 0 || n > INT_MAX)
2391+ return n;
2392+
2393+ if (!__builtin_constant_p(n))
2394+ check_object_size(to, n, false);
2395+
2396+ if (likely(access_ok(VERIFY_READ, from, n)))
2397+ n = __copy_from_user(to, from, n);
2398+ else
2399+ memset(to, 0, n);
2400+ return n;
2401+}
2402+
2403+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2404+{
2405+ if ((long)n < 0 || n > INT_MAX)
2406+ return n;
2407+
2408+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
2409+ if (!__builtin_constant_p(n))
2410+ check_object_size(from, n, true);
2411+ n = __copy_to_user(to, from, n);
2412+ }
2413+ return n;
2414+}
2415+
2416+extern unsigned long copy_in_user(void __user *to, const void __user *from,
2417+ unsigned long n);
2418+
2419+#endif /* __powerpc64__ */
2420+
2421 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2422
2423 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2424diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
2425index 429983c..7af363b 100644
2426--- a/arch/powerpc/kernel/exceptions-64e.S
2427+++ b/arch/powerpc/kernel/exceptions-64e.S
2428@@ -587,6 +587,7 @@ storage_fault_common:
2429 std r14,_DAR(r1)
2430 std r15,_DSISR(r1)
2431 addi r3,r1,STACK_FRAME_OVERHEAD
2432+ bl .save_nvgprs
2433 mr r4,r14
2434 mr r5,r15
2435 ld r14,PACA_EXGEN+EX_R14(r13)
2436@@ -596,8 +597,7 @@ storage_fault_common:
2437 cmpdi r3,0
2438 bne- 1f
2439 b .ret_from_except_lite
2440-1: bl .save_nvgprs
2441- mr r5,r3
2442+1: mr r5,r3
2443 addi r3,r1,STACK_FRAME_OVERHEAD
2444 ld r4,_DAR(r1)
2445 bl .bad_page_fault
2446diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
2447index 41b02c7..05e76fb 100644
2448--- a/arch/powerpc/kernel/exceptions-64s.S
2449+++ b/arch/powerpc/kernel/exceptions-64s.S
2450@@ -1014,10 +1014,10 @@ handle_page_fault:
2451 11: ld r4,_DAR(r1)
2452 ld r5,_DSISR(r1)
2453 addi r3,r1,STACK_FRAME_OVERHEAD
2454+ bl .save_nvgprs
2455 bl .do_page_fault
2456 cmpdi r3,0
2457 beq+ 13f
2458- bl .save_nvgprs
2459 mr r5,r3
2460 addi r3,r1,STACK_FRAME_OVERHEAD
2461 lwz r4,_DAR(r1)
2462diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
2463index 0b6d796..d760ddb 100644
2464--- a/arch/powerpc/kernel/module_32.c
2465+++ b/arch/powerpc/kernel/module_32.c
2466@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
2467 me->arch.core_plt_section = i;
2468 }
2469 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2470- printk("Module doesn't contain .plt or .init.plt sections.\n");
2471+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2472 return -ENOEXEC;
2473 }
2474
2475@@ -192,11 +192,16 @@ static uint32_t do_plt_call(void *location,
2476
2477 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2478 /* Init, or core PLT? */
2479- if (location >= mod->module_core
2480- && location < mod->module_core + mod->core_size)
2481+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2482+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2483 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2484- else
2485+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2486+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2487 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2488+ else {
2489+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2490+ return ~0UL;
2491+ }
2492
2493 /* Find this entry, or if that fails, the next avail. entry */
2494 while (entry->jump[0]) {
2495diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
2496index 8f53954..a704ad6 100644
2497--- a/arch/powerpc/kernel/process.c
2498+++ b/arch/powerpc/kernel/process.c
2499@@ -682,8 +682,8 @@ void show_regs(struct pt_regs * regs)
2500 * Lookup NIP late so we have the best change of getting the
2501 * above info out without failing
2502 */
2503- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2504- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2505+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2506+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2507 #endif
2508 show_stack(current, (unsigned long *) regs->gpr[1]);
2509 if (!user_mode(regs))
2510@@ -1187,10 +1187,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2511 newsp = stack[0];
2512 ip = stack[STACK_FRAME_LR_SAVE];
2513 if (!firstframe || ip != lr) {
2514- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2515+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2516 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2517 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2518- printk(" (%pS)",
2519+ printk(" (%pA)",
2520 (void *)current->ret_stack[curr_frame].ret);
2521 curr_frame--;
2522 }
2523@@ -1210,7 +1210,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2524 struct pt_regs *regs = (struct pt_regs *)
2525 (sp + STACK_FRAME_OVERHEAD);
2526 lr = regs->link;
2527- printk("--- Exception: %lx at %pS\n LR = %pS\n",
2528+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
2529 regs->trap, (void *)regs->nip, (void *)lr);
2530 firstframe = 1;
2531 }
2532@@ -1285,58 +1285,3 @@ void thread_info_cache_init(void)
2533 }
2534
2535 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2536-
2537-unsigned long arch_align_stack(unsigned long sp)
2538-{
2539- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2540- sp -= get_random_int() & ~PAGE_MASK;
2541- return sp & ~0xf;
2542-}
2543-
2544-static inline unsigned long brk_rnd(void)
2545-{
2546- unsigned long rnd = 0;
2547-
2548- /* 8MB for 32bit, 1GB for 64bit */
2549- if (is_32bit_task())
2550- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2551- else
2552- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2553-
2554- return rnd << PAGE_SHIFT;
2555-}
2556-
2557-unsigned long arch_randomize_brk(struct mm_struct *mm)
2558-{
2559- unsigned long base = mm->brk;
2560- unsigned long ret;
2561-
2562-#ifdef CONFIG_PPC_STD_MMU_64
2563- /*
2564- * If we are using 1TB segments and we are allowed to randomise
2565- * the heap, we can put it above 1TB so it is backed by a 1TB
2566- * segment. Otherwise the heap will be in the bottom 1TB
2567- * which always uses 256MB segments and this may result in a
2568- * performance penalty.
2569- */
2570- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2571- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2572-#endif
2573-
2574- ret = PAGE_ALIGN(base + brk_rnd());
2575-
2576- if (ret < mm->brk)
2577- return mm->brk;
2578-
2579- return ret;
2580-}
2581-
2582-unsigned long randomize_et_dyn(unsigned long base)
2583-{
2584- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2585-
2586- if (ret < base)
2587- return base;
2588-
2589- return ret;
2590-}
2591diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
2592index 78b76dc..7f232ef 100644
2593--- a/arch/powerpc/kernel/signal_32.c
2594+++ b/arch/powerpc/kernel/signal_32.c
2595@@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
2596 /* Save user registers on the stack */
2597 frame = &rt_sf->uc.uc_mcontext;
2598 addr = frame;
2599- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2600+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2601 if (save_user_regs(regs, frame, 0, 1))
2602 goto badframe;
2603 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2604diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
2605index e91c736..742ec06 100644
2606--- a/arch/powerpc/kernel/signal_64.c
2607+++ b/arch/powerpc/kernel/signal_64.c
2608@@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
2609 current->thread.fpscr.val = 0;
2610
2611 /* Set up to return from userspace. */
2612- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2613+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2614 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2615 } else {
2616 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2617diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
2618index f19d977..8ac286e 100644
2619--- a/arch/powerpc/kernel/traps.c
2620+++ b/arch/powerpc/kernel/traps.c
2621@@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void)
2622 static inline void pmac_backlight_unblank(void) { }
2623 #endif
2624
2625+extern void gr_handle_kernel_exploit(void);
2626+
2627 int die(const char *str, struct pt_regs *regs, long err)
2628 {
2629 static struct {
2630@@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs *regs, long err)
2631 if (panic_on_oops)
2632 panic("Fatal exception");
2633
2634+ gr_handle_kernel_exploit();
2635+
2636 oops_exit();
2637 do_exit(err);
2638
2639diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
2640index 142ab10..236e61a 100644
2641--- a/arch/powerpc/kernel/vdso.c
2642+++ b/arch/powerpc/kernel/vdso.c
2643@@ -36,6 +36,7 @@
2644 #include <asm/firmware.h>
2645 #include <asm/vdso.h>
2646 #include <asm/vdso_datapage.h>
2647+#include <asm/mman.h>
2648
2649 #include "setup.h"
2650
2651@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2652 vdso_base = VDSO32_MBASE;
2653 #endif
2654
2655- current->mm->context.vdso_base = 0;
2656+ current->mm->context.vdso_base = ~0UL;
2657
2658 /* vDSO has a problem and was disabled, just don't "enable" it for the
2659 * process
2660@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2661 vdso_base = get_unmapped_area(NULL, vdso_base,
2662 (vdso_pages << PAGE_SHIFT) +
2663 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2664- 0, 0);
2665+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
2666 if (IS_ERR_VALUE(vdso_base)) {
2667 rc = vdso_base;
2668 goto fail_mmapsem;
2669diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
2670index 5eea6f3..5d10396 100644
2671--- a/arch/powerpc/lib/usercopy_64.c
2672+++ b/arch/powerpc/lib/usercopy_64.c
2673@@ -9,22 +9,6 @@
2674 #include <linux/module.h>
2675 #include <asm/uaccess.h>
2676
2677-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2678-{
2679- if (likely(access_ok(VERIFY_READ, from, n)))
2680- n = __copy_from_user(to, from, n);
2681- else
2682- memset(to, 0, n);
2683- return n;
2684-}
2685-
2686-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2687-{
2688- if (likely(access_ok(VERIFY_WRITE, to, n)))
2689- n = __copy_to_user(to, from, n);
2690- return n;
2691-}
2692-
2693 unsigned long copy_in_user(void __user *to, const void __user *from,
2694 unsigned long n)
2695 {
2696@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
2697 return n;
2698 }
2699
2700-EXPORT_SYMBOL(copy_from_user);
2701-EXPORT_SYMBOL(copy_to_user);
2702 EXPORT_SYMBOL(copy_in_user);
2703
2704diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
2705index 5efe8c9..db9ceef 100644
2706--- a/arch/powerpc/mm/fault.c
2707+++ b/arch/powerpc/mm/fault.c
2708@@ -32,6 +32,10 @@
2709 #include <linux/perf_event.h>
2710 #include <linux/magic.h>
2711 #include <linux/ratelimit.h>
2712+#include <linux/slab.h>
2713+#include <linux/pagemap.h>
2714+#include <linux/compiler.h>
2715+#include <linux/unistd.h>
2716
2717 #include <asm/firmware.h>
2718 #include <asm/page.h>
2719@@ -43,6 +47,7 @@
2720 #include <asm/tlbflush.h>
2721 #include <asm/siginfo.h>
2722 #include <mm/mmu_decl.h>
2723+#include <asm/ptrace.h>
2724
2725 #ifdef CONFIG_KPROBES
2726 static inline int notify_page_fault(struct pt_regs *regs)
2727@@ -66,6 +71,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
2728 }
2729 #endif
2730
2731+#ifdef CONFIG_PAX_PAGEEXEC
2732+/*
2733+ * PaX: decide what to do with offenders (regs->nip = fault address)
2734+ *
2735+ * returns 1 when task should be killed
2736+ */
2737+static int pax_handle_fetch_fault(struct pt_regs *regs)
2738+{
2739+ return 1;
2740+}
2741+
2742+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2743+{
2744+ unsigned long i;
2745+
2746+ printk(KERN_ERR "PAX: bytes at PC: ");
2747+ for (i = 0; i < 5; i++) {
2748+ unsigned int c;
2749+ if (get_user(c, (unsigned int __user *)pc+i))
2750+ printk(KERN_CONT "???????? ");
2751+ else
2752+ printk(KERN_CONT "%08x ", c);
2753+ }
2754+ printk("\n");
2755+}
2756+#endif
2757+
2758 /*
2759 * Check whether the instruction at regs->nip is a store using
2760 * an update addressing form which will update r1.
2761@@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
2762 * indicate errors in DSISR but can validly be set in SRR1.
2763 */
2764 if (trap == 0x400)
2765- error_code &= 0x48200000;
2766+ error_code &= 0x58200000;
2767 else
2768 is_write = error_code & DSISR_ISSTORE;
2769 #else
2770@@ -259,7 +291,7 @@ good_area:
2771 * "undefined". Of those that can be set, this is the only
2772 * one which seems bad.
2773 */
2774- if (error_code & 0x10000000)
2775+ if (error_code & DSISR_GUARDED)
2776 /* Guarded storage error. */
2777 goto bad_area;
2778 #endif /* CONFIG_8xx */
2779@@ -274,7 +306,7 @@ good_area:
2780 * processors use the same I/D cache coherency mechanism
2781 * as embedded.
2782 */
2783- if (error_code & DSISR_PROTFAULT)
2784+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2785 goto bad_area;
2786 #endif /* CONFIG_PPC_STD_MMU */
2787
2788@@ -343,6 +375,23 @@ bad_area:
2789 bad_area_nosemaphore:
2790 /* User mode accesses cause a SIGSEGV */
2791 if (user_mode(regs)) {
2792+
2793+#ifdef CONFIG_PAX_PAGEEXEC
2794+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2795+#ifdef CONFIG_PPC_STD_MMU
2796+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2797+#else
2798+ if (is_exec && regs->nip == address) {
2799+#endif
2800+ switch (pax_handle_fetch_fault(regs)) {
2801+ }
2802+
2803+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2804+ do_group_exit(SIGKILL);
2805+ }
2806+ }
2807+#endif
2808+
2809 _exception(SIGSEGV, regs, code, address);
2810 return 0;
2811 }
2812diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
2813index 5a783d8..c23e14b 100644
2814--- a/arch/powerpc/mm/mmap_64.c
2815+++ b/arch/powerpc/mm/mmap_64.c
2816@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
2817 */
2818 if (mmap_is_legacy()) {
2819 mm->mmap_base = TASK_UNMAPPED_BASE;
2820+
2821+#ifdef CONFIG_PAX_RANDMMAP
2822+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2823+ mm->mmap_base += mm->delta_mmap;
2824+#endif
2825+
2826 mm->get_unmapped_area = arch_get_unmapped_area;
2827 mm->unmap_area = arch_unmap_area;
2828 } else {
2829 mm->mmap_base = mmap_base();
2830+
2831+#ifdef CONFIG_PAX_RANDMMAP
2832+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2833+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2834+#endif
2835+
2836 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2837 mm->unmap_area = arch_unmap_area_topdown;
2838 }
2839diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
2840index ba51948..23009d9 100644
2841--- a/arch/powerpc/mm/slice.c
2842+++ b/arch/powerpc/mm/slice.c
2843@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
2844 if ((mm->task_size - len) < addr)
2845 return 0;
2846 vma = find_vma(mm, addr);
2847- return (!vma || (addr + len) <= vma->vm_start);
2848+ return check_heap_stack_gap(vma, addr, len);
2849 }
2850
2851 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
2852@@ -256,7 +256,7 @@ full_search:
2853 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
2854 continue;
2855 }
2856- if (!vma || addr + len <= vma->vm_start) {
2857+ if (check_heap_stack_gap(vma, addr, len)) {
2858 /*
2859 * Remember the place where we stopped the search:
2860 */
2861@@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2862 }
2863 }
2864
2865- addr = mm->mmap_base;
2866- while (addr > len) {
2867+ if (mm->mmap_base < len)
2868+ addr = -ENOMEM;
2869+ else
2870+ addr = mm->mmap_base - len;
2871+
2872+ while (!IS_ERR_VALUE(addr)) {
2873 /* Go down by chunk size */
2874- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
2875+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
2876
2877 /* Check for hit with different page size */
2878 mask = slice_range_to_mask(addr, len);
2879@@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2880 * return with success:
2881 */
2882 vma = find_vma(mm, addr);
2883- if (!vma || (addr + len) <= vma->vm_start) {
2884+ if (check_heap_stack_gap(vma, addr, len)) {
2885 /* remember the address as a hint for next time */
2886 if (use_cache)
2887 mm->free_area_cache = addr;
2888@@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2889 mm->cached_hole_size = vma->vm_start - addr;
2890
2891 /* try just below the current vma->vm_start */
2892- addr = vma->vm_start;
2893+ addr = skip_heap_stack_gap(vma, len);
2894 }
2895
2896 /*
2897@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
2898 if (fixed && addr > (mm->task_size - len))
2899 return -EINVAL;
2900
2901+#ifdef CONFIG_PAX_RANDMMAP
2902+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2903+ addr = 0;
2904+#endif
2905+
2906 /* If hint, make sure it matches our alignment restrictions */
2907 if (!fixed && addr) {
2908 addr = _ALIGN_UP(addr, 1ul << pshift);
2909diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
2910index 547f1a6..3fff354 100644
2911--- a/arch/s390/include/asm/elf.h
2912+++ b/arch/s390/include/asm/elf.h
2913@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
2914 the loader. We need to make sure that it is out of the way of the program
2915 that it will "exec", and that there is sufficient room for the brk. */
2916
2917-extern unsigned long randomize_et_dyn(unsigned long base);
2918-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
2919+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
2920+
2921+#ifdef CONFIG_PAX_ASLR
2922+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2923+
2924+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2925+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2926+#endif
2927
2928 /* This yields a mask that user programs can use to figure out what
2929 instruction set this CPU supports. */
2930@@ -211,7 +217,4 @@ struct linux_binprm;
2931 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2932 int arch_setup_additional_pages(struct linux_binprm *, int);
2933
2934-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2935-#define arch_randomize_brk arch_randomize_brk
2936-
2937 #endif
2938diff --git a/arch/s390/include/asm/system.h b/arch/s390/include/asm/system.h
2939index 6582f69..b69906f 100644
2940--- a/arch/s390/include/asm/system.h
2941+++ b/arch/s390/include/asm/system.h
2942@@ -256,7 +256,7 @@ extern void (*_machine_restart)(char *command);
2943 extern void (*_machine_halt)(void);
2944 extern void (*_machine_power_off)(void);
2945
2946-extern unsigned long arch_align_stack(unsigned long sp);
2947+#define arch_align_stack(x) ((x) & ~0xfUL)
2948
2949 static inline int tprot(unsigned long addr)
2950 {
2951diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
2952index 2b23885..e136e31 100644
2953--- a/arch/s390/include/asm/uaccess.h
2954+++ b/arch/s390/include/asm/uaccess.h
2955@@ -235,6 +235,10 @@ static inline unsigned long __must_check
2956 copy_to_user(void __user *to, const void *from, unsigned long n)
2957 {
2958 might_fault();
2959+
2960+ if ((long)n < 0)
2961+ return n;
2962+
2963 if (access_ok(VERIFY_WRITE, to, n))
2964 n = __copy_to_user(to, from, n);
2965 return n;
2966@@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
2967 static inline unsigned long __must_check
2968 __copy_from_user(void *to, const void __user *from, unsigned long n)
2969 {
2970+ if ((long)n < 0)
2971+ return n;
2972+
2973 if (__builtin_constant_p(n) && (n <= 256))
2974 return uaccess.copy_from_user_small(n, from, to);
2975 else
2976@@ -294,6 +301,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
2977 unsigned int sz = __compiletime_object_size(to);
2978
2979 might_fault();
2980+
2981+ if ((long)n < 0)
2982+ return n;
2983+
2984 if (unlikely(sz != -1 && sz < n)) {
2985 copy_from_user_overflow();
2986 return n;
2987diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
2988index dfcb343..eda788a 100644
2989--- a/arch/s390/kernel/module.c
2990+++ b/arch/s390/kernel/module.c
2991@@ -161,11 +161,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
2992
2993 /* Increase core size by size of got & plt and set start
2994 offsets for got and plt. */
2995- me->core_size = ALIGN(me->core_size, 4);
2996- me->arch.got_offset = me->core_size;
2997- me->core_size += me->arch.got_size;
2998- me->arch.plt_offset = me->core_size;
2999- me->core_size += me->arch.plt_size;
3000+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
3001+ me->arch.got_offset = me->core_size_rw;
3002+ me->core_size_rw += me->arch.got_size;
3003+ me->arch.plt_offset = me->core_size_rx;
3004+ me->core_size_rx += me->arch.plt_size;
3005 return 0;
3006 }
3007
3008@@ -242,7 +242,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3009 if (info->got_initialized == 0) {
3010 Elf_Addr *gotent;
3011
3012- gotent = me->module_core + me->arch.got_offset +
3013+ gotent = me->module_core_rw + me->arch.got_offset +
3014 info->got_offset;
3015 *gotent = val;
3016 info->got_initialized = 1;
3017@@ -266,7 +266,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3018 else if (r_type == R_390_GOTENT ||
3019 r_type == R_390_GOTPLTENT)
3020 *(unsigned int *) loc =
3021- (val + (Elf_Addr) me->module_core - loc) >> 1;
3022+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3023 else if (r_type == R_390_GOT64 ||
3024 r_type == R_390_GOTPLT64)
3025 *(unsigned long *) loc = val;
3026@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3027 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3028 if (info->plt_initialized == 0) {
3029 unsigned int *ip;
3030- ip = me->module_core + me->arch.plt_offset +
3031+ ip = me->module_core_rx + me->arch.plt_offset +
3032 info->plt_offset;
3033 #ifndef CONFIG_64BIT
3034 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3035@@ -305,7 +305,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3036 val - loc + 0xffffUL < 0x1ffffeUL) ||
3037 (r_type == R_390_PLT32DBL &&
3038 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3039- val = (Elf_Addr) me->module_core +
3040+ val = (Elf_Addr) me->module_core_rx +
3041 me->arch.plt_offset +
3042 info->plt_offset;
3043 val += rela->r_addend - loc;
3044@@ -327,7 +327,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3045 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3046 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3047 val = val + rela->r_addend -
3048- ((Elf_Addr) me->module_core + me->arch.got_offset);
3049+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3050 if (r_type == R_390_GOTOFF16)
3051 *(unsigned short *) loc = val;
3052 else if (r_type == R_390_GOTOFF32)
3053@@ -337,7 +337,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3054 break;
3055 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3056 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3057- val = (Elf_Addr) me->module_core + me->arch.got_offset +
3058+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3059 rela->r_addend - loc;
3060 if (r_type == R_390_GOTPC)
3061 *(unsigned int *) loc = val;
3062diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
3063index 541a750..8739853 100644
3064--- a/arch/s390/kernel/process.c
3065+++ b/arch/s390/kernel/process.c
3066@@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_struct *p)
3067 }
3068 return 0;
3069 }
3070-
3071-unsigned long arch_align_stack(unsigned long sp)
3072-{
3073- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3074- sp -= get_random_int() & ~PAGE_MASK;
3075- return sp & ~0xf;
3076-}
3077-
3078-static inline unsigned long brk_rnd(void)
3079-{
3080- /* 8MB for 32bit, 1GB for 64bit */
3081- if (is_32bit_task())
3082- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
3083- else
3084- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
3085-}
3086-
3087-unsigned long arch_randomize_brk(struct mm_struct *mm)
3088-{
3089- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
3090-
3091- if (ret < mm->brk)
3092- return mm->brk;
3093- return ret;
3094-}
3095-
3096-unsigned long randomize_et_dyn(unsigned long base)
3097-{
3098- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3099-
3100- if (!(current->flags & PF_RANDOMIZE))
3101- return base;
3102- if (ret < base)
3103- return base;
3104- return ret;
3105-}
3106diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
3107index 7b371c3..ad06cf1 100644
3108--- a/arch/s390/kernel/setup.c
3109+++ b/arch/s390/kernel/setup.c
3110@@ -271,7 +271,7 @@ static int __init early_parse_mem(char *p)
3111 }
3112 early_param("mem", early_parse_mem);
3113
3114-unsigned int user_mode = HOME_SPACE_MODE;
3115+unsigned int user_mode = SECONDARY_SPACE_MODE;
3116 EXPORT_SYMBOL_GPL(user_mode);
3117
3118 static int set_amode_and_uaccess(unsigned long user_amode,
3119diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
3120index c9a9f7f..60d0315 100644
3121--- a/arch/s390/mm/mmap.c
3122+++ b/arch/s390/mm/mmap.c
3123@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3124 */
3125 if (mmap_is_legacy()) {
3126 mm->mmap_base = TASK_UNMAPPED_BASE;
3127+
3128+#ifdef CONFIG_PAX_RANDMMAP
3129+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3130+ mm->mmap_base += mm->delta_mmap;
3131+#endif
3132+
3133 mm->get_unmapped_area = arch_get_unmapped_area;
3134 mm->unmap_area = arch_unmap_area;
3135 } else {
3136 mm->mmap_base = mmap_base();
3137+
3138+#ifdef CONFIG_PAX_RANDMMAP
3139+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3140+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3141+#endif
3142+
3143 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3144 mm->unmap_area = arch_unmap_area_topdown;
3145 }
3146@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3147 */
3148 if (mmap_is_legacy()) {
3149 mm->mmap_base = TASK_UNMAPPED_BASE;
3150+
3151+#ifdef CONFIG_PAX_RANDMMAP
3152+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3153+ mm->mmap_base += mm->delta_mmap;
3154+#endif
3155+
3156 mm->get_unmapped_area = s390_get_unmapped_area;
3157 mm->unmap_area = arch_unmap_area;
3158 } else {
3159 mm->mmap_base = mmap_base();
3160+
3161+#ifdef CONFIG_PAX_RANDMMAP
3162+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3163+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3164+#endif
3165+
3166 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3167 mm->unmap_area = arch_unmap_area_topdown;
3168 }
3169diff --git a/arch/score/include/asm/system.h b/arch/score/include/asm/system.h
3170index 589d5c7..669e274 100644
3171--- a/arch/score/include/asm/system.h
3172+++ b/arch/score/include/asm/system.h
3173@@ -17,7 +17,7 @@ do { \
3174 #define finish_arch_switch(prev) do {} while (0)
3175
3176 typedef void (*vi_handler_t)(void);
3177-extern unsigned long arch_align_stack(unsigned long sp);
3178+#define arch_align_stack(x) (x)
3179
3180 #define mb() barrier()
3181 #define rmb() barrier()
3182diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
3183index 25d0803..d6c8e36 100644
3184--- a/arch/score/kernel/process.c
3185+++ b/arch/score/kernel/process.c
3186@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_struct *task)
3187
3188 return task_pt_regs(task)->cp0_epc;
3189 }
3190-
3191-unsigned long arch_align_stack(unsigned long sp)
3192-{
3193- return sp;
3194-}
3195diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
3196index afeb710..d1d1289 100644
3197--- a/arch/sh/mm/mmap.c
3198+++ b/arch/sh/mm/mmap.c
3199@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
3200 addr = PAGE_ALIGN(addr);
3201
3202 vma = find_vma(mm, addr);
3203- if (TASK_SIZE - len >= addr &&
3204- (!vma || addr + len <= vma->vm_start))
3205+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3206 return addr;
3207 }
3208
3209@@ -106,7 +105,7 @@ full_search:
3210 }
3211 return -ENOMEM;
3212 }
3213- if (likely(!vma || addr + len <= vma->vm_start)) {
3214+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3215 /*
3216 * Remember the place where we stopped the search:
3217 */
3218@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3219 addr = PAGE_ALIGN(addr);
3220
3221 vma = find_vma(mm, addr);
3222- if (TASK_SIZE - len >= addr &&
3223- (!vma || addr + len <= vma->vm_start))
3224+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3225 return addr;
3226 }
3227
3228@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3229 /* make sure it can fit in the remaining address space */
3230 if (likely(addr > len)) {
3231 vma = find_vma(mm, addr-len);
3232- if (!vma || addr <= vma->vm_start) {
3233+ if (check_heap_stack_gap(vma, addr - len, len)) {
3234 /* remember the address as a hint for next time */
3235 return (mm->free_area_cache = addr-len);
3236 }
3237@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3238 if (unlikely(mm->mmap_base < len))
3239 goto bottomup;
3240
3241- addr = mm->mmap_base-len;
3242- if (do_colour_align)
3243- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3244+ addr = mm->mmap_base - len;
3245
3246 do {
3247+ if (do_colour_align)
3248+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3249 /*
3250 * Lookup failure means no vma is above this address,
3251 * else if new region fits below vma->vm_start,
3252 * return with success:
3253 */
3254 vma = find_vma(mm, addr);
3255- if (likely(!vma || addr+len <= vma->vm_start)) {
3256+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3257 /* remember the address as a hint for next time */
3258 return (mm->free_area_cache = addr);
3259 }
3260@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3261 mm->cached_hole_size = vma->vm_start - addr;
3262
3263 /* try just below the current vma->vm_start */
3264- addr = vma->vm_start-len;
3265- if (do_colour_align)
3266- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3267- } while (likely(len < vma->vm_start));
3268+ addr = skip_heap_stack_gap(vma, len);
3269+ } while (!IS_ERR_VALUE(addr));
3270
3271 bottomup:
3272 /*
3273diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
3274index ad1fb5d..fc5315b 100644
3275--- a/arch/sparc/Makefile
3276+++ b/arch/sparc/Makefile
3277@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
3278 # Export what is needed by arch/sparc/boot/Makefile
3279 export VMLINUX_INIT VMLINUX_MAIN
3280 VMLINUX_INIT := $(head-y) $(init-y)
3281-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
3282+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
3283 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
3284 VMLINUX_MAIN += $(drivers-y) $(net-y)
3285
3286diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
3287index 9f421df..b81fc12 100644
3288--- a/arch/sparc/include/asm/atomic_64.h
3289+++ b/arch/sparc/include/asm/atomic_64.h
3290@@ -14,18 +14,40 @@
3291 #define ATOMIC64_INIT(i) { (i) }
3292
3293 #define atomic_read(v) (*(volatile int *)&(v)->counter)
3294+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3295+{
3296+ return v->counter;
3297+}
3298 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
3299+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3300+{
3301+ return v->counter;
3302+}
3303
3304 #define atomic_set(v, i) (((v)->counter) = i)
3305+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3306+{
3307+ v->counter = i;
3308+}
3309 #define atomic64_set(v, i) (((v)->counter) = i)
3310+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3311+{
3312+ v->counter = i;
3313+}
3314
3315 extern void atomic_add(int, atomic_t *);
3316+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3317 extern void atomic64_add(long, atomic64_t *);
3318+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3319 extern void atomic_sub(int, atomic_t *);
3320+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3321 extern void atomic64_sub(long, atomic64_t *);
3322+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3323
3324 extern int atomic_add_ret(int, atomic_t *);
3325+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3326 extern long atomic64_add_ret(long, atomic64_t *);
3327+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3328 extern int atomic_sub_ret(int, atomic_t *);
3329 extern long atomic64_sub_ret(long, atomic64_t *);
3330
3331@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3332 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3333
3334 #define atomic_inc_return(v) atomic_add_ret(1, v)
3335+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3336+{
3337+ return atomic_add_ret_unchecked(1, v);
3338+}
3339 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3340+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3341+{
3342+ return atomic64_add_ret_unchecked(1, v);
3343+}
3344
3345 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3346 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3347
3348 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3349+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3350+{
3351+ return atomic_add_ret_unchecked(i, v);
3352+}
3353 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3354+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3355+{
3356+ return atomic64_add_ret_unchecked(i, v);
3357+}
3358
3359 /*
3360 * atomic_inc_and_test - increment and test
3361@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3362 * other cases.
3363 */
3364 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3365+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3366+{
3367+ return atomic_inc_return_unchecked(v) == 0;
3368+}
3369 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3370
3371 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3372@@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3373 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3374
3375 #define atomic_inc(v) atomic_add(1, v)
3376+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3377+{
3378+ atomic_add_unchecked(1, v);
3379+}
3380 #define atomic64_inc(v) atomic64_add(1, v)
3381+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3382+{
3383+ atomic64_add_unchecked(1, v);
3384+}
3385
3386 #define atomic_dec(v) atomic_sub(1, v)
3387+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3388+{
3389+ atomic_sub_unchecked(1, v);
3390+}
3391 #define atomic64_dec(v) atomic64_sub(1, v)
3392+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3393+{
3394+ atomic64_sub_unchecked(1, v);
3395+}
3396
3397 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3398 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3399
3400 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3401+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3402+{
3403+ return cmpxchg(&v->counter, old, new);
3404+}
3405 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3406+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3407+{
3408+ return xchg(&v->counter, new);
3409+}
3410
3411 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3412 {
3413- int c, old;
3414+ int c, old, new;
3415 c = atomic_read(v);
3416 for (;;) {
3417- if (unlikely(c == (u)))
3418+ if (unlikely(c == u))
3419 break;
3420- old = atomic_cmpxchg((v), c, c + (a));
3421+
3422+ asm volatile("addcc %2, %0, %0\n"
3423+
3424+#ifdef CONFIG_PAX_REFCOUNT
3425+ "tvs %%icc, 6\n"
3426+#endif
3427+
3428+ : "=r" (new)
3429+ : "0" (c), "ir" (a)
3430+ : "cc");
3431+
3432+ old = atomic_cmpxchg(v, c, new);
3433 if (likely(old == c))
3434 break;
3435 c = old;
3436@@ -89,20 +166,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3437 #define atomic64_cmpxchg(v, o, n) \
3438 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3439 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3440+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3441+{
3442+ return xchg(&v->counter, new);
3443+}
3444
3445 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3446 {
3447- long c, old;
3448+ long c, old, new;
3449 c = atomic64_read(v);
3450 for (;;) {
3451- if (unlikely(c == (u)))
3452+ if (unlikely(c == u))
3453 break;
3454- old = atomic64_cmpxchg((v), c, c + (a));
3455+
3456+ asm volatile("addcc %2, %0, %0\n"
3457+
3458+#ifdef CONFIG_PAX_REFCOUNT
3459+ "tvs %%xcc, 6\n"
3460+#endif
3461+
3462+ : "=r" (new)
3463+ : "0" (c), "ir" (a)
3464+ : "cc");
3465+
3466+ old = atomic64_cmpxchg(v, c, new);
3467 if (likely(old == c))
3468 break;
3469 c = old;
3470 }
3471- return c != (u);
3472+ return c != u;
3473 }
3474
3475 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3476diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
3477index 69358b5..17b4745 100644
3478--- a/arch/sparc/include/asm/cache.h
3479+++ b/arch/sparc/include/asm/cache.h
3480@@ -10,7 +10,7 @@
3481 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
3482
3483 #define L1_CACHE_SHIFT 5
3484-#define L1_CACHE_BYTES 32
3485+#define L1_CACHE_BYTES 32UL
3486
3487 #ifdef CONFIG_SPARC32
3488 #define SMP_CACHE_BYTES_SHIFT 5
3489diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
3490index 4269ca6..e3da77f 100644
3491--- a/arch/sparc/include/asm/elf_32.h
3492+++ b/arch/sparc/include/asm/elf_32.h
3493@@ -114,6 +114,13 @@ typedef struct {
3494
3495 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3496
3497+#ifdef CONFIG_PAX_ASLR
3498+#define PAX_ELF_ET_DYN_BASE 0x10000UL
3499+
3500+#define PAX_DELTA_MMAP_LEN 16
3501+#define PAX_DELTA_STACK_LEN 16
3502+#endif
3503+
3504 /* This yields a mask that user programs can use to figure out what
3505 instruction set this cpu supports. This can NOT be done in userspace
3506 on Sparc. */
3507diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
3508index 7df8b7f..4946269 100644
3509--- a/arch/sparc/include/asm/elf_64.h
3510+++ b/arch/sparc/include/asm/elf_64.h
3511@@ -180,6 +180,13 @@ typedef struct {
3512 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3513 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3514
3515+#ifdef CONFIG_PAX_ASLR
3516+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3517+
3518+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3519+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3520+#endif
3521+
3522 extern unsigned long sparc64_elf_hwcap;
3523 #define ELF_HWCAP sparc64_elf_hwcap
3524
3525diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
3526index 5b31a8e..1d92567 100644
3527--- a/arch/sparc/include/asm/pgtable_32.h
3528+++ b/arch/sparc/include/asm/pgtable_32.h
3529@@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3530 BTFIXUPDEF_INT(page_none)
3531 BTFIXUPDEF_INT(page_copy)
3532 BTFIXUPDEF_INT(page_readonly)
3533+
3534+#ifdef CONFIG_PAX_PAGEEXEC
3535+BTFIXUPDEF_INT(page_shared_noexec)
3536+BTFIXUPDEF_INT(page_copy_noexec)
3537+BTFIXUPDEF_INT(page_readonly_noexec)
3538+#endif
3539+
3540 BTFIXUPDEF_INT(page_kernel)
3541
3542 #define PMD_SHIFT SUN4C_PMD_SHIFT
3543@@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED;
3544 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
3545 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
3546
3547+#ifdef CONFIG_PAX_PAGEEXEC
3548+extern pgprot_t PAGE_SHARED_NOEXEC;
3549+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
3550+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
3551+#else
3552+# define PAGE_SHARED_NOEXEC PAGE_SHARED
3553+# define PAGE_COPY_NOEXEC PAGE_COPY
3554+# define PAGE_READONLY_NOEXEC PAGE_READONLY
3555+#endif
3556+
3557 extern unsigned long page_kernel;
3558
3559 #ifdef MODULE
3560diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
3561index f6ae2b2..b03ffc7 100644
3562--- a/arch/sparc/include/asm/pgtsrmmu.h
3563+++ b/arch/sparc/include/asm/pgtsrmmu.h
3564@@ -115,6 +115,13 @@
3565 SRMMU_EXEC | SRMMU_REF)
3566 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3567 SRMMU_EXEC | SRMMU_REF)
3568+
3569+#ifdef CONFIG_PAX_PAGEEXEC
3570+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3571+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3572+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3573+#endif
3574+
3575 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3576 SRMMU_DIRTY | SRMMU_REF)
3577
3578diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
3579index 9689176..63c18ea 100644
3580--- a/arch/sparc/include/asm/spinlock_64.h
3581+++ b/arch/sparc/include/asm/spinlock_64.h
3582@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
3583
3584 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
3585
3586-static void inline arch_read_lock(arch_rwlock_t *lock)
3587+static inline void arch_read_lock(arch_rwlock_t *lock)
3588 {
3589 unsigned long tmp1, tmp2;
3590
3591 __asm__ __volatile__ (
3592 "1: ldsw [%2], %0\n"
3593 " brlz,pn %0, 2f\n"
3594-"4: add %0, 1, %1\n"
3595+"4: addcc %0, 1, %1\n"
3596+
3597+#ifdef CONFIG_PAX_REFCOUNT
3598+" tvs %%icc, 6\n"
3599+#endif
3600+
3601 " cas [%2], %0, %1\n"
3602 " cmp %0, %1\n"
3603 " bne,pn %%icc, 1b\n"
3604@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
3605 " .previous"
3606 : "=&r" (tmp1), "=&r" (tmp2)
3607 : "r" (lock)
3608- : "memory");
3609+ : "memory", "cc");
3610 }
3611
3612-static int inline arch_read_trylock(arch_rwlock_t *lock)
3613+static inline int arch_read_trylock(arch_rwlock_t *lock)
3614 {
3615 int tmp1, tmp2;
3616
3617@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3618 "1: ldsw [%2], %0\n"
3619 " brlz,a,pn %0, 2f\n"
3620 " mov 0, %0\n"
3621-" add %0, 1, %1\n"
3622+" addcc %0, 1, %1\n"
3623+
3624+#ifdef CONFIG_PAX_REFCOUNT
3625+" tvs %%icc, 6\n"
3626+#endif
3627+
3628 " cas [%2], %0, %1\n"
3629 " cmp %0, %1\n"
3630 " bne,pn %%icc, 1b\n"
3631@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3632 return tmp1;
3633 }
3634
3635-static void inline arch_read_unlock(arch_rwlock_t *lock)
3636+static inline void arch_read_unlock(arch_rwlock_t *lock)
3637 {
3638 unsigned long tmp1, tmp2;
3639
3640 __asm__ __volatile__(
3641 "1: lduw [%2], %0\n"
3642-" sub %0, 1, %1\n"
3643+" subcc %0, 1, %1\n"
3644+
3645+#ifdef CONFIG_PAX_REFCOUNT
3646+" tvs %%icc, 6\n"
3647+#endif
3648+
3649 " cas [%2], %0, %1\n"
3650 " cmp %0, %1\n"
3651 " bne,pn %%xcc, 1b\n"
3652@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
3653 : "memory");
3654 }
3655
3656-static void inline arch_write_lock(arch_rwlock_t *lock)
3657+static inline void arch_write_lock(arch_rwlock_t *lock)
3658 {
3659 unsigned long mask, tmp1, tmp2;
3660
3661@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
3662 : "memory");
3663 }
3664
3665-static void inline arch_write_unlock(arch_rwlock_t *lock)
3666+static inline void arch_write_unlock(arch_rwlock_t *lock)
3667 {
3668 __asm__ __volatile__(
3669 " stw %%g0, [%0]"
3670@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
3671 : "memory");
3672 }
3673
3674-static int inline arch_write_trylock(arch_rwlock_t *lock)
3675+static inline int arch_write_trylock(arch_rwlock_t *lock)
3676 {
3677 unsigned long mask, tmp1, tmp2, result;
3678
3679diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
3680index fa57532..e1a4c53 100644
3681--- a/arch/sparc/include/asm/thread_info_32.h
3682+++ b/arch/sparc/include/asm/thread_info_32.h
3683@@ -50,6 +50,8 @@ struct thread_info {
3684 unsigned long w_saved;
3685
3686 struct restart_block restart_block;
3687+
3688+ unsigned long lowest_stack;
3689 };
3690
3691 /*
3692diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
3693index 60d86be..952dea1 100644
3694--- a/arch/sparc/include/asm/thread_info_64.h
3695+++ b/arch/sparc/include/asm/thread_info_64.h
3696@@ -63,6 +63,8 @@ struct thread_info {
3697 struct pt_regs *kern_una_regs;
3698 unsigned int kern_una_insn;
3699
3700+ unsigned long lowest_stack;
3701+
3702 unsigned long fpregs[0] __attribute__ ((aligned(64)));
3703 };
3704
3705diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
3706index e88fbe5..96b0ce5 100644
3707--- a/arch/sparc/include/asm/uaccess.h
3708+++ b/arch/sparc/include/asm/uaccess.h
3709@@ -1,5 +1,13 @@
3710 #ifndef ___ASM_SPARC_UACCESS_H
3711 #define ___ASM_SPARC_UACCESS_H
3712+
3713+#ifdef __KERNEL__
3714+#ifndef __ASSEMBLY__
3715+#include <linux/types.h>
3716+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3717+#endif
3718+#endif
3719+
3720 #if defined(__sparc__) && defined(__arch64__)
3721 #include <asm/uaccess_64.h>
3722 #else
3723diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
3724index 8303ac4..07f333d 100644
3725--- a/arch/sparc/include/asm/uaccess_32.h
3726+++ b/arch/sparc/include/asm/uaccess_32.h
3727@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
3728
3729 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3730 {
3731- if (n && __access_ok((unsigned long) to, n))
3732+ if ((long)n < 0)
3733+ return n;
3734+
3735+ if (n && __access_ok((unsigned long) to, n)) {
3736+ if (!__builtin_constant_p(n))
3737+ check_object_size(from, n, true);
3738 return __copy_user(to, (__force void __user *) from, n);
3739- else
3740+ } else
3741 return n;
3742 }
3743
3744 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3745 {
3746+ if ((long)n < 0)
3747+ return n;
3748+
3749+ if (!__builtin_constant_p(n))
3750+ check_object_size(from, n, true);
3751+
3752 return __copy_user(to, (__force void __user *) from, n);
3753 }
3754
3755 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
3756 {
3757- if (n && __access_ok((unsigned long) from, n))
3758+ if ((long)n < 0)
3759+ return n;
3760+
3761+ if (n && __access_ok((unsigned long) from, n)) {
3762+ if (!__builtin_constant_p(n))
3763+ check_object_size(to, n, false);
3764 return __copy_user((__force void __user *) to, from, n);
3765- else
3766+ } else
3767 return n;
3768 }
3769
3770 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3771 {
3772+ if ((long)n < 0)
3773+ return n;
3774+
3775 return __copy_user((__force void __user *) to, from, n);
3776 }
3777
3778diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
3779index 3e1449f..5293a0e 100644
3780--- a/arch/sparc/include/asm/uaccess_64.h
3781+++ b/arch/sparc/include/asm/uaccess_64.h
3782@@ -10,6 +10,7 @@
3783 #include <linux/compiler.h>
3784 #include <linux/string.h>
3785 #include <linux/thread_info.h>
3786+#include <linux/kernel.h>
3787 #include <asm/asi.h>
3788 #include <asm/system.h>
3789 #include <asm/spitfire.h>
3790@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
3791 static inline unsigned long __must_check
3792 copy_from_user(void *to, const void __user *from, unsigned long size)
3793 {
3794- unsigned long ret = ___copy_from_user(to, from, size);
3795+ unsigned long ret;
3796
3797+ if ((long)size < 0 || size > INT_MAX)
3798+ return size;
3799+
3800+ if (!__builtin_constant_p(size))
3801+ check_object_size(to, size, false);
3802+
3803+ ret = ___copy_from_user(to, from, size);
3804 if (unlikely(ret))
3805 ret = copy_from_user_fixup(to, from, size);
3806
3807@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
3808 static inline unsigned long __must_check
3809 copy_to_user(void __user *to, const void *from, unsigned long size)
3810 {
3811- unsigned long ret = ___copy_to_user(to, from, size);
3812+ unsigned long ret;
3813
3814+ if ((long)size < 0 || size > INT_MAX)
3815+ return size;
3816+
3817+ if (!__builtin_constant_p(size))
3818+ check_object_size(from, size, true);
3819+
3820+ ret = ___copy_to_user(to, from, size);
3821 if (unlikely(ret))
3822 ret = copy_to_user_fixup(to, from, size);
3823 return ret;
3824diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
3825index cb85458..e063f17 100644
3826--- a/arch/sparc/kernel/Makefile
3827+++ b/arch/sparc/kernel/Makefile
3828@@ -3,7 +3,7 @@
3829 #
3830
3831 asflags-y := -ansi
3832-ccflags-y := -Werror
3833+#ccflags-y := -Werror
3834
3835 extra-y := head_$(BITS).o
3836 extra-y += init_task.o
3837diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
3838index f793742..4d880af 100644
3839--- a/arch/sparc/kernel/process_32.c
3840+++ b/arch/sparc/kernel/process_32.c
3841@@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp)
3842 rw->ins[4], rw->ins[5],
3843 rw->ins[6],
3844 rw->ins[7]);
3845- printk("%pS\n", (void *) rw->ins[7]);
3846+ printk("%pA\n", (void *) rw->ins[7]);
3847 rw = (struct reg_window32 *) rw->ins[6];
3848 }
3849 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
3850@@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r)
3851
3852 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
3853 r->psr, r->pc, r->npc, r->y, print_tainted());
3854- printk("PC: <%pS>\n", (void *) r->pc);
3855+ printk("PC: <%pA>\n", (void *) r->pc);
3856 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3857 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
3858 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
3859 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3860 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
3861 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
3862- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
3863+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
3864
3865 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3866 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
3867@@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
3868 rw = (struct reg_window32 *) fp;
3869 pc = rw->ins[7];
3870 printk("[%08lx : ", pc);
3871- printk("%pS ] ", (void *) pc);
3872+ printk("%pA ] ", (void *) pc);
3873 fp = rw->ins[6];
3874 } while (++count < 16);
3875 printk("\n");
3876diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
3877index d959cd0..7b42812 100644
3878--- a/arch/sparc/kernel/process_64.c
3879+++ b/arch/sparc/kernel/process_64.c
3880@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_regs *regs)
3881 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
3882 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
3883 if (regs->tstate & TSTATE_PRIV)
3884- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
3885+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
3886 }
3887
3888 void show_regs(struct pt_regs *regs)
3889 {
3890 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
3891 regs->tpc, regs->tnpc, regs->y, print_tainted());
3892- printk("TPC: <%pS>\n", (void *) regs->tpc);
3893+ printk("TPC: <%pA>\n", (void *) regs->tpc);
3894 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
3895 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
3896 regs->u_regs[3]);
3897@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
3898 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
3899 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
3900 regs->u_regs[15]);
3901- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
3902+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
3903 show_regwindow(regs);
3904 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
3905 }
3906@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void)
3907 ((tp && tp->task) ? tp->task->pid : -1));
3908
3909 if (gp->tstate & TSTATE_PRIV) {
3910- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
3911+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
3912 (void *) gp->tpc,
3913 (void *) gp->o7,
3914 (void *) gp->i7,
3915diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
3916index 42b282f..28ce9f2 100644
3917--- a/arch/sparc/kernel/sys_sparc_32.c
3918+++ b/arch/sparc/kernel/sys_sparc_32.c
3919@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3920 if (ARCH_SUN4C && len > 0x20000000)
3921 return -ENOMEM;
3922 if (!addr)
3923- addr = TASK_UNMAPPED_BASE;
3924+ addr = current->mm->mmap_base;
3925
3926 if (flags & MAP_SHARED)
3927 addr = COLOUR_ALIGN(addr);
3928@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3929 }
3930 if (TASK_SIZE - PAGE_SIZE - len < addr)
3931 return -ENOMEM;
3932- if (!vmm || addr + len <= vmm->vm_start)
3933+ if (check_heap_stack_gap(vmm, addr, len))
3934 return addr;
3935 addr = vmm->vm_end;
3936 if (flags & MAP_SHARED)
3937diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
3938index 908b47a..aa9e584 100644
3939--- a/arch/sparc/kernel/sys_sparc_64.c
3940+++ b/arch/sparc/kernel/sys_sparc_64.c
3941@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3942 /* We do not accept a shared mapping if it would violate
3943 * cache aliasing constraints.
3944 */
3945- if ((flags & MAP_SHARED) &&
3946+ if ((filp || (flags & MAP_SHARED)) &&
3947 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3948 return -EINVAL;
3949 return addr;
3950@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3951 if (filp || (flags & MAP_SHARED))
3952 do_color_align = 1;
3953
3954+#ifdef CONFIG_PAX_RANDMMAP
3955+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3956+#endif
3957+
3958 if (addr) {
3959 if (do_color_align)
3960 addr = COLOUR_ALIGN(addr, pgoff);
3961@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3962 addr = PAGE_ALIGN(addr);
3963
3964 vma = find_vma(mm, addr);
3965- if (task_size - len >= addr &&
3966- (!vma || addr + len <= vma->vm_start))
3967+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3968 return addr;
3969 }
3970
3971 if (len > mm->cached_hole_size) {
3972- start_addr = addr = mm->free_area_cache;
3973+ start_addr = addr = mm->free_area_cache;
3974 } else {
3975- start_addr = addr = TASK_UNMAPPED_BASE;
3976+ start_addr = addr = mm->mmap_base;
3977 mm->cached_hole_size = 0;
3978 }
3979
3980@@ -174,14 +177,14 @@ full_search:
3981 vma = find_vma(mm, VA_EXCLUDE_END);
3982 }
3983 if (unlikely(task_size < addr)) {
3984- if (start_addr != TASK_UNMAPPED_BASE) {
3985- start_addr = addr = TASK_UNMAPPED_BASE;
3986+ if (start_addr != mm->mmap_base) {
3987+ start_addr = addr = mm->mmap_base;
3988 mm->cached_hole_size = 0;
3989 goto full_search;
3990 }
3991 return -ENOMEM;
3992 }
3993- if (likely(!vma || addr + len <= vma->vm_start)) {
3994+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3995 /*
3996 * Remember the place where we stopped the search:
3997 */
3998@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3999 /* We do not accept a shared mapping if it would violate
4000 * cache aliasing constraints.
4001 */
4002- if ((flags & MAP_SHARED) &&
4003+ if ((filp || (flags & MAP_SHARED)) &&
4004 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4005 return -EINVAL;
4006 return addr;
4007@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4008 addr = PAGE_ALIGN(addr);
4009
4010 vma = find_vma(mm, addr);
4011- if (task_size - len >= addr &&
4012- (!vma || addr + len <= vma->vm_start))
4013+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4014 return addr;
4015 }
4016
4017@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4018 /* make sure it can fit in the remaining address space */
4019 if (likely(addr > len)) {
4020 vma = find_vma(mm, addr-len);
4021- if (!vma || addr <= vma->vm_start) {
4022+ if (check_heap_stack_gap(vma, addr - len, len)) {
4023 /* remember the address as a hint for next time */
4024 return (mm->free_area_cache = addr-len);
4025 }
4026@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4027 if (unlikely(mm->mmap_base < len))
4028 goto bottomup;
4029
4030- addr = mm->mmap_base-len;
4031- if (do_color_align)
4032- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4033+ addr = mm->mmap_base - len;
4034
4035 do {
4036+ if (do_color_align)
4037+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4038 /*
4039 * Lookup failure means no vma is above this address,
4040 * else if new region fits below vma->vm_start,
4041 * return with success:
4042 */
4043 vma = find_vma(mm, addr);
4044- if (likely(!vma || addr+len <= vma->vm_start)) {
4045+ if (likely(check_heap_stack_gap(vma, addr, len))) {
4046 /* remember the address as a hint for next time */
4047 return (mm->free_area_cache = addr);
4048 }
4049@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4050 mm->cached_hole_size = vma->vm_start - addr;
4051
4052 /* try just below the current vma->vm_start */
4053- addr = vma->vm_start-len;
4054- if (do_color_align)
4055- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4056- } while (likely(len < vma->vm_start));
4057+ addr = skip_heap_stack_gap(vma, len);
4058+ } while (!IS_ERR_VALUE(addr));
4059
4060 bottomup:
4061 /*
4062@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4063 gap == RLIM_INFINITY ||
4064 sysctl_legacy_va_layout) {
4065 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4066+
4067+#ifdef CONFIG_PAX_RANDMMAP
4068+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4069+ mm->mmap_base += mm->delta_mmap;
4070+#endif
4071+
4072 mm->get_unmapped_area = arch_get_unmapped_area;
4073 mm->unmap_area = arch_unmap_area;
4074 } else {
4075@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4076 gap = (task_size / 6 * 5);
4077
4078 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4079+
4080+#ifdef CONFIG_PAX_RANDMMAP
4081+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4082+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4083+#endif
4084+
4085 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4086 mm->unmap_area = arch_unmap_area_topdown;
4087 }
4088diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
4089index c0490c7..84959d1 100644
4090--- a/arch/sparc/kernel/traps_32.c
4091+++ b/arch/sparc/kernel/traps_32.c
4092@@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
4093 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4094 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4095
4096+extern void gr_handle_kernel_exploit(void);
4097+
4098 void die_if_kernel(char *str, struct pt_regs *regs)
4099 {
4100 static int die_counter;
4101@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4102 count++ < 30 &&
4103 (((unsigned long) rw) >= PAGE_OFFSET) &&
4104 !(((unsigned long) rw) & 0x7)) {
4105- printk("Caller[%08lx]: %pS\n", rw->ins[7],
4106+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
4107 (void *) rw->ins[7]);
4108 rw = (struct reg_window32 *)rw->ins[6];
4109 }
4110 }
4111 printk("Instruction DUMP:");
4112 instruction_dump ((unsigned long *) regs->pc);
4113- if(regs->psr & PSR_PS)
4114+ if(regs->psr & PSR_PS) {
4115+ gr_handle_kernel_exploit();
4116 do_exit(SIGKILL);
4117+ }
4118 do_exit(SIGSEGV);
4119 }
4120
4121diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
4122index 0cbdaa4..438e4c9 100644
4123--- a/arch/sparc/kernel/traps_64.c
4124+++ b/arch/sparc/kernel/traps_64.c
4125@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
4126 i + 1,
4127 p->trapstack[i].tstate, p->trapstack[i].tpc,
4128 p->trapstack[i].tnpc, p->trapstack[i].tt);
4129- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4130+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4131 }
4132 }
4133
4134@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
4135
4136 lvl -= 0x100;
4137 if (regs->tstate & TSTATE_PRIV) {
4138+
4139+#ifdef CONFIG_PAX_REFCOUNT
4140+ if (lvl == 6)
4141+ pax_report_refcount_overflow(regs);
4142+#endif
4143+
4144 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4145 die_if_kernel(buffer, regs);
4146 }
4147@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
4148 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4149 {
4150 char buffer[32];
4151-
4152+
4153 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4154 0, lvl, SIGTRAP) == NOTIFY_STOP)
4155 return;
4156
4157+#ifdef CONFIG_PAX_REFCOUNT
4158+ if (lvl == 6)
4159+ pax_report_refcount_overflow(regs);
4160+#endif
4161+
4162 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4163
4164 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4165@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
4166 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4167 printk("%s" "ERROR(%d): ",
4168 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4169- printk("TPC<%pS>\n", (void *) regs->tpc);
4170+ printk("TPC<%pA>\n", (void *) regs->tpc);
4171 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4172 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4173 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4174@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4175 smp_processor_id(),
4176 (type & 0x1) ? 'I' : 'D',
4177 regs->tpc);
4178- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4179+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4180 panic("Irrecoverable Cheetah+ parity error.");
4181 }
4182
4183@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4184 smp_processor_id(),
4185 (type & 0x1) ? 'I' : 'D',
4186 regs->tpc);
4187- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4188+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4189 }
4190
4191 struct sun4v_error_entry {
4192@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
4193
4194 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4195 regs->tpc, tl);
4196- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4197+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4198 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4199- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4200+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4201 (void *) regs->u_regs[UREG_I7]);
4202 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4203 "pte[%lx] error[%lx]\n",
4204@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
4205
4206 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4207 regs->tpc, tl);
4208- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4209+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4210 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4211- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4212+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4213 (void *) regs->u_regs[UREG_I7]);
4214 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4215 "pte[%lx] error[%lx]\n",
4216@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
4217 fp = (unsigned long)sf->fp + STACK_BIAS;
4218 }
4219
4220- printk(" [%016lx] %pS\n", pc, (void *) pc);
4221+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4222 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
4223 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
4224 int index = tsk->curr_ret_stack;
4225 if (tsk->ret_stack && index >= graph) {
4226 pc = tsk->ret_stack[index - graph].ret;
4227- printk(" [%016lx] %pS\n", pc, (void *) pc);
4228+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4229 graph++;
4230 }
4231 }
4232@@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
4233 return (struct reg_window *) (fp + STACK_BIAS);
4234 }
4235
4236+extern void gr_handle_kernel_exploit(void);
4237+
4238 void die_if_kernel(char *str, struct pt_regs *regs)
4239 {
4240 static int die_counter;
4241@@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4242 while (rw &&
4243 count++ < 30 &&
4244 kstack_valid(tp, (unsigned long) rw)) {
4245- printk("Caller[%016lx]: %pS\n", rw->ins[7],
4246+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
4247 (void *) rw->ins[7]);
4248
4249 rw = kernel_stack_up(rw);
4250@@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4251 }
4252 user_instruction_dump ((unsigned int __user *) regs->tpc);
4253 }
4254- if (regs->tstate & TSTATE_PRIV)
4255+ if (regs->tstate & TSTATE_PRIV) {
4256+ gr_handle_kernel_exploit();
4257 do_exit(SIGKILL);
4258+ }
4259 do_exit(SIGSEGV);
4260 }
4261 EXPORT_SYMBOL(die_if_kernel);
4262diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
4263index 76e4ac1..78f8bb1 100644
4264--- a/arch/sparc/kernel/unaligned_64.c
4265+++ b/arch/sparc/kernel/unaligned_64.c
4266@@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs *regs)
4267 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
4268
4269 if (__ratelimit(&ratelimit)) {
4270- printk("Kernel unaligned access at TPC[%lx] %pS\n",
4271+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
4272 regs->tpc, (void *) regs->tpc);
4273 }
4274 }
4275diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
4276index a3fc437..fea9957 100644
4277--- a/arch/sparc/lib/Makefile
4278+++ b/arch/sparc/lib/Makefile
4279@@ -2,7 +2,7 @@
4280 #
4281
4282 asflags-y := -ansi -DST_DIV0=0x02
4283-ccflags-y := -Werror
4284+#ccflags-y := -Werror
4285
4286 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
4287 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
4288diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
4289index 59186e0..f747d7a 100644
4290--- a/arch/sparc/lib/atomic_64.S
4291+++ b/arch/sparc/lib/atomic_64.S
4292@@ -18,7 +18,12 @@
4293 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4294 BACKOFF_SETUP(%o2)
4295 1: lduw [%o1], %g1
4296- add %g1, %o0, %g7
4297+ addcc %g1, %o0, %g7
4298+
4299+#ifdef CONFIG_PAX_REFCOUNT
4300+ tvs %icc, 6
4301+#endif
4302+
4303 cas [%o1], %g1, %g7
4304 cmp %g1, %g7
4305 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4306@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4307 2: BACKOFF_SPIN(%o2, %o3, 1b)
4308 .size atomic_add, .-atomic_add
4309
4310+ .globl atomic_add_unchecked
4311+ .type atomic_add_unchecked,#function
4312+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4313+ BACKOFF_SETUP(%o2)
4314+1: lduw [%o1], %g1
4315+ add %g1, %o0, %g7
4316+ cas [%o1], %g1, %g7
4317+ cmp %g1, %g7
4318+ bne,pn %icc, 2f
4319+ nop
4320+ retl
4321+ nop
4322+2: BACKOFF_SPIN(%o2, %o3, 1b)
4323+ .size atomic_add_unchecked, .-atomic_add_unchecked
4324+
4325 .globl atomic_sub
4326 .type atomic_sub,#function
4327 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4328 BACKOFF_SETUP(%o2)
4329 1: lduw [%o1], %g1
4330- sub %g1, %o0, %g7
4331+ subcc %g1, %o0, %g7
4332+
4333+#ifdef CONFIG_PAX_REFCOUNT
4334+ tvs %icc, 6
4335+#endif
4336+
4337 cas [%o1], %g1, %g7
4338 cmp %g1, %g7
4339 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4340@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4341 2: BACKOFF_SPIN(%o2, %o3, 1b)
4342 .size atomic_sub, .-atomic_sub
4343
4344+ .globl atomic_sub_unchecked
4345+ .type atomic_sub_unchecked,#function
4346+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4347+ BACKOFF_SETUP(%o2)
4348+1: lduw [%o1], %g1
4349+ sub %g1, %o0, %g7
4350+ cas [%o1], %g1, %g7
4351+ cmp %g1, %g7
4352+ bne,pn %icc, 2f
4353+ nop
4354+ retl
4355+ nop
4356+2: BACKOFF_SPIN(%o2, %o3, 1b)
4357+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
4358+
4359 .globl atomic_add_ret
4360 .type atomic_add_ret,#function
4361 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4362 BACKOFF_SETUP(%o2)
4363 1: lduw [%o1], %g1
4364- add %g1, %o0, %g7
4365+ addcc %g1, %o0, %g7
4366+
4367+#ifdef CONFIG_PAX_REFCOUNT
4368+ tvs %icc, 6
4369+#endif
4370+
4371 cas [%o1], %g1, %g7
4372 cmp %g1, %g7
4373 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4374@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4375 2: BACKOFF_SPIN(%o2, %o3, 1b)
4376 .size atomic_add_ret, .-atomic_add_ret
4377
4378+ .globl atomic_add_ret_unchecked
4379+ .type atomic_add_ret_unchecked,#function
4380+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4381+ BACKOFF_SETUP(%o2)
4382+1: lduw [%o1], %g1
4383+ addcc %g1, %o0, %g7
4384+ cas [%o1], %g1, %g7
4385+ cmp %g1, %g7
4386+ bne,pn %icc, 2f
4387+ add %g7, %o0, %g7
4388+ sra %g7, 0, %o0
4389+ retl
4390+ nop
4391+2: BACKOFF_SPIN(%o2, %o3, 1b)
4392+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4393+
4394 .globl atomic_sub_ret
4395 .type atomic_sub_ret,#function
4396 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4397 BACKOFF_SETUP(%o2)
4398 1: lduw [%o1], %g1
4399- sub %g1, %o0, %g7
4400+ subcc %g1, %o0, %g7
4401+
4402+#ifdef CONFIG_PAX_REFCOUNT
4403+ tvs %icc, 6
4404+#endif
4405+
4406 cas [%o1], %g1, %g7
4407 cmp %g1, %g7
4408 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4409@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4410 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4411 BACKOFF_SETUP(%o2)
4412 1: ldx [%o1], %g1
4413- add %g1, %o0, %g7
4414+ addcc %g1, %o0, %g7
4415+
4416+#ifdef CONFIG_PAX_REFCOUNT
4417+ tvs %xcc, 6
4418+#endif
4419+
4420 casx [%o1], %g1, %g7
4421 cmp %g1, %g7
4422 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4423@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4424 2: BACKOFF_SPIN(%o2, %o3, 1b)
4425 .size atomic64_add, .-atomic64_add
4426
4427+ .globl atomic64_add_unchecked
4428+ .type atomic64_add_unchecked,#function
4429+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4430+ BACKOFF_SETUP(%o2)
4431+1: ldx [%o1], %g1
4432+ addcc %g1, %o0, %g7
4433+ casx [%o1], %g1, %g7
4434+ cmp %g1, %g7
4435+ bne,pn %xcc, 2f
4436+ nop
4437+ retl
4438+ nop
4439+2: BACKOFF_SPIN(%o2, %o3, 1b)
4440+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
4441+
4442 .globl atomic64_sub
4443 .type atomic64_sub,#function
4444 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4445 BACKOFF_SETUP(%o2)
4446 1: ldx [%o1], %g1
4447- sub %g1, %o0, %g7
4448+ subcc %g1, %o0, %g7
4449+
4450+#ifdef CONFIG_PAX_REFCOUNT
4451+ tvs %xcc, 6
4452+#endif
4453+
4454 casx [%o1], %g1, %g7
4455 cmp %g1, %g7
4456 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4457@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4458 2: BACKOFF_SPIN(%o2, %o3, 1b)
4459 .size atomic64_sub, .-atomic64_sub
4460
4461+ .globl atomic64_sub_unchecked
4462+ .type atomic64_sub_unchecked,#function
4463+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4464+ BACKOFF_SETUP(%o2)
4465+1: ldx [%o1], %g1
4466+ subcc %g1, %o0, %g7
4467+ casx [%o1], %g1, %g7
4468+ cmp %g1, %g7
4469+ bne,pn %xcc, 2f
4470+ nop
4471+ retl
4472+ nop
4473+2: BACKOFF_SPIN(%o2, %o3, 1b)
4474+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
4475+
4476 .globl atomic64_add_ret
4477 .type atomic64_add_ret,#function
4478 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4479 BACKOFF_SETUP(%o2)
4480 1: ldx [%o1], %g1
4481- add %g1, %o0, %g7
4482+ addcc %g1, %o0, %g7
4483+
4484+#ifdef CONFIG_PAX_REFCOUNT
4485+ tvs %xcc, 6
4486+#endif
4487+
4488 casx [%o1], %g1, %g7
4489 cmp %g1, %g7
4490 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4491@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4492 2: BACKOFF_SPIN(%o2, %o3, 1b)
4493 .size atomic64_add_ret, .-atomic64_add_ret
4494
4495+ .globl atomic64_add_ret_unchecked
4496+ .type atomic64_add_ret_unchecked,#function
4497+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4498+ BACKOFF_SETUP(%o2)
4499+1: ldx [%o1], %g1
4500+ addcc %g1, %o0, %g7
4501+ casx [%o1], %g1, %g7
4502+ cmp %g1, %g7
4503+ bne,pn %xcc, 2f
4504+ add %g7, %o0, %g7
4505+ mov %g7, %o0
4506+ retl
4507+ nop
4508+2: BACKOFF_SPIN(%o2, %o3, 1b)
4509+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
4510+
4511 .globl atomic64_sub_ret
4512 .type atomic64_sub_ret,#function
4513 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4514 BACKOFF_SETUP(%o2)
4515 1: ldx [%o1], %g1
4516- sub %g1, %o0, %g7
4517+ subcc %g1, %o0, %g7
4518+
4519+#ifdef CONFIG_PAX_REFCOUNT
4520+ tvs %xcc, 6
4521+#endif
4522+
4523 casx [%o1], %g1, %g7
4524 cmp %g1, %g7
4525 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4526diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
4527index 1b30bb3..b4a16c7 100644
4528--- a/arch/sparc/lib/ksyms.c
4529+++ b/arch/sparc/lib/ksyms.c
4530@@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write);
4531
4532 /* Atomic counter implementation. */
4533 EXPORT_SYMBOL(atomic_add);
4534+EXPORT_SYMBOL(atomic_add_unchecked);
4535 EXPORT_SYMBOL(atomic_add_ret);
4536+EXPORT_SYMBOL(atomic_add_ret_unchecked);
4537 EXPORT_SYMBOL(atomic_sub);
4538+EXPORT_SYMBOL(atomic_sub_unchecked);
4539 EXPORT_SYMBOL(atomic_sub_ret);
4540 EXPORT_SYMBOL(atomic64_add);
4541+EXPORT_SYMBOL(atomic64_add_unchecked);
4542 EXPORT_SYMBOL(atomic64_add_ret);
4543+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
4544 EXPORT_SYMBOL(atomic64_sub);
4545+EXPORT_SYMBOL(atomic64_sub_unchecked);
4546 EXPORT_SYMBOL(atomic64_sub_ret);
4547
4548 /* Atomic bit operations. */
4549diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
4550index e3cda21..a68e4cb 100644
4551--- a/arch/sparc/mm/Makefile
4552+++ b/arch/sparc/mm/Makefile
4553@@ -2,7 +2,7 @@
4554 #
4555
4556 asflags-y := -ansi
4557-ccflags-y := -Werror
4558+#ccflags-y := -Werror
4559
4560 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
4561 obj-y += fault_$(BITS).o
4562diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
4563index aa1c1b1..f93e28f 100644
4564--- a/arch/sparc/mm/fault_32.c
4565+++ b/arch/sparc/mm/fault_32.c
4566@@ -22,6 +22,9 @@
4567 #include <linux/interrupt.h>
4568 #include <linux/module.h>
4569 #include <linux/kdebug.h>
4570+#include <linux/slab.h>
4571+#include <linux/pagemap.h>
4572+#include <linux/compiler.h>
4573
4574 #include <asm/system.h>
4575 #include <asm/page.h>
4576@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
4577 return safe_compute_effective_address(regs, insn);
4578 }
4579
4580+#ifdef CONFIG_PAX_PAGEEXEC
4581+#ifdef CONFIG_PAX_DLRESOLVE
4582+static void pax_emuplt_close(struct vm_area_struct *vma)
4583+{
4584+ vma->vm_mm->call_dl_resolve = 0UL;
4585+}
4586+
4587+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4588+{
4589+ unsigned int *kaddr;
4590+
4591+ vmf->page = alloc_page(GFP_HIGHUSER);
4592+ if (!vmf->page)
4593+ return VM_FAULT_OOM;
4594+
4595+ kaddr = kmap(vmf->page);
4596+ memset(kaddr, 0, PAGE_SIZE);
4597+ kaddr[0] = 0x9DE3BFA8U; /* save */
4598+ flush_dcache_page(vmf->page);
4599+ kunmap(vmf->page);
4600+ return VM_FAULT_MAJOR;
4601+}
4602+
4603+static const struct vm_operations_struct pax_vm_ops = {
4604+ .close = pax_emuplt_close,
4605+ .fault = pax_emuplt_fault
4606+};
4607+
4608+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4609+{
4610+ int ret;
4611+
4612+ INIT_LIST_HEAD(&vma->anon_vma_chain);
4613+ vma->vm_mm = current->mm;
4614+ vma->vm_start = addr;
4615+ vma->vm_end = addr + PAGE_SIZE;
4616+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4617+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4618+ vma->vm_ops = &pax_vm_ops;
4619+
4620+ ret = insert_vm_struct(current->mm, vma);
4621+ if (ret)
4622+ return ret;
4623+
4624+ ++current->mm->total_vm;
4625+ return 0;
4626+}
4627+#endif
4628+
4629+/*
4630+ * PaX: decide what to do with offenders (regs->pc = fault address)
4631+ *
4632+ * returns 1 when task should be killed
4633+ * 2 when patched PLT trampoline was detected
4634+ * 3 when unpatched PLT trampoline was detected
4635+ */
4636+static int pax_handle_fetch_fault(struct pt_regs *regs)
4637+{
4638+
4639+#ifdef CONFIG_PAX_EMUPLT
4640+ int err;
4641+
4642+ do { /* PaX: patched PLT emulation #1 */
4643+ unsigned int sethi1, sethi2, jmpl;
4644+
4645+ err = get_user(sethi1, (unsigned int *)regs->pc);
4646+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4647+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4648+
4649+ if (err)
4650+ break;
4651+
4652+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4653+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
4654+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
4655+ {
4656+ unsigned int addr;
4657+
4658+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4659+ addr = regs->u_regs[UREG_G1];
4660+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4661+ regs->pc = addr;
4662+ regs->npc = addr+4;
4663+ return 2;
4664+ }
4665+ } while (0);
4666+
4667+ { /* PaX: patched PLT emulation #2 */
4668+ unsigned int ba;
4669+
4670+ err = get_user(ba, (unsigned int *)regs->pc);
4671+
4672+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4673+ unsigned int addr;
4674+
4675+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4676+ regs->pc = addr;
4677+ regs->npc = addr+4;
4678+ return 2;
4679+ }
4680+ }
4681+
4682+ do { /* PaX: patched PLT emulation #3 */
4683+ unsigned int sethi, jmpl, nop;
4684+
4685+ err = get_user(sethi, (unsigned int *)regs->pc);
4686+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4687+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
4688+
4689+ if (err)
4690+ break;
4691+
4692+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
4693+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4694+ nop == 0x01000000U)
4695+ {
4696+ unsigned int addr;
4697+
4698+ addr = (sethi & 0x003FFFFFU) << 10;
4699+ regs->u_regs[UREG_G1] = addr;
4700+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4701+ regs->pc = addr;
4702+ regs->npc = addr+4;
4703+ return 2;
4704+ }
4705+ } while (0);
4706+
4707+ do { /* PaX: unpatched PLT emulation step 1 */
4708+ unsigned int sethi, ba, nop;
4709+
4710+ err = get_user(sethi, (unsigned int *)regs->pc);
4711+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
4712+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
4713+
4714+ if (err)
4715+ break;
4716+
4717+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
4718+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4719+ nop == 0x01000000U)
4720+ {
4721+ unsigned int addr, save, call;
4722+
4723+ if ((ba & 0xFFC00000U) == 0x30800000U)
4724+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4725+ else
4726+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4727+
4728+ err = get_user(save, (unsigned int *)addr);
4729+ err |= get_user(call, (unsigned int *)(addr+4));
4730+ err |= get_user(nop, (unsigned int *)(addr+8));
4731+ if (err)
4732+ break;
4733+
4734+#ifdef CONFIG_PAX_DLRESOLVE
4735+ if (save == 0x9DE3BFA8U &&
4736+ (call & 0xC0000000U) == 0x40000000U &&
4737+ nop == 0x01000000U)
4738+ {
4739+ struct vm_area_struct *vma;
4740+ unsigned long call_dl_resolve;
4741+
4742+ down_read(&current->mm->mmap_sem);
4743+ call_dl_resolve = current->mm->call_dl_resolve;
4744+ up_read(&current->mm->mmap_sem);
4745+ if (likely(call_dl_resolve))
4746+ goto emulate;
4747+
4748+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4749+
4750+ down_write(&current->mm->mmap_sem);
4751+ if (current->mm->call_dl_resolve) {
4752+ call_dl_resolve = current->mm->call_dl_resolve;
4753+ up_write(&current->mm->mmap_sem);
4754+ if (vma)
4755+ kmem_cache_free(vm_area_cachep, vma);
4756+ goto emulate;
4757+ }
4758+
4759+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4760+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4761+ up_write(&current->mm->mmap_sem);
4762+ if (vma)
4763+ kmem_cache_free(vm_area_cachep, vma);
4764+ return 1;
4765+ }
4766+
4767+ if (pax_insert_vma(vma, call_dl_resolve)) {
4768+ up_write(&current->mm->mmap_sem);
4769+ kmem_cache_free(vm_area_cachep, vma);
4770+ return 1;
4771+ }
4772+
4773+ current->mm->call_dl_resolve = call_dl_resolve;
4774+ up_write(&current->mm->mmap_sem);
4775+
4776+emulate:
4777+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4778+ regs->pc = call_dl_resolve;
4779+ regs->npc = addr+4;
4780+ return 3;
4781+ }
4782+#endif
4783+
4784+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4785+ if ((save & 0xFFC00000U) == 0x05000000U &&
4786+ (call & 0xFFFFE000U) == 0x85C0A000U &&
4787+ nop == 0x01000000U)
4788+ {
4789+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4790+ regs->u_regs[UREG_G2] = addr + 4;
4791+ addr = (save & 0x003FFFFFU) << 10;
4792+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4793+ regs->pc = addr;
4794+ regs->npc = addr+4;
4795+ return 3;
4796+ }
4797+ }
4798+ } while (0);
4799+
4800+ do { /* PaX: unpatched PLT emulation step 2 */
4801+ unsigned int save, call, nop;
4802+
4803+ err = get_user(save, (unsigned int *)(regs->pc-4));
4804+ err |= get_user(call, (unsigned int *)regs->pc);
4805+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
4806+ if (err)
4807+ break;
4808+
4809+ if (save == 0x9DE3BFA8U &&
4810+ (call & 0xC0000000U) == 0x40000000U &&
4811+ nop == 0x01000000U)
4812+ {
4813+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4814+
4815+ regs->u_regs[UREG_RETPC] = regs->pc;
4816+ regs->pc = dl_resolve;
4817+ regs->npc = dl_resolve+4;
4818+ return 3;
4819+ }
4820+ } while (0);
4821+#endif
4822+
4823+ return 1;
4824+}
4825+
4826+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
4827+{
4828+ unsigned long i;
4829+
4830+ printk(KERN_ERR "PAX: bytes at PC: ");
4831+ for (i = 0; i < 8; i++) {
4832+ unsigned int c;
4833+ if (get_user(c, (unsigned int *)pc+i))
4834+ printk(KERN_CONT "???????? ");
4835+ else
4836+ printk(KERN_CONT "%08x ", c);
4837+ }
4838+ printk("\n");
4839+}
4840+#endif
4841+
4842 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
4843 int text_fault)
4844 {
4845@@ -281,6 +546,24 @@ good_area:
4846 if(!(vma->vm_flags & VM_WRITE))
4847 goto bad_area;
4848 } else {
4849+
4850+#ifdef CONFIG_PAX_PAGEEXEC
4851+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4852+ up_read(&mm->mmap_sem);
4853+ switch (pax_handle_fetch_fault(regs)) {
4854+
4855+#ifdef CONFIG_PAX_EMUPLT
4856+ case 2:
4857+ case 3:
4858+ return;
4859+#endif
4860+
4861+ }
4862+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4863+ do_group_exit(SIGKILL);
4864+ }
4865+#endif
4866+
4867 /* Allow reads even for write-only mappings */
4868 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4869 goto bad_area;
4870diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
4871index 504c062..6fcb9c6 100644
4872--- a/arch/sparc/mm/fault_64.c
4873+++ b/arch/sparc/mm/fault_64.c
4874@@ -21,6 +21,9 @@
4875 #include <linux/kprobes.h>
4876 #include <linux/kdebug.h>
4877 #include <linux/percpu.h>
4878+#include <linux/slab.h>
4879+#include <linux/pagemap.h>
4880+#include <linux/compiler.h>
4881
4882 #include <asm/page.h>
4883 #include <asm/pgtable.h>
4884@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
4885 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
4886 regs->tpc);
4887 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
4888- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
4889+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
4890 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
4891 dump_stack();
4892 unhandled_fault(regs->tpc, current, regs);
4893@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
4894 show_regs(regs);
4895 }
4896
4897+#ifdef CONFIG_PAX_PAGEEXEC
4898+#ifdef CONFIG_PAX_DLRESOLVE
4899+static void pax_emuplt_close(struct vm_area_struct *vma)
4900+{
4901+ vma->vm_mm->call_dl_resolve = 0UL;
4902+}
4903+
4904+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4905+{
4906+ unsigned int *kaddr;
4907+
4908+ vmf->page = alloc_page(GFP_HIGHUSER);
4909+ if (!vmf->page)
4910+ return VM_FAULT_OOM;
4911+
4912+ kaddr = kmap(vmf->page);
4913+ memset(kaddr, 0, PAGE_SIZE);
4914+ kaddr[0] = 0x9DE3BFA8U; /* save */
4915+ flush_dcache_page(vmf->page);
4916+ kunmap(vmf->page);
4917+ return VM_FAULT_MAJOR;
4918+}
4919+
4920+static const struct vm_operations_struct pax_vm_ops = {
4921+ .close = pax_emuplt_close,
4922+ .fault = pax_emuplt_fault
4923+};
4924+
4925+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4926+{
4927+ int ret;
4928+
4929+ INIT_LIST_HEAD(&vma->anon_vma_chain);
4930+ vma->vm_mm = current->mm;
4931+ vma->vm_start = addr;
4932+ vma->vm_end = addr + PAGE_SIZE;
4933+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4934+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4935+ vma->vm_ops = &pax_vm_ops;
4936+
4937+ ret = insert_vm_struct(current->mm, vma);
4938+ if (ret)
4939+ return ret;
4940+
4941+ ++current->mm->total_vm;
4942+ return 0;
4943+}
4944+#endif
4945+
4946+/*
4947+ * PaX: decide what to do with offenders (regs->tpc = fault address)
4948+ *
4949+ * returns 1 when task should be killed
4950+ * 2 when patched PLT trampoline was detected
4951+ * 3 when unpatched PLT trampoline was detected
4952+ */
4953+static int pax_handle_fetch_fault(struct pt_regs *regs)
4954+{
4955+
4956+#ifdef CONFIG_PAX_EMUPLT
4957+ int err;
4958+
4959+ do { /* PaX: patched PLT emulation #1 */
4960+ unsigned int sethi1, sethi2, jmpl;
4961+
4962+ err = get_user(sethi1, (unsigned int *)regs->tpc);
4963+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4964+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4965+
4966+ if (err)
4967+ break;
4968+
4969+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4970+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
4971+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
4972+ {
4973+ unsigned long addr;
4974+
4975+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4976+ addr = regs->u_regs[UREG_G1];
4977+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4978+
4979+ if (test_thread_flag(TIF_32BIT))
4980+ addr &= 0xFFFFFFFFUL;
4981+
4982+ regs->tpc = addr;
4983+ regs->tnpc = addr+4;
4984+ return 2;
4985+ }
4986+ } while (0);
4987+
4988+ { /* PaX: patched PLT emulation #2 */
4989+ unsigned int ba;
4990+
4991+ err = get_user(ba, (unsigned int *)regs->tpc);
4992+
4993+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4994+ unsigned long addr;
4995+
4996+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4997+
4998+ if (test_thread_flag(TIF_32BIT))
4999+ addr &= 0xFFFFFFFFUL;
5000+
5001+ regs->tpc = addr;
5002+ regs->tnpc = addr+4;
5003+ return 2;
5004+ }
5005+ }
5006+
5007+ do { /* PaX: patched PLT emulation #3 */
5008+ unsigned int sethi, jmpl, nop;
5009+
5010+ err = get_user(sethi, (unsigned int *)regs->tpc);
5011+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5012+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5013+
5014+ if (err)
5015+ break;
5016+
5017+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5018+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5019+ nop == 0x01000000U)
5020+ {
5021+ unsigned long addr;
5022+
5023+ addr = (sethi & 0x003FFFFFU) << 10;
5024+ regs->u_regs[UREG_G1] = addr;
5025+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5026+
5027+ if (test_thread_flag(TIF_32BIT))
5028+ addr &= 0xFFFFFFFFUL;
5029+
5030+ regs->tpc = addr;
5031+ regs->tnpc = addr+4;
5032+ return 2;
5033+ }
5034+ } while (0);
5035+
5036+ do { /* PaX: patched PLT emulation #4 */
5037+ unsigned int sethi, mov1, call, mov2;
5038+
5039+ err = get_user(sethi, (unsigned int *)regs->tpc);
5040+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5041+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
5042+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5043+
5044+ if (err)
5045+ break;
5046+
5047+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5048+ mov1 == 0x8210000FU &&
5049+ (call & 0xC0000000U) == 0x40000000U &&
5050+ mov2 == 0x9E100001U)
5051+ {
5052+ unsigned long addr;
5053+
5054+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5055+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5056+
5057+ if (test_thread_flag(TIF_32BIT))
5058+ addr &= 0xFFFFFFFFUL;
5059+
5060+ regs->tpc = addr;
5061+ regs->tnpc = addr+4;
5062+ return 2;
5063+ }
5064+ } while (0);
5065+
5066+ do { /* PaX: patched PLT emulation #5 */
5067+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5068+
5069+ err = get_user(sethi, (unsigned int *)regs->tpc);
5070+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5071+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5072+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5073+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5074+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5075+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5076+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5077+
5078+ if (err)
5079+ break;
5080+
5081+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5082+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5083+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5084+ (or1 & 0xFFFFE000U) == 0x82106000U &&
5085+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5086+ sllx == 0x83287020U &&
5087+ jmpl == 0x81C04005U &&
5088+ nop == 0x01000000U)
5089+ {
5090+ unsigned long addr;
5091+
5092+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5093+ regs->u_regs[UREG_G1] <<= 32;
5094+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5095+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5096+ regs->tpc = addr;
5097+ regs->tnpc = addr+4;
5098+ return 2;
5099+ }
5100+ } while (0);
5101+
5102+ do { /* PaX: patched PLT emulation #6 */
5103+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5104+
5105+ err = get_user(sethi, (unsigned int *)regs->tpc);
5106+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5107+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5108+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5109+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
5110+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5111+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5112+
5113+ if (err)
5114+ break;
5115+
5116+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5117+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5118+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5119+ sllx == 0x83287020U &&
5120+ (or & 0xFFFFE000U) == 0x8A116000U &&
5121+ jmpl == 0x81C04005U &&
5122+ nop == 0x01000000U)
5123+ {
5124+ unsigned long addr;
5125+
5126+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5127+ regs->u_regs[UREG_G1] <<= 32;
5128+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5129+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5130+ regs->tpc = addr;
5131+ regs->tnpc = addr+4;
5132+ return 2;
5133+ }
5134+ } while (0);
5135+
5136+ do { /* PaX: unpatched PLT emulation step 1 */
5137+ unsigned int sethi, ba, nop;
5138+
5139+ err = get_user(sethi, (unsigned int *)regs->tpc);
5140+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5141+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5142+
5143+ if (err)
5144+ break;
5145+
5146+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5147+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5148+ nop == 0x01000000U)
5149+ {
5150+ unsigned long addr;
5151+ unsigned int save, call;
5152+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5153+
5154+ if ((ba & 0xFFC00000U) == 0x30800000U)
5155+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5156+ else
5157+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5158+
5159+ if (test_thread_flag(TIF_32BIT))
5160+ addr &= 0xFFFFFFFFUL;
5161+
5162+ err = get_user(save, (unsigned int *)addr);
5163+ err |= get_user(call, (unsigned int *)(addr+4));
5164+ err |= get_user(nop, (unsigned int *)(addr+8));
5165+ if (err)
5166+ break;
5167+
5168+#ifdef CONFIG_PAX_DLRESOLVE
5169+ if (save == 0x9DE3BFA8U &&
5170+ (call & 0xC0000000U) == 0x40000000U &&
5171+ nop == 0x01000000U)
5172+ {
5173+ struct vm_area_struct *vma;
5174+ unsigned long call_dl_resolve;
5175+
5176+ down_read(&current->mm->mmap_sem);
5177+ call_dl_resolve = current->mm->call_dl_resolve;
5178+ up_read(&current->mm->mmap_sem);
5179+ if (likely(call_dl_resolve))
5180+ goto emulate;
5181+
5182+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5183+
5184+ down_write(&current->mm->mmap_sem);
5185+ if (current->mm->call_dl_resolve) {
5186+ call_dl_resolve = current->mm->call_dl_resolve;
5187+ up_write(&current->mm->mmap_sem);
5188+ if (vma)
5189+ kmem_cache_free(vm_area_cachep, vma);
5190+ goto emulate;
5191+ }
5192+
5193+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5194+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5195+ up_write(&current->mm->mmap_sem);
5196+ if (vma)
5197+ kmem_cache_free(vm_area_cachep, vma);
5198+ return 1;
5199+ }
5200+
5201+ if (pax_insert_vma(vma, call_dl_resolve)) {
5202+ up_write(&current->mm->mmap_sem);
5203+ kmem_cache_free(vm_area_cachep, vma);
5204+ return 1;
5205+ }
5206+
5207+ current->mm->call_dl_resolve = call_dl_resolve;
5208+ up_write(&current->mm->mmap_sem);
5209+
5210+emulate:
5211+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5212+ regs->tpc = call_dl_resolve;
5213+ regs->tnpc = addr+4;
5214+ return 3;
5215+ }
5216+#endif
5217+
5218+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5219+ if ((save & 0xFFC00000U) == 0x05000000U &&
5220+ (call & 0xFFFFE000U) == 0x85C0A000U &&
5221+ nop == 0x01000000U)
5222+ {
5223+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5224+ regs->u_regs[UREG_G2] = addr + 4;
5225+ addr = (save & 0x003FFFFFU) << 10;
5226+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5227+
5228+ if (test_thread_flag(TIF_32BIT))
5229+ addr &= 0xFFFFFFFFUL;
5230+
5231+ regs->tpc = addr;
5232+ regs->tnpc = addr+4;
5233+ return 3;
5234+ }
5235+
5236+ /* PaX: 64-bit PLT stub */
5237+ err = get_user(sethi1, (unsigned int *)addr);
5238+ err |= get_user(sethi2, (unsigned int *)(addr+4));
5239+ err |= get_user(or1, (unsigned int *)(addr+8));
5240+ err |= get_user(or2, (unsigned int *)(addr+12));
5241+ err |= get_user(sllx, (unsigned int *)(addr+16));
5242+ err |= get_user(add, (unsigned int *)(addr+20));
5243+ err |= get_user(jmpl, (unsigned int *)(addr+24));
5244+ err |= get_user(nop, (unsigned int *)(addr+28));
5245+ if (err)
5246+ break;
5247+
5248+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5249+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5250+ (or1 & 0xFFFFE000U) == 0x88112000U &&
5251+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5252+ sllx == 0x89293020U &&
5253+ add == 0x8A010005U &&
5254+ jmpl == 0x89C14000U &&
5255+ nop == 0x01000000U)
5256+ {
5257+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5258+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5259+ regs->u_regs[UREG_G4] <<= 32;
5260+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5261+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5262+ regs->u_regs[UREG_G4] = addr + 24;
5263+ addr = regs->u_regs[UREG_G5];
5264+ regs->tpc = addr;
5265+ regs->tnpc = addr+4;
5266+ return 3;
5267+ }
5268+ }
5269+ } while (0);
5270+
5271+#ifdef CONFIG_PAX_DLRESOLVE
5272+ do { /* PaX: unpatched PLT emulation step 2 */
5273+ unsigned int save, call, nop;
5274+
5275+ err = get_user(save, (unsigned int *)(regs->tpc-4));
5276+ err |= get_user(call, (unsigned int *)regs->tpc);
5277+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5278+ if (err)
5279+ break;
5280+
5281+ if (save == 0x9DE3BFA8U &&
5282+ (call & 0xC0000000U) == 0x40000000U &&
5283+ nop == 0x01000000U)
5284+ {
5285+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5286+
5287+ if (test_thread_flag(TIF_32BIT))
5288+ dl_resolve &= 0xFFFFFFFFUL;
5289+
5290+ regs->u_regs[UREG_RETPC] = regs->tpc;
5291+ regs->tpc = dl_resolve;
5292+ regs->tnpc = dl_resolve+4;
5293+ return 3;
5294+ }
5295+ } while (0);
5296+#endif
5297+
5298+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5299+ unsigned int sethi, ba, nop;
5300+
5301+ err = get_user(sethi, (unsigned int *)regs->tpc);
5302+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5303+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5304+
5305+ if (err)
5306+ break;
5307+
5308+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5309+ (ba & 0xFFF00000U) == 0x30600000U &&
5310+ nop == 0x01000000U)
5311+ {
5312+ unsigned long addr;
5313+
5314+ addr = (sethi & 0x003FFFFFU) << 10;
5315+ regs->u_regs[UREG_G1] = addr;
5316+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5317+
5318+ if (test_thread_flag(TIF_32BIT))
5319+ addr &= 0xFFFFFFFFUL;
5320+
5321+ regs->tpc = addr;
5322+ regs->tnpc = addr+4;
5323+ return 2;
5324+ }
5325+ } while (0);
5326+
5327+#endif
5328+
5329+ return 1;
5330+}
5331+
5332+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5333+{
5334+ unsigned long i;
5335+
5336+ printk(KERN_ERR "PAX: bytes at PC: ");
5337+ for (i = 0; i < 8; i++) {
5338+ unsigned int c;
5339+ if (get_user(c, (unsigned int *)pc+i))
5340+ printk(KERN_CONT "???????? ");
5341+ else
5342+ printk(KERN_CONT "%08x ", c);
5343+ }
5344+ printk("\n");
5345+}
5346+#endif
5347+
5348 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5349 {
5350 struct mm_struct *mm = current->mm;
5351@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5352 if (!vma)
5353 goto bad_area;
5354
5355+#ifdef CONFIG_PAX_PAGEEXEC
5356+ /* PaX: detect ITLB misses on non-exec pages */
5357+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5358+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5359+ {
5360+ if (address != regs->tpc)
5361+ goto good_area;
5362+
5363+ up_read(&mm->mmap_sem);
5364+ switch (pax_handle_fetch_fault(regs)) {
5365+
5366+#ifdef CONFIG_PAX_EMUPLT
5367+ case 2:
5368+ case 3:
5369+ return;
5370+#endif
5371+
5372+ }
5373+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
5374+ do_group_exit(SIGKILL);
5375+ }
5376+#endif
5377+
5378 /* Pure DTLB misses do not tell us whether the fault causing
5379 * load/store/atomic was a write or not, it only says that there
5380 * was no match. So in such a case we (carefully) read the
5381diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
5382index f4e9764..5682724 100644
5383--- a/arch/sparc/mm/hugetlbpage.c
5384+++ b/arch/sparc/mm/hugetlbpage.c
5385@@ -68,7 +68,7 @@ full_search:
5386 }
5387 return -ENOMEM;
5388 }
5389- if (likely(!vma || addr + len <= vma->vm_start)) {
5390+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5391 /*
5392 * Remember the place where we stopped the search:
5393 */
5394@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5395 /* make sure it can fit in the remaining address space */
5396 if (likely(addr > len)) {
5397 vma = find_vma(mm, addr-len);
5398- if (!vma || addr <= vma->vm_start) {
5399+ if (check_heap_stack_gap(vma, addr - len, len)) {
5400 /* remember the address as a hint for next time */
5401 return (mm->free_area_cache = addr-len);
5402 }
5403@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5404 if (unlikely(mm->mmap_base < len))
5405 goto bottomup;
5406
5407- addr = (mm->mmap_base-len) & HPAGE_MASK;
5408+ addr = mm->mmap_base - len;
5409
5410 do {
5411+ addr &= HPAGE_MASK;
5412 /*
5413 * Lookup failure means no vma is above this address,
5414 * else if new region fits below vma->vm_start,
5415 * return with success:
5416 */
5417 vma = find_vma(mm, addr);
5418- if (likely(!vma || addr+len <= vma->vm_start)) {
5419+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5420 /* remember the address as a hint for next time */
5421 return (mm->free_area_cache = addr);
5422 }
5423@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5424 mm->cached_hole_size = vma->vm_start - addr;
5425
5426 /* try just below the current vma->vm_start */
5427- addr = (vma->vm_start-len) & HPAGE_MASK;
5428- } while (likely(len < vma->vm_start));
5429+ addr = skip_heap_stack_gap(vma, len);
5430+ } while (!IS_ERR_VALUE(addr));
5431
5432 bottomup:
5433 /*
5434@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
5435 if (addr) {
5436 addr = ALIGN(addr, HPAGE_SIZE);
5437 vma = find_vma(mm, addr);
5438- if (task_size - len >= addr &&
5439- (!vma || addr + len <= vma->vm_start))
5440+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5441 return addr;
5442 }
5443 if (mm->get_unmapped_area == arch_get_unmapped_area)
5444diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
5445index 7b00de6..78239f4 100644
5446--- a/arch/sparc/mm/init_32.c
5447+++ b/arch/sparc/mm/init_32.c
5448@@ -316,6 +316,9 @@ extern void device_scan(void);
5449 pgprot_t PAGE_SHARED __read_mostly;
5450 EXPORT_SYMBOL(PAGE_SHARED);
5451
5452+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
5453+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
5454+
5455 void __init paging_init(void)
5456 {
5457 switch(sparc_cpu_model) {
5458@@ -344,17 +347,17 @@ void __init paging_init(void)
5459
5460 /* Initialize the protection map with non-constant, MMU dependent values. */
5461 protection_map[0] = PAGE_NONE;
5462- protection_map[1] = PAGE_READONLY;
5463- protection_map[2] = PAGE_COPY;
5464- protection_map[3] = PAGE_COPY;
5465+ protection_map[1] = PAGE_READONLY_NOEXEC;
5466+ protection_map[2] = PAGE_COPY_NOEXEC;
5467+ protection_map[3] = PAGE_COPY_NOEXEC;
5468 protection_map[4] = PAGE_READONLY;
5469 protection_map[5] = PAGE_READONLY;
5470 protection_map[6] = PAGE_COPY;
5471 protection_map[7] = PAGE_COPY;
5472 protection_map[8] = PAGE_NONE;
5473- protection_map[9] = PAGE_READONLY;
5474- protection_map[10] = PAGE_SHARED;
5475- protection_map[11] = PAGE_SHARED;
5476+ protection_map[9] = PAGE_READONLY_NOEXEC;
5477+ protection_map[10] = PAGE_SHARED_NOEXEC;
5478+ protection_map[11] = PAGE_SHARED_NOEXEC;
5479 protection_map[12] = PAGE_READONLY;
5480 protection_map[13] = PAGE_READONLY;
5481 protection_map[14] = PAGE_SHARED;
5482diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
5483index cbef74e..c38fead 100644
5484--- a/arch/sparc/mm/srmmu.c
5485+++ b/arch/sparc/mm/srmmu.c
5486@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
5487 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
5488 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
5489 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
5490+
5491+#ifdef CONFIG_PAX_PAGEEXEC
5492+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
5493+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
5494+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
5495+#endif
5496+
5497 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
5498 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
5499
5500diff --git a/arch/um/Makefile b/arch/um/Makefile
5501index c0f712c..3a5c4c9 100644
5502--- a/arch/um/Makefile
5503+++ b/arch/um/Makefile
5504@@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
5505 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
5506 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
5507
5508+ifdef CONSTIFY_PLUGIN
5509+USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5510+endif
5511+
5512 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
5513
5514 #This will adjust *FLAGS accordingly to the platform.
5515diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
5516index 6c03acd..a5e0215 100644
5517--- a/arch/um/include/asm/kmap_types.h
5518+++ b/arch/um/include/asm/kmap_types.h
5519@@ -23,6 +23,7 @@ enum km_type {
5520 KM_IRQ1,
5521 KM_SOFTIRQ0,
5522 KM_SOFTIRQ1,
5523+ KM_CLEARPAGE,
5524 KM_TYPE_NR
5525 };
5526
5527diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
5528index 4cc9b6c..02e5029 100644
5529--- a/arch/um/include/asm/page.h
5530+++ b/arch/um/include/asm/page.h
5531@@ -14,6 +14,9 @@
5532 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
5533 #define PAGE_MASK (~(PAGE_SIZE-1))
5534
5535+#define ktla_ktva(addr) (addr)
5536+#define ktva_ktla(addr) (addr)
5537+
5538 #ifndef __ASSEMBLY__
5539
5540 struct page;
5541diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
5542index 21c1ae7..4640aaa 100644
5543--- a/arch/um/kernel/process.c
5544+++ b/arch/um/kernel/process.c
5545@@ -404,22 +404,6 @@ int singlestepping(void * t)
5546 return 2;
5547 }
5548
5549-/*
5550- * Only x86 and x86_64 have an arch_align_stack().
5551- * All other arches have "#define arch_align_stack(x) (x)"
5552- * in their asm/system.h
5553- * As this is included in UML from asm-um/system-generic.h,
5554- * we can use it to behave as the subarch does.
5555- */
5556-#ifndef arch_align_stack
5557-unsigned long arch_align_stack(unsigned long sp)
5558-{
5559- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
5560- sp -= get_random_int() % 8192;
5561- return sp & ~0xf;
5562-}
5563-#endif
5564-
5565 unsigned long get_wchan(struct task_struct *p)
5566 {
5567 unsigned long stack_page, sp, ip;
5568diff --git a/arch/um/sys-i386/shared/sysdep/system.h b/arch/um/sys-i386/shared/sysdep/system.h
5569index d1b93c4..ae1b7fd 100644
5570--- a/arch/um/sys-i386/shared/sysdep/system.h
5571+++ b/arch/um/sys-i386/shared/sysdep/system.h
5572@@ -17,7 +17,7 @@
5573 # define AT_VECTOR_SIZE_ARCH 1
5574 #endif
5575
5576-extern unsigned long arch_align_stack(unsigned long sp);
5577+#define arch_align_stack(x) ((x) & ~0xfUL)
5578
5579 void default_idle(void);
5580
5581diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
5582index 70ca357..728d1cc 100644
5583--- a/arch/um/sys-i386/syscalls.c
5584+++ b/arch/um/sys-i386/syscalls.c
5585@@ -11,6 +11,21 @@
5586 #include "asm/uaccess.h"
5587 #include "asm/unistd.h"
5588
5589+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
5590+{
5591+ unsigned long pax_task_size = TASK_SIZE;
5592+
5593+#ifdef CONFIG_PAX_SEGMEXEC
5594+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
5595+ pax_task_size = SEGMEXEC_TASK_SIZE;
5596+#endif
5597+
5598+ if (len > pax_task_size || addr > pax_task_size - len)
5599+ return -EINVAL;
5600+
5601+ return 0;
5602+}
5603+
5604 /*
5605 * The prototype on i386 is:
5606 *
5607diff --git a/arch/um/sys-x86_64/shared/sysdep/system.h b/arch/um/sys-x86_64/shared/sysdep/system.h
5608index d1b93c4..ae1b7fd 100644
5609--- a/arch/um/sys-x86_64/shared/sysdep/system.h
5610+++ b/arch/um/sys-x86_64/shared/sysdep/system.h
5611@@ -17,7 +17,7 @@
5612 # define AT_VECTOR_SIZE_ARCH 1
5613 #endif
5614
5615-extern unsigned long arch_align_stack(unsigned long sp);
5616+#define arch_align_stack(x) ((x) & ~0xfUL)
5617
5618 void default_idle(void);
5619
5620diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
5621index 6a47bb2..dc9a868 100644
5622--- a/arch/x86/Kconfig
5623+++ b/arch/x86/Kconfig
5624@@ -236,7 +236,7 @@ config X86_HT
5625
5626 config X86_32_LAZY_GS
5627 def_bool y
5628- depends on X86_32 && !CC_STACKPROTECTOR
5629+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
5630
5631 config ARCH_HWEIGHT_CFLAGS
5632 string
5633@@ -1019,7 +1019,7 @@ choice
5634
5635 config NOHIGHMEM
5636 bool "off"
5637- depends on !X86_NUMAQ
5638+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5639 ---help---
5640 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
5641 However, the address space of 32-bit x86 processors is only 4
5642@@ -1056,7 +1056,7 @@ config NOHIGHMEM
5643
5644 config HIGHMEM4G
5645 bool "4GB"
5646- depends on !X86_NUMAQ
5647+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5648 ---help---
5649 Select this if you have a 32-bit processor and between 1 and 4
5650 gigabytes of physical RAM.
5651@@ -1110,7 +1110,7 @@ config PAGE_OFFSET
5652 hex
5653 default 0xB0000000 if VMSPLIT_3G_OPT
5654 default 0x80000000 if VMSPLIT_2G
5655- default 0x78000000 if VMSPLIT_2G_OPT
5656+ default 0x70000000 if VMSPLIT_2G_OPT
5657 default 0x40000000 if VMSPLIT_1G
5658 default 0xC0000000
5659 depends on X86_32
5660@@ -1484,6 +1484,7 @@ config SECCOMP
5661
5662 config CC_STACKPROTECTOR
5663 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
5664+ depends on X86_64 || !PAX_MEMORY_UDEREF
5665 ---help---
5666 This option turns on the -fstack-protector GCC feature. This
5667 feature puts, at the beginning of functions, a canary value on
5668@@ -1541,6 +1542,7 @@ config KEXEC_JUMP
5669 config PHYSICAL_START
5670 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
5671 default "0x1000000"
5672+ range 0x400000 0x40000000
5673 ---help---
5674 This gives the physical address where the kernel is loaded.
5675
5676@@ -1604,6 +1606,7 @@ config X86_NEED_RELOCS
5677 config PHYSICAL_ALIGN
5678 hex "Alignment value to which kernel should be aligned" if X86_32
5679 default "0x1000000"
5680+ range 0x400000 0x1000000 if PAX_KERNEXEC
5681 range 0x2000 0x1000000
5682 ---help---
5683 This value puts the alignment restrictions on physical address
5684@@ -1635,9 +1638,10 @@ config HOTPLUG_CPU
5685 Say N if you want to disable CPU hotplug.
5686
5687 config COMPAT_VDSO
5688- def_bool y
5689+ def_bool n
5690 prompt "Compat VDSO support"
5691 depends on X86_32 || IA32_EMULATION
5692+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
5693 ---help---
5694 Map the 32-bit VDSO to the predictable old-style address too.
5695
5696diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
5697index e3ca7e0..b30b28a 100644
5698--- a/arch/x86/Kconfig.cpu
5699+++ b/arch/x86/Kconfig.cpu
5700@@ -341,7 +341,7 @@ config X86_PPRO_FENCE
5701
5702 config X86_F00F_BUG
5703 def_bool y
5704- depends on M586MMX || M586TSC || M586 || M486 || M386
5705+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
5706
5707 config X86_INVD_BUG
5708 def_bool y
5709@@ -365,7 +365,7 @@ config X86_POPAD_OK
5710
5711 config X86_ALIGNMENT_16
5712 def_bool y
5713- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5714+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5715
5716 config X86_INTEL_USERCOPY
5717 def_bool y
5718@@ -411,7 +411,7 @@ config X86_CMPXCHG64
5719 # generates cmov.
5720 config X86_CMOV
5721 def_bool y
5722- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5723+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5724
5725 config X86_MINIMUM_CPU_FAMILY
5726 int
5727diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
5728index c0f8a5c..6404f61 100644
5729--- a/arch/x86/Kconfig.debug
5730+++ b/arch/x86/Kconfig.debug
5731@@ -81,7 +81,7 @@ config X86_PTDUMP
5732 config DEBUG_RODATA
5733 bool "Write protect kernel read-only data structures"
5734 default y
5735- depends on DEBUG_KERNEL
5736+ depends on DEBUG_KERNEL && BROKEN
5737 ---help---
5738 Mark the kernel read-only data as write-protected in the pagetables,
5739 in order to catch accidental (and incorrect) writes to such const
5740@@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST
5741
5742 config DEBUG_SET_MODULE_RONX
5743 bool "Set loadable kernel module data as NX and text as RO"
5744- depends on MODULES
5745+ depends on MODULES && BROKEN
5746 ---help---
5747 This option helps catch unintended modifications to loadable
5748 kernel module's text and read-only data. It also prevents execution
5749diff --git a/arch/x86/Makefile b/arch/x86/Makefile
5750index b02e509..2631e48 100644
5751--- a/arch/x86/Makefile
5752+++ b/arch/x86/Makefile
5753@@ -46,6 +46,7 @@ else
5754 UTS_MACHINE := x86_64
5755 CHECKFLAGS += -D__x86_64__ -m64
5756
5757+ biarch := $(call cc-option,-m64)
5758 KBUILD_AFLAGS += -m64
5759 KBUILD_CFLAGS += -m64
5760
5761@@ -195,3 +196,12 @@ define archhelp
5762 echo ' FDARGS="..." arguments for the booted kernel'
5763 echo ' FDINITRD=file initrd for the booted kernel'
5764 endef
5765+
5766+define OLD_LD
5767+
5768+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
5769+*** Please upgrade your binutils to 2.18 or newer
5770+endef
5771+
5772+archprepare:
5773+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
5774diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
5775index 95365a8..52f857b 100644
5776--- a/arch/x86/boot/Makefile
5777+++ b/arch/x86/boot/Makefile
5778@@ -63,6 +63,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
5779 $(call cc-option, -fno-stack-protector) \
5780 $(call cc-option, -mpreferred-stack-boundary=2)
5781 KBUILD_CFLAGS += $(call cc-option, -m32)
5782+ifdef CONSTIFY_PLUGIN
5783+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5784+endif
5785 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5786 GCOV_PROFILE := n
5787
5788diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
5789index 878e4b9..20537ab 100644
5790--- a/arch/x86/boot/bitops.h
5791+++ b/arch/x86/boot/bitops.h
5792@@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5793 u8 v;
5794 const u32 *p = (const u32 *)addr;
5795
5796- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5797+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5798 return v;
5799 }
5800
5801@@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5802
5803 static inline void set_bit(int nr, void *addr)
5804 {
5805- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5806+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5807 }
5808
5809 #endif /* BOOT_BITOPS_H */
5810diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
5811index c7093bd..d4247ffe0 100644
5812--- a/arch/x86/boot/boot.h
5813+++ b/arch/x86/boot/boot.h
5814@@ -85,7 +85,7 @@ static inline void io_delay(void)
5815 static inline u16 ds(void)
5816 {
5817 u16 seg;
5818- asm("movw %%ds,%0" : "=rm" (seg));
5819+ asm volatile("movw %%ds,%0" : "=rm" (seg));
5820 return seg;
5821 }
5822
5823@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t addr)
5824 static inline int memcmp(const void *s1, const void *s2, size_t len)
5825 {
5826 u8 diff;
5827- asm("repe; cmpsb; setnz %0"
5828+ asm volatile("repe; cmpsb; setnz %0"
5829 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
5830 return diff;
5831 }
5832diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
5833index 09664ef..edc5d03 100644
5834--- a/arch/x86/boot/compressed/Makefile
5835+++ b/arch/x86/boot/compressed/Makefile
5836@@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
5837 KBUILD_CFLAGS += $(cflags-y)
5838 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
5839 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
5840+ifdef CONSTIFY_PLUGIN
5841+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5842+endif
5843
5844 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5845 GCOV_PROFILE := n
5846diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
5847index 67a655a..b924059 100644
5848--- a/arch/x86/boot/compressed/head_32.S
5849+++ b/arch/x86/boot/compressed/head_32.S
5850@@ -76,7 +76,7 @@ ENTRY(startup_32)
5851 notl %eax
5852 andl %eax, %ebx
5853 #else
5854- movl $LOAD_PHYSICAL_ADDR, %ebx
5855+ movl $____LOAD_PHYSICAL_ADDR, %ebx
5856 #endif
5857
5858 /* Target address to relocate to for decompression */
5859@@ -162,7 +162,7 @@ relocated:
5860 * and where it was actually loaded.
5861 */
5862 movl %ebp, %ebx
5863- subl $LOAD_PHYSICAL_ADDR, %ebx
5864+ subl $____LOAD_PHYSICAL_ADDR, %ebx
5865 jz 2f /* Nothing to be done if loaded at compiled addr. */
5866 /*
5867 * Process relocations.
5868@@ -170,8 +170,7 @@ relocated:
5869
5870 1: subl $4, %edi
5871 movl (%edi), %ecx
5872- testl %ecx, %ecx
5873- jz 2f
5874+ jecxz 2f
5875 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5876 jmp 1b
5877 2:
5878diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
5879index 35af09d..99c9676 100644
5880--- a/arch/x86/boot/compressed/head_64.S
5881+++ b/arch/x86/boot/compressed/head_64.S
5882@@ -91,7 +91,7 @@ ENTRY(startup_32)
5883 notl %eax
5884 andl %eax, %ebx
5885 #else
5886- movl $LOAD_PHYSICAL_ADDR, %ebx
5887+ movl $____LOAD_PHYSICAL_ADDR, %ebx
5888 #endif
5889
5890 /* Target address to relocate to for decompression */
5891@@ -233,7 +233,7 @@ ENTRY(startup_64)
5892 notq %rax
5893 andq %rax, %rbp
5894 #else
5895- movq $LOAD_PHYSICAL_ADDR, %rbp
5896+ movq $____LOAD_PHYSICAL_ADDR, %rbp
5897 #endif
5898
5899 /* Target address to relocate to for decompression */
5900diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
5901index 3a19d04..7c1d55a 100644
5902--- a/arch/x86/boot/compressed/misc.c
5903+++ b/arch/x86/boot/compressed/misc.c
5904@@ -310,7 +310,7 @@ static void parse_elf(void *output)
5905 case PT_LOAD:
5906 #ifdef CONFIG_RELOCATABLE
5907 dest = output;
5908- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5909+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5910 #else
5911 dest = (void *)(phdr->p_paddr);
5912 #endif
5913@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
5914 error("Destination address too large");
5915 #endif
5916 #ifndef CONFIG_RELOCATABLE
5917- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5918+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5919 error("Wrong destination address");
5920 #endif
5921
5922diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
5923index 89bbf4e..869908e 100644
5924--- a/arch/x86/boot/compressed/relocs.c
5925+++ b/arch/x86/boot/compressed/relocs.c
5926@@ -13,8 +13,11 @@
5927
5928 static void die(char *fmt, ...);
5929
5930+#include "../../../../include/generated/autoconf.h"
5931+
5932 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5933 static Elf32_Ehdr ehdr;
5934+static Elf32_Phdr *phdr;
5935 static unsigned long reloc_count, reloc_idx;
5936 static unsigned long *relocs;
5937
5938@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5939 }
5940 }
5941
5942+static void read_phdrs(FILE *fp)
5943+{
5944+ unsigned int i;
5945+
5946+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5947+ if (!phdr) {
5948+ die("Unable to allocate %d program headers\n",
5949+ ehdr.e_phnum);
5950+ }
5951+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5952+ die("Seek to %d failed: %s\n",
5953+ ehdr.e_phoff, strerror(errno));
5954+ }
5955+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5956+ die("Cannot read ELF program headers: %s\n",
5957+ strerror(errno));
5958+ }
5959+ for(i = 0; i < ehdr.e_phnum; i++) {
5960+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
5961+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
5962+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
5963+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
5964+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
5965+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
5966+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
5967+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
5968+ }
5969+
5970+}
5971+
5972 static void read_shdrs(FILE *fp)
5973 {
5974- int i;
5975+ unsigned int i;
5976 Elf32_Shdr shdr;
5977
5978 secs = calloc(ehdr.e_shnum, sizeof(struct section));
5979@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5980
5981 static void read_strtabs(FILE *fp)
5982 {
5983- int i;
5984+ unsigned int i;
5985 for (i = 0; i < ehdr.e_shnum; i++) {
5986 struct section *sec = &secs[i];
5987 if (sec->shdr.sh_type != SHT_STRTAB) {
5988@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5989
5990 static void read_symtabs(FILE *fp)
5991 {
5992- int i,j;
5993+ unsigned int i,j;
5994 for (i = 0; i < ehdr.e_shnum; i++) {
5995 struct section *sec = &secs[i];
5996 if (sec->shdr.sh_type != SHT_SYMTAB) {
5997@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5998
5999 static void read_relocs(FILE *fp)
6000 {
6001- int i,j;
6002+ unsigned int i,j;
6003+ uint32_t base;
6004+
6005 for (i = 0; i < ehdr.e_shnum; i++) {
6006 struct section *sec = &secs[i];
6007 if (sec->shdr.sh_type != SHT_REL) {
6008@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
6009 die("Cannot read symbol table: %s\n",
6010 strerror(errno));
6011 }
6012+ base = 0;
6013+ for (j = 0; j < ehdr.e_phnum; j++) {
6014+ if (phdr[j].p_type != PT_LOAD )
6015+ continue;
6016+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6017+ continue;
6018+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6019+ break;
6020+ }
6021 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6022 Elf32_Rel *rel = &sec->reltab[j];
6023- rel->r_offset = elf32_to_cpu(rel->r_offset);
6024+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6025 rel->r_info = elf32_to_cpu(rel->r_info);
6026 }
6027 }
6028@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
6029
6030 static void print_absolute_symbols(void)
6031 {
6032- int i;
6033+ unsigned int i;
6034 printf("Absolute symbols\n");
6035 printf(" Num: Value Size Type Bind Visibility Name\n");
6036 for (i = 0; i < ehdr.e_shnum; i++) {
6037 struct section *sec = &secs[i];
6038 char *sym_strtab;
6039 Elf32_Sym *sh_symtab;
6040- int j;
6041+ unsigned int j;
6042
6043 if (sec->shdr.sh_type != SHT_SYMTAB) {
6044 continue;
6045@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
6046
6047 static void print_absolute_relocs(void)
6048 {
6049- int i, printed = 0;
6050+ unsigned int i, printed = 0;
6051
6052 for (i = 0; i < ehdr.e_shnum; i++) {
6053 struct section *sec = &secs[i];
6054 struct section *sec_applies, *sec_symtab;
6055 char *sym_strtab;
6056 Elf32_Sym *sh_symtab;
6057- int j;
6058+ unsigned int j;
6059 if (sec->shdr.sh_type != SHT_REL) {
6060 continue;
6061 }
6062@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
6063
6064 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6065 {
6066- int i;
6067+ unsigned int i;
6068 /* Walk through the relocations */
6069 for (i = 0; i < ehdr.e_shnum; i++) {
6070 char *sym_strtab;
6071 Elf32_Sym *sh_symtab;
6072 struct section *sec_applies, *sec_symtab;
6073- int j;
6074+ unsigned int j;
6075 struct section *sec = &secs[i];
6076
6077 if (sec->shdr.sh_type != SHT_REL) {
6078@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6079 !is_rel_reloc(sym_name(sym_strtab, sym))) {
6080 continue;
6081 }
6082+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6083+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6084+ continue;
6085+
6086+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6087+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6088+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6089+ continue;
6090+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6091+ continue;
6092+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6093+ continue;
6094+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6095+ continue;
6096+#endif
6097+
6098 switch (r_type) {
6099 case R_386_NONE:
6100 case R_386_PC32:
6101@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, const void *vb)
6102
6103 static void emit_relocs(int as_text)
6104 {
6105- int i;
6106+ unsigned int i;
6107 /* Count how many relocations I have and allocate space for them. */
6108 reloc_count = 0;
6109 walk_relocs(count_reloc);
6110@@ -665,6 +725,7 @@ int main(int argc, char **argv)
6111 fname, strerror(errno));
6112 }
6113 read_ehdr(fp);
6114+ read_phdrs(fp);
6115 read_shdrs(fp);
6116 read_strtabs(fp);
6117 read_symtabs(fp);
6118diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
6119index 4d3ff03..e4972ff 100644
6120--- a/arch/x86/boot/cpucheck.c
6121+++ b/arch/x86/boot/cpucheck.c
6122@@ -74,7 +74,7 @@ static int has_fpu(void)
6123 u16 fcw = -1, fsw = -1;
6124 u32 cr0;
6125
6126- asm("movl %%cr0,%0" : "=r" (cr0));
6127+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
6128 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6129 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6130 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6131@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6132 {
6133 u32 f0, f1;
6134
6135- asm("pushfl ; "
6136+ asm volatile("pushfl ; "
6137 "pushfl ; "
6138 "popl %0 ; "
6139 "movl %0,%1 ; "
6140@@ -115,7 +115,7 @@ static void get_flags(void)
6141 set_bit(X86_FEATURE_FPU, cpu.flags);
6142
6143 if (has_eflag(X86_EFLAGS_ID)) {
6144- asm("cpuid"
6145+ asm volatile("cpuid"
6146 : "=a" (max_intel_level),
6147 "=b" (cpu_vendor[0]),
6148 "=d" (cpu_vendor[1]),
6149@@ -124,7 +124,7 @@ static void get_flags(void)
6150
6151 if (max_intel_level >= 0x00000001 &&
6152 max_intel_level <= 0x0000ffff) {
6153- asm("cpuid"
6154+ asm volatile("cpuid"
6155 : "=a" (tfms),
6156 "=c" (cpu.flags[4]),
6157 "=d" (cpu.flags[0])
6158@@ -136,7 +136,7 @@ static void get_flags(void)
6159 cpu.model += ((tfms >> 16) & 0xf) << 4;
6160 }
6161
6162- asm("cpuid"
6163+ asm volatile("cpuid"
6164 : "=a" (max_amd_level)
6165 : "a" (0x80000000)
6166 : "ebx", "ecx", "edx");
6167@@ -144,7 +144,7 @@ static void get_flags(void)
6168 if (max_amd_level >= 0x80000001 &&
6169 max_amd_level <= 0x8000ffff) {
6170 u32 eax = 0x80000001;
6171- asm("cpuid"
6172+ asm volatile("cpuid"
6173 : "+a" (eax),
6174 "=c" (cpu.flags[6]),
6175 "=d" (cpu.flags[1])
6176@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6177 u32 ecx = MSR_K7_HWCR;
6178 u32 eax, edx;
6179
6180- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6181+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6182 eax &= ~(1 << 15);
6183- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6184+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6185
6186 get_flags(); /* Make sure it really did something */
6187 err = check_flags();
6188@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6189 u32 ecx = MSR_VIA_FCR;
6190 u32 eax, edx;
6191
6192- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6193+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6194 eax |= (1<<1)|(1<<7);
6195- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6196+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6197
6198 set_bit(X86_FEATURE_CX8, cpu.flags);
6199 err = check_flags();
6200@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6201 u32 eax, edx;
6202 u32 level = 1;
6203
6204- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6205- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6206- asm("cpuid"
6207+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6208+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6209+ asm volatile("cpuid"
6210 : "+a" (level), "=d" (cpu.flags[0])
6211 : : "ecx", "ebx");
6212- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6213+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6214
6215 err = check_flags();
6216 }
6217diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
6218index 93e689f..504ba09 100644
6219--- a/arch/x86/boot/header.S
6220+++ b/arch/x86/boot/header.S
6221@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical pointer to
6222 # single linked list of
6223 # struct setup_data
6224
6225-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6226+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6227
6228 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6229 #define VO_INIT_SIZE (VO__end - VO__text)
6230diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
6231index db75d07..8e6d0af 100644
6232--- a/arch/x86/boot/memory.c
6233+++ b/arch/x86/boot/memory.c
6234@@ -19,7 +19,7 @@
6235
6236 static int detect_memory_e820(void)
6237 {
6238- int count = 0;
6239+ unsigned int count = 0;
6240 struct biosregs ireg, oreg;
6241 struct e820entry *desc = boot_params.e820_map;
6242 static struct e820entry buf; /* static so it is zeroed */
6243diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
6244index 11e8c6e..fdbb1ed 100644
6245--- a/arch/x86/boot/video-vesa.c
6246+++ b/arch/x86/boot/video-vesa.c
6247@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6248
6249 boot_params.screen_info.vesapm_seg = oreg.es;
6250 boot_params.screen_info.vesapm_off = oreg.di;
6251+ boot_params.screen_info.vesapm_size = oreg.cx;
6252 }
6253
6254 /*
6255diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
6256index 43eda28..5ab5fdb 100644
6257--- a/arch/x86/boot/video.c
6258+++ b/arch/x86/boot/video.c
6259@@ -96,7 +96,7 @@ static void store_mode_params(void)
6260 static unsigned int get_entry(void)
6261 {
6262 char entry_buf[4];
6263- int i, len = 0;
6264+ unsigned int i, len = 0;
6265 int key;
6266 unsigned int v;
6267
6268diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
6269index 5b577d5..3c1fed4 100644
6270--- a/arch/x86/crypto/aes-x86_64-asm_64.S
6271+++ b/arch/x86/crypto/aes-x86_64-asm_64.S
6272@@ -8,6 +8,8 @@
6273 * including this sentence is retained in full.
6274 */
6275
6276+#include <asm/alternative-asm.h>
6277+
6278 .extern crypto_ft_tab
6279 .extern crypto_it_tab
6280 .extern crypto_fl_tab
6281@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
6282 je B192; \
6283 leaq 32(r9),r9;
6284
6285+#define ret pax_force_retaddr 0, 1; ret
6286+
6287 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
6288 movq r1,r2; \
6289 movq r3,r4; \
6290diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
6291index be6d9e3..21fbbca 100644
6292--- a/arch/x86/crypto/aesni-intel_asm.S
6293+++ b/arch/x86/crypto/aesni-intel_asm.S
6294@@ -31,6 +31,7 @@
6295
6296 #include <linux/linkage.h>
6297 #include <asm/inst.h>
6298+#include <asm/alternative-asm.h>
6299
6300 #ifdef __x86_64__
6301 .data
6302@@ -1436,7 +1437,9 @@ _return_T_done_decrypt:
6303 pop %r14
6304 pop %r13
6305 pop %r12
6306+ pax_force_retaddr 0, 1
6307 ret
6308+ENDPROC(aesni_gcm_dec)
6309
6310
6311 /*****************************************************************************
6312@@ -1699,7 +1702,9 @@ _return_T_done_encrypt:
6313 pop %r14
6314 pop %r13
6315 pop %r12
6316+ pax_force_retaddr 0, 1
6317 ret
6318+ENDPROC(aesni_gcm_enc)
6319
6320 #endif
6321
6322@@ -1714,6 +1719,7 @@ _key_expansion_256a:
6323 pxor %xmm1, %xmm0
6324 movaps %xmm0, (TKEYP)
6325 add $0x10, TKEYP
6326+ pax_force_retaddr_bts
6327 ret
6328
6329 .align 4
6330@@ -1738,6 +1744,7 @@ _key_expansion_192a:
6331 shufps $0b01001110, %xmm2, %xmm1
6332 movaps %xmm1, 0x10(TKEYP)
6333 add $0x20, TKEYP
6334+ pax_force_retaddr_bts
6335 ret
6336
6337 .align 4
6338@@ -1757,6 +1764,7 @@ _key_expansion_192b:
6339
6340 movaps %xmm0, (TKEYP)
6341 add $0x10, TKEYP
6342+ pax_force_retaddr_bts
6343 ret
6344
6345 .align 4
6346@@ -1769,6 +1777,7 @@ _key_expansion_256b:
6347 pxor %xmm1, %xmm2
6348 movaps %xmm2, (TKEYP)
6349 add $0x10, TKEYP
6350+ pax_force_retaddr_bts
6351 ret
6352
6353 /*
6354@@ -1881,7 +1890,9 @@ ENTRY(aesni_set_key)
6355 #ifndef __x86_64__
6356 popl KEYP
6357 #endif
6358+ pax_force_retaddr 0, 1
6359 ret
6360+ENDPROC(aesni_set_key)
6361
6362 /*
6363 * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
6364@@ -1902,7 +1913,9 @@ ENTRY(aesni_enc)
6365 popl KLEN
6366 popl KEYP
6367 #endif
6368+ pax_force_retaddr 0, 1
6369 ret
6370+ENDPROC(aesni_enc)
6371
6372 /*
6373 * _aesni_enc1: internal ABI
6374@@ -1959,6 +1972,7 @@ _aesni_enc1:
6375 AESENC KEY STATE
6376 movaps 0x70(TKEYP), KEY
6377 AESENCLAST KEY STATE
6378+ pax_force_retaddr_bts
6379 ret
6380
6381 /*
6382@@ -2067,6 +2081,7 @@ _aesni_enc4:
6383 AESENCLAST KEY STATE2
6384 AESENCLAST KEY STATE3
6385 AESENCLAST KEY STATE4
6386+ pax_force_retaddr_bts
6387 ret
6388
6389 /*
6390@@ -2089,7 +2104,9 @@ ENTRY(aesni_dec)
6391 popl KLEN
6392 popl KEYP
6393 #endif
6394+ pax_force_retaddr 0, 1
6395 ret
6396+ENDPROC(aesni_dec)
6397
6398 /*
6399 * _aesni_dec1: internal ABI
6400@@ -2146,6 +2163,7 @@ _aesni_dec1:
6401 AESDEC KEY STATE
6402 movaps 0x70(TKEYP), KEY
6403 AESDECLAST KEY STATE
6404+ pax_force_retaddr_bts
6405 ret
6406
6407 /*
6408@@ -2254,6 +2272,7 @@ _aesni_dec4:
6409 AESDECLAST KEY STATE2
6410 AESDECLAST KEY STATE3
6411 AESDECLAST KEY STATE4
6412+ pax_force_retaddr_bts
6413 ret
6414
6415 /*
6416@@ -2311,7 +2330,9 @@ ENTRY(aesni_ecb_enc)
6417 popl KEYP
6418 popl LEN
6419 #endif
6420+ pax_force_retaddr 0, 1
6421 ret
6422+ENDPROC(aesni_ecb_enc)
6423
6424 /*
6425 * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6426@@ -2369,7 +2390,9 @@ ENTRY(aesni_ecb_dec)
6427 popl KEYP
6428 popl LEN
6429 #endif
6430+ pax_force_retaddr 0, 1
6431 ret
6432+ENDPROC(aesni_ecb_dec)
6433
6434 /*
6435 * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6436@@ -2410,7 +2433,9 @@ ENTRY(aesni_cbc_enc)
6437 popl LEN
6438 popl IVP
6439 #endif
6440+ pax_force_retaddr 0, 1
6441 ret
6442+ENDPROC(aesni_cbc_enc)
6443
6444 /*
6445 * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6446@@ -2498,7 +2523,9 @@ ENTRY(aesni_cbc_dec)
6447 popl LEN
6448 popl IVP
6449 #endif
6450+ pax_force_retaddr 0, 1
6451 ret
6452+ENDPROC(aesni_cbc_dec)
6453
6454 #ifdef __x86_64__
6455 .align 16
6456@@ -2524,6 +2551,7 @@ _aesni_inc_init:
6457 mov $1, TCTR_LOW
6458 MOVQ_R64_XMM TCTR_LOW INC
6459 MOVQ_R64_XMM CTR TCTR_LOW
6460+ pax_force_retaddr_bts
6461 ret
6462
6463 /*
6464@@ -2552,6 +2580,7 @@ _aesni_inc:
6465 .Linc_low:
6466 movaps CTR, IV
6467 PSHUFB_XMM BSWAP_MASK IV
6468+ pax_force_retaddr_bts
6469 ret
6470
6471 /*
6472@@ -2612,5 +2641,7 @@ ENTRY(aesni_ctr_enc)
6473 .Lctr_enc_ret:
6474 movups IV, (IVP)
6475 .Lctr_enc_just_ret:
6476+ pax_force_retaddr 0, 1
6477 ret
6478+ENDPROC(aesni_ctr_enc)
6479 #endif
6480diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6481index 6214a9b..1f4fc9a 100644
6482--- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
6483+++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6484@@ -1,3 +1,5 @@
6485+#include <asm/alternative-asm.h>
6486+
6487 # enter ECRYPT_encrypt_bytes
6488 .text
6489 .p2align 5
6490@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
6491 add %r11,%rsp
6492 mov %rdi,%rax
6493 mov %rsi,%rdx
6494+ pax_force_retaddr 0, 1
6495 ret
6496 # bytesatleast65:
6497 ._bytesatleast65:
6498@@ -891,6 +894,7 @@ ECRYPT_keysetup:
6499 add %r11,%rsp
6500 mov %rdi,%rax
6501 mov %rsi,%rdx
6502+ pax_force_retaddr
6503 ret
6504 # enter ECRYPT_ivsetup
6505 .text
6506@@ -917,4 +921,5 @@ ECRYPT_ivsetup:
6507 add %r11,%rsp
6508 mov %rdi,%rax
6509 mov %rsi,%rdx
6510+ pax_force_retaddr
6511 ret
6512diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
6513index 573aa10..b73ad89 100644
6514--- a/arch/x86/crypto/twofish-x86_64-asm_64.S
6515+++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
6516@@ -21,6 +21,7 @@
6517 .text
6518
6519 #include <asm/asm-offsets.h>
6520+#include <asm/alternative-asm.h>
6521
6522 #define a_offset 0
6523 #define b_offset 4
6524@@ -269,6 +270,7 @@ twofish_enc_blk:
6525
6526 popq R1
6527 movq $1,%rax
6528+ pax_force_retaddr 0, 1
6529 ret
6530
6531 twofish_dec_blk:
6532@@ -321,4 +323,5 @@ twofish_dec_blk:
6533
6534 popq R1
6535 movq $1,%rax
6536+ pax_force_retaddr 0, 1
6537 ret
6538diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
6539index fd84387..0b4af7d 100644
6540--- a/arch/x86/ia32/ia32_aout.c
6541+++ b/arch/x86/ia32/ia32_aout.c
6542@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
6543 unsigned long dump_start, dump_size;
6544 struct user32 dump;
6545
6546+ memset(&dump, 0, sizeof(dump));
6547+
6548 fs = get_fs();
6549 set_fs(KERNEL_DS);
6550 has_dumped = 1;
6551diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
6552index 6557769..ef6ae89 100644
6553--- a/arch/x86/ia32/ia32_signal.c
6554+++ b/arch/x86/ia32/ia32_signal.c
6555@@ -169,7 +169,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
6556 }
6557 seg = get_fs();
6558 set_fs(KERNEL_DS);
6559- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
6560+ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
6561 set_fs(seg);
6562 if (ret >= 0 && uoss_ptr) {
6563 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
6564@@ -370,7 +370,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
6565 */
6566 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6567 size_t frame_size,
6568- void **fpstate)
6569+ void __user **fpstate)
6570 {
6571 unsigned long sp;
6572
6573@@ -391,7 +391,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6574
6575 if (used_math()) {
6576 sp = sp - sig_xstate_ia32_size;
6577- *fpstate = (struct _fpstate_ia32 *) sp;
6578+ *fpstate = (struct _fpstate_ia32 __user *) sp;
6579 if (save_i387_xstate_ia32(*fpstate) < 0)
6580 return (void __user *) -1L;
6581 }
6582@@ -399,7 +399,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6583 sp -= frame_size;
6584 /* Align the stack pointer according to the i386 ABI,
6585 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
6586- sp = ((sp + 4) & -16ul) - 4;
6587+ sp = ((sp - 12) & -16ul) - 4;
6588 return (void __user *) sp;
6589 }
6590
6591@@ -457,7 +457,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
6592 * These are actually not used anymore, but left because some
6593 * gdb versions depend on them as a marker.
6594 */
6595- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6596+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6597 } put_user_catch(err);
6598
6599 if (err)
6600@@ -499,7 +499,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6601 0xb8,
6602 __NR_ia32_rt_sigreturn,
6603 0x80cd,
6604- 0,
6605+ 0
6606 };
6607
6608 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
6609@@ -529,16 +529,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6610
6611 if (ka->sa.sa_flags & SA_RESTORER)
6612 restorer = ka->sa.sa_restorer;
6613+ else if (current->mm->context.vdso)
6614+ /* Return stub is in 32bit vsyscall page */
6615+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
6616 else
6617- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
6618- rt_sigreturn);
6619+ restorer = &frame->retcode;
6620 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
6621
6622 /*
6623 * Not actually used anymore, but left because some gdb
6624 * versions need it.
6625 */
6626- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6627+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6628 } put_user_catch(err);
6629
6630 if (err)
6631diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
6632index 54edb207..9335b5f 100644
6633--- a/arch/x86/ia32/ia32entry.S
6634+++ b/arch/x86/ia32/ia32entry.S
6635@@ -13,7 +13,9 @@
6636 #include <asm/thread_info.h>
6637 #include <asm/segment.h>
6638 #include <asm/irqflags.h>
6639+#include <asm/pgtable.h>
6640 #include <linux/linkage.h>
6641+#include <asm/alternative-asm.h>
6642
6643 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6644 #include <linux/elf-em.h>
6645@@ -95,6 +97,30 @@ ENTRY(native_irq_enable_sysexit)
6646 ENDPROC(native_irq_enable_sysexit)
6647 #endif
6648
6649+ .macro pax_enter_kernel_user
6650+ pax_set_fptr_mask
6651+#ifdef CONFIG_PAX_MEMORY_UDEREF
6652+ call pax_enter_kernel_user
6653+#endif
6654+ .endm
6655+
6656+ .macro pax_exit_kernel_user
6657+#ifdef CONFIG_PAX_MEMORY_UDEREF
6658+ call pax_exit_kernel_user
6659+#endif
6660+#ifdef CONFIG_PAX_RANDKSTACK
6661+ pushq %rax
6662+ call pax_randomize_kstack
6663+ popq %rax
6664+#endif
6665+ .endm
6666+
6667+.macro pax_erase_kstack
6668+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6669+ call pax_erase_kstack
6670+#endif
6671+.endm
6672+
6673 /*
6674 * 32bit SYSENTER instruction entry.
6675 *
6676@@ -121,12 +147,6 @@ ENTRY(ia32_sysenter_target)
6677 CFI_REGISTER rsp,rbp
6678 SWAPGS_UNSAFE_STACK
6679 movq PER_CPU_VAR(kernel_stack), %rsp
6680- addq $(KERNEL_STACK_OFFSET),%rsp
6681- /*
6682- * No need to follow this irqs on/off section: the syscall
6683- * disabled irqs, here we enable it straight after entry:
6684- */
6685- ENABLE_INTERRUPTS(CLBR_NONE)
6686 movl %ebp,%ebp /* zero extension */
6687 pushq_cfi $__USER32_DS
6688 /*CFI_REL_OFFSET ss,0*/
6689@@ -134,25 +154,38 @@ ENTRY(ia32_sysenter_target)
6690 CFI_REL_OFFSET rsp,0
6691 pushfq_cfi
6692 /*CFI_REL_OFFSET rflags,0*/
6693- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6694- CFI_REGISTER rip,r10
6695+ GET_THREAD_INFO(%r11)
6696+ movl TI_sysenter_return(%r11), %r11d
6697+ CFI_REGISTER rip,r11
6698 pushq_cfi $__USER32_CS
6699 /*CFI_REL_OFFSET cs,0*/
6700 movl %eax, %eax
6701- pushq_cfi %r10
6702+ pushq_cfi %r11
6703 CFI_REL_OFFSET rip,0
6704 pushq_cfi %rax
6705 cld
6706 SAVE_ARGS 0,1,0
6707+ pax_enter_kernel_user
6708+ /*
6709+ * No need to follow this irqs on/off section: the syscall
6710+ * disabled irqs, here we enable it straight after entry:
6711+ */
6712+ ENABLE_INTERRUPTS(CLBR_NONE)
6713 /* no need to do an access_ok check here because rbp has been
6714 32bit zero extended */
6715+
6716+#ifdef CONFIG_PAX_MEMORY_UDEREF
6717+ mov $PAX_USER_SHADOW_BASE,%r11
6718+ add %r11,%rbp
6719+#endif
6720+
6721 1: movl (%rbp),%ebp
6722 .section __ex_table,"a"
6723 .quad 1b,ia32_badarg
6724 .previous
6725- GET_THREAD_INFO(%r10)
6726- orl $TS_COMPAT,TI_status(%r10)
6727- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6728+ GET_THREAD_INFO(%r11)
6729+ orl $TS_COMPAT,TI_status(%r11)
6730+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6731 CFI_REMEMBER_STATE
6732 jnz sysenter_tracesys
6733 cmpq $(IA32_NR_syscalls-1),%rax
6734@@ -162,13 +195,15 @@ sysenter_do_call:
6735 sysenter_dispatch:
6736 call *ia32_sys_call_table(,%rax,8)
6737 movq %rax,RAX-ARGOFFSET(%rsp)
6738- GET_THREAD_INFO(%r10)
6739+ GET_THREAD_INFO(%r11)
6740 DISABLE_INTERRUPTS(CLBR_NONE)
6741 TRACE_IRQS_OFF
6742- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6743+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6744 jnz sysexit_audit
6745 sysexit_from_sys_call:
6746- andl $~TS_COMPAT,TI_status(%r10)
6747+ pax_exit_kernel_user
6748+ pax_erase_kstack
6749+ andl $~TS_COMPAT,TI_status(%r11)
6750 /* clear IF, that popfq doesn't enable interrupts early */
6751 andl $~0x200,EFLAGS-R11(%rsp)
6752 movl RIP-R11(%rsp),%edx /* User %eip */
6753@@ -194,6 +229,9 @@ sysexit_from_sys_call:
6754 movl %eax,%esi /* 2nd arg: syscall number */
6755 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6756 call audit_syscall_entry
6757+
6758+ pax_erase_kstack
6759+
6760 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6761 cmpq $(IA32_NR_syscalls-1),%rax
6762 ja ia32_badsys
6763@@ -205,7 +243,7 @@ sysexit_from_sys_call:
6764 .endm
6765
6766 .macro auditsys_exit exit
6767- testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6768+ testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6769 jnz ia32_ret_from_sys_call
6770 TRACE_IRQS_ON
6771 sti
6772@@ -215,12 +253,12 @@ sysexit_from_sys_call:
6773 movzbl %al,%edi /* zero-extend that into %edi */
6774 inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
6775 call audit_syscall_exit
6776- GET_THREAD_INFO(%r10)
6777+ GET_THREAD_INFO(%r11)
6778 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
6779 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
6780 cli
6781 TRACE_IRQS_OFF
6782- testl %edi,TI_flags(%r10)
6783+ testl %edi,TI_flags(%r11)
6784 jz \exit
6785 CLEAR_RREGS -ARGOFFSET
6786 jmp int_with_check
6787@@ -238,7 +276,7 @@ sysexit_audit:
6788
6789 sysenter_tracesys:
6790 #ifdef CONFIG_AUDITSYSCALL
6791- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6792+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6793 jz sysenter_auditsys
6794 #endif
6795 SAVE_REST
6796@@ -246,6 +284,9 @@ sysenter_tracesys:
6797 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6798 movq %rsp,%rdi /* &pt_regs -> arg1 */
6799 call syscall_trace_enter
6800+
6801+ pax_erase_kstack
6802+
6803 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6804 RESTORE_REST
6805 cmpq $(IA32_NR_syscalls-1),%rax
6806@@ -277,19 +318,20 @@ ENDPROC(ia32_sysenter_target)
6807 ENTRY(ia32_cstar_target)
6808 CFI_STARTPROC32 simple
6809 CFI_SIGNAL_FRAME
6810- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6811+ CFI_DEF_CFA rsp,0
6812 CFI_REGISTER rip,rcx
6813 /*CFI_REGISTER rflags,r11*/
6814 SWAPGS_UNSAFE_STACK
6815 movl %esp,%r8d
6816 CFI_REGISTER rsp,r8
6817 movq PER_CPU_VAR(kernel_stack),%rsp
6818+ SAVE_ARGS 8*6,0,0
6819+ pax_enter_kernel_user
6820 /*
6821 * No need to follow this irqs on/off section: the syscall
6822 * disabled irqs and here we enable it straight after entry:
6823 */
6824 ENABLE_INTERRUPTS(CLBR_NONE)
6825- SAVE_ARGS 8,0,0
6826 movl %eax,%eax /* zero extension */
6827 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
6828 movq %rcx,RIP-ARGOFFSET(%rsp)
6829@@ -305,13 +347,19 @@ ENTRY(ia32_cstar_target)
6830 /* no need to do an access_ok check here because r8 has been
6831 32bit zero extended */
6832 /* hardware stack frame is complete now */
6833+
6834+#ifdef CONFIG_PAX_MEMORY_UDEREF
6835+ mov $PAX_USER_SHADOW_BASE,%r11
6836+ add %r11,%r8
6837+#endif
6838+
6839 1: movl (%r8),%r9d
6840 .section __ex_table,"a"
6841 .quad 1b,ia32_badarg
6842 .previous
6843- GET_THREAD_INFO(%r10)
6844- orl $TS_COMPAT,TI_status(%r10)
6845- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6846+ GET_THREAD_INFO(%r11)
6847+ orl $TS_COMPAT,TI_status(%r11)
6848+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6849 CFI_REMEMBER_STATE
6850 jnz cstar_tracesys
6851 cmpq $IA32_NR_syscalls-1,%rax
6852@@ -321,13 +369,15 @@ cstar_do_call:
6853 cstar_dispatch:
6854 call *ia32_sys_call_table(,%rax,8)
6855 movq %rax,RAX-ARGOFFSET(%rsp)
6856- GET_THREAD_INFO(%r10)
6857+ GET_THREAD_INFO(%r11)
6858 DISABLE_INTERRUPTS(CLBR_NONE)
6859 TRACE_IRQS_OFF
6860- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6861+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6862 jnz sysretl_audit
6863 sysretl_from_sys_call:
6864- andl $~TS_COMPAT,TI_status(%r10)
6865+ pax_exit_kernel_user
6866+ pax_erase_kstack
6867+ andl $~TS_COMPAT,TI_status(%r11)
6868 RESTORE_ARGS 0,-ARG_SKIP,0,0,0
6869 movl RIP-ARGOFFSET(%rsp),%ecx
6870 CFI_REGISTER rip,rcx
6871@@ -355,7 +405,7 @@ sysretl_audit:
6872
6873 cstar_tracesys:
6874 #ifdef CONFIG_AUDITSYSCALL
6875- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6876+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6877 jz cstar_auditsys
6878 #endif
6879 xchgl %r9d,%ebp
6880@@ -364,6 +414,9 @@ cstar_tracesys:
6881 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6882 movq %rsp,%rdi /* &pt_regs -> arg1 */
6883 call syscall_trace_enter
6884+
6885+ pax_erase_kstack
6886+
6887 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
6888 RESTORE_REST
6889 xchgl %ebp,%r9d
6890@@ -409,20 +462,21 @@ ENTRY(ia32_syscall)
6891 CFI_REL_OFFSET rip,RIP-RIP
6892 PARAVIRT_ADJUST_EXCEPTION_FRAME
6893 SWAPGS
6894- /*
6895- * No need to follow this irqs on/off section: the syscall
6896- * disabled irqs and here we enable it straight after entry:
6897- */
6898- ENABLE_INTERRUPTS(CLBR_NONE)
6899 movl %eax,%eax
6900 pushq_cfi %rax
6901 cld
6902 /* note the registers are not zero extended to the sf.
6903 this could be a problem. */
6904 SAVE_ARGS 0,1,0
6905- GET_THREAD_INFO(%r10)
6906- orl $TS_COMPAT,TI_status(%r10)
6907- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6908+ pax_enter_kernel_user
6909+ /*
6910+ * No need to follow this irqs on/off section: the syscall
6911+ * disabled irqs and here we enable it straight after entry:
6912+ */
6913+ ENABLE_INTERRUPTS(CLBR_NONE)
6914+ GET_THREAD_INFO(%r11)
6915+ orl $TS_COMPAT,TI_status(%r11)
6916+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6917 jnz ia32_tracesys
6918 cmpq $(IA32_NR_syscalls-1),%rax
6919 ja ia32_badsys
6920@@ -441,6 +495,9 @@ ia32_tracesys:
6921 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6922 movq %rsp,%rdi /* &pt_regs -> arg1 */
6923 call syscall_trace_enter
6924+
6925+ pax_erase_kstack
6926+
6927 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6928 RESTORE_REST
6929 cmpq $(IA32_NR_syscalls-1),%rax
6930@@ -455,6 +512,7 @@ ia32_badsys:
6931
6932 quiet_ni_syscall:
6933 movq $-ENOSYS,%rax
6934+ pax_force_retaddr
6935 ret
6936 CFI_ENDPROC
6937
6938diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
6939index f6f5c53..b358b28 100644
6940--- a/arch/x86/ia32/sys_ia32.c
6941+++ b/arch/x86/ia32/sys_ia32.c
6942@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
6943 */
6944 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
6945 {
6946- typeof(ubuf->st_uid) uid = 0;
6947- typeof(ubuf->st_gid) gid = 0;
6948+ typeof(((struct stat64 *)0)->st_uid) uid = 0;
6949+ typeof(((struct stat64 *)0)->st_gid) gid = 0;
6950 SET_UID(uid, stat->uid);
6951 SET_GID(gid, stat->gid);
6952 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
6953@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
6954 }
6955 set_fs(KERNEL_DS);
6956 ret = sys_rt_sigprocmask(how,
6957- set ? (sigset_t __user *)&s : NULL,
6958- oset ? (sigset_t __user *)&s : NULL,
6959+ set ? (sigset_t __force_user *)&s : NULL,
6960+ oset ? (sigset_t __force_user *)&s : NULL,
6961 sigsetsize);
6962 set_fs(old_fs);
6963 if (ret)
6964@@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int seconds)
6965 return alarm_setitimer(seconds);
6966 }
6967
6968-asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
6969+asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
6970 int options)
6971 {
6972 return compat_sys_wait4(pid, stat_addr, options, NULL);
6973@@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
6974 mm_segment_t old_fs = get_fs();
6975
6976 set_fs(KERNEL_DS);
6977- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
6978+ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
6979 set_fs(old_fs);
6980 if (put_compat_timespec(&t, interval))
6981 return -EFAULT;
6982@@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
6983 mm_segment_t old_fs = get_fs();
6984
6985 set_fs(KERNEL_DS);
6986- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
6987+ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
6988 set_fs(old_fs);
6989 if (!ret) {
6990 switch (_NSIG_WORDS) {
6991@@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
6992 if (copy_siginfo_from_user32(&info, uinfo))
6993 return -EFAULT;
6994 set_fs(KERNEL_DS);
6995- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
6996+ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
6997 set_fs(old_fs);
6998 return ret;
6999 }
7000@@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
7001 return -EFAULT;
7002
7003 set_fs(KERNEL_DS);
7004- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
7005+ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
7006 count);
7007 set_fs(old_fs);
7008
7009diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
7010index 091508b..0ee32ec 100644
7011--- a/arch/x86/include/asm/alternative-asm.h
7012+++ b/arch/x86/include/asm/alternative-asm.h
7013@@ -15,6 +15,45 @@
7014 .endm
7015 #endif
7016
7017+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
7018+ .macro pax_force_retaddr_bts rip=0
7019+ btsq $63,\rip(%rsp)
7020+ .endm
7021+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
7022+ .macro pax_force_retaddr rip=0, reload=0
7023+ btsq $63,\rip(%rsp)
7024+ .endm
7025+ .macro pax_force_fptr ptr
7026+ btsq $63,\ptr
7027+ .endm
7028+ .macro pax_set_fptr_mask
7029+ .endm
7030+#endif
7031+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
7032+ .macro pax_force_retaddr rip=0, reload=0
7033+ .if \reload
7034+ pax_set_fptr_mask
7035+ .endif
7036+ orq %r10,\rip(%rsp)
7037+ .endm
7038+ .macro pax_force_fptr ptr
7039+ orq %r10,\ptr
7040+ .endm
7041+ .macro pax_set_fptr_mask
7042+ movabs $0x8000000000000000,%r10
7043+ .endm
7044+#endif
7045+#else
7046+ .macro pax_force_retaddr rip=0, reload=0
7047+ .endm
7048+ .macro pax_force_fptr ptr
7049+ .endm
7050+ .macro pax_force_retaddr_bts rip=0
7051+ .endm
7052+ .macro pax_set_fptr_mask
7053+ .endm
7054+#endif
7055+
7056 .macro altinstruction_entry orig alt feature orig_len alt_len
7057 .long \orig - .
7058 .long \alt - .
7059diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
7060index 37ad100..7d47faa 100644
7061--- a/arch/x86/include/asm/alternative.h
7062+++ b/arch/x86/include/asm/alternative.h
7063@@ -89,7 +89,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
7064 ".section .discard,\"aw\",@progbits\n" \
7065 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
7066 ".previous\n" \
7067- ".section .altinstr_replacement, \"ax\"\n" \
7068+ ".section .altinstr_replacement, \"a\"\n" \
7069 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
7070 ".previous"
7071
7072diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
7073index 9b7273c..e9fcc24 100644
7074--- a/arch/x86/include/asm/apic.h
7075+++ b/arch/x86/include/asm/apic.h
7076@@ -45,7 +45,7 @@ static inline void generic_apic_probe(void)
7077
7078 #ifdef CONFIG_X86_LOCAL_APIC
7079
7080-extern unsigned int apic_verbosity;
7081+extern int apic_verbosity;
7082 extern int local_apic_timer_c2_ok;
7083
7084 extern int disable_apic;
7085diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
7086index 20370c6..a2eb9b0 100644
7087--- a/arch/x86/include/asm/apm.h
7088+++ b/arch/x86/include/asm/apm.h
7089@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
7090 __asm__ __volatile__(APM_DO_ZERO_SEGS
7091 "pushl %%edi\n\t"
7092 "pushl %%ebp\n\t"
7093- "lcall *%%cs:apm_bios_entry\n\t"
7094+ "lcall *%%ss:apm_bios_entry\n\t"
7095 "setc %%al\n\t"
7096 "popl %%ebp\n\t"
7097 "popl %%edi\n\t"
7098@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
7099 __asm__ __volatile__(APM_DO_ZERO_SEGS
7100 "pushl %%edi\n\t"
7101 "pushl %%ebp\n\t"
7102- "lcall *%%cs:apm_bios_entry\n\t"
7103+ "lcall *%%ss:apm_bios_entry\n\t"
7104 "setc %%bl\n\t"
7105 "popl %%ebp\n\t"
7106 "popl %%edi\n\t"
7107diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
7108index 10572e3..2618d91 100644
7109--- a/arch/x86/include/asm/atomic.h
7110+++ b/arch/x86/include/asm/atomic.h
7111@@ -22,7 +22,18 @@
7112 */
7113 static inline int atomic_read(const atomic_t *v)
7114 {
7115- return (*(volatile int *)&(v)->counter);
7116+ return (*(volatile const int *)&(v)->counter);
7117+}
7118+
7119+/**
7120+ * atomic_read_unchecked - read atomic variable
7121+ * @v: pointer of type atomic_unchecked_t
7122+ *
7123+ * Atomically reads the value of @v.
7124+ */
7125+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7126+{
7127+ return (*(volatile const int *)&(v)->counter);
7128 }
7129
7130 /**
7131@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *v, int i)
7132 }
7133
7134 /**
7135+ * atomic_set_unchecked - set atomic variable
7136+ * @v: pointer of type atomic_unchecked_t
7137+ * @i: required value
7138+ *
7139+ * Atomically sets the value of @v to @i.
7140+ */
7141+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7142+{
7143+ v->counter = i;
7144+}
7145+
7146+/**
7147 * atomic_add - add integer to atomic variable
7148 * @i: integer value to add
7149 * @v: pointer of type atomic_t
7150@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *v, int i)
7151 */
7152 static inline void atomic_add(int i, atomic_t *v)
7153 {
7154- asm volatile(LOCK_PREFIX "addl %1,%0"
7155+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7156+
7157+#ifdef CONFIG_PAX_REFCOUNT
7158+ "jno 0f\n"
7159+ LOCK_PREFIX "subl %1,%0\n"
7160+ "int $4\n0:\n"
7161+ _ASM_EXTABLE(0b, 0b)
7162+#endif
7163+
7164+ : "+m" (v->counter)
7165+ : "ir" (i));
7166+}
7167+
7168+/**
7169+ * atomic_add_unchecked - add integer to atomic variable
7170+ * @i: integer value to add
7171+ * @v: pointer of type atomic_unchecked_t
7172+ *
7173+ * Atomically adds @i to @v.
7174+ */
7175+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7176+{
7177+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7178 : "+m" (v->counter)
7179 : "ir" (i));
7180 }
7181@@ -60,7 +105,29 @@ static inline void atomic_add(int i, atomic_t *v)
7182 */
7183 static inline void atomic_sub(int i, atomic_t *v)
7184 {
7185- asm volatile(LOCK_PREFIX "subl %1,%0"
7186+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7187+
7188+#ifdef CONFIG_PAX_REFCOUNT
7189+ "jno 0f\n"
7190+ LOCK_PREFIX "addl %1,%0\n"
7191+ "int $4\n0:\n"
7192+ _ASM_EXTABLE(0b, 0b)
7193+#endif
7194+
7195+ : "+m" (v->counter)
7196+ : "ir" (i));
7197+}
7198+
7199+/**
7200+ * atomic_sub_unchecked - subtract integer from atomic variable
7201+ * @i: integer value to subtract
7202+ * @v: pointer of type atomic_unchecked_t
7203+ *
7204+ * Atomically subtracts @i from @v.
7205+ */
7206+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7207+{
7208+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7209 : "+m" (v->counter)
7210 : "ir" (i));
7211 }
7212@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7213 {
7214 unsigned char c;
7215
7216- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7217+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
7218+
7219+#ifdef CONFIG_PAX_REFCOUNT
7220+ "jno 0f\n"
7221+ LOCK_PREFIX "addl %2,%0\n"
7222+ "int $4\n0:\n"
7223+ _ASM_EXTABLE(0b, 0b)
7224+#endif
7225+
7226+ "sete %1\n"
7227 : "+m" (v->counter), "=qm" (c)
7228 : "ir" (i) : "memory");
7229 return c;
7230@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7231 */
7232 static inline void atomic_inc(atomic_t *v)
7233 {
7234- asm volatile(LOCK_PREFIX "incl %0"
7235+ asm volatile(LOCK_PREFIX "incl %0\n"
7236+
7237+#ifdef CONFIG_PAX_REFCOUNT
7238+ "jno 0f\n"
7239+ LOCK_PREFIX "decl %0\n"
7240+ "int $4\n0:\n"
7241+ _ASM_EXTABLE(0b, 0b)
7242+#endif
7243+
7244+ : "+m" (v->counter));
7245+}
7246+
7247+/**
7248+ * atomic_inc_unchecked - increment atomic variable
7249+ * @v: pointer of type atomic_unchecked_t
7250+ *
7251+ * Atomically increments @v by 1.
7252+ */
7253+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7254+{
7255+ asm volatile(LOCK_PREFIX "incl %0\n"
7256 : "+m" (v->counter));
7257 }
7258
7259@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *v)
7260 */
7261 static inline void atomic_dec(atomic_t *v)
7262 {
7263- asm volatile(LOCK_PREFIX "decl %0"
7264+ asm volatile(LOCK_PREFIX "decl %0\n"
7265+
7266+#ifdef CONFIG_PAX_REFCOUNT
7267+ "jno 0f\n"
7268+ LOCK_PREFIX "incl %0\n"
7269+ "int $4\n0:\n"
7270+ _ASM_EXTABLE(0b, 0b)
7271+#endif
7272+
7273+ : "+m" (v->counter));
7274+}
7275+
7276+/**
7277+ * atomic_dec_unchecked - decrement atomic variable
7278+ * @v: pointer of type atomic_unchecked_t
7279+ *
7280+ * Atomically decrements @v by 1.
7281+ */
7282+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7283+{
7284+ asm volatile(LOCK_PREFIX "decl %0\n"
7285 : "+m" (v->counter));
7286 }
7287
7288@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
7289 {
7290 unsigned char c;
7291
7292- asm volatile(LOCK_PREFIX "decl %0; sete %1"
7293+ asm volatile(LOCK_PREFIX "decl %0\n"
7294+
7295+#ifdef CONFIG_PAX_REFCOUNT
7296+ "jno 0f\n"
7297+ LOCK_PREFIX "incl %0\n"
7298+ "int $4\n0:\n"
7299+ _ASM_EXTABLE(0b, 0b)
7300+#endif
7301+
7302+ "sete %1\n"
7303 : "+m" (v->counter), "=qm" (c)
7304 : : "memory");
7305 return c != 0;
7306@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
7307 {
7308 unsigned char c;
7309
7310- asm volatile(LOCK_PREFIX "incl %0; sete %1"
7311+ asm volatile(LOCK_PREFIX "incl %0\n"
7312+
7313+#ifdef CONFIG_PAX_REFCOUNT
7314+ "jno 0f\n"
7315+ LOCK_PREFIX "decl %0\n"
7316+ "int $4\n0:\n"
7317+ _ASM_EXTABLE(0b, 0b)
7318+#endif
7319+
7320+ "sete %1\n"
7321+ : "+m" (v->counter), "=qm" (c)
7322+ : : "memory");
7323+ return c != 0;
7324+}
7325+
7326+/**
7327+ * atomic_inc_and_test_unchecked - increment and test
7328+ * @v: pointer of type atomic_unchecked_t
7329+ *
7330+ * Atomically increments @v by 1
7331+ * and returns true if the result is zero, or false for all
7332+ * other cases.
7333+ */
7334+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7335+{
7336+ unsigned char c;
7337+
7338+ asm volatile(LOCK_PREFIX "incl %0\n"
7339+ "sete %1\n"
7340 : "+m" (v->counter), "=qm" (c)
7341 : : "memory");
7342 return c != 0;
7343@@ -157,7 +310,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
7344 {
7345 unsigned char c;
7346
7347- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7348+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
7349+
7350+#ifdef CONFIG_PAX_REFCOUNT
7351+ "jno 0f\n"
7352+ LOCK_PREFIX "subl %2,%0\n"
7353+ "int $4\n0:\n"
7354+ _ASM_EXTABLE(0b, 0b)
7355+#endif
7356+
7357+ "sets %1\n"
7358 : "+m" (v->counter), "=qm" (c)
7359 : "ir" (i) : "memory");
7360 return c;
7361@@ -180,6 +342,46 @@ static inline int atomic_add_return(int i, atomic_t *v)
7362 #endif
7363 /* Modern 486+ processor */
7364 __i = i;
7365+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7366+
7367+#ifdef CONFIG_PAX_REFCOUNT
7368+ "jno 0f\n"
7369+ "movl %0, %1\n"
7370+ "int $4\n0:\n"
7371+ _ASM_EXTABLE(0b, 0b)
7372+#endif
7373+
7374+ : "+r" (i), "+m" (v->counter)
7375+ : : "memory");
7376+ return i + __i;
7377+
7378+#ifdef CONFIG_M386
7379+no_xadd: /* Legacy 386 processor */
7380+ local_irq_save(flags);
7381+ __i = atomic_read(v);
7382+ atomic_set(v, i + __i);
7383+ local_irq_restore(flags);
7384+ return i + __i;
7385+#endif
7386+}
7387+
7388+/**
7389+ * atomic_add_return_unchecked - add integer and return
7390+ * @v: pointer of type atomic_unchecked_t
7391+ * @i: integer value to add
7392+ *
7393+ * Atomically adds @i to @v and returns @i + @v
7394+ */
7395+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7396+{
7397+ int __i;
7398+#ifdef CONFIG_M386
7399+ unsigned long flags;
7400+ if (unlikely(boot_cpu_data.x86 <= 3))
7401+ goto no_xadd;
7402+#endif
7403+ /* Modern 486+ processor */
7404+ __i = i;
7405 asm volatile(LOCK_PREFIX "xaddl %0, %1"
7406 : "+r" (i), "+m" (v->counter)
7407 : : "memory");
7408@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
7409 }
7410
7411 #define atomic_inc_return(v) (atomic_add_return(1, v))
7412+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7413+{
7414+ return atomic_add_return_unchecked(1, v);
7415+}
7416 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7417
7418 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7419@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7420 return cmpxchg(&v->counter, old, new);
7421 }
7422
7423+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7424+{
7425+ return cmpxchg(&v->counter, old, new);
7426+}
7427+
7428 static inline int atomic_xchg(atomic_t *v, int new)
7429 {
7430 return xchg(&v->counter, new);
7431 }
7432
7433+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7434+{
7435+ return xchg(&v->counter, new);
7436+}
7437+
7438 /**
7439 * __atomic_add_unless - add unless the number is already a given value
7440 * @v: pointer of type atomic_t
7441@@ -231,12 +447,25 @@ static inline int atomic_xchg(atomic_t *v, int new)
7442 */
7443 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7444 {
7445- int c, old;
7446+ int c, old, new;
7447 c = atomic_read(v);
7448 for (;;) {
7449- if (unlikely(c == (u)))
7450+ if (unlikely(c == u))
7451 break;
7452- old = atomic_cmpxchg((v), c, c + (a));
7453+
7454+ asm volatile("addl %2,%0\n"
7455+
7456+#ifdef CONFIG_PAX_REFCOUNT
7457+ "jno 0f\n"
7458+ "subl %2,%0\n"
7459+ "int $4\n0:\n"
7460+ _ASM_EXTABLE(0b, 0b)
7461+#endif
7462+
7463+ : "=r" (new)
7464+ : "0" (c), "ir" (a));
7465+
7466+ old = atomic_cmpxchg(v, c, new);
7467 if (likely(old == c))
7468 break;
7469 c = old;
7470@@ -244,6 +473,48 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7471 return c;
7472 }
7473
7474+/**
7475+ * atomic_inc_not_zero_hint - increment if not null
7476+ * @v: pointer of type atomic_t
7477+ * @hint: probable value of the atomic before the increment
7478+ *
7479+ * This version of atomic_inc_not_zero() gives a hint of probable
7480+ * value of the atomic. This helps processor to not read the memory
7481+ * before doing the atomic read/modify/write cycle, lowering
7482+ * number of bus transactions on some arches.
7483+ *
7484+ * Returns: 0 if increment was not done, 1 otherwise.
7485+ */
7486+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
7487+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
7488+{
7489+ int val, c = hint, new;
7490+
7491+ /* sanity test, should be removed by compiler if hint is a constant */
7492+ if (!hint)
7493+ return __atomic_add_unless(v, 1, 0);
7494+
7495+ do {
7496+ asm volatile("incl %0\n"
7497+
7498+#ifdef CONFIG_PAX_REFCOUNT
7499+ "jno 0f\n"
7500+ "decl %0\n"
7501+ "int $4\n0:\n"
7502+ _ASM_EXTABLE(0b, 0b)
7503+#endif
7504+
7505+ : "=r" (new)
7506+ : "0" (c));
7507+
7508+ val = atomic_cmpxchg(v, c, new);
7509+ if (val == c)
7510+ return 1;
7511+ c = val;
7512+ } while (c);
7513+
7514+ return 0;
7515+}
7516
7517 /*
7518 * atomic_dec_if_positive - decrement by 1 if old value positive
7519diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
7520index 24098aa..1e37723 100644
7521--- a/arch/x86/include/asm/atomic64_32.h
7522+++ b/arch/x86/include/asm/atomic64_32.h
7523@@ -12,6 +12,14 @@ typedef struct {
7524 u64 __aligned(8) counter;
7525 } atomic64_t;
7526
7527+#ifdef CONFIG_PAX_REFCOUNT
7528+typedef struct {
7529+ u64 __aligned(8) counter;
7530+} atomic64_unchecked_t;
7531+#else
7532+typedef atomic64_t atomic64_unchecked_t;
7533+#endif
7534+
7535 #define ATOMIC64_INIT(val) { (val) }
7536
7537 #ifdef CONFIG_X86_CMPXCHG64
7538@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
7539 }
7540
7541 /**
7542+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
7543+ * @p: pointer to type atomic64_unchecked_t
7544+ * @o: expected value
7545+ * @n: new value
7546+ *
7547+ * Atomically sets @v to @n if it was equal to @o and returns
7548+ * the old value.
7549+ */
7550+
7551+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
7552+{
7553+ return cmpxchg64(&v->counter, o, n);
7554+}
7555+
7556+/**
7557 * atomic64_xchg - xchg atomic64 variable
7558 * @v: pointer to type atomic64_t
7559 * @n: value to assign
7560@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64_t *v, long long i)
7561 }
7562
7563 /**
7564+ * atomic64_set_unchecked - set atomic64 variable
7565+ * @v: pointer to type atomic64_unchecked_t
7566+ * @n: value to assign
7567+ *
7568+ * Atomically sets the value of @v to @n.
7569+ */
7570+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
7571+{
7572+ unsigned high = (unsigned)(i >> 32);
7573+ unsigned low = (unsigned)i;
7574+ asm volatile(ATOMIC64_ALTERNATIVE(set)
7575+ : "+b" (low), "+c" (high)
7576+ : "S" (v)
7577+ : "eax", "edx", "memory"
7578+ );
7579+}
7580+
7581+/**
7582 * atomic64_read - read atomic64 variable
7583 * @v: pointer to type atomic64_t
7584 *
7585@@ -93,6 +134,22 @@ static inline long long atomic64_read(atomic64_t *v)
7586 }
7587
7588 /**
7589+ * atomic64_read_unchecked - read atomic64 variable
7590+ * @v: pointer to type atomic64_unchecked_t
7591+ *
7592+ * Atomically reads the value of @v and returns it.
7593+ */
7594+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
7595+{
7596+ long long r;
7597+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
7598+ : "=A" (r), "+c" (v)
7599+ : : "memory"
7600+ );
7601+ return r;
7602+ }
7603+
7604+/**
7605 * atomic64_add_return - add and return
7606 * @i: integer value to add
7607 * @v: pointer to type atomic64_t
7608@@ -108,6 +165,22 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
7609 return i;
7610 }
7611
7612+/**
7613+ * atomic64_add_return_unchecked - add and return
7614+ * @i: integer value to add
7615+ * @v: pointer to type atomic64_unchecked_t
7616+ *
7617+ * Atomically adds @i to @v and returns @i + *@v
7618+ */
7619+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
7620+{
7621+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
7622+ : "+A" (i), "+c" (v)
7623+ : : "memory"
7624+ );
7625+ return i;
7626+}
7627+
7628 /*
7629 * Other variants with different arithmetic operators:
7630 */
7631@@ -131,6 +204,17 @@ static inline long long atomic64_inc_return(atomic64_t *v)
7632 return a;
7633 }
7634
7635+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7636+{
7637+ long long a;
7638+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
7639+ : "=A" (a)
7640+ : "S" (v)
7641+ : "memory", "ecx"
7642+ );
7643+ return a;
7644+}
7645+
7646 static inline long long atomic64_dec_return(atomic64_t *v)
7647 {
7648 long long a;
7649@@ -159,6 +243,22 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
7650 }
7651
7652 /**
7653+ * atomic64_add_unchecked - add integer to atomic64 variable
7654+ * @i: integer value to add
7655+ * @v: pointer to type atomic64_unchecked_t
7656+ *
7657+ * Atomically adds @i to @v.
7658+ */
7659+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
7660+{
7661+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
7662+ : "+A" (i), "+c" (v)
7663+ : : "memory"
7664+ );
7665+ return i;
7666+}
7667+
7668+/**
7669 * atomic64_sub - subtract the atomic64 variable
7670 * @i: integer value to subtract
7671 * @v: pointer to type atomic64_t
7672diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
7673index 017594d..d3fcf72 100644
7674--- a/arch/x86/include/asm/atomic64_64.h
7675+++ b/arch/x86/include/asm/atomic64_64.h
7676@@ -18,7 +18,19 @@
7677 */
7678 static inline long atomic64_read(const atomic64_t *v)
7679 {
7680- return (*(volatile long *)&(v)->counter);
7681+ return (*(volatile const long *)&(v)->counter);
7682+}
7683+
7684+/**
7685+ * atomic64_read_unchecked - read atomic64 variable
7686+ * @v: pointer of type atomic64_unchecked_t
7687+ *
7688+ * Atomically reads the value of @v.
7689+ * Doesn't imply a read memory barrier.
7690+ */
7691+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
7692+{
7693+ return (*(volatile const long *)&(v)->counter);
7694 }
7695
7696 /**
7697@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
7698 }
7699
7700 /**
7701+ * atomic64_set_unchecked - set atomic64 variable
7702+ * @v: pointer to type atomic64_unchecked_t
7703+ * @i: required value
7704+ *
7705+ * Atomically sets the value of @v to @i.
7706+ */
7707+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
7708+{
7709+ v->counter = i;
7710+}
7711+
7712+/**
7713 * atomic64_add - add integer to atomic64 variable
7714 * @i: integer value to add
7715 * @v: pointer to type atomic64_t
7716@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
7717 */
7718 static inline void atomic64_add(long i, atomic64_t *v)
7719 {
7720+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
7721+
7722+#ifdef CONFIG_PAX_REFCOUNT
7723+ "jno 0f\n"
7724+ LOCK_PREFIX "subq %1,%0\n"
7725+ "int $4\n0:\n"
7726+ _ASM_EXTABLE(0b, 0b)
7727+#endif
7728+
7729+ : "=m" (v->counter)
7730+ : "er" (i), "m" (v->counter));
7731+}
7732+
7733+/**
7734+ * atomic64_add_unchecked - add integer to atomic64 variable
7735+ * @i: integer value to add
7736+ * @v: pointer to type atomic64_unchecked_t
7737+ *
7738+ * Atomically adds @i to @v.
7739+ */
7740+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
7741+{
7742 asm volatile(LOCK_PREFIX "addq %1,%0"
7743 : "=m" (v->counter)
7744 : "er" (i), "m" (v->counter));
7745@@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
7746 */
7747 static inline void atomic64_sub(long i, atomic64_t *v)
7748 {
7749- asm volatile(LOCK_PREFIX "subq %1,%0"
7750+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7751+
7752+#ifdef CONFIG_PAX_REFCOUNT
7753+ "jno 0f\n"
7754+ LOCK_PREFIX "addq %1,%0\n"
7755+ "int $4\n0:\n"
7756+ _ASM_EXTABLE(0b, 0b)
7757+#endif
7758+
7759+ : "=m" (v->counter)
7760+ : "er" (i), "m" (v->counter));
7761+}
7762+
7763+/**
7764+ * atomic64_sub_unchecked - subtract the atomic64 variable
7765+ * @i: integer value to subtract
7766+ * @v: pointer to type atomic64_unchecked_t
7767+ *
7768+ * Atomically subtracts @i from @v.
7769+ */
7770+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
7771+{
7772+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7773 : "=m" (v->counter)
7774 : "er" (i), "m" (v->counter));
7775 }
7776@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7777 {
7778 unsigned char c;
7779
7780- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
7781+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
7782+
7783+#ifdef CONFIG_PAX_REFCOUNT
7784+ "jno 0f\n"
7785+ LOCK_PREFIX "addq %2,%0\n"
7786+ "int $4\n0:\n"
7787+ _ASM_EXTABLE(0b, 0b)
7788+#endif
7789+
7790+ "sete %1\n"
7791 : "=m" (v->counter), "=qm" (c)
7792 : "er" (i), "m" (v->counter) : "memory");
7793 return c;
7794@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7795 */
7796 static inline void atomic64_inc(atomic64_t *v)
7797 {
7798+ asm volatile(LOCK_PREFIX "incq %0\n"
7799+
7800+#ifdef CONFIG_PAX_REFCOUNT
7801+ "jno 0f\n"
7802+ LOCK_PREFIX "decq %0\n"
7803+ "int $4\n0:\n"
7804+ _ASM_EXTABLE(0b, 0b)
7805+#endif
7806+
7807+ : "=m" (v->counter)
7808+ : "m" (v->counter));
7809+}
7810+
7811+/**
7812+ * atomic64_inc_unchecked - increment atomic64 variable
7813+ * @v: pointer to type atomic64_unchecked_t
7814+ *
7815+ * Atomically increments @v by 1.
7816+ */
7817+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
7818+{
7819 asm volatile(LOCK_PREFIX "incq %0"
7820 : "=m" (v->counter)
7821 : "m" (v->counter));
7822@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64_t *v)
7823 */
7824 static inline void atomic64_dec(atomic64_t *v)
7825 {
7826- asm volatile(LOCK_PREFIX "decq %0"
7827+ asm volatile(LOCK_PREFIX "decq %0\n"
7828+
7829+#ifdef CONFIG_PAX_REFCOUNT
7830+ "jno 0f\n"
7831+ LOCK_PREFIX "incq %0\n"
7832+ "int $4\n0:\n"
7833+ _ASM_EXTABLE(0b, 0b)
7834+#endif
7835+
7836+ : "=m" (v->counter)
7837+ : "m" (v->counter));
7838+}
7839+
7840+/**
7841+ * atomic64_dec_unchecked - decrement atomic64 variable
7842+ * @v: pointer to type atomic64_t
7843+ *
7844+ * Atomically decrements @v by 1.
7845+ */
7846+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
7847+{
7848+ asm volatile(LOCK_PREFIX "decq %0\n"
7849 : "=m" (v->counter)
7850 : "m" (v->counter));
7851 }
7852@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
7853 {
7854 unsigned char c;
7855
7856- asm volatile(LOCK_PREFIX "decq %0; sete %1"
7857+ asm volatile(LOCK_PREFIX "decq %0\n"
7858+
7859+#ifdef CONFIG_PAX_REFCOUNT
7860+ "jno 0f\n"
7861+ LOCK_PREFIX "incq %0\n"
7862+ "int $4\n0:\n"
7863+ _ASM_EXTABLE(0b, 0b)
7864+#endif
7865+
7866+ "sete %1\n"
7867 : "=m" (v->counter), "=qm" (c)
7868 : "m" (v->counter) : "memory");
7869 return c != 0;
7870@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
7871 {
7872 unsigned char c;
7873
7874- asm volatile(LOCK_PREFIX "incq %0; sete %1"
7875+ asm volatile(LOCK_PREFIX "incq %0\n"
7876+
7877+#ifdef CONFIG_PAX_REFCOUNT
7878+ "jno 0f\n"
7879+ LOCK_PREFIX "decq %0\n"
7880+ "int $4\n0:\n"
7881+ _ASM_EXTABLE(0b, 0b)
7882+#endif
7883+
7884+ "sete %1\n"
7885 : "=m" (v->counter), "=qm" (c)
7886 : "m" (v->counter) : "memory");
7887 return c != 0;
7888@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7889 {
7890 unsigned char c;
7891
7892- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
7893+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
7894+
7895+#ifdef CONFIG_PAX_REFCOUNT
7896+ "jno 0f\n"
7897+ LOCK_PREFIX "subq %2,%0\n"
7898+ "int $4\n0:\n"
7899+ _ASM_EXTABLE(0b, 0b)
7900+#endif
7901+
7902+ "sets %1\n"
7903 : "=m" (v->counter), "=qm" (c)
7904 : "er" (i), "m" (v->counter) : "memory");
7905 return c;
7906@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7907 static inline long atomic64_add_return(long i, atomic64_t *v)
7908 {
7909 long __i = i;
7910- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
7911+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
7912+
7913+#ifdef CONFIG_PAX_REFCOUNT
7914+ "jno 0f\n"
7915+ "movq %0, %1\n"
7916+ "int $4\n0:\n"
7917+ _ASM_EXTABLE(0b, 0b)
7918+#endif
7919+
7920+ : "+r" (i), "+m" (v->counter)
7921+ : : "memory");
7922+ return i + __i;
7923+}
7924+
7925+/**
7926+ * atomic64_add_return_unchecked - add and return
7927+ * @i: integer value to add
7928+ * @v: pointer to type atomic64_unchecked_t
7929+ *
7930+ * Atomically adds @i to @v and returns @i + @v
7931+ */
7932+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
7933+{
7934+ long __i = i;
7935+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
7936 : "+r" (i), "+m" (v->counter)
7937 : : "memory");
7938 return i + __i;
7939@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
7940 }
7941
7942 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
7943+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7944+{
7945+ return atomic64_add_return_unchecked(1, v);
7946+}
7947 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
7948
7949 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7950@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7951 return cmpxchg(&v->counter, old, new);
7952 }
7953
7954+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
7955+{
7956+ return cmpxchg(&v->counter, old, new);
7957+}
7958+
7959 static inline long atomic64_xchg(atomic64_t *v, long new)
7960 {
7961 return xchg(&v->counter, new);
7962@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
7963 */
7964 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
7965 {
7966- long c, old;
7967+ long c, old, new;
7968 c = atomic64_read(v);
7969 for (;;) {
7970- if (unlikely(c == (u)))
7971+ if (unlikely(c == u))
7972 break;
7973- old = atomic64_cmpxchg((v), c, c + (a));
7974+
7975+ asm volatile("add %2,%0\n"
7976+
7977+#ifdef CONFIG_PAX_REFCOUNT
7978+ "jno 0f\n"
7979+ "sub %2,%0\n"
7980+ "int $4\n0:\n"
7981+ _ASM_EXTABLE(0b, 0b)
7982+#endif
7983+
7984+ : "=r" (new)
7985+ : "0" (c), "ir" (a));
7986+
7987+ old = atomic64_cmpxchg(v, c, new);
7988 if (likely(old == c))
7989 break;
7990 c = old;
7991 }
7992- return c != (u);
7993+ return c != u;
7994 }
7995
7996 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
7997diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
7998index 1775d6e..b65017f 100644
7999--- a/arch/x86/include/asm/bitops.h
8000+++ b/arch/x86/include/asm/bitops.h
8001@@ -38,7 +38,7 @@
8002 * a mask operation on a byte.
8003 */
8004 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8005-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8006+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8007 #define CONST_MASK(nr) (1 << ((nr) & 7))
8008
8009 /**
8010diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
8011index 5e1a2ee..c9f9533 100644
8012--- a/arch/x86/include/asm/boot.h
8013+++ b/arch/x86/include/asm/boot.h
8014@@ -11,10 +11,15 @@
8015 #include <asm/pgtable_types.h>
8016
8017 /* Physical address where kernel should be loaded. */
8018-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8019+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8020 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8021 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8022
8023+#ifndef __ASSEMBLY__
8024+extern unsigned char __LOAD_PHYSICAL_ADDR[];
8025+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8026+#endif
8027+
8028 /* Minimum kernel alignment, as a power of two */
8029 #ifdef CONFIG_X86_64
8030 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8031diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
8032index 48f99f1..d78ebf9 100644
8033--- a/arch/x86/include/asm/cache.h
8034+++ b/arch/x86/include/asm/cache.h
8035@@ -5,12 +5,13 @@
8036
8037 /* L1 cache line size */
8038 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8039-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8040+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8041
8042 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
8043+#define __read_only __attribute__((__section__(".data..read_only")))
8044
8045 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
8046-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
8047+#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
8048
8049 #ifdef CONFIG_X86_VSMP
8050 #ifdef CONFIG_SMP
8051diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
8052index 4e12668..501d239 100644
8053--- a/arch/x86/include/asm/cacheflush.h
8054+++ b/arch/x86/include/asm/cacheflush.h
8055@@ -26,7 +26,7 @@ static inline unsigned long get_page_memtype(struct page *pg)
8056 unsigned long pg_flags = pg->flags & _PGMT_MASK;
8057
8058 if (pg_flags == _PGMT_DEFAULT)
8059- return -1;
8060+ return ~0UL;
8061 else if (pg_flags == _PGMT_WC)
8062 return _PAGE_CACHE_WC;
8063 else if (pg_flags == _PGMT_UC_MINUS)
8064diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
8065index 46fc474..b02b0f9 100644
8066--- a/arch/x86/include/asm/checksum_32.h
8067+++ b/arch/x86/include/asm/checksum_32.h
8068@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
8069 int len, __wsum sum,
8070 int *src_err_ptr, int *dst_err_ptr);
8071
8072+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8073+ int len, __wsum sum,
8074+ int *src_err_ptr, int *dst_err_ptr);
8075+
8076+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8077+ int len, __wsum sum,
8078+ int *src_err_ptr, int *dst_err_ptr);
8079+
8080 /*
8081 * Note: when you get a NULL pointer exception here this means someone
8082 * passed in an incorrect kernel address to one of these functions.
8083@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
8084 int *err_ptr)
8085 {
8086 might_sleep();
8087- return csum_partial_copy_generic((__force void *)src, dst,
8088+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
8089 len, sum, err_ptr, NULL);
8090 }
8091
8092@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
8093 {
8094 might_sleep();
8095 if (access_ok(VERIFY_WRITE, dst, len))
8096- return csum_partial_copy_generic(src, (__force void *)dst,
8097+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8098 len, sum, NULL, err_ptr);
8099
8100 if (len)
8101diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
8102index 88b23a4..d2e5f9f 100644
8103--- a/arch/x86/include/asm/cpufeature.h
8104+++ b/arch/x86/include/asm/cpufeature.h
8105@@ -358,7 +358,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
8106 ".section .discard,\"aw\",@progbits\n"
8107 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
8108 ".previous\n"
8109- ".section .altinstr_replacement,\"ax\"\n"
8110+ ".section .altinstr_replacement,\"a\"\n"
8111 "3: movb $1,%0\n"
8112 "4:\n"
8113 ".previous\n"
8114diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
8115index 41935fa..3b40db8 100644
8116--- a/arch/x86/include/asm/desc.h
8117+++ b/arch/x86/include/asm/desc.h
8118@@ -4,6 +4,7 @@
8119 #include <asm/desc_defs.h>
8120 #include <asm/ldt.h>
8121 #include <asm/mmu.h>
8122+#include <asm/pgtable.h>
8123
8124 #include <linux/smp.h>
8125
8126@@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8127
8128 desc->type = (info->read_exec_only ^ 1) << 1;
8129 desc->type |= info->contents << 2;
8130+ desc->type |= info->seg_not_present ^ 1;
8131
8132 desc->s = 1;
8133 desc->dpl = 0x3;
8134@@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8135 }
8136
8137 extern struct desc_ptr idt_descr;
8138-extern gate_desc idt_table[];
8139-
8140-struct gdt_page {
8141- struct desc_struct gdt[GDT_ENTRIES];
8142-} __attribute__((aligned(PAGE_SIZE)));
8143-
8144-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8145+extern gate_desc idt_table[256];
8146
8147+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8148 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8149 {
8150- return per_cpu(gdt_page, cpu).gdt;
8151+ return cpu_gdt_table[cpu];
8152 }
8153
8154 #ifdef CONFIG_X86_64
8155@@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
8156 unsigned long base, unsigned dpl, unsigned flags,
8157 unsigned short seg)
8158 {
8159- gate->a = (seg << 16) | (base & 0xffff);
8160- gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8161+ gate->gate.offset_low = base;
8162+ gate->gate.seg = seg;
8163+ gate->gate.reserved = 0;
8164+ gate->gate.type = type;
8165+ gate->gate.s = 0;
8166+ gate->gate.dpl = dpl;
8167+ gate->gate.p = 1;
8168+ gate->gate.offset_high = base >> 16;
8169 }
8170
8171 #endif
8172@@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
8173
8174 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
8175 {
8176+ pax_open_kernel();
8177 memcpy(&idt[entry], gate, sizeof(*gate));
8178+ pax_close_kernel();
8179 }
8180
8181 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
8182 {
8183+ pax_open_kernel();
8184 memcpy(&ldt[entry], desc, 8);
8185+ pax_close_kernel();
8186 }
8187
8188 static inline void
8189@@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
8190 default: size = sizeof(*gdt); break;
8191 }
8192
8193+ pax_open_kernel();
8194 memcpy(&gdt[entry], desc, size);
8195+ pax_close_kernel();
8196 }
8197
8198 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8199@@ -207,7 +216,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
8200
8201 static inline void native_load_tr_desc(void)
8202 {
8203+ pax_open_kernel();
8204 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8205+ pax_close_kernel();
8206 }
8207
8208 static inline void native_load_gdt(const struct desc_ptr *dtr)
8209@@ -244,8 +255,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
8210 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8211 unsigned int i;
8212
8213+ pax_open_kernel();
8214 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8215 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8216+ pax_close_kernel();
8217 }
8218
8219 #define _LDT_empty(info) \
8220@@ -307,7 +320,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
8221 desc->limit = (limit >> 16) & 0xf;
8222 }
8223
8224-static inline void _set_gate(int gate, unsigned type, void *addr,
8225+static inline void _set_gate(int gate, unsigned type, const void *addr,
8226 unsigned dpl, unsigned ist, unsigned seg)
8227 {
8228 gate_desc s;
8229@@ -326,7 +339,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
8230 * Pentium F0 0F bugfix can have resulted in the mapped
8231 * IDT being write-protected.
8232 */
8233-static inline void set_intr_gate(unsigned int n, void *addr)
8234+static inline void set_intr_gate(unsigned int n, const void *addr)
8235 {
8236 BUG_ON((unsigned)n > 0xFF);
8237 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8238@@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
8239 /*
8240 * This routine sets up an interrupt gate at directory privilege level 3.
8241 */
8242-static inline void set_system_intr_gate(unsigned int n, void *addr)
8243+static inline void set_system_intr_gate(unsigned int n, const void *addr)
8244 {
8245 BUG_ON((unsigned)n > 0xFF);
8246 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8247 }
8248
8249-static inline void set_system_trap_gate(unsigned int n, void *addr)
8250+static inline void set_system_trap_gate(unsigned int n, const void *addr)
8251 {
8252 BUG_ON((unsigned)n > 0xFF);
8253 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8254 }
8255
8256-static inline void set_trap_gate(unsigned int n, void *addr)
8257+static inline void set_trap_gate(unsigned int n, const void *addr)
8258 {
8259 BUG_ON((unsigned)n > 0xFF);
8260 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8261@@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
8262 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8263 {
8264 BUG_ON((unsigned)n > 0xFF);
8265- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8266+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8267 }
8268
8269-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8270+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8271 {
8272 BUG_ON((unsigned)n > 0xFF);
8273 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8274 }
8275
8276-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8277+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8278 {
8279 BUG_ON((unsigned)n > 0xFF);
8280 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8281 }
8282
8283+#ifdef CONFIG_X86_32
8284+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8285+{
8286+ struct desc_struct d;
8287+
8288+ if (likely(limit))
8289+ limit = (limit - 1UL) >> PAGE_SHIFT;
8290+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
8291+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8292+}
8293+#endif
8294+
8295 #endif /* _ASM_X86_DESC_H */
8296diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
8297index 278441f..b95a174 100644
8298--- a/arch/x86/include/asm/desc_defs.h
8299+++ b/arch/x86/include/asm/desc_defs.h
8300@@ -31,6 +31,12 @@ struct desc_struct {
8301 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8302 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8303 };
8304+ struct {
8305+ u16 offset_low;
8306+ u16 seg;
8307+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8308+ unsigned offset_high: 16;
8309+ } gate;
8310 };
8311 } __attribute__((packed));
8312
8313diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
8314index 908b969..a1f4eb4 100644
8315--- a/arch/x86/include/asm/e820.h
8316+++ b/arch/x86/include/asm/e820.h
8317@@ -69,7 +69,7 @@ struct e820map {
8318 #define ISA_START_ADDRESS 0xa0000
8319 #define ISA_END_ADDRESS 0x100000
8320
8321-#define BIOS_BEGIN 0x000a0000
8322+#define BIOS_BEGIN 0x000c0000
8323 #define BIOS_END 0x00100000
8324
8325 #define BIOS_ROM_BASE 0xffe00000
8326diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
8327index f2ad216..eb24c96 100644
8328--- a/arch/x86/include/asm/elf.h
8329+++ b/arch/x86/include/asm/elf.h
8330@@ -237,7 +237,25 @@ extern int force_personality32;
8331 the loader. We need to make sure that it is out of the way of the program
8332 that it will "exec", and that there is sufficient room for the brk. */
8333
8334+#ifdef CONFIG_PAX_SEGMEXEC
8335+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8336+#else
8337 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8338+#endif
8339+
8340+#ifdef CONFIG_PAX_ASLR
8341+#ifdef CONFIG_X86_32
8342+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8343+
8344+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8345+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8346+#else
8347+#define PAX_ELF_ET_DYN_BASE 0x400000UL
8348+
8349+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8350+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8351+#endif
8352+#endif
8353
8354 /* This yields a mask that user programs can use to figure out what
8355 instruction set this CPU supports. This could be done in user space,
8356@@ -290,9 +308,7 @@ do { \
8357
8358 #define ARCH_DLINFO \
8359 do { \
8360- if (vdso_enabled) \
8361- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8362- (unsigned long)current->mm->context.vdso); \
8363+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8364 } while (0)
8365
8366 #define AT_SYSINFO 32
8367@@ -303,7 +319,7 @@ do { \
8368
8369 #endif /* !CONFIG_X86_32 */
8370
8371-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8372+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8373
8374 #define VDSO_ENTRY \
8375 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8376@@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
8377 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8378 #define compat_arch_setup_additional_pages syscall32_setup_pages
8379
8380-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8381-#define arch_randomize_brk arch_randomize_brk
8382-
8383 #endif /* _ASM_X86_ELF_H */
8384diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
8385index cc70c1c..d96d011 100644
8386--- a/arch/x86/include/asm/emergency-restart.h
8387+++ b/arch/x86/include/asm/emergency-restart.h
8388@@ -15,6 +15,6 @@ enum reboot_type {
8389
8390 extern enum reboot_type reboot_type;
8391
8392-extern void machine_emergency_restart(void);
8393+extern void machine_emergency_restart(void) __noreturn;
8394
8395 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8396diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
8397index d09bb03..4ea4194 100644
8398--- a/arch/x86/include/asm/futex.h
8399+++ b/arch/x86/include/asm/futex.h
8400@@ -12,16 +12,18 @@
8401 #include <asm/system.h>
8402
8403 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8404+ typecheck(u32 __user *, uaddr); \
8405 asm volatile("1:\t" insn "\n" \
8406 "2:\t.section .fixup,\"ax\"\n" \
8407 "3:\tmov\t%3, %1\n" \
8408 "\tjmp\t2b\n" \
8409 "\t.previous\n" \
8410 _ASM_EXTABLE(1b, 3b) \
8411- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8412+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
8413 : "i" (-EFAULT), "0" (oparg), "1" (0))
8414
8415 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8416+ typecheck(u32 __user *, uaddr); \
8417 asm volatile("1:\tmovl %2, %0\n" \
8418 "\tmovl\t%0, %3\n" \
8419 "\t" insn "\n" \
8420@@ -34,7 +36,7 @@
8421 _ASM_EXTABLE(1b, 4b) \
8422 _ASM_EXTABLE(2b, 4b) \
8423 : "=&a" (oldval), "=&r" (ret), \
8424- "+m" (*uaddr), "=&r" (tem) \
8425+ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
8426 : "r" (oparg), "i" (-EFAULT), "1" (0))
8427
8428 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8429@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8430
8431 switch (op) {
8432 case FUTEX_OP_SET:
8433- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8434+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8435 break;
8436 case FUTEX_OP_ADD:
8437- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8438+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8439 uaddr, oparg);
8440 break;
8441 case FUTEX_OP_OR:
8442@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
8443 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
8444 return -EFAULT;
8445
8446- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
8447+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
8448 "2:\t.section .fixup, \"ax\"\n"
8449 "3:\tmov %3, %0\n"
8450 "\tjmp 2b\n"
8451 "\t.previous\n"
8452 _ASM_EXTABLE(1b, 3b)
8453- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
8454+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
8455 : "i" (-EFAULT), "r" (newval), "1" (oldval)
8456 : "memory"
8457 );
8458diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
8459index 0919905..2cf38d6 100644
8460--- a/arch/x86/include/asm/hw_irq.h
8461+++ b/arch/x86/include/asm/hw_irq.h
8462@@ -136,8 +136,8 @@ extern void setup_ioapic_dest(void);
8463 extern void enable_IO_APIC(void);
8464
8465 /* Statistics */
8466-extern atomic_t irq_err_count;
8467-extern atomic_t irq_mis_count;
8468+extern atomic_unchecked_t irq_err_count;
8469+extern atomic_unchecked_t irq_mis_count;
8470
8471 /* EISA */
8472 extern void eisa_set_level_irq(unsigned int irq);
8473diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
8474index c9e09ea..73888df 100644
8475--- a/arch/x86/include/asm/i387.h
8476+++ b/arch/x86/include/asm/i387.h
8477@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
8478 {
8479 int err;
8480
8481+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8482+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8483+ fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
8484+#endif
8485+
8486 /* See comment in fxsave() below. */
8487 #ifdef CONFIG_AS_FXSAVEQ
8488 asm volatile("1: fxrstorq %[fx]\n\t"
8489@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
8490 {
8491 int err;
8492
8493+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8494+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8495+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
8496+#endif
8497+
8498 /*
8499 * Clear the bytes not touched by the fxsave and reserved
8500 * for the SW usage.
8501@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu *fpu)
8502 #endif /* CONFIG_X86_64 */
8503
8504 /* We need a safe address that is cheap to find and that is already
8505- in L1 during context switch. The best choices are unfortunately
8506- different for UP and SMP */
8507-#ifdef CONFIG_SMP
8508-#define safe_address (__per_cpu_offset[0])
8509-#else
8510-#define safe_address (kstat_cpu(0).cpustat.user)
8511-#endif
8512+ in L1 during context switch. */
8513+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
8514
8515 /*
8516 * These must be called with preempt disabled
8517@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void)
8518 struct thread_info *me = current_thread_info();
8519 preempt_disable();
8520 if (me->status & TS_USEDFPU)
8521- __save_init_fpu(me->task);
8522+ __save_init_fpu(current);
8523 else
8524 clts();
8525 }
8526diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
8527index d8e8eef..99f81ae 100644
8528--- a/arch/x86/include/asm/io.h
8529+++ b/arch/x86/include/asm/io.h
8530@@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
8531
8532 #include <linux/vmalloc.h>
8533
8534+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
8535+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
8536+{
8537+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8538+}
8539+
8540+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
8541+{
8542+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8543+}
8544+
8545 /*
8546 * Convert a virtual cached pointer to an uncached pointer
8547 */
8548diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
8549index bba3cf8..06bc8da 100644
8550--- a/arch/x86/include/asm/irqflags.h
8551+++ b/arch/x86/include/asm/irqflags.h
8552@@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
8553 sti; \
8554 sysexit
8555
8556+#define GET_CR0_INTO_RDI mov %cr0, %rdi
8557+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
8558+#define GET_CR3_INTO_RDI mov %cr3, %rdi
8559+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
8560+
8561 #else
8562 #define INTERRUPT_RETURN iret
8563 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
8564diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
8565index 5478825..839e88c 100644
8566--- a/arch/x86/include/asm/kprobes.h
8567+++ b/arch/x86/include/asm/kprobes.h
8568@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
8569 #define RELATIVEJUMP_SIZE 5
8570 #define RELATIVECALL_OPCODE 0xe8
8571 #define RELATIVE_ADDR_SIZE 4
8572-#define MAX_STACK_SIZE 64
8573-#define MIN_STACK_SIZE(ADDR) \
8574- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
8575- THREAD_SIZE - (unsigned long)(ADDR))) \
8576- ? (MAX_STACK_SIZE) \
8577- : (((unsigned long)current_thread_info()) + \
8578- THREAD_SIZE - (unsigned long)(ADDR)))
8579+#define MAX_STACK_SIZE 64UL
8580+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
8581
8582 #define flush_insn_slot(p) do { } while (0)
8583
8584diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
8585index dd51c83..66cbfac 100644
8586--- a/arch/x86/include/asm/kvm_host.h
8587+++ b/arch/x86/include/asm/kvm_host.h
8588@@ -456,7 +456,7 @@ struct kvm_arch {
8589 unsigned int n_requested_mmu_pages;
8590 unsigned int n_max_mmu_pages;
8591 unsigned int indirect_shadow_pages;
8592- atomic_t invlpg_counter;
8593+ atomic_unchecked_t invlpg_counter;
8594 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
8595 /*
8596 * Hash table of struct kvm_mmu_page.
8597@@ -636,7 +636,7 @@ struct kvm_x86_ops {
8598 enum x86_intercept_stage stage);
8599
8600 const struct trace_print_flags *exit_reasons_str;
8601-};
8602+} __do_const;
8603
8604 struct kvm_arch_async_pf {
8605 u32 token;
8606diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
8607index 9cdae5d..300d20f 100644
8608--- a/arch/x86/include/asm/local.h
8609+++ b/arch/x86/include/asm/local.h
8610@@ -18,26 +18,58 @@ typedef struct {
8611
8612 static inline void local_inc(local_t *l)
8613 {
8614- asm volatile(_ASM_INC "%0"
8615+ asm volatile(_ASM_INC "%0\n"
8616+
8617+#ifdef CONFIG_PAX_REFCOUNT
8618+ "jno 0f\n"
8619+ _ASM_DEC "%0\n"
8620+ "int $4\n0:\n"
8621+ _ASM_EXTABLE(0b, 0b)
8622+#endif
8623+
8624 : "+m" (l->a.counter));
8625 }
8626
8627 static inline void local_dec(local_t *l)
8628 {
8629- asm volatile(_ASM_DEC "%0"
8630+ asm volatile(_ASM_DEC "%0\n"
8631+
8632+#ifdef CONFIG_PAX_REFCOUNT
8633+ "jno 0f\n"
8634+ _ASM_INC "%0\n"
8635+ "int $4\n0:\n"
8636+ _ASM_EXTABLE(0b, 0b)
8637+#endif
8638+
8639 : "+m" (l->a.counter));
8640 }
8641
8642 static inline void local_add(long i, local_t *l)
8643 {
8644- asm volatile(_ASM_ADD "%1,%0"
8645+ asm volatile(_ASM_ADD "%1,%0\n"
8646+
8647+#ifdef CONFIG_PAX_REFCOUNT
8648+ "jno 0f\n"
8649+ _ASM_SUB "%1,%0\n"
8650+ "int $4\n0:\n"
8651+ _ASM_EXTABLE(0b, 0b)
8652+#endif
8653+
8654 : "+m" (l->a.counter)
8655 : "ir" (i));
8656 }
8657
8658 static inline void local_sub(long i, local_t *l)
8659 {
8660- asm volatile(_ASM_SUB "%1,%0"
8661+ asm volatile(_ASM_SUB "%1,%0\n"
8662+
8663+#ifdef CONFIG_PAX_REFCOUNT
8664+ "jno 0f\n"
8665+ _ASM_ADD "%1,%0\n"
8666+ "int $4\n0:\n"
8667+ _ASM_EXTABLE(0b, 0b)
8668+#endif
8669+
8670 : "+m" (l->a.counter)
8671 : "ir" (i));
8672 }
8673@@ -55,7 +87,16 @@ static inline int local_sub_and_test(long i, local_t *l)
8674 {
8675 unsigned char c;
8676
8677- asm volatile(_ASM_SUB "%2,%0; sete %1"
8678+ asm volatile(_ASM_SUB "%2,%0\n"
8679+
8680+#ifdef CONFIG_PAX_REFCOUNT
8681+ "jno 0f\n"
8682+ _ASM_ADD "%2,%0\n"
8683+ "int $4\n0:\n"
8684+ _ASM_EXTABLE(0b, 0b)
8685+#endif
8686+
8687+ "sete %1\n"
8688 : "+m" (l->a.counter), "=qm" (c)
8689 : "ir" (i) : "memory");
8690 return c;
8691@@ -73,7 +114,16 @@ static inline int local_dec_and_test(local_t *l)
8692 {
8693 unsigned char c;
8694
8695- asm volatile(_ASM_DEC "%0; sete %1"
8696+ asm volatile(_ASM_DEC "%0\n"
8697+
8698+#ifdef CONFIG_PAX_REFCOUNT
8699+ "jno 0f\n"
8700+ _ASM_INC "%0\n"
8701+ "int $4\n0:\n"
8702+ _ASM_EXTABLE(0b, 0b)
8703+#endif
8704+
8705+ "sete %1\n"
8706 : "+m" (l->a.counter), "=qm" (c)
8707 : : "memory");
8708 return c != 0;
8709@@ -91,7 +141,16 @@ static inline int local_inc_and_test(local_t *l)
8710 {
8711 unsigned char c;
8712
8713- asm volatile(_ASM_INC "%0; sete %1"
8714+ asm volatile(_ASM_INC "%0\n"
8715+
8716+#ifdef CONFIG_PAX_REFCOUNT
8717+ "jno 0f\n"
8718+ _ASM_DEC "%0\n"
8719+ "int $4\n0:\n"
8720+ _ASM_EXTABLE(0b, 0b)
8721+#endif
8722+
8723+ "sete %1\n"
8724 : "+m" (l->a.counter), "=qm" (c)
8725 : : "memory");
8726 return c != 0;
8727@@ -110,7 +169,16 @@ static inline int local_add_negative(long i, local_t *l)
8728 {
8729 unsigned char c;
8730
8731- asm volatile(_ASM_ADD "%2,%0; sets %1"
8732+ asm volatile(_ASM_ADD "%2,%0\n"
8733+
8734+#ifdef CONFIG_PAX_REFCOUNT
8735+ "jno 0f\n"
8736+ _ASM_SUB "%2,%0\n"
8737+ "int $4\n0:\n"
8738+ _ASM_EXTABLE(0b, 0b)
8739+#endif
8740+
8741+ "sets %1\n"
8742 : "+m" (l->a.counter), "=qm" (c)
8743 : "ir" (i) : "memory");
8744 return c;
8745@@ -133,7 +201,15 @@ static inline long local_add_return(long i, local_t *l)
8746 #endif
8747 /* Modern 486+ processor */
8748 __i = i;
8749- asm volatile(_ASM_XADD "%0, %1;"
8750+ asm volatile(_ASM_XADD "%0, %1\n"
8751+
8752+#ifdef CONFIG_PAX_REFCOUNT
8753+ "jno 0f\n"
8754+ _ASM_MOV "%0,%1\n"
8755+ "int $4\n0:\n"
8756+ _ASM_EXTABLE(0b, 0b)
8757+#endif
8758+
8759 : "+r" (i), "+m" (l->a.counter)
8760 : : "memory");
8761 return i + __i;
8762diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
8763index 593e51d..fa69c9a 100644
8764--- a/arch/x86/include/asm/mman.h
8765+++ b/arch/x86/include/asm/mman.h
8766@@ -5,4 +5,14 @@
8767
8768 #include <asm-generic/mman.h>
8769
8770+#ifdef __KERNEL__
8771+#ifndef __ASSEMBLY__
8772+#ifdef CONFIG_X86_32
8773+#define arch_mmap_check i386_mmap_check
8774+int i386_mmap_check(unsigned long addr, unsigned long len,
8775+ unsigned long flags);
8776+#endif
8777+#endif
8778+#endif
8779+
8780 #endif /* _ASM_X86_MMAN_H */
8781diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
8782index 5f55e69..e20bfb1 100644
8783--- a/arch/x86/include/asm/mmu.h
8784+++ b/arch/x86/include/asm/mmu.h
8785@@ -9,7 +9,7 @@
8786 * we put the segment information here.
8787 */
8788 typedef struct {
8789- void *ldt;
8790+ struct desc_struct *ldt;
8791 int size;
8792
8793 #ifdef CONFIG_X86_64
8794@@ -18,7 +18,19 @@ typedef struct {
8795 #endif
8796
8797 struct mutex lock;
8798- void *vdso;
8799+ unsigned long vdso;
8800+
8801+#ifdef CONFIG_X86_32
8802+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
8803+ unsigned long user_cs_base;
8804+ unsigned long user_cs_limit;
8805+
8806+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8807+ cpumask_t cpu_user_cs_mask;
8808+#endif
8809+
8810+#endif
8811+#endif
8812 } mm_context_t;
8813
8814 #ifdef CONFIG_SMP
8815diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
8816index 6902152..399f3a2 100644
8817--- a/arch/x86/include/asm/mmu_context.h
8818+++ b/arch/x86/include/asm/mmu_context.h
8819@@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
8820
8821 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
8822 {
8823+
8824+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8825+ unsigned int i;
8826+ pgd_t *pgd;
8827+
8828+ pax_open_kernel();
8829+ pgd = get_cpu_pgd(smp_processor_id());
8830+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
8831+ set_pgd_batched(pgd+i, native_make_pgd(0));
8832+ pax_close_kernel();
8833+#endif
8834+
8835 #ifdef CONFIG_SMP
8836 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
8837 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
8838@@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8839 struct task_struct *tsk)
8840 {
8841 unsigned cpu = smp_processor_id();
8842+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8843+ int tlbstate = TLBSTATE_OK;
8844+#endif
8845
8846 if (likely(prev != next)) {
8847 #ifdef CONFIG_SMP
8848+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8849+ tlbstate = percpu_read(cpu_tlbstate.state);
8850+#endif
8851 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8852 percpu_write(cpu_tlbstate.active_mm, next);
8853 #endif
8854 cpumask_set_cpu(cpu, mm_cpumask(next));
8855
8856 /* Re-load page tables */
8857+#ifdef CONFIG_PAX_PER_CPU_PGD
8858+ pax_open_kernel();
8859+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8860+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8861+ pax_close_kernel();
8862+ load_cr3(get_cpu_pgd(cpu));
8863+#else
8864 load_cr3(next->pgd);
8865+#endif
8866
8867 /* stop flush ipis for the previous mm */
8868 cpumask_clear_cpu(cpu, mm_cpumask(prev));
8869@@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8870 */
8871 if (unlikely(prev->context.ldt != next->context.ldt))
8872 load_LDT_nolock(&next->context);
8873- }
8874+
8875+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8876+ if (!(__supported_pte_mask & _PAGE_NX)) {
8877+ smp_mb__before_clear_bit();
8878+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
8879+ smp_mb__after_clear_bit();
8880+ cpu_set(cpu, next->context.cpu_user_cs_mask);
8881+ }
8882+#endif
8883+
8884+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8885+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
8886+ prev->context.user_cs_limit != next->context.user_cs_limit))
8887+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8888 #ifdef CONFIG_SMP
8889+ else if (unlikely(tlbstate != TLBSTATE_OK))
8890+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8891+#endif
8892+#endif
8893+
8894+ }
8895 else {
8896+
8897+#ifdef CONFIG_PAX_PER_CPU_PGD
8898+ pax_open_kernel();
8899+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8900+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8901+ pax_close_kernel();
8902+ load_cr3(get_cpu_pgd(cpu));
8903+#endif
8904+
8905+#ifdef CONFIG_SMP
8906 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8907 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
8908
8909@@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8910 * tlb flush IPI delivery. We must reload CR3
8911 * to make sure to use no freed page tables.
8912 */
8913+
8914+#ifndef CONFIG_PAX_PER_CPU_PGD
8915 load_cr3(next->pgd);
8916+#endif
8917+
8918 load_LDT_nolock(&next->context);
8919+
8920+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
8921+ if (!(__supported_pte_mask & _PAGE_NX))
8922+ cpu_set(cpu, next->context.cpu_user_cs_mask);
8923+#endif
8924+
8925+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8926+#ifdef CONFIG_PAX_PAGEEXEC
8927+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
8928+#endif
8929+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8930+#endif
8931+
8932 }
8933+#endif
8934 }
8935-#endif
8936 }
8937
8938 #define activate_mm(prev, next) \
8939diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
8940index 9eae775..c914fea 100644
8941--- a/arch/x86/include/asm/module.h
8942+++ b/arch/x86/include/asm/module.h
8943@@ -5,6 +5,7 @@
8944
8945 #ifdef CONFIG_X86_64
8946 /* X86_64 does not define MODULE_PROC_FAMILY */
8947+#define MODULE_PROC_FAMILY ""
8948 #elif defined CONFIG_M386
8949 #define MODULE_PROC_FAMILY "386 "
8950 #elif defined CONFIG_M486
8951@@ -59,8 +60,20 @@
8952 #error unknown processor family
8953 #endif
8954
8955-#ifdef CONFIG_X86_32
8956-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
8957+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
8958+#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
8959+#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
8960+#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
8961+#else
8962+#define MODULE_PAX_KERNEXEC ""
8963 #endif
8964
8965+#ifdef CONFIG_PAX_MEMORY_UDEREF
8966+#define MODULE_PAX_UDEREF "UDEREF "
8967+#else
8968+#define MODULE_PAX_UDEREF ""
8969+#endif
8970+
8971+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
8972+
8973 #endif /* _ASM_X86_MODULE_H */
8974diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
8975index 7639dbf..e08a58c 100644
8976--- a/arch/x86/include/asm/page_64_types.h
8977+++ b/arch/x86/include/asm/page_64_types.h
8978@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
8979
8980 /* duplicated to the one in bootmem.h */
8981 extern unsigned long max_pfn;
8982-extern unsigned long phys_base;
8983+extern const unsigned long phys_base;
8984
8985 extern unsigned long __phys_addr(unsigned long);
8986 #define __phys_reloc_hide(x) (x)
8987diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
8988index a7d2db9..edb023e 100644
8989--- a/arch/x86/include/asm/paravirt.h
8990+++ b/arch/x86/include/asm/paravirt.h
8991@@ -667,6 +667,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
8992 val);
8993 }
8994
8995+static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
8996+{
8997+ pgdval_t val = native_pgd_val(pgd);
8998+
8999+ if (sizeof(pgdval_t) > sizeof(long))
9000+ PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9001+ val, (u64)val >> 32);
9002+ else
9003+ PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9004+ val);
9005+}
9006+
9007 static inline void pgd_clear(pgd_t *pgdp)
9008 {
9009 set_pgd(pgdp, __pgd(0));
9010@@ -748,6 +760,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
9011 pv_mmu_ops.set_fixmap(idx, phys, flags);
9012 }
9013
9014+#ifdef CONFIG_PAX_KERNEXEC
9015+static inline unsigned long pax_open_kernel(void)
9016+{
9017+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9018+}
9019+
9020+static inline unsigned long pax_close_kernel(void)
9021+{
9022+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9023+}
9024+#else
9025+static inline unsigned long pax_open_kernel(void) { return 0; }
9026+static inline unsigned long pax_close_kernel(void) { return 0; }
9027+#endif
9028+
9029 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9030
9031 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
9032@@ -964,7 +991,7 @@ extern void default_banner(void);
9033
9034 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9035 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9036-#define PARA_INDIRECT(addr) *%cs:addr
9037+#define PARA_INDIRECT(addr) *%ss:addr
9038 #endif
9039
9040 #define INTERRUPT_RETURN \
9041@@ -1041,6 +1068,21 @@ extern void default_banner(void);
9042 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9043 CLBR_NONE, \
9044 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9045+
9046+#define GET_CR0_INTO_RDI \
9047+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9048+ mov %rax,%rdi
9049+
9050+#define SET_RDI_INTO_CR0 \
9051+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9052+
9053+#define GET_CR3_INTO_RDI \
9054+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9055+ mov %rax,%rdi
9056+
9057+#define SET_RDI_INTO_CR3 \
9058+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9059+
9060 #endif /* CONFIG_X86_32 */
9061
9062 #endif /* __ASSEMBLY__ */
9063diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
9064index 8e8b9a4..f07d725 100644
9065--- a/arch/x86/include/asm/paravirt_types.h
9066+++ b/arch/x86/include/asm/paravirt_types.h
9067@@ -84,20 +84,20 @@ struct pv_init_ops {
9068 */
9069 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9070 unsigned long addr, unsigned len);
9071-};
9072+} __no_const;
9073
9074
9075 struct pv_lazy_ops {
9076 /* Set deferred update mode, used for batching operations. */
9077 void (*enter)(void);
9078 void (*leave)(void);
9079-};
9080+} __no_const;
9081
9082 struct pv_time_ops {
9083 unsigned long long (*sched_clock)(void);
9084 unsigned long long (*steal_clock)(int cpu);
9085 unsigned long (*get_tsc_khz)(void);
9086-};
9087+} __no_const;
9088
9089 struct pv_cpu_ops {
9090 /* hooks for various privileged instructions */
9091@@ -193,7 +193,7 @@ struct pv_cpu_ops {
9092
9093 void (*start_context_switch)(struct task_struct *prev);
9094 void (*end_context_switch)(struct task_struct *next);
9095-};
9096+} __no_const;
9097
9098 struct pv_irq_ops {
9099 /*
9100@@ -224,7 +224,7 @@ struct pv_apic_ops {
9101 unsigned long start_eip,
9102 unsigned long start_esp);
9103 #endif
9104-};
9105+} __no_const;
9106
9107 struct pv_mmu_ops {
9108 unsigned long (*read_cr2)(void);
9109@@ -313,6 +313,7 @@ struct pv_mmu_ops {
9110 struct paravirt_callee_save make_pud;
9111
9112 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9113+ void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9114 #endif /* PAGETABLE_LEVELS == 4 */
9115 #endif /* PAGETABLE_LEVELS >= 3 */
9116
9117@@ -324,6 +325,12 @@ struct pv_mmu_ops {
9118 an mfn. We can tell which is which from the index. */
9119 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9120 phys_addr_t phys, pgprot_t flags);
9121+
9122+#ifdef CONFIG_PAX_KERNEXEC
9123+ unsigned long (*pax_open_kernel)(void);
9124+ unsigned long (*pax_close_kernel)(void);
9125+#endif
9126+
9127 };
9128
9129 struct arch_spinlock;
9130@@ -334,7 +341,7 @@ struct pv_lock_ops {
9131 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
9132 int (*spin_trylock)(struct arch_spinlock *lock);
9133 void (*spin_unlock)(struct arch_spinlock *lock);
9134-};
9135+} __no_const;
9136
9137 /* This contains all the paravirt structures: we get a convenient
9138 * number for each function using the offset which we use to indicate
9139diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
9140index b4389a4..b7ff22c 100644
9141--- a/arch/x86/include/asm/pgalloc.h
9142+++ b/arch/x86/include/asm/pgalloc.h
9143@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
9144 pmd_t *pmd, pte_t *pte)
9145 {
9146 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9147+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9148+}
9149+
9150+static inline void pmd_populate_user(struct mm_struct *mm,
9151+ pmd_t *pmd, pte_t *pte)
9152+{
9153+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9154 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9155 }
9156
9157diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
9158index 98391db..8f6984e 100644
9159--- a/arch/x86/include/asm/pgtable-2level.h
9160+++ b/arch/x86/include/asm/pgtable-2level.h
9161@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
9162
9163 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9164 {
9165+ pax_open_kernel();
9166 *pmdp = pmd;
9167+ pax_close_kernel();
9168 }
9169
9170 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9171diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
9172index effff47..f9e4035 100644
9173--- a/arch/x86/include/asm/pgtable-3level.h
9174+++ b/arch/x86/include/asm/pgtable-3level.h
9175@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9176
9177 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9178 {
9179+ pax_open_kernel();
9180 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9181+ pax_close_kernel();
9182 }
9183
9184 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9185 {
9186+ pax_open_kernel();
9187 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9188+ pax_close_kernel();
9189 }
9190
9191 /*
9192diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
9193index 18601c8..3d716d1 100644
9194--- a/arch/x86/include/asm/pgtable.h
9195+++ b/arch/x86/include/asm/pgtable.h
9196@@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9197
9198 #ifndef __PAGETABLE_PUD_FOLDED
9199 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9200+#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9201 #define pgd_clear(pgd) native_pgd_clear(pgd)
9202 #endif
9203
9204@@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9205
9206 #define arch_end_context_switch(prev) do {} while(0)
9207
9208+#define pax_open_kernel() native_pax_open_kernel()
9209+#define pax_close_kernel() native_pax_close_kernel()
9210 #endif /* CONFIG_PARAVIRT */
9211
9212+#define __HAVE_ARCH_PAX_OPEN_KERNEL
9213+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
9214+
9215+#ifdef CONFIG_PAX_KERNEXEC
9216+static inline unsigned long native_pax_open_kernel(void)
9217+{
9218+ unsigned long cr0;
9219+
9220+ preempt_disable();
9221+ barrier();
9222+ cr0 = read_cr0() ^ X86_CR0_WP;
9223+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
9224+ write_cr0(cr0);
9225+ return cr0 ^ X86_CR0_WP;
9226+}
9227+
9228+static inline unsigned long native_pax_close_kernel(void)
9229+{
9230+ unsigned long cr0;
9231+
9232+ cr0 = read_cr0() ^ X86_CR0_WP;
9233+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
9234+ write_cr0(cr0);
9235+ barrier();
9236+ preempt_enable_no_resched();
9237+ return cr0 ^ X86_CR0_WP;
9238+}
9239+#else
9240+static inline unsigned long native_pax_open_kernel(void) { return 0; }
9241+static inline unsigned long native_pax_close_kernel(void) { return 0; }
9242+#endif
9243+
9244 /*
9245 * The following only work if pte_present() is true.
9246 * Undefined behaviour if not..
9247 */
9248+static inline int pte_user(pte_t pte)
9249+{
9250+ return pte_val(pte) & _PAGE_USER;
9251+}
9252+
9253 static inline int pte_dirty(pte_t pte)
9254 {
9255 return pte_flags(pte) & _PAGE_DIRTY;
9256@@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
9257 return pte_clear_flags(pte, _PAGE_RW);
9258 }
9259
9260+static inline pte_t pte_mkread(pte_t pte)
9261+{
9262+ return __pte(pte_val(pte) | _PAGE_USER);
9263+}
9264+
9265 static inline pte_t pte_mkexec(pte_t pte)
9266 {
9267- return pte_clear_flags(pte, _PAGE_NX);
9268+#ifdef CONFIG_X86_PAE
9269+ if (__supported_pte_mask & _PAGE_NX)
9270+ return pte_clear_flags(pte, _PAGE_NX);
9271+ else
9272+#endif
9273+ return pte_set_flags(pte, _PAGE_USER);
9274+}
9275+
9276+static inline pte_t pte_exprotect(pte_t pte)
9277+{
9278+#ifdef CONFIG_X86_PAE
9279+ if (__supported_pte_mask & _PAGE_NX)
9280+ return pte_set_flags(pte, _PAGE_NX);
9281+ else
9282+#endif
9283+ return pte_clear_flags(pte, _PAGE_USER);
9284 }
9285
9286 static inline pte_t pte_mkdirty(pte_t pte)
9287@@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
9288 #endif
9289
9290 #ifndef __ASSEMBLY__
9291+
9292+#ifdef CONFIG_PAX_PER_CPU_PGD
9293+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
9294+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
9295+{
9296+ return cpu_pgd[cpu];
9297+}
9298+#endif
9299+
9300 #include <linux/mm_types.h>
9301
9302 static inline int pte_none(pte_t pte)
9303@@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
9304
9305 static inline int pgd_bad(pgd_t pgd)
9306 {
9307- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
9308+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
9309 }
9310
9311 static inline int pgd_none(pgd_t pgd)
9312@@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
9313 * pgd_offset() returns a (pgd_t *)
9314 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
9315 */
9316-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
9317+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
9318+
9319+#ifdef CONFIG_PAX_PER_CPU_PGD
9320+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
9321+#endif
9322+
9323 /*
9324 * a shortcut which implies the use of the kernel's pgd, instead
9325 * of a process's
9326@@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
9327 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
9328 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
9329
9330+#ifdef CONFIG_X86_32
9331+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
9332+#else
9333+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
9334+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
9335+
9336+#ifdef CONFIG_PAX_MEMORY_UDEREF
9337+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
9338+#else
9339+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
9340+#endif
9341+
9342+#endif
9343+
9344 #ifndef __ASSEMBLY__
9345
9346 extern int direct_gbpages;
9347@@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
9348 * dst and src can be on the same page, but the range must not overlap,
9349 * and must not cross a page boundary.
9350 */
9351-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
9352+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
9353 {
9354- memcpy(dst, src, count * sizeof(pgd_t));
9355+ pax_open_kernel();
9356+ while (count--)
9357+ *dst++ = *src++;
9358+ pax_close_kernel();
9359 }
9360
9361+#ifdef CONFIG_PAX_PER_CPU_PGD
9362+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9363+#endif
9364+
9365+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9366+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9367+#else
9368+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
9369+#endif
9370
9371 #include <asm-generic/pgtable.h>
9372 #endif /* __ASSEMBLY__ */
9373diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
9374index 0c92113..34a77c6 100644
9375--- a/arch/x86/include/asm/pgtable_32.h
9376+++ b/arch/x86/include/asm/pgtable_32.h
9377@@ -25,9 +25,6 @@
9378 struct mm_struct;
9379 struct vm_area_struct;
9380
9381-extern pgd_t swapper_pg_dir[1024];
9382-extern pgd_t initial_page_table[1024];
9383-
9384 static inline void pgtable_cache_init(void) { }
9385 static inline void check_pgt_cache(void) { }
9386 void paging_init(void);
9387@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9388 # include <asm/pgtable-2level.h>
9389 #endif
9390
9391+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9392+extern pgd_t initial_page_table[PTRS_PER_PGD];
9393+#ifdef CONFIG_X86_PAE
9394+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9395+#endif
9396+
9397 #if defined(CONFIG_HIGHPTE)
9398 #define pte_offset_map(dir, address) \
9399 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
9400@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9401 /* Clear a kernel PTE and flush it from the TLB */
9402 #define kpte_clear_flush(ptep, vaddr) \
9403 do { \
9404+ pax_open_kernel(); \
9405 pte_clear(&init_mm, (vaddr), (ptep)); \
9406+ pax_close_kernel(); \
9407 __flush_tlb_one((vaddr)); \
9408 } while (0)
9409
9410@@ -74,6 +79,9 @@ do { \
9411
9412 #endif /* !__ASSEMBLY__ */
9413
9414+#define HAVE_ARCH_UNMAPPED_AREA
9415+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9416+
9417 /*
9418 * kern_addr_valid() is (1) for FLATMEM and (0) for
9419 * SPARSEMEM and DISCONTIGMEM
9420diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
9421index ed5903b..c7fe163 100644
9422--- a/arch/x86/include/asm/pgtable_32_types.h
9423+++ b/arch/x86/include/asm/pgtable_32_types.h
9424@@ -8,7 +8,7 @@
9425 */
9426 #ifdef CONFIG_X86_PAE
9427 # include <asm/pgtable-3level_types.h>
9428-# define PMD_SIZE (1UL << PMD_SHIFT)
9429+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9430 # define PMD_MASK (~(PMD_SIZE - 1))
9431 #else
9432 # include <asm/pgtable-2level_types.h>
9433@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
9434 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9435 #endif
9436
9437+#ifdef CONFIG_PAX_KERNEXEC
9438+#ifndef __ASSEMBLY__
9439+extern unsigned char MODULES_EXEC_VADDR[];
9440+extern unsigned char MODULES_EXEC_END[];
9441+#endif
9442+#include <asm/boot.h>
9443+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9444+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9445+#else
9446+#define ktla_ktva(addr) (addr)
9447+#define ktva_ktla(addr) (addr)
9448+#endif
9449+
9450 #define MODULES_VADDR VMALLOC_START
9451 #define MODULES_END VMALLOC_END
9452 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9453diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
9454index 975f709..107976d 100644
9455--- a/arch/x86/include/asm/pgtable_64.h
9456+++ b/arch/x86/include/asm/pgtable_64.h
9457@@ -16,10 +16,14 @@
9458
9459 extern pud_t level3_kernel_pgt[512];
9460 extern pud_t level3_ident_pgt[512];
9461+extern pud_t level3_vmalloc_start_pgt[512];
9462+extern pud_t level3_vmalloc_end_pgt[512];
9463+extern pud_t level3_vmemmap_pgt[512];
9464+extern pud_t level2_vmemmap_pgt[512];
9465 extern pmd_t level2_kernel_pgt[512];
9466 extern pmd_t level2_fixmap_pgt[512];
9467-extern pmd_t level2_ident_pgt[512];
9468-extern pgd_t init_level4_pgt[];
9469+extern pmd_t level2_ident_pgt[512*2];
9470+extern pgd_t init_level4_pgt[512];
9471
9472 #define swapper_pg_dir init_level4_pgt
9473
9474@@ -61,7 +65,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9475
9476 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9477 {
9478+ pax_open_kernel();
9479 *pmdp = pmd;
9480+ pax_close_kernel();
9481 }
9482
9483 static inline void native_pmd_clear(pmd_t *pmd)
9484@@ -107,6 +113,13 @@ static inline void native_pud_clear(pud_t *pud)
9485
9486 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9487 {
9488+ pax_open_kernel();
9489+ *pgdp = pgd;
9490+ pax_close_kernel();
9491+}
9492+
9493+static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9494+{
9495 *pgdp = pgd;
9496 }
9497
9498diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
9499index 766ea16..5b96cb3 100644
9500--- a/arch/x86/include/asm/pgtable_64_types.h
9501+++ b/arch/x86/include/asm/pgtable_64_types.h
9502@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9503 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9504 #define MODULES_END _AC(0xffffffffff000000, UL)
9505 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9506+#define MODULES_EXEC_VADDR MODULES_VADDR
9507+#define MODULES_EXEC_END MODULES_END
9508+
9509+#define ktla_ktva(addr) (addr)
9510+#define ktva_ktla(addr) (addr)
9511
9512 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9513diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
9514index 013286a..8b42f4f 100644
9515--- a/arch/x86/include/asm/pgtable_types.h
9516+++ b/arch/x86/include/asm/pgtable_types.h
9517@@ -16,13 +16,12 @@
9518 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
9519 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
9520 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
9521-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
9522+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
9523 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
9524 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
9525 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
9526-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
9527-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
9528-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
9529+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
9530+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
9531 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
9532
9533 /* If _PAGE_BIT_PRESENT is clear, we use these: */
9534@@ -40,7 +39,6 @@
9535 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
9536 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
9537 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
9538-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
9539 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
9540 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
9541 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
9542@@ -57,8 +55,10 @@
9543
9544 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
9545 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
9546-#else
9547+#elif defined(CONFIG_KMEMCHECK)
9548 #define _PAGE_NX (_AT(pteval_t, 0))
9549+#else
9550+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
9551 #endif
9552
9553 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
9554@@ -96,6 +96,9 @@
9555 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
9556 _PAGE_ACCESSED)
9557
9558+#define PAGE_READONLY_NOEXEC PAGE_READONLY
9559+#define PAGE_SHARED_NOEXEC PAGE_SHARED
9560+
9561 #define __PAGE_KERNEL_EXEC \
9562 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
9563 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
9564@@ -106,7 +109,7 @@
9565 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
9566 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
9567 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
9568-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
9569+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
9570 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
9571 #define __PAGE_KERNEL_VVAR_NOCACHE (__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
9572 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
9573@@ -168,8 +171,8 @@
9574 * bits are combined, this will alow user to access the high address mapped
9575 * VDSO in the presence of CONFIG_COMPAT_VDSO
9576 */
9577-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
9578-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
9579+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9580+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9581 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
9582 #endif
9583
9584@@ -207,7 +210,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
9585 {
9586 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
9587 }
9588+#endif
9589
9590+#if PAGETABLE_LEVELS == 3
9591+#include <asm-generic/pgtable-nopud.h>
9592+#endif
9593+
9594+#if PAGETABLE_LEVELS == 2
9595+#include <asm-generic/pgtable-nopmd.h>
9596+#endif
9597+
9598+#ifndef __ASSEMBLY__
9599 #if PAGETABLE_LEVELS > 3
9600 typedef struct { pudval_t pud; } pud_t;
9601
9602@@ -221,8 +234,6 @@ static inline pudval_t native_pud_val(pud_t pud)
9603 return pud.pud;
9604 }
9605 #else
9606-#include <asm-generic/pgtable-nopud.h>
9607-
9608 static inline pudval_t native_pud_val(pud_t pud)
9609 {
9610 return native_pgd_val(pud.pgd);
9611@@ -242,8 +253,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
9612 return pmd.pmd;
9613 }
9614 #else
9615-#include <asm-generic/pgtable-nopmd.h>
9616-
9617 static inline pmdval_t native_pmd_val(pmd_t pmd)
9618 {
9619 return native_pgd_val(pmd.pud.pgd);
9620@@ -283,7 +292,6 @@ typedef struct page *pgtable_t;
9621
9622 extern pteval_t __supported_pte_mask;
9623 extern void set_nx(void);
9624-extern int nx_enabled;
9625
9626 #define pgprot_writecombine pgprot_writecombine
9627 extern pgprot_t pgprot_writecombine(pgprot_t prot);
9628diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
9629index 0d1171c..36571a9 100644
9630--- a/arch/x86/include/asm/processor.h
9631+++ b/arch/x86/include/asm/processor.h
9632@@ -266,7 +266,7 @@ struct tss_struct {
9633
9634 } ____cacheline_aligned;
9635
9636-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
9637+extern struct tss_struct init_tss[NR_CPUS];
9638
9639 /*
9640 * Save the original ist values for checking stack pointers during debugging
9641@@ -858,11 +858,18 @@ static inline void spin_lock_prefetch(const void *x)
9642 */
9643 #define TASK_SIZE PAGE_OFFSET
9644 #define TASK_SIZE_MAX TASK_SIZE
9645+
9646+#ifdef CONFIG_PAX_SEGMEXEC
9647+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
9648+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
9649+#else
9650 #define STACK_TOP TASK_SIZE
9651-#define STACK_TOP_MAX STACK_TOP
9652+#endif
9653+
9654+#define STACK_TOP_MAX TASK_SIZE
9655
9656 #define INIT_THREAD { \
9657- .sp0 = sizeof(init_stack) + (long)&init_stack, \
9658+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9659 .vm86_info = NULL, \
9660 .sysenter_cs = __KERNEL_CS, \
9661 .io_bitmap_ptr = NULL, \
9662@@ -876,7 +883,7 @@ static inline void spin_lock_prefetch(const void *x)
9663 */
9664 #define INIT_TSS { \
9665 .x86_tss = { \
9666- .sp0 = sizeof(init_stack) + (long)&init_stack, \
9667+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9668 .ss0 = __KERNEL_DS, \
9669 .ss1 = __KERNEL_CS, \
9670 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
9671@@ -887,11 +894,7 @@ static inline void spin_lock_prefetch(const void *x)
9672 extern unsigned long thread_saved_pc(struct task_struct *tsk);
9673
9674 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
9675-#define KSTK_TOP(info) \
9676-({ \
9677- unsigned long *__ptr = (unsigned long *)(info); \
9678- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
9679-})
9680+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
9681
9682 /*
9683 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
9684@@ -906,7 +909,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9685 #define task_pt_regs(task) \
9686 ({ \
9687 struct pt_regs *__regs__; \
9688- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
9689+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
9690 __regs__ - 1; \
9691 })
9692
9693@@ -916,13 +919,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9694 /*
9695 * User space process size. 47bits minus one guard page.
9696 */
9697-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
9698+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
9699
9700 /* This decides where the kernel will search for a free chunk of vm
9701 * space during mmap's.
9702 */
9703 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
9704- 0xc0000000 : 0xFFFFe000)
9705+ 0xc0000000 : 0xFFFFf000)
9706
9707 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
9708 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
9709@@ -933,11 +936,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9710 #define STACK_TOP_MAX TASK_SIZE_MAX
9711
9712 #define INIT_THREAD { \
9713- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9714+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9715 }
9716
9717 #define INIT_TSS { \
9718- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9719+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9720 }
9721
9722 /*
9723@@ -959,6 +962,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
9724 */
9725 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
9726
9727+#ifdef CONFIG_PAX_SEGMEXEC
9728+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
9729+#endif
9730+
9731 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
9732
9733 /* Get/set a process' ability to use the timestamp counter instruction */
9734diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
9735index 3566454..4bdfb8c 100644
9736--- a/arch/x86/include/asm/ptrace.h
9737+++ b/arch/x86/include/asm/ptrace.h
9738@@ -156,28 +156,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
9739 }
9740
9741 /*
9742- * user_mode_vm(regs) determines whether a register set came from user mode.
9743+ * user_mode(regs) determines whether a register set came from user mode.
9744 * This is true if V8086 mode was enabled OR if the register set was from
9745 * protected mode with RPL-3 CS value. This tricky test checks that with
9746 * one comparison. Many places in the kernel can bypass this full check
9747- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
9748+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
9749+ * be used.
9750 */
9751-static inline int user_mode(struct pt_regs *regs)
9752+static inline int user_mode_novm(struct pt_regs *regs)
9753 {
9754 #ifdef CONFIG_X86_32
9755 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
9756 #else
9757- return !!(regs->cs & 3);
9758+ return !!(regs->cs & SEGMENT_RPL_MASK);
9759 #endif
9760 }
9761
9762-static inline int user_mode_vm(struct pt_regs *regs)
9763+static inline int user_mode(struct pt_regs *regs)
9764 {
9765 #ifdef CONFIG_X86_32
9766 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
9767 USER_RPL;
9768 #else
9769- return user_mode(regs);
9770+ return user_mode_novm(regs);
9771 #endif
9772 }
9773
9774@@ -193,15 +194,16 @@ static inline int v8086_mode(struct pt_regs *regs)
9775 #ifdef CONFIG_X86_64
9776 static inline bool user_64bit_mode(struct pt_regs *regs)
9777 {
9778+ unsigned long cs = regs->cs & 0xffff;
9779 #ifndef CONFIG_PARAVIRT
9780 /*
9781 * On non-paravirt systems, this is the only long mode CPL 3
9782 * selector. We do not allow long mode selectors in the LDT.
9783 */
9784- return regs->cs == __USER_CS;
9785+ return cs == __USER_CS;
9786 #else
9787 /* Headers are too twisted for this to go in paravirt.h. */
9788- return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
9789+ return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
9790 #endif
9791 }
9792 #endif
9793diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
9794index 3250e3d..20db631 100644
9795--- a/arch/x86/include/asm/reboot.h
9796+++ b/arch/x86/include/asm/reboot.h
9797@@ -6,19 +6,19 @@
9798 struct pt_regs;
9799
9800 struct machine_ops {
9801- void (*restart)(char *cmd);
9802- void (*halt)(void);
9803- void (*power_off)(void);
9804+ void (* __noreturn restart)(char *cmd);
9805+ void (* __noreturn halt)(void);
9806+ void (* __noreturn power_off)(void);
9807 void (*shutdown)(void);
9808 void (*crash_shutdown)(struct pt_regs *);
9809- void (*emergency_restart)(void);
9810-};
9811+ void (* __noreturn emergency_restart)(void);
9812+} __no_const;
9813
9814 extern struct machine_ops machine_ops;
9815
9816 void native_machine_crash_shutdown(struct pt_regs *regs);
9817 void native_machine_shutdown(void);
9818-void machine_real_restart(unsigned int type);
9819+void machine_real_restart(unsigned int type) __noreturn;
9820 /* These must match dispatch_table in reboot_32.S */
9821 #define MRR_BIOS 0
9822 #define MRR_APM 1
9823diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
9824index df4cd32..27ae072 100644
9825--- a/arch/x86/include/asm/rwsem.h
9826+++ b/arch/x86/include/asm/rwsem.h
9827@@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
9828 {
9829 asm volatile("# beginning down_read\n\t"
9830 LOCK_PREFIX _ASM_INC "(%1)\n\t"
9831+
9832+#ifdef CONFIG_PAX_REFCOUNT
9833+ "jno 0f\n"
9834+ LOCK_PREFIX _ASM_DEC "(%1)\n"
9835+ "int $4\n0:\n"
9836+ _ASM_EXTABLE(0b, 0b)
9837+#endif
9838+
9839 /* adds 0x00000001 */
9840 " jns 1f\n"
9841 " call call_rwsem_down_read_failed\n"
9842@@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
9843 "1:\n\t"
9844 " mov %1,%2\n\t"
9845 " add %3,%2\n\t"
9846+
9847+#ifdef CONFIG_PAX_REFCOUNT
9848+ "jno 0f\n"
9849+ "sub %3,%2\n"
9850+ "int $4\n0:\n"
9851+ _ASM_EXTABLE(0b, 0b)
9852+#endif
9853+
9854 " jle 2f\n\t"
9855 LOCK_PREFIX " cmpxchg %2,%0\n\t"
9856 " jnz 1b\n\t"
9857@@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
9858 long tmp;
9859 asm volatile("# beginning down_write\n\t"
9860 LOCK_PREFIX " xadd %1,(%2)\n\t"
9861+
9862+#ifdef CONFIG_PAX_REFCOUNT
9863+ "jno 0f\n"
9864+ "mov %1,(%2)\n"
9865+ "int $4\n0:\n"
9866+ _ASM_EXTABLE(0b, 0b)
9867+#endif
9868+
9869 /* adds 0xffff0001, returns the old value */
9870 " test %1,%1\n\t"
9871 /* was the count 0 before? */
9872@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_semaphore *sem)
9873 long tmp;
9874 asm volatile("# beginning __up_read\n\t"
9875 LOCK_PREFIX " xadd %1,(%2)\n\t"
9876+
9877+#ifdef CONFIG_PAX_REFCOUNT
9878+ "jno 0f\n"
9879+ "mov %1,(%2)\n"
9880+ "int $4\n0:\n"
9881+ _ASM_EXTABLE(0b, 0b)
9882+#endif
9883+
9884 /* subtracts 1, returns the old value */
9885 " jns 1f\n\t"
9886 " call call_rwsem_wake\n" /* expects old value in %edx */
9887@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_semaphore *sem)
9888 long tmp;
9889 asm volatile("# beginning __up_write\n\t"
9890 LOCK_PREFIX " xadd %1,(%2)\n\t"
9891+
9892+#ifdef CONFIG_PAX_REFCOUNT
9893+ "jno 0f\n"
9894+ "mov %1,(%2)\n"
9895+ "int $4\n0:\n"
9896+ _ASM_EXTABLE(0b, 0b)
9897+#endif
9898+
9899 /* subtracts 0xffff0001, returns the old value */
9900 " jns 1f\n\t"
9901 " call call_rwsem_wake\n" /* expects old value in %edx */
9902@@ -176,6 +216,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9903 {
9904 asm volatile("# beginning __downgrade_write\n\t"
9905 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
9906+
9907+#ifdef CONFIG_PAX_REFCOUNT
9908+ "jno 0f\n"
9909+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
9910+ "int $4\n0:\n"
9911+ _ASM_EXTABLE(0b, 0b)
9912+#endif
9913+
9914 /*
9915 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
9916 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
9917@@ -194,7 +242,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9918 */
9919 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
9920 {
9921- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
9922+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
9923+
9924+#ifdef CONFIG_PAX_REFCOUNT
9925+ "jno 0f\n"
9926+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
9927+ "int $4\n0:\n"
9928+ _ASM_EXTABLE(0b, 0b)
9929+#endif
9930+
9931 : "+m" (sem->count)
9932 : "er" (delta));
9933 }
9934@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
9935 {
9936 long tmp = delta;
9937
9938- asm volatile(LOCK_PREFIX "xadd %0,%1"
9939+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
9940+
9941+#ifdef CONFIG_PAX_REFCOUNT
9942+ "jno 0f\n"
9943+ "mov %0,%1\n"
9944+ "int $4\n0:\n"
9945+ _ASM_EXTABLE(0b, 0b)
9946+#endif
9947+
9948 : "+r" (tmp), "+m" (sem->count)
9949 : : "memory");
9950
9951diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
9952index 5e64171..f58957e 100644
9953--- a/arch/x86/include/asm/segment.h
9954+++ b/arch/x86/include/asm/segment.h
9955@@ -64,10 +64,15 @@
9956 * 26 - ESPFIX small SS
9957 * 27 - per-cpu [ offset to per-cpu data area ]
9958 * 28 - stack_canary-20 [ for stack protector ]
9959- * 29 - unused
9960- * 30 - unused
9961+ * 29 - PCI BIOS CS
9962+ * 30 - PCI BIOS DS
9963 * 31 - TSS for double fault handler
9964 */
9965+#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
9966+#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
9967+#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
9968+#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
9969+
9970 #define GDT_ENTRY_TLS_MIN 6
9971 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
9972
9973@@ -79,6 +84,8 @@
9974
9975 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
9976
9977+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
9978+
9979 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
9980
9981 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
9982@@ -104,6 +111,12 @@
9983 #define __KERNEL_STACK_CANARY 0
9984 #endif
9985
9986+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
9987+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
9988+
9989+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
9990+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
9991+
9992 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
9993
9994 /*
9995@@ -141,7 +154,7 @@
9996 */
9997
9998 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
9999-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10000+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10001
10002
10003 #else
10004@@ -165,6 +178,8 @@
10005 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8+3)
10006 #define __USER32_DS __USER_DS
10007
10008+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10009+
10010 #define GDT_ENTRY_TSS 8 /* needs two entries */
10011 #define GDT_ENTRY_LDT 10 /* needs two entries */
10012 #define GDT_ENTRY_TLS_MIN 12
10013@@ -185,6 +200,7 @@
10014 #endif
10015
10016 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
10017+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
10018 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
10019 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
10020 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
10021diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
10022index 73b11bc..d4a3b63 100644
10023--- a/arch/x86/include/asm/smp.h
10024+++ b/arch/x86/include/asm/smp.h
10025@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10026 /* cpus sharing the last level cache: */
10027 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
10028 DECLARE_PER_CPU(u16, cpu_llc_id);
10029-DECLARE_PER_CPU(int, cpu_number);
10030+DECLARE_PER_CPU(unsigned int, cpu_number);
10031
10032 static inline struct cpumask *cpu_sibling_mask(int cpu)
10033 {
10034@@ -77,7 +77,7 @@ struct smp_ops {
10035
10036 void (*send_call_func_ipi)(const struct cpumask *mask);
10037 void (*send_call_func_single_ipi)(int cpu);
10038-};
10039+} __no_const;
10040
10041 /* Globals due to paravirt */
10042 extern void set_cpu_sibling_map(int cpu);
10043@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitdata;
10044 extern int safe_smp_processor_id(void);
10045
10046 #elif defined(CONFIG_X86_64_SMP)
10047-#define raw_smp_processor_id() (percpu_read(cpu_number))
10048-
10049-#define stack_smp_processor_id() \
10050-({ \
10051- struct thread_info *ti; \
10052- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10053- ti->cpu; \
10054-})
10055+#define raw_smp_processor_id() (percpu_read(cpu_number))
10056+#define stack_smp_processor_id() raw_smp_processor_id()
10057 #define safe_smp_processor_id() smp_processor_id()
10058
10059 #endif
10060diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
10061index ee67edf..49c796b 100644
10062--- a/arch/x86/include/asm/spinlock.h
10063+++ b/arch/x86/include/asm/spinlock.h
10064@@ -248,6 +248,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock)
10065 static inline void arch_read_lock(arch_rwlock_t *rw)
10066 {
10067 asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t"
10068+
10069+#ifdef CONFIG_PAX_REFCOUNT
10070+ "jno 0f\n"
10071+ LOCK_PREFIX READ_LOCK_SIZE(inc) " (%0)\n"
10072+ "int $4\n0:\n"
10073+ _ASM_EXTABLE(0b, 0b)
10074+#endif
10075+
10076 "jns 1f\n"
10077 "call __read_lock_failed\n\t"
10078 "1:\n"
10079@@ -257,6 +265,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
10080 static inline void arch_write_lock(arch_rwlock_t *rw)
10081 {
10082 asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t"
10083+
10084+#ifdef CONFIG_PAX_REFCOUNT
10085+ "jno 0f\n"
10086+ LOCK_PREFIX WRITE_LOCK_ADD(%1) "(%0)\n"
10087+ "int $4\n0:\n"
10088+ _ASM_EXTABLE(0b, 0b)
10089+#endif
10090+
10091 "jz 1f\n"
10092 "call __write_lock_failed\n\t"
10093 "1:\n"
10094@@ -286,13 +302,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
10095
10096 static inline void arch_read_unlock(arch_rwlock_t *rw)
10097 {
10098- asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0"
10099+ asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0\n"
10100+
10101+#ifdef CONFIG_PAX_REFCOUNT
10102+ "jno 0f\n"
10103+ LOCK_PREFIX READ_LOCK_SIZE(dec) " %0\n"
10104+ "int $4\n0:\n"
10105+ _ASM_EXTABLE(0b, 0b)
10106+#endif
10107+
10108 :"+m" (rw->lock) : : "memory");
10109 }
10110
10111 static inline void arch_write_unlock(arch_rwlock_t *rw)
10112 {
10113- asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0"
10114+ asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0\n"
10115+
10116+#ifdef CONFIG_PAX_REFCOUNT
10117+ "jno 0f\n"
10118+ LOCK_PREFIX WRITE_LOCK_SUB(%1) "%0\n"
10119+ "int $4\n0:\n"
10120+ _ASM_EXTABLE(0b, 0b)
10121+#endif
10122+
10123 : "+m" (rw->write) : "i" (RW_LOCK_BIAS) : "memory");
10124 }
10125
10126diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
10127index 1575177..cb23f52 100644
10128--- a/arch/x86/include/asm/stackprotector.h
10129+++ b/arch/x86/include/asm/stackprotector.h
10130@@ -48,7 +48,7 @@
10131 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10132 */
10133 #define GDT_STACK_CANARY_INIT \
10134- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10135+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10136
10137 /*
10138 * Initialize the stackprotector canary value.
10139@@ -113,7 +113,7 @@ static inline void setup_stack_canary_segment(int cpu)
10140
10141 static inline void load_stack_canary_segment(void)
10142 {
10143-#ifdef CONFIG_X86_32
10144+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10145 asm volatile ("mov %0, %%gs" : : "r" (0));
10146 #endif
10147 }
10148diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
10149index 70bbe39..4ae2bd4 100644
10150--- a/arch/x86/include/asm/stacktrace.h
10151+++ b/arch/x86/include/asm/stacktrace.h
10152@@ -11,28 +11,20 @@
10153
10154 extern int kstack_depth_to_print;
10155
10156-struct thread_info;
10157+struct task_struct;
10158 struct stacktrace_ops;
10159
10160-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
10161- unsigned long *stack,
10162- unsigned long bp,
10163- const struct stacktrace_ops *ops,
10164- void *data,
10165- unsigned long *end,
10166- int *graph);
10167+typedef unsigned long walk_stack_t(struct task_struct *task,
10168+ void *stack_start,
10169+ unsigned long *stack,
10170+ unsigned long bp,
10171+ const struct stacktrace_ops *ops,
10172+ void *data,
10173+ unsigned long *end,
10174+ int *graph);
10175
10176-extern unsigned long
10177-print_context_stack(struct thread_info *tinfo,
10178- unsigned long *stack, unsigned long bp,
10179- const struct stacktrace_ops *ops, void *data,
10180- unsigned long *end, int *graph);
10181-
10182-extern unsigned long
10183-print_context_stack_bp(struct thread_info *tinfo,
10184- unsigned long *stack, unsigned long bp,
10185- const struct stacktrace_ops *ops, void *data,
10186- unsigned long *end, int *graph);
10187+extern walk_stack_t print_context_stack;
10188+extern walk_stack_t print_context_stack_bp;
10189
10190 /* Generic stack tracer with callbacks */
10191
10192@@ -40,7 +32,7 @@ struct stacktrace_ops {
10193 void (*address)(void *data, unsigned long address, int reliable);
10194 /* On negative return stop dumping */
10195 int (*stack)(void *data, char *name);
10196- walk_stack_t walk_stack;
10197+ walk_stack_t *walk_stack;
10198 };
10199
10200 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
10201diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
10202index cb23852..2dde194 100644
10203--- a/arch/x86/include/asm/sys_ia32.h
10204+++ b/arch/x86/include/asm/sys_ia32.h
10205@@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int, compat_sigset_t __user *,
10206 compat_sigset_t __user *, unsigned int);
10207 asmlinkage long sys32_alarm(unsigned int);
10208
10209-asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
10210+asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
10211 asmlinkage long sys32_sysfs(int, u32, u32);
10212
10213 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
10214diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
10215index 2d2f01c..f985723 100644
10216--- a/arch/x86/include/asm/system.h
10217+++ b/arch/x86/include/asm/system.h
10218@@ -129,7 +129,7 @@ do { \
10219 "call __switch_to\n\t" \
10220 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10221 __switch_canary \
10222- "movq %P[thread_info](%%rsi),%%r8\n\t" \
10223+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10224 "movq %%rax,%%rdi\n\t" \
10225 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10226 "jnz ret_from_fork\n\t" \
10227@@ -140,7 +140,7 @@ do { \
10228 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10229 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10230 [_tif_fork] "i" (_TIF_FORK), \
10231- [thread_info] "i" (offsetof(struct task_struct, stack)), \
10232+ [thread_info] "m" (current_tinfo), \
10233 [current_task] "m" (current_task) \
10234 __switch_canary_iparam \
10235 : "memory", "cc" __EXTRA_CLOBBER)
10236@@ -200,7 +200,7 @@ static inline unsigned long get_limit(unsigned long segment)
10237 {
10238 unsigned long __limit;
10239 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10240- return __limit + 1;
10241+ return __limit;
10242 }
10243
10244 static inline void native_clts(void)
10245@@ -397,13 +397,13 @@ void enable_hlt(void);
10246
10247 void cpu_idle_wait(void);
10248
10249-extern unsigned long arch_align_stack(unsigned long sp);
10250+#define arch_align_stack(x) ((x) & ~0xfUL)
10251 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10252
10253 void default_idle(void);
10254 bool set_pm_idle_to_default(void);
10255
10256-void stop_this_cpu(void *dummy);
10257+void stop_this_cpu(void *dummy) __noreturn;
10258
10259 /*
10260 * Force strict CPU ordering.
10261diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
10262index a1fe5c1..ee326d8 100644
10263--- a/arch/x86/include/asm/thread_info.h
10264+++ b/arch/x86/include/asm/thread_info.h
10265@@ -10,6 +10,7 @@
10266 #include <linux/compiler.h>
10267 #include <asm/page.h>
10268 #include <asm/types.h>
10269+#include <asm/percpu.h>
10270
10271 /*
10272 * low level task data that entry.S needs immediate access to
10273@@ -24,7 +25,6 @@ struct exec_domain;
10274 #include <linux/atomic.h>
10275
10276 struct thread_info {
10277- struct task_struct *task; /* main task structure */
10278 struct exec_domain *exec_domain; /* execution domain */
10279 __u32 flags; /* low level flags */
10280 __u32 status; /* thread synchronous flags */
10281@@ -34,18 +34,12 @@ struct thread_info {
10282 mm_segment_t addr_limit;
10283 struct restart_block restart_block;
10284 void __user *sysenter_return;
10285-#ifdef CONFIG_X86_32
10286- unsigned long previous_esp; /* ESP of the previous stack in
10287- case of nested (IRQ) stacks
10288- */
10289- __u8 supervisor_stack[0];
10290-#endif
10291+ unsigned long lowest_stack;
10292 int uaccess_err;
10293 };
10294
10295-#define INIT_THREAD_INFO(tsk) \
10296+#define INIT_THREAD_INFO \
10297 { \
10298- .task = &tsk, \
10299 .exec_domain = &default_exec_domain, \
10300 .flags = 0, \
10301 .cpu = 0, \
10302@@ -56,7 +50,7 @@ struct thread_info {
10303 }, \
10304 }
10305
10306-#define init_thread_info (init_thread_union.thread_info)
10307+#define init_thread_info (init_thread_union.stack)
10308 #define init_stack (init_thread_union.stack)
10309
10310 #else /* !__ASSEMBLY__ */
10311@@ -170,45 +164,40 @@ struct thread_info {
10312 ret; \
10313 })
10314
10315-#ifdef CONFIG_X86_32
10316-
10317-#define STACK_WARN (THREAD_SIZE/8)
10318-/*
10319- * macros/functions for gaining access to the thread information structure
10320- *
10321- * preempt_count needs to be 1 initially, until the scheduler is functional.
10322- */
10323-#ifndef __ASSEMBLY__
10324-
10325-
10326-/* how to get the current stack pointer from C */
10327-register unsigned long current_stack_pointer asm("esp") __used;
10328-
10329-/* how to get the thread information struct from C */
10330-static inline struct thread_info *current_thread_info(void)
10331-{
10332- return (struct thread_info *)
10333- (current_stack_pointer & ~(THREAD_SIZE - 1));
10334-}
10335-
10336-#else /* !__ASSEMBLY__ */
10337-
10338+#ifdef __ASSEMBLY__
10339 /* how to get the thread information struct from ASM */
10340 #define GET_THREAD_INFO(reg) \
10341- movl $-THREAD_SIZE, reg; \
10342- andl %esp, reg
10343+ mov PER_CPU_VAR(current_tinfo), reg
10344
10345 /* use this one if reg already contains %esp */
10346-#define GET_THREAD_INFO_WITH_ESP(reg) \
10347- andl $-THREAD_SIZE, reg
10348+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10349+#else
10350+/* how to get the thread information struct from C */
10351+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10352+
10353+static __always_inline struct thread_info *current_thread_info(void)
10354+{
10355+ return percpu_read_stable(current_tinfo);
10356+}
10357+#endif
10358+
10359+#ifdef CONFIG_X86_32
10360+
10361+#define STACK_WARN (THREAD_SIZE/8)
10362+/*
10363+ * macros/functions for gaining access to the thread information structure
10364+ *
10365+ * preempt_count needs to be 1 initially, until the scheduler is functional.
10366+ */
10367+#ifndef __ASSEMBLY__
10368+
10369+/* how to get the current stack pointer from C */
10370+register unsigned long current_stack_pointer asm("esp") __used;
10371
10372 #endif
10373
10374 #else /* X86_32 */
10375
10376-#include <asm/percpu.h>
10377-#define KERNEL_STACK_OFFSET (5*8)
10378-
10379 /*
10380 * macros/functions for gaining access to the thread information structure
10381 * preempt_count needs to be 1 initially, until the scheduler is functional.
10382@@ -216,21 +205,8 @@ static inline struct thread_info *current_thread_info(void)
10383 #ifndef __ASSEMBLY__
10384 DECLARE_PER_CPU(unsigned long, kernel_stack);
10385
10386-static inline struct thread_info *current_thread_info(void)
10387-{
10388- struct thread_info *ti;
10389- ti = (void *)(percpu_read_stable(kernel_stack) +
10390- KERNEL_STACK_OFFSET - THREAD_SIZE);
10391- return ti;
10392-}
10393-
10394-#else /* !__ASSEMBLY__ */
10395-
10396-/* how to get the thread information struct from ASM */
10397-#define GET_THREAD_INFO(reg) \
10398- movq PER_CPU_VAR(kernel_stack),reg ; \
10399- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10400-
10401+/* how to get the current stack pointer from C */
10402+register unsigned long current_stack_pointer asm("rsp") __used;
10403 #endif
10404
10405 #endif /* !X86_32 */
10406@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
10407 extern void free_thread_info(struct thread_info *ti);
10408 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10409 #define arch_task_cache_init arch_task_cache_init
10410+
10411+#define __HAVE_THREAD_FUNCTIONS
10412+#define task_thread_info(task) (&(task)->tinfo)
10413+#define task_stack_page(task) ((task)->stack)
10414+#define setup_thread_stack(p, org) do {} while (0)
10415+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10416+
10417+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10418+extern struct task_struct *alloc_task_struct_node(int node);
10419+extern void free_task_struct(struct task_struct *);
10420+
10421 #endif
10422 #endif /* _ASM_X86_THREAD_INFO_H */
10423diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
10424index 36361bf..324f262 100644
10425--- a/arch/x86/include/asm/uaccess.h
10426+++ b/arch/x86/include/asm/uaccess.h
10427@@ -7,12 +7,15 @@
10428 #include <linux/compiler.h>
10429 #include <linux/thread_info.h>
10430 #include <linux/string.h>
10431+#include <linux/sched.h>
10432 #include <asm/asm.h>
10433 #include <asm/page.h>
10434
10435 #define VERIFY_READ 0
10436 #define VERIFY_WRITE 1
10437
10438+extern void check_object_size(const void *ptr, unsigned long n, bool to);
10439+
10440 /*
10441 * The fs value determines whether argument validity checking should be
10442 * performed or not. If get_fs() == USER_DS, checking is performed, with
10443@@ -28,7 +31,12 @@
10444
10445 #define get_ds() (KERNEL_DS)
10446 #define get_fs() (current_thread_info()->addr_limit)
10447+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10448+void __set_fs(mm_segment_t x);
10449+void set_fs(mm_segment_t x);
10450+#else
10451 #define set_fs(x) (current_thread_info()->addr_limit = (x))
10452+#endif
10453
10454 #define segment_eq(a, b) ((a).seg == (b).seg)
10455
10456@@ -76,7 +84,33 @@
10457 * checks that the pointer is in the user space range - after calling
10458 * this function, memory access functions may still return -EFAULT.
10459 */
10460-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10461+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10462+#define access_ok(type, addr, size) \
10463+({ \
10464+ long __size = size; \
10465+ unsigned long __addr = (unsigned long)addr; \
10466+ unsigned long __addr_ao = __addr & PAGE_MASK; \
10467+ unsigned long __end_ao = __addr + __size - 1; \
10468+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
10469+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
10470+ while(__addr_ao <= __end_ao) { \
10471+ char __c_ao; \
10472+ __addr_ao += PAGE_SIZE; \
10473+ if (__size > PAGE_SIZE) \
10474+ cond_resched(); \
10475+ if (__get_user(__c_ao, (char __user *)__addr)) \
10476+ break; \
10477+ if (type != VERIFY_WRITE) { \
10478+ __addr = __addr_ao; \
10479+ continue; \
10480+ } \
10481+ if (__put_user(__c_ao, (char __user *)__addr)) \
10482+ break; \
10483+ __addr = __addr_ao; \
10484+ } \
10485+ } \
10486+ __ret_ao; \
10487+})
10488
10489 /*
10490 * The exception table consists of pairs of addresses: the first is the
10491@@ -182,12 +216,20 @@ extern int __get_user_bad(void);
10492 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
10493 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
10494
10495-
10496+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10497+#define __copyuser_seg "gs;"
10498+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
10499+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
10500+#else
10501+#define __copyuser_seg
10502+#define __COPYUSER_SET_ES
10503+#define __COPYUSER_RESTORE_ES
10504+#endif
10505
10506 #ifdef CONFIG_X86_32
10507 #define __put_user_asm_u64(x, addr, err, errret) \
10508- asm volatile("1: movl %%eax,0(%2)\n" \
10509- "2: movl %%edx,4(%2)\n" \
10510+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
10511+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
10512 "3:\n" \
10513 ".section .fixup,\"ax\"\n" \
10514 "4: movl %3,%0\n" \
10515@@ -199,8 +241,8 @@ extern int __get_user_bad(void);
10516 : "A" (x), "r" (addr), "i" (errret), "0" (err))
10517
10518 #define __put_user_asm_ex_u64(x, addr) \
10519- asm volatile("1: movl %%eax,0(%1)\n" \
10520- "2: movl %%edx,4(%1)\n" \
10521+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
10522+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
10523 "3:\n" \
10524 _ASM_EXTABLE(1b, 2b - 1b) \
10525 _ASM_EXTABLE(2b, 3b - 2b) \
10526@@ -252,7 +294,7 @@ extern void __put_user_8(void);
10527 __typeof__(*(ptr)) __pu_val; \
10528 __chk_user_ptr(ptr); \
10529 might_fault(); \
10530- __pu_val = x; \
10531+ __pu_val = (x); \
10532 switch (sizeof(*(ptr))) { \
10533 case 1: \
10534 __put_user_x(1, __pu_val, ptr, __ret_pu); \
10535@@ -373,7 +415,7 @@ do { \
10536 } while (0)
10537
10538 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10539- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
10540+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
10541 "2:\n" \
10542 ".section .fixup,\"ax\"\n" \
10543 "3: mov %3,%0\n" \
10544@@ -381,7 +423,7 @@ do { \
10545 " jmp 2b\n" \
10546 ".previous\n" \
10547 _ASM_EXTABLE(1b, 3b) \
10548- : "=r" (err), ltype(x) \
10549+ : "=r" (err), ltype (x) \
10550 : "m" (__m(addr)), "i" (errret), "0" (err))
10551
10552 #define __get_user_size_ex(x, ptr, size) \
10553@@ -406,7 +448,7 @@ do { \
10554 } while (0)
10555
10556 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
10557- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
10558+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
10559 "2:\n" \
10560 _ASM_EXTABLE(1b, 2b - 1b) \
10561 : ltype(x) : "m" (__m(addr)))
10562@@ -423,13 +465,24 @@ do { \
10563 int __gu_err; \
10564 unsigned long __gu_val; \
10565 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
10566- (x) = (__force __typeof__(*(ptr)))__gu_val; \
10567+ (x) = (__typeof__(*(ptr)))__gu_val; \
10568 __gu_err; \
10569 })
10570
10571 /* FIXME: this hack is definitely wrong -AK */
10572 struct __large_struct { unsigned long buf[100]; };
10573-#define __m(x) (*(struct __large_struct __user *)(x))
10574+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10575+#define ____m(x) \
10576+({ \
10577+ unsigned long ____x = (unsigned long)(x); \
10578+ if (____x < PAX_USER_SHADOW_BASE) \
10579+ ____x += PAX_USER_SHADOW_BASE; \
10580+ (void __user *)____x; \
10581+})
10582+#else
10583+#define ____m(x) (x)
10584+#endif
10585+#define __m(x) (*(struct __large_struct __user *)____m(x))
10586
10587 /*
10588 * Tell gcc we read from memory instead of writing: this is because
10589@@ -437,7 +490,7 @@ struct __large_struct { unsigned long buf[100]; };
10590 * aliasing issues.
10591 */
10592 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10593- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
10594+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
10595 "2:\n" \
10596 ".section .fixup,\"ax\"\n" \
10597 "3: mov %3,%0\n" \
10598@@ -445,10 +498,10 @@ struct __large_struct { unsigned long buf[100]; };
10599 ".previous\n" \
10600 _ASM_EXTABLE(1b, 3b) \
10601 : "=r"(err) \
10602- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
10603+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
10604
10605 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
10606- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
10607+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
10608 "2:\n" \
10609 _ASM_EXTABLE(1b, 2b - 1b) \
10610 : : ltype(x), "m" (__m(addr)))
10611@@ -487,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
10612 * On error, the variable @x is set to zero.
10613 */
10614
10615+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10616+#define __get_user(x, ptr) get_user((x), (ptr))
10617+#else
10618 #define __get_user(x, ptr) \
10619 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
10620+#endif
10621
10622 /**
10623 * __put_user: - Write a simple value into user space, with less checking.
10624@@ -510,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
10625 * Returns zero on success, or -EFAULT on error.
10626 */
10627
10628+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10629+#define __put_user(x, ptr) put_user((x), (ptr))
10630+#else
10631 #define __put_user(x, ptr) \
10632 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
10633+#endif
10634
10635 #define __get_user_unaligned __get_user
10636 #define __put_user_unaligned __put_user
10637@@ -529,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
10638 #define get_user_ex(x, ptr) do { \
10639 unsigned long __gue_val; \
10640 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
10641- (x) = (__force __typeof__(*(ptr)))__gue_val; \
10642+ (x) = (__typeof__(*(ptr)))__gue_val; \
10643 } while (0)
10644
10645 #ifdef CONFIG_X86_WP_WORKS_OK
10646diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
10647index 566e803..89f1e60 100644
10648--- a/arch/x86/include/asm/uaccess_32.h
10649+++ b/arch/x86/include/asm/uaccess_32.h
10650@@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
10651 static __always_inline unsigned long __must_check
10652 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10653 {
10654+ pax_track_stack();
10655+
10656+ if ((long)n < 0)
10657+ return n;
10658+
10659 if (__builtin_constant_p(n)) {
10660 unsigned long ret;
10661
10662@@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10663 return ret;
10664 }
10665 }
10666+ if (!__builtin_constant_p(n))
10667+ check_object_size(from, n, true);
10668 return __copy_to_user_ll(to, from, n);
10669 }
10670
10671@@ -82,12 +89,16 @@ static __always_inline unsigned long __must_check
10672 __copy_to_user(void __user *to, const void *from, unsigned long n)
10673 {
10674 might_fault();
10675+
10676 return __copy_to_user_inatomic(to, from, n);
10677 }
10678
10679 static __always_inline unsigned long
10680 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
10681 {
10682+ if ((long)n < 0)
10683+ return n;
10684+
10685 /* Avoid zeroing the tail if the copy fails..
10686 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
10687 * but as the zeroing behaviour is only significant when n is not
10688@@ -137,6 +148,12 @@ static __always_inline unsigned long
10689 __copy_from_user(void *to, const void __user *from, unsigned long n)
10690 {
10691 might_fault();
10692+
10693+ pax_track_stack();
10694+
10695+ if ((long)n < 0)
10696+ return n;
10697+
10698 if (__builtin_constant_p(n)) {
10699 unsigned long ret;
10700
10701@@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
10702 return ret;
10703 }
10704 }
10705+ if (!__builtin_constant_p(n))
10706+ check_object_size(to, n, false);
10707 return __copy_from_user_ll(to, from, n);
10708 }
10709
10710@@ -159,6 +178,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
10711 const void __user *from, unsigned long n)
10712 {
10713 might_fault();
10714+
10715+ if ((long)n < 0)
10716+ return n;
10717+
10718 if (__builtin_constant_p(n)) {
10719 unsigned long ret;
10720
10721@@ -181,15 +204,19 @@ static __always_inline unsigned long
10722 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
10723 unsigned long n)
10724 {
10725- return __copy_from_user_ll_nocache_nozero(to, from, n);
10726+ if ((long)n < 0)
10727+ return n;
10728+
10729+ return __copy_from_user_ll_nocache_nozero(to, from, n);
10730 }
10731
10732-unsigned long __must_check copy_to_user(void __user *to,
10733- const void *from, unsigned long n);
10734-unsigned long __must_check _copy_from_user(void *to,
10735- const void __user *from,
10736- unsigned long n);
10737-
10738+extern void copy_to_user_overflow(void)
10739+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10740+ __compiletime_error("copy_to_user() buffer size is not provably correct")
10741+#else
10742+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
10743+#endif
10744+;
10745
10746 extern void copy_from_user_overflow(void)
10747 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10748@@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void)
10749 #endif
10750 ;
10751
10752-static inline unsigned long __must_check copy_from_user(void *to,
10753- const void __user *from,
10754- unsigned long n)
10755+/**
10756+ * copy_to_user: - Copy a block of data into user space.
10757+ * @to: Destination address, in user space.
10758+ * @from: Source address, in kernel space.
10759+ * @n: Number of bytes to copy.
10760+ *
10761+ * Context: User context only. This function may sleep.
10762+ *
10763+ * Copy data from kernel space to user space.
10764+ *
10765+ * Returns number of bytes that could not be copied.
10766+ * On success, this will be zero.
10767+ */
10768+static inline unsigned long __must_check
10769+copy_to_user(void __user *to, const void *from, unsigned long n)
10770+{
10771+ int sz = __compiletime_object_size(from);
10772+
10773+ if (unlikely(sz != -1 && sz < n))
10774+ copy_to_user_overflow();
10775+ else if (access_ok(VERIFY_WRITE, to, n))
10776+ n = __copy_to_user(to, from, n);
10777+ return n;
10778+}
10779+
10780+/**
10781+ * copy_from_user: - Copy a block of data from user space.
10782+ * @to: Destination address, in kernel space.
10783+ * @from: Source address, in user space.
10784+ * @n: Number of bytes to copy.
10785+ *
10786+ * Context: User context only. This function may sleep.
10787+ *
10788+ * Copy data from user space to kernel space.
10789+ *
10790+ * Returns number of bytes that could not be copied.
10791+ * On success, this will be zero.
10792+ *
10793+ * If some data could not be copied, this function will pad the copied
10794+ * data to the requested size using zero bytes.
10795+ */
10796+static inline unsigned long __must_check
10797+copy_from_user(void *to, const void __user *from, unsigned long n)
10798 {
10799 int sz = __compiletime_object_size(to);
10800
10801- if (likely(sz == -1 || sz >= n))
10802- n = _copy_from_user(to, from, n);
10803- else
10804+ if (unlikely(sz != -1 && sz < n))
10805 copy_from_user_overflow();
10806-
10807+ else if (access_ok(VERIFY_READ, from, n))
10808+ n = __copy_from_user(to, from, n);
10809+ else if ((long)n > 0) {
10810+ if (!__builtin_constant_p(n))
10811+ check_object_size(to, n, false);
10812+ memset(to, 0, n);
10813+ }
10814 return n;
10815 }
10816
10817diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
10818index 1c66d30..59bd7d4 100644
10819--- a/arch/x86/include/asm/uaccess_64.h
10820+++ b/arch/x86/include/asm/uaccess_64.h
10821@@ -10,6 +10,9 @@
10822 #include <asm/alternative.h>
10823 #include <asm/cpufeature.h>
10824 #include <asm/page.h>
10825+#include <asm/pgtable.h>
10826+
10827+#define set_fs(x) (current_thread_info()->addr_limit = (x))
10828
10829 /*
10830 * Copy To/From Userspace
10831@@ -17,12 +20,12 @@
10832
10833 /* Handles exceptions in both to and from, but doesn't do access_ok */
10834 __must_check unsigned long
10835-copy_user_generic_string(void *to, const void *from, unsigned len);
10836+copy_user_generic_string(void *to, const void *from, unsigned long len);
10837 __must_check unsigned long
10838-copy_user_generic_unrolled(void *to, const void *from, unsigned len);
10839+copy_user_generic_unrolled(void *to, const void *from, unsigned long len);
10840
10841 static __always_inline __must_check unsigned long
10842-copy_user_generic(void *to, const void *from, unsigned len)
10843+copy_user_generic(void *to, const void *from, unsigned long len)
10844 {
10845 unsigned ret;
10846
10847@@ -36,138 +39,226 @@ copy_user_generic(void *to, const void *from, unsigned len)
10848 return ret;
10849 }
10850
10851+static __always_inline __must_check unsigned long
10852+__copy_to_user(void __user *to, const void *from, unsigned long len);
10853+static __always_inline __must_check unsigned long
10854+__copy_from_user(void *to, const void __user *from, unsigned long len);
10855 __must_check unsigned long
10856-_copy_to_user(void __user *to, const void *from, unsigned len);
10857-__must_check unsigned long
10858-_copy_from_user(void *to, const void __user *from, unsigned len);
10859-__must_check unsigned long
10860-copy_in_user(void __user *to, const void __user *from, unsigned len);
10861+copy_in_user(void __user *to, const void __user *from, unsigned long len);
10862
10863 static inline unsigned long __must_check copy_from_user(void *to,
10864 const void __user *from,
10865- unsigned long n)
10866+ unsigned n)
10867 {
10868- int sz = __compiletime_object_size(to);
10869-
10870 might_fault();
10871- if (likely(sz == -1 || sz >= n))
10872- n = _copy_from_user(to, from, n);
10873-#ifdef CONFIG_DEBUG_VM
10874- else
10875- WARN(1, "Buffer overflow detected!\n");
10876-#endif
10877+
10878+ if (access_ok(VERIFY_READ, from, n))
10879+ n = __copy_from_user(to, from, n);
10880+ else if (n < INT_MAX) {
10881+ if (!__builtin_constant_p(n))
10882+ check_object_size(to, n, false);
10883+ memset(to, 0, n);
10884+ }
10885 return n;
10886 }
10887
10888 static __always_inline __must_check
10889-int copy_to_user(void __user *dst, const void *src, unsigned size)
10890+int copy_to_user(void __user *dst, const void *src, unsigned long size)
10891 {
10892 might_fault();
10893
10894- return _copy_to_user(dst, src, size);
10895+ if (access_ok(VERIFY_WRITE, dst, size))
10896+ size = __copy_to_user(dst, src, size);
10897+ return size;
10898 }
10899
10900 static __always_inline __must_check
10901-int __copy_from_user(void *dst, const void __user *src, unsigned size)
10902+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
10903 {
10904- int ret = 0;
10905+ int sz = __compiletime_object_size(dst);
10906+ unsigned ret = 0;
10907
10908 might_fault();
10909- if (!__builtin_constant_p(size))
10910- return copy_user_generic(dst, (__force void *)src, size);
10911+
10912+ pax_track_stack();
10913+
10914+ if (size > INT_MAX)
10915+ return size;
10916+
10917+#ifdef CONFIG_PAX_MEMORY_UDEREF
10918+ if (!__access_ok(VERIFY_READ, src, size))
10919+ return size;
10920+#endif
10921+
10922+ if (unlikely(sz != -1 && sz < size)) {
10923+#ifdef CONFIG_DEBUG_VM
10924+ WARN(1, "Buffer overflow detected!\n");
10925+#endif
10926+ return size;
10927+ }
10928+
10929+ if (!__builtin_constant_p(size)) {
10930+ check_object_size(dst, size, false);
10931+
10932+#ifdef CONFIG_PAX_MEMORY_UDEREF
10933+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10934+ src += PAX_USER_SHADOW_BASE;
10935+#endif
10936+
10937+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
10938+ }
10939 switch (size) {
10940- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
10941+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
10942 ret, "b", "b", "=q", 1);
10943 return ret;
10944- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
10945+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
10946 ret, "w", "w", "=r", 2);
10947 return ret;
10948- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
10949+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
10950 ret, "l", "k", "=r", 4);
10951 return ret;
10952- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
10953+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10954 ret, "q", "", "=r", 8);
10955 return ret;
10956 case 10:
10957- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10958+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10959 ret, "q", "", "=r", 10);
10960 if (unlikely(ret))
10961 return ret;
10962 __get_user_asm(*(u16 *)(8 + (char *)dst),
10963- (u16 __user *)(8 + (char __user *)src),
10964+ (const u16 __user *)(8 + (const char __user *)src),
10965 ret, "w", "w", "=r", 2);
10966 return ret;
10967 case 16:
10968- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10969+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10970 ret, "q", "", "=r", 16);
10971 if (unlikely(ret))
10972 return ret;
10973 __get_user_asm(*(u64 *)(8 + (char *)dst),
10974- (u64 __user *)(8 + (char __user *)src),
10975+ (const u64 __user *)(8 + (const char __user *)src),
10976 ret, "q", "", "=r", 8);
10977 return ret;
10978 default:
10979- return copy_user_generic(dst, (__force void *)src, size);
10980+
10981+#ifdef CONFIG_PAX_MEMORY_UDEREF
10982+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10983+ src += PAX_USER_SHADOW_BASE;
10984+#endif
10985+
10986+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
10987 }
10988 }
10989
10990 static __always_inline __must_check
10991-int __copy_to_user(void __user *dst, const void *src, unsigned size)
10992+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
10993 {
10994- int ret = 0;
10995+ int sz = __compiletime_object_size(src);
10996+ unsigned ret = 0;
10997
10998 might_fault();
10999- if (!__builtin_constant_p(size))
11000- return copy_user_generic((__force void *)dst, src, size);
11001+
11002+ pax_track_stack();
11003+
11004+ if (size > INT_MAX)
11005+ return size;
11006+
11007+#ifdef CONFIG_PAX_MEMORY_UDEREF
11008+ if (!__access_ok(VERIFY_WRITE, dst, size))
11009+ return size;
11010+#endif
11011+
11012+ if (unlikely(sz != -1 && sz < size)) {
11013+#ifdef CONFIG_DEBUG_VM
11014+ WARN(1, "Buffer overflow detected!\n");
11015+#endif
11016+ return size;
11017+ }
11018+
11019+ if (!__builtin_constant_p(size)) {
11020+ check_object_size(src, size, true);
11021+
11022+#ifdef CONFIG_PAX_MEMORY_UDEREF
11023+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11024+ dst += PAX_USER_SHADOW_BASE;
11025+#endif
11026+
11027+ return copy_user_generic((__force_kernel void *)dst, src, size);
11028+ }
11029 switch (size) {
11030- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11031+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11032 ret, "b", "b", "iq", 1);
11033 return ret;
11034- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11035+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11036 ret, "w", "w", "ir", 2);
11037 return ret;
11038- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11039+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11040 ret, "l", "k", "ir", 4);
11041 return ret;
11042- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11043+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11044 ret, "q", "", "er", 8);
11045 return ret;
11046 case 10:
11047- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11048+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11049 ret, "q", "", "er", 10);
11050 if (unlikely(ret))
11051 return ret;
11052 asm("":::"memory");
11053- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11054+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11055 ret, "w", "w", "ir", 2);
11056 return ret;
11057 case 16:
11058- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11059+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11060 ret, "q", "", "er", 16);
11061 if (unlikely(ret))
11062 return ret;
11063 asm("":::"memory");
11064- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11065+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11066 ret, "q", "", "er", 8);
11067 return ret;
11068 default:
11069- return copy_user_generic((__force void *)dst, src, size);
11070+
11071+#ifdef CONFIG_PAX_MEMORY_UDEREF
11072+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11073+ dst += PAX_USER_SHADOW_BASE;
11074+#endif
11075+
11076+ return copy_user_generic((__force_kernel void *)dst, src, size);
11077 }
11078 }
11079
11080 static __always_inline __must_check
11081-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11082+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
11083 {
11084- int ret = 0;
11085+ unsigned ret = 0;
11086
11087 might_fault();
11088- if (!__builtin_constant_p(size))
11089- return copy_user_generic((__force void *)dst,
11090- (__force void *)src, size);
11091+
11092+ if (size > INT_MAX)
11093+ return size;
11094+
11095+#ifdef CONFIG_PAX_MEMORY_UDEREF
11096+ if (!__access_ok(VERIFY_READ, src, size))
11097+ return size;
11098+ if (!__access_ok(VERIFY_WRITE, dst, size))
11099+ return size;
11100+#endif
11101+
11102+ if (!__builtin_constant_p(size)) {
11103+
11104+#ifdef CONFIG_PAX_MEMORY_UDEREF
11105+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11106+ src += PAX_USER_SHADOW_BASE;
11107+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11108+ dst += PAX_USER_SHADOW_BASE;
11109+#endif
11110+
11111+ return copy_user_generic((__force_kernel void *)dst,
11112+ (__force_kernel const void *)src, size);
11113+ }
11114 switch (size) {
11115 case 1: {
11116 u8 tmp;
11117- __get_user_asm(tmp, (u8 __user *)src,
11118+ __get_user_asm(tmp, (const u8 __user *)src,
11119 ret, "b", "b", "=q", 1);
11120 if (likely(!ret))
11121 __put_user_asm(tmp, (u8 __user *)dst,
11122@@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11123 }
11124 case 2: {
11125 u16 tmp;
11126- __get_user_asm(tmp, (u16 __user *)src,
11127+ __get_user_asm(tmp, (const u16 __user *)src,
11128 ret, "w", "w", "=r", 2);
11129 if (likely(!ret))
11130 __put_user_asm(tmp, (u16 __user *)dst,
11131@@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11132
11133 case 4: {
11134 u32 tmp;
11135- __get_user_asm(tmp, (u32 __user *)src,
11136+ __get_user_asm(tmp, (const u32 __user *)src,
11137 ret, "l", "k", "=r", 4);
11138 if (likely(!ret))
11139 __put_user_asm(tmp, (u32 __user *)dst,
11140@@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11141 }
11142 case 8: {
11143 u64 tmp;
11144- __get_user_asm(tmp, (u64 __user *)src,
11145+ __get_user_asm(tmp, (const u64 __user *)src,
11146 ret, "q", "", "=r", 8);
11147 if (likely(!ret))
11148 __put_user_asm(tmp, (u64 __user *)dst,
11149@@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11150 return ret;
11151 }
11152 default:
11153- return copy_user_generic((__force void *)dst,
11154- (__force void *)src, size);
11155+
11156+#ifdef CONFIG_PAX_MEMORY_UDEREF
11157+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11158+ src += PAX_USER_SHADOW_BASE;
11159+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11160+ dst += PAX_USER_SHADOW_BASE;
11161+#endif
11162+
11163+ return copy_user_generic((__force_kernel void *)dst,
11164+ (__force_kernel const void *)src, size);
11165 }
11166 }
11167
11168@@ -219,35 +318,74 @@ __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11169 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11170
11171 static __must_check __always_inline int
11172-__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11173+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
11174 {
11175- return copy_user_generic(dst, (__force const void *)src, size);
11176+ pax_track_stack();
11177+
11178+ if (size > INT_MAX)
11179+ return size;
11180+
11181+#ifdef CONFIG_PAX_MEMORY_UDEREF
11182+ if (!__access_ok(VERIFY_READ, src, size))
11183+ return size;
11184+
11185+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11186+ src += PAX_USER_SHADOW_BASE;
11187+#endif
11188+
11189+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
11190 }
11191
11192-static __must_check __always_inline int
11193-__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11194+static __must_check __always_inline unsigned long
11195+__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
11196 {
11197- return copy_user_generic((__force void *)dst, src, size);
11198+ if (size > INT_MAX)
11199+ return size;
11200+
11201+#ifdef CONFIG_PAX_MEMORY_UDEREF
11202+ if (!__access_ok(VERIFY_WRITE, dst, size))
11203+ return size;
11204+
11205+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11206+ dst += PAX_USER_SHADOW_BASE;
11207+#endif
11208+
11209+ return copy_user_generic((__force_kernel void *)dst, src, size);
11210 }
11211
11212-extern long __copy_user_nocache(void *dst, const void __user *src,
11213- unsigned size, int zerorest);
11214+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11215+ unsigned long size, int zerorest);
11216
11217-static inline int
11218-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11219+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
11220 {
11221 might_sleep();
11222+
11223+ if (size > INT_MAX)
11224+ return size;
11225+
11226+#ifdef CONFIG_PAX_MEMORY_UDEREF
11227+ if (!__access_ok(VERIFY_READ, src, size))
11228+ return size;
11229+#endif
11230+
11231 return __copy_user_nocache(dst, src, size, 1);
11232 }
11233
11234-static inline int
11235-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11236- unsigned size)
11237+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11238+ unsigned long size)
11239 {
11240+ if (size > INT_MAX)
11241+ return size;
11242+
11243+#ifdef CONFIG_PAX_MEMORY_UDEREF
11244+ if (!__access_ok(VERIFY_READ, src, size))
11245+ return size;
11246+#endif
11247+
11248 return __copy_user_nocache(dst, src, size, 0);
11249 }
11250
11251-unsigned long
11252-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11253+extern unsigned long
11254+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest);
11255
11256 #endif /* _ASM_X86_UACCESS_64_H */
11257diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
11258index bb05228..d763d5b 100644
11259--- a/arch/x86/include/asm/vdso.h
11260+++ b/arch/x86/include/asm/vdso.h
11261@@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
11262 #define VDSO32_SYMBOL(base, name) \
11263 ({ \
11264 extern const char VDSO32_##name[]; \
11265- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11266+ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11267 })
11268 #endif
11269
11270diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
11271index d3d8590..d296b5f 100644
11272--- a/arch/x86/include/asm/x86_init.h
11273+++ b/arch/x86/include/asm/x86_init.h
11274@@ -28,7 +28,7 @@ struct x86_init_mpparse {
11275 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11276 void (*find_smp_config)(void);
11277 void (*get_smp_config)(unsigned int early);
11278-};
11279+} __no_const;
11280
11281 /**
11282 * struct x86_init_resources - platform specific resource related ops
11283@@ -42,7 +42,7 @@ struct x86_init_resources {
11284 void (*probe_roms)(void);
11285 void (*reserve_resources)(void);
11286 char *(*memory_setup)(void);
11287-};
11288+} __no_const;
11289
11290 /**
11291 * struct x86_init_irqs - platform specific interrupt setup
11292@@ -55,7 +55,7 @@ struct x86_init_irqs {
11293 void (*pre_vector_init)(void);
11294 void (*intr_init)(void);
11295 void (*trap_init)(void);
11296-};
11297+} __no_const;
11298
11299 /**
11300 * struct x86_init_oem - oem platform specific customizing functions
11301@@ -65,7 +65,7 @@ struct x86_init_irqs {
11302 struct x86_init_oem {
11303 void (*arch_setup)(void);
11304 void (*banner)(void);
11305-};
11306+} __no_const;
11307
11308 /**
11309 * struct x86_init_mapping - platform specific initial kernel pagetable setup
11310@@ -76,7 +76,7 @@ struct x86_init_oem {
11311 */
11312 struct x86_init_mapping {
11313 void (*pagetable_reserve)(u64 start, u64 end);
11314-};
11315+} __no_const;
11316
11317 /**
11318 * struct x86_init_paging - platform specific paging functions
11319@@ -86,7 +86,7 @@ struct x86_init_mapping {
11320 struct x86_init_paging {
11321 void (*pagetable_setup_start)(pgd_t *base);
11322 void (*pagetable_setup_done)(pgd_t *base);
11323-};
11324+} __no_const;
11325
11326 /**
11327 * struct x86_init_timers - platform specific timer setup
11328@@ -101,7 +101,7 @@ struct x86_init_timers {
11329 void (*tsc_pre_init)(void);
11330 void (*timer_init)(void);
11331 void (*wallclock_init)(void);
11332-};
11333+} __no_const;
11334
11335 /**
11336 * struct x86_init_iommu - platform specific iommu setup
11337@@ -109,7 +109,7 @@ struct x86_init_timers {
11338 */
11339 struct x86_init_iommu {
11340 int (*iommu_init)(void);
11341-};
11342+} __no_const;
11343
11344 /**
11345 * struct x86_init_pci - platform specific pci init functions
11346@@ -123,7 +123,7 @@ struct x86_init_pci {
11347 int (*init)(void);
11348 void (*init_irq)(void);
11349 void (*fixup_irqs)(void);
11350-};
11351+} __no_const;
11352
11353 /**
11354 * struct x86_init_ops - functions for platform specific setup
11355@@ -139,7 +139,7 @@ struct x86_init_ops {
11356 struct x86_init_timers timers;
11357 struct x86_init_iommu iommu;
11358 struct x86_init_pci pci;
11359-};
11360+} __no_const;
11361
11362 /**
11363 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11364@@ -147,7 +147,7 @@ struct x86_init_ops {
11365 */
11366 struct x86_cpuinit_ops {
11367 void (*setup_percpu_clockev)(void);
11368-};
11369+} __no_const;
11370
11371 /**
11372 * struct x86_platform_ops - platform specific runtime functions
11373@@ -166,7 +166,7 @@ struct x86_platform_ops {
11374 bool (*is_untracked_pat_range)(u64 start, u64 end);
11375 void (*nmi_init)(void);
11376 int (*i8042_detect)(void);
11377-};
11378+} __no_const;
11379
11380 struct pci_dev;
11381
11382@@ -174,7 +174,7 @@ struct x86_msi_ops {
11383 int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
11384 void (*teardown_msi_irq)(unsigned int irq);
11385 void (*teardown_msi_irqs)(struct pci_dev *dev);
11386-};
11387+} __no_const;
11388
11389 extern struct x86_init_ops x86_init;
11390 extern struct x86_cpuinit_ops x86_cpuinit;
11391diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
11392index c6ce245..ffbdab7 100644
11393--- a/arch/x86/include/asm/xsave.h
11394+++ b/arch/x86/include/asm/xsave.h
11395@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11396 {
11397 int err;
11398
11399+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11400+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11401+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11402+#endif
11403+
11404 /*
11405 * Clear the xsave header first, so that reserved fields are
11406 * initialized to zero.
11407@@ -96,10 +101,15 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11408 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
11409 {
11410 int err;
11411- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
11412+ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
11413 u32 lmask = mask;
11414 u32 hmask = mask >> 32;
11415
11416+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11417+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11418+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11419+#endif
11420+
11421 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11422 "2:\n"
11423 ".section .fixup,\"ax\"\n"
11424diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
11425index 6a564ac..9b1340c 100644
11426--- a/arch/x86/kernel/acpi/realmode/Makefile
11427+++ b/arch/x86/kernel/acpi/realmode/Makefile
11428@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \
11429 $(call cc-option, -fno-stack-protector) \
11430 $(call cc-option, -mpreferred-stack-boundary=2)
11431 KBUILD_CFLAGS += $(call cc-option, -m32)
11432+ifdef CONSTIFY_PLUGIN
11433+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
11434+endif
11435 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
11436 GCOV_PROFILE := n
11437
11438diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
11439index b4fd836..4358fe3 100644
11440--- a/arch/x86/kernel/acpi/realmode/wakeup.S
11441+++ b/arch/x86/kernel/acpi/realmode/wakeup.S
11442@@ -108,6 +108,9 @@ wakeup_code:
11443 /* Do any other stuff... */
11444
11445 #ifndef CONFIG_64BIT
11446+ /* Recheck NX bit overrides (64bit path does this in trampoline */
11447+ call verify_cpu
11448+
11449 /* This could also be done in C code... */
11450 movl pmode_cr3, %eax
11451 movl %eax, %cr3
11452@@ -131,6 +134,7 @@ wakeup_code:
11453 movl pmode_cr0, %eax
11454 movl %eax, %cr0
11455 jmp pmode_return
11456+# include "../../verify_cpu.S"
11457 #else
11458 pushw $0
11459 pushw trampoline_segment
11460diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
11461index 103b6ab..2004d0a 100644
11462--- a/arch/x86/kernel/acpi/sleep.c
11463+++ b/arch/x86/kernel/acpi/sleep.c
11464@@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void)
11465 header->trampoline_segment = trampoline_address() >> 4;
11466 #ifdef CONFIG_SMP
11467 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
11468+
11469+ pax_open_kernel();
11470 early_gdt_descr.address =
11471 (unsigned long)get_cpu_gdt_table(smp_processor_id());
11472+ pax_close_kernel();
11473+
11474 initial_gs = per_cpu_offset(smp_processor_id());
11475 #endif
11476 initial_code = (unsigned long)wakeup_long64;
11477diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
11478index 13ab720..95d5442 100644
11479--- a/arch/x86/kernel/acpi/wakeup_32.S
11480+++ b/arch/x86/kernel/acpi/wakeup_32.S
11481@@ -30,13 +30,11 @@ wakeup_pmode_return:
11482 # and restore the stack ... but you need gdt for this to work
11483 movl saved_context_esp, %esp
11484
11485- movl %cs:saved_magic, %eax
11486- cmpl $0x12345678, %eax
11487+ cmpl $0x12345678, saved_magic
11488 jne bogus_magic
11489
11490 # jump to place where we left off
11491- movl saved_eip, %eax
11492- jmp *%eax
11493+ jmp *(saved_eip)
11494
11495 bogus_magic:
11496 jmp bogus_magic
11497diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
11498index c638228..16dfa8d 100644
11499--- a/arch/x86/kernel/alternative.c
11500+++ b/arch/x86/kernel/alternative.c
11501@@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
11502 */
11503 for (a = start; a < end; a++) {
11504 instr = (u8 *)&a->instr_offset + a->instr_offset;
11505+
11506+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11507+ instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11508+ if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
11509+ instr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11510+#endif
11511+
11512 replacement = (u8 *)&a->repl_offset + a->repl_offset;
11513 BUG_ON(a->replacementlen > a->instrlen);
11514 BUG_ON(a->instrlen > sizeof(insnbuf));
11515@@ -307,10 +314,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
11516 for (poff = start; poff < end; poff++) {
11517 u8 *ptr = (u8 *)poff + *poff;
11518
11519+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11520+ ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11521+ if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11522+ ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11523+#endif
11524+
11525 if (!*poff || ptr < text || ptr >= text_end)
11526 continue;
11527 /* turn DS segment override prefix into lock prefix */
11528- if (*ptr == 0x3e)
11529+ if (*ktla_ktva(ptr) == 0x3e)
11530 text_poke(ptr, ((unsigned char []){0xf0}), 1);
11531 };
11532 mutex_unlock(&text_mutex);
11533@@ -328,10 +341,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
11534 for (poff = start; poff < end; poff++) {
11535 u8 *ptr = (u8 *)poff + *poff;
11536
11537+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11538+ ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11539+ if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11540+ ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11541+#endif
11542+
11543 if (!*poff || ptr < text || ptr >= text_end)
11544 continue;
11545 /* turn lock prefix into DS segment override prefix */
11546- if (*ptr == 0xf0)
11547+ if (*ktla_ktva(ptr) == 0xf0)
11548 text_poke(ptr, ((unsigned char []){0x3E}), 1);
11549 };
11550 mutex_unlock(&text_mutex);
11551@@ -500,7 +519,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
11552
11553 BUG_ON(p->len > MAX_PATCH_LEN);
11554 /* prep the buffer with the original instructions */
11555- memcpy(insnbuf, p->instr, p->len);
11556+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
11557 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
11558 (unsigned long)p->instr, p->len);
11559
11560@@ -568,7 +587,7 @@ void __init alternative_instructions(void)
11561 if (smp_alt_once)
11562 free_init_pages("SMP alternatives",
11563 (unsigned long)__smp_locks,
11564- (unsigned long)__smp_locks_end);
11565+ PAGE_ALIGN((unsigned long)__smp_locks_end));
11566
11567 restart_nmi();
11568 }
11569@@ -585,13 +604,17 @@ void __init alternative_instructions(void)
11570 * instructions. And on the local CPU you need to be protected again NMI or MCE
11571 * handlers seeing an inconsistent instruction while you patch.
11572 */
11573-void *__init_or_module text_poke_early(void *addr, const void *opcode,
11574+void *__kprobes text_poke_early(void *addr, const void *opcode,
11575 size_t len)
11576 {
11577 unsigned long flags;
11578 local_irq_save(flags);
11579- memcpy(addr, opcode, len);
11580+
11581+ pax_open_kernel();
11582+ memcpy(ktla_ktva(addr), opcode, len);
11583 sync_core();
11584+ pax_close_kernel();
11585+
11586 local_irq_restore(flags);
11587 /* Could also do a CLFLUSH here to speed up CPU recovery; but
11588 that causes hangs on some VIA CPUs. */
11589@@ -613,36 +636,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
11590 */
11591 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
11592 {
11593- unsigned long flags;
11594- char *vaddr;
11595+ unsigned char *vaddr = ktla_ktva(addr);
11596 struct page *pages[2];
11597- int i;
11598+ size_t i;
11599
11600 if (!core_kernel_text((unsigned long)addr)) {
11601- pages[0] = vmalloc_to_page(addr);
11602- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
11603+ pages[0] = vmalloc_to_page(vaddr);
11604+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
11605 } else {
11606- pages[0] = virt_to_page(addr);
11607+ pages[0] = virt_to_page(vaddr);
11608 WARN_ON(!PageReserved(pages[0]));
11609- pages[1] = virt_to_page(addr + PAGE_SIZE);
11610+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
11611 }
11612 BUG_ON(!pages[0]);
11613- local_irq_save(flags);
11614- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
11615- if (pages[1])
11616- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
11617- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
11618- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
11619- clear_fixmap(FIX_TEXT_POKE0);
11620- if (pages[1])
11621- clear_fixmap(FIX_TEXT_POKE1);
11622- local_flush_tlb();
11623- sync_core();
11624- /* Could also do a CLFLUSH here to speed up CPU recovery; but
11625- that causes hangs on some VIA CPUs. */
11626+ text_poke_early(addr, opcode, len);
11627 for (i = 0; i < len; i++)
11628- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
11629- local_irq_restore(flags);
11630+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
11631 return addr;
11632 }
11633
11634diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
11635index 52fa563..5de9d9c 100644
11636--- a/arch/x86/kernel/apic/apic.c
11637+++ b/arch/x86/kernel/apic/apic.c
11638@@ -174,7 +174,7 @@ int first_system_vector = 0xfe;
11639 /*
11640 * Debug level, exported for io_apic.c
11641 */
11642-unsigned int apic_verbosity;
11643+int apic_verbosity;
11644
11645 int pic_mode;
11646
11647@@ -1835,7 +1835,7 @@ void smp_error_interrupt(struct pt_regs *regs)
11648 apic_write(APIC_ESR, 0);
11649 v1 = apic_read(APIC_ESR);
11650 ack_APIC_irq();
11651- atomic_inc(&irq_err_count);
11652+ atomic_inc_unchecked(&irq_err_count);
11653
11654 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
11655 smp_processor_id(), v0 , v1);
11656@@ -2209,6 +2209,8 @@ static int __cpuinit apic_cluster_num(void)
11657 u16 *bios_cpu_apicid;
11658 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
11659
11660+ pax_track_stack();
11661+
11662 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
11663 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
11664
11665diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
11666index 8eb863e..32e6934 100644
11667--- a/arch/x86/kernel/apic/io_apic.c
11668+++ b/arch/x86/kernel/apic/io_apic.c
11669@@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
11670 }
11671 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
11672
11673-void lock_vector_lock(void)
11674+void lock_vector_lock(void) __acquires(vector_lock)
11675 {
11676 /* Used to the online set of cpus does not change
11677 * during assign_irq_vector.
11678@@ -1036,7 +1036,7 @@ void lock_vector_lock(void)
11679 raw_spin_lock(&vector_lock);
11680 }
11681
11682-void unlock_vector_lock(void)
11683+void unlock_vector_lock(void) __releases(vector_lock)
11684 {
11685 raw_spin_unlock(&vector_lock);
11686 }
11687@@ -2405,7 +2405,7 @@ static void ack_apic_edge(struct irq_data *data)
11688 ack_APIC_irq();
11689 }
11690
11691-atomic_t irq_mis_count;
11692+atomic_unchecked_t irq_mis_count;
11693
11694 /*
11695 * IO-APIC versions below 0x20 don't support EOI register.
11696@@ -2513,7 +2513,7 @@ static void ack_apic_level(struct irq_data *data)
11697 * at the cpu.
11698 */
11699 if (!(v & (1 << (i & 0x1f)))) {
11700- atomic_inc(&irq_mis_count);
11701+ atomic_inc_unchecked(&irq_mis_count);
11702
11703 eoi_ioapic_irq(irq, cfg);
11704 }
11705diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
11706index 0371c48..54cdf63 100644
11707--- a/arch/x86/kernel/apm_32.c
11708+++ b/arch/x86/kernel/apm_32.c
11709@@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex);
11710 * This is for buggy BIOS's that refer to (real mode) segment 0x40
11711 * even though they are called in protected mode.
11712 */
11713-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
11714+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
11715 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
11716
11717 static const char driver_version[] = "1.16ac"; /* no spaces */
11718@@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call)
11719 BUG_ON(cpu != 0);
11720 gdt = get_cpu_gdt_table(cpu);
11721 save_desc_40 = gdt[0x40 / 8];
11722+
11723+ pax_open_kernel();
11724 gdt[0x40 / 8] = bad_bios_desc;
11725+ pax_close_kernel();
11726
11727 apm_irq_save(flags);
11728 APM_DO_SAVE_SEGS;
11729@@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call)
11730 &call->esi);
11731 APM_DO_RESTORE_SEGS;
11732 apm_irq_restore(flags);
11733+
11734+ pax_open_kernel();
11735 gdt[0x40 / 8] = save_desc_40;
11736+ pax_close_kernel();
11737+
11738 put_cpu();
11739
11740 return call->eax & 0xff;
11741@@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void *_call)
11742 BUG_ON(cpu != 0);
11743 gdt = get_cpu_gdt_table(cpu);
11744 save_desc_40 = gdt[0x40 / 8];
11745+
11746+ pax_open_kernel();
11747 gdt[0x40 / 8] = bad_bios_desc;
11748+ pax_close_kernel();
11749
11750 apm_irq_save(flags);
11751 APM_DO_SAVE_SEGS;
11752@@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void *_call)
11753 &call->eax);
11754 APM_DO_RESTORE_SEGS;
11755 apm_irq_restore(flags);
11756+
11757+ pax_open_kernel();
11758 gdt[0x40 / 8] = save_desc_40;
11759+ pax_close_kernel();
11760+
11761 put_cpu();
11762 return error;
11763 }
11764@@ -2349,12 +2363,15 @@ static int __init apm_init(void)
11765 * code to that CPU.
11766 */
11767 gdt = get_cpu_gdt_table(0);
11768+
11769+ pax_open_kernel();
11770 set_desc_base(&gdt[APM_CS >> 3],
11771 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
11772 set_desc_base(&gdt[APM_CS_16 >> 3],
11773 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
11774 set_desc_base(&gdt[APM_DS >> 3],
11775 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
11776+ pax_close_kernel();
11777
11778 proc_create("apm", 0, NULL, &apm_file_ops);
11779
11780diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
11781index 4f13faf..87db5d2 100644
11782--- a/arch/x86/kernel/asm-offsets.c
11783+++ b/arch/x86/kernel/asm-offsets.c
11784@@ -33,6 +33,8 @@ void common(void) {
11785 OFFSET(TI_status, thread_info, status);
11786 OFFSET(TI_addr_limit, thread_info, addr_limit);
11787 OFFSET(TI_preempt_count, thread_info, preempt_count);
11788+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
11789+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
11790
11791 BLANK();
11792 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
11793@@ -53,8 +55,26 @@ void common(void) {
11794 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
11795 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
11796 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
11797+
11798+#ifdef CONFIG_PAX_KERNEXEC
11799+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
11800 #endif
11801
11802+#ifdef CONFIG_PAX_MEMORY_UDEREF
11803+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
11804+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
11805+#ifdef CONFIG_X86_64
11806+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
11807+#endif
11808+#endif
11809+
11810+#endif
11811+
11812+ BLANK();
11813+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
11814+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
11815+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
11816+
11817 #ifdef CONFIG_XEN
11818 BLANK();
11819 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
11820diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
11821index e72a119..6e2955d 100644
11822--- a/arch/x86/kernel/asm-offsets_64.c
11823+++ b/arch/x86/kernel/asm-offsets_64.c
11824@@ -69,6 +69,7 @@ int main(void)
11825 BLANK();
11826 #undef ENTRY
11827
11828+ DEFINE(TSS_size, sizeof(struct tss_struct));
11829 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
11830 BLANK();
11831
11832diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
11833index 6042981..e638266 100644
11834--- a/arch/x86/kernel/cpu/Makefile
11835+++ b/arch/x86/kernel/cpu/Makefile
11836@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
11837 CFLAGS_REMOVE_perf_event.o = -pg
11838 endif
11839
11840-# Make sure load_percpu_segment has no stackprotector
11841-nostackp := $(call cc-option, -fno-stack-protector)
11842-CFLAGS_common.o := $(nostackp)
11843-
11844 obj-y := intel_cacheinfo.o scattered.o topology.o
11845 obj-y += proc.o capflags.o powerflags.o common.o
11846 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
11847diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
11848index b13ed39..603286c 100644
11849--- a/arch/x86/kernel/cpu/amd.c
11850+++ b/arch/x86/kernel/cpu/amd.c
11851@@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
11852 unsigned int size)
11853 {
11854 /* AMD errata T13 (order #21922) */
11855- if ((c->x86 == 6)) {
11856+ if (c->x86 == 6) {
11857 /* Duron Rev A0 */
11858 if (c->x86_model == 3 && c->x86_mask == 0)
11859 size = 64;
11860diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
11861index 6218439..0f1addc 100644
11862--- a/arch/x86/kernel/cpu/common.c
11863+++ b/arch/x86/kernel/cpu/common.c
11864@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
11865
11866 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
11867
11868-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
11869-#ifdef CONFIG_X86_64
11870- /*
11871- * We need valid kernel segments for data and code in long mode too
11872- * IRET will check the segment types kkeil 2000/10/28
11873- * Also sysret mandates a special GDT layout
11874- *
11875- * TLS descriptors are currently at a different place compared to i386.
11876- * Hopefully nobody expects them at a fixed place (Wine?)
11877- */
11878- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
11879- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
11880- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
11881- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
11882- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
11883- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
11884-#else
11885- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
11886- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11887- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
11888- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
11889- /*
11890- * Segments used for calling PnP BIOS have byte granularity.
11891- * They code segments and data segments have fixed 64k limits,
11892- * the transfer segment sizes are set at run time.
11893- */
11894- /* 32-bit code */
11895- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11896- /* 16-bit code */
11897- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11898- /* 16-bit data */
11899- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
11900- /* 16-bit data */
11901- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
11902- /* 16-bit data */
11903- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
11904- /*
11905- * The APM segments have byte granularity and their bases
11906- * are set at run time. All have 64k limits.
11907- */
11908- /* 32-bit code */
11909- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11910- /* 16-bit code */
11911- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11912- /* data */
11913- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
11914-
11915- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11916- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11917- GDT_STACK_CANARY_INIT
11918-#endif
11919-} };
11920-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
11921-
11922 static int __init x86_xsave_setup(char *s)
11923 {
11924 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
11925@@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu)
11926 {
11927 struct desc_ptr gdt_descr;
11928
11929- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
11930+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
11931 gdt_descr.size = GDT_SIZE - 1;
11932 load_gdt(&gdt_descr);
11933 /* Reload the per-cpu base */
11934@@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
11935 /* Filter out anything that depends on CPUID levels we don't have */
11936 filter_cpuid_features(c, true);
11937
11938+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
11939+ setup_clear_cpu_cap(X86_FEATURE_SEP);
11940+#endif
11941+
11942 /* If the model name is still unset, do table lookup. */
11943 if (!c->x86_model_id[0]) {
11944 const char *p;
11945@@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(char *arg)
11946 }
11947 __setup("clearcpuid=", setup_disablecpuid);
11948
11949+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
11950+EXPORT_PER_CPU_SYMBOL(current_tinfo);
11951+
11952 #ifdef CONFIG_X86_64
11953 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
11954
11955@@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
11956 EXPORT_PER_CPU_SYMBOL(current_task);
11957
11958 DEFINE_PER_CPU(unsigned long, kernel_stack) =
11959- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
11960+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
11961 EXPORT_PER_CPU_SYMBOL(kernel_stack);
11962
11963 DEFINE_PER_CPU(char *, irq_stack_ptr) =
11964@@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
11965 {
11966 memset(regs, 0, sizeof(struct pt_regs));
11967 regs->fs = __KERNEL_PERCPU;
11968- regs->gs = __KERNEL_STACK_CANARY;
11969+ savesegment(gs, regs->gs);
11970
11971 return regs;
11972 }
11973@@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void)
11974 int i;
11975
11976 cpu = stack_smp_processor_id();
11977- t = &per_cpu(init_tss, cpu);
11978+ t = init_tss + cpu;
11979 oist = &per_cpu(orig_ist, cpu);
11980
11981 #ifdef CONFIG_NUMA
11982@@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void)
11983 switch_to_new_gdt(cpu);
11984 loadsegment(fs, 0);
11985
11986- load_idt((const struct desc_ptr *)&idt_descr);
11987+ load_idt(&idt_descr);
11988
11989 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
11990 syscall_init();
11991@@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void)
11992 wrmsrl(MSR_KERNEL_GS_BASE, 0);
11993 barrier();
11994
11995- x86_configure_nx();
11996 if (cpu != 0)
11997 enable_x2apic();
11998
11999@@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void)
12000 {
12001 int cpu = smp_processor_id();
12002 struct task_struct *curr = current;
12003- struct tss_struct *t = &per_cpu(init_tss, cpu);
12004+ struct tss_struct *t = init_tss + cpu;
12005 struct thread_struct *thread = &curr->thread;
12006
12007 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12008diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
12009index ed6086e..a1dcf29 100644
12010--- a/arch/x86/kernel/cpu/intel.c
12011+++ b/arch/x86/kernel/cpu/intel.c
12012@@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug(void)
12013 * Update the IDT descriptor and reload the IDT so that
12014 * it uses the read-only mapped virtual address.
12015 */
12016- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12017+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12018 load_idt(&idt_descr);
12019 }
12020 #endif
12021diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12022index 0ed633c..82cef2a 100644
12023--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
12024+++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12025@@ -215,7 +215,9 @@ static int inject_init(void)
12026 if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
12027 return -ENOMEM;
12028 printk(KERN_INFO "Machine check injector initialized\n");
12029- mce_chrdev_ops.write = mce_write;
12030+ pax_open_kernel();
12031+ *(void **)&mce_chrdev_ops.write = mce_write;
12032+ pax_close_kernel();
12033 register_die_notifier(&mce_raise_nb);
12034 return 0;
12035 }
12036diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
12037index 08363b0..ee26113 100644
12038--- a/arch/x86/kernel/cpu/mcheck/mce.c
12039+++ b/arch/x86/kernel/cpu/mcheck/mce.c
12040@@ -42,6 +42,7 @@
12041 #include <asm/processor.h>
12042 #include <asm/mce.h>
12043 #include <asm/msr.h>
12044+#include <asm/local.h>
12045
12046 #include "mce-internal.h"
12047
12048@@ -205,7 +206,7 @@ static void print_mce(struct mce *m)
12049 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12050 m->cs, m->ip);
12051
12052- if (m->cs == __KERNEL_CS)
12053+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12054 print_symbol("{%s}", m->ip);
12055 pr_cont("\n");
12056 }
12057@@ -233,10 +234,10 @@ static void print_mce(struct mce *m)
12058
12059 #define PANIC_TIMEOUT 5 /* 5 seconds */
12060
12061-static atomic_t mce_paniced;
12062+static atomic_unchecked_t mce_paniced;
12063
12064 static int fake_panic;
12065-static atomic_t mce_fake_paniced;
12066+static atomic_unchecked_t mce_fake_paniced;
12067
12068 /* Panic in progress. Enable interrupts and wait for final IPI */
12069 static void wait_for_panic(void)
12070@@ -260,7 +261,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12071 /*
12072 * Make sure only one CPU runs in machine check panic
12073 */
12074- if (atomic_inc_return(&mce_paniced) > 1)
12075+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12076 wait_for_panic();
12077 barrier();
12078
12079@@ -268,7 +269,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12080 console_verbose();
12081 } else {
12082 /* Don't log too much for fake panic */
12083- if (atomic_inc_return(&mce_fake_paniced) > 1)
12084+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12085 return;
12086 }
12087 /* First print corrected ones that are still unlogged */
12088@@ -610,7 +611,7 @@ static int mce_timed_out(u64 *t)
12089 * might have been modified by someone else.
12090 */
12091 rmb();
12092- if (atomic_read(&mce_paniced))
12093+ if (atomic_read_unchecked(&mce_paniced))
12094 wait_for_panic();
12095 if (!monarch_timeout)
12096 goto out;
12097@@ -1392,7 +1393,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
12098 }
12099
12100 /* Call the installed machine check handler for this CPU setup. */
12101-void (*machine_check_vector)(struct pt_regs *, long error_code) =
12102+void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
12103 unexpected_machine_check;
12104
12105 /*
12106@@ -1415,7 +1416,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12107 return;
12108 }
12109
12110+ pax_open_kernel();
12111 machine_check_vector = do_machine_check;
12112+ pax_close_kernel();
12113
12114 __mcheck_cpu_init_generic();
12115 __mcheck_cpu_init_vendor(c);
12116@@ -1429,7 +1432,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12117 */
12118
12119 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
12120-static int mce_chrdev_open_count; /* #times opened */
12121+static local_t mce_chrdev_open_count; /* #times opened */
12122 static int mce_chrdev_open_exclu; /* already open exclusive? */
12123
12124 static int mce_chrdev_open(struct inode *inode, struct file *file)
12125@@ -1437,7 +1440,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12126 spin_lock(&mce_chrdev_state_lock);
12127
12128 if (mce_chrdev_open_exclu ||
12129- (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
12130+ (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
12131 spin_unlock(&mce_chrdev_state_lock);
12132
12133 return -EBUSY;
12134@@ -1445,7 +1448,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12135
12136 if (file->f_flags & O_EXCL)
12137 mce_chrdev_open_exclu = 1;
12138- mce_chrdev_open_count++;
12139+ local_inc(&mce_chrdev_open_count);
12140
12141 spin_unlock(&mce_chrdev_state_lock);
12142
12143@@ -1456,7 +1459,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
12144 {
12145 spin_lock(&mce_chrdev_state_lock);
12146
12147- mce_chrdev_open_count--;
12148+ local_dec(&mce_chrdev_open_count);
12149 mce_chrdev_open_exclu = 0;
12150
12151 spin_unlock(&mce_chrdev_state_lock);
12152@@ -2147,7 +2150,7 @@ struct dentry *mce_get_debugfs_dir(void)
12153 static void mce_reset(void)
12154 {
12155 cpu_missing = 0;
12156- atomic_set(&mce_fake_paniced, 0);
12157+ atomic_set_unchecked(&mce_fake_paniced, 0);
12158 atomic_set(&mce_executing, 0);
12159 atomic_set(&mce_callin, 0);
12160 atomic_set(&global_nwo, 0);
12161diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
12162index 5c0e653..1e82c7c 100644
12163--- a/arch/x86/kernel/cpu/mcheck/p5.c
12164+++ b/arch/x86/kernel/cpu/mcheck/p5.c
12165@@ -50,7 +50,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
12166 if (!cpu_has(c, X86_FEATURE_MCE))
12167 return;
12168
12169+ pax_open_kernel();
12170 machine_check_vector = pentium_machine_check;
12171+ pax_close_kernel();
12172 /* Make sure the vector pointer is visible before we enable MCEs: */
12173 wmb();
12174
12175diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
12176index 54060f5..e6ba93d 100644
12177--- a/arch/x86/kernel/cpu/mcheck/winchip.c
12178+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
12179@@ -24,7 +24,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
12180 {
12181 u32 lo, hi;
12182
12183+ pax_open_kernel();
12184 machine_check_vector = winchip_machine_check;
12185+ pax_close_kernel();
12186 /* Make sure the vector pointer is visible before we enable MCEs: */
12187 wmb();
12188
12189diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
12190index 6b96110..0da73eb 100644
12191--- a/arch/x86/kernel/cpu/mtrr/main.c
12192+++ b/arch/x86/kernel/cpu/mtrr/main.c
12193@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
12194 u64 size_or_mask, size_and_mask;
12195 static bool mtrr_aps_delayed_init;
12196
12197-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12198+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12199
12200 const struct mtrr_ops *mtrr_if;
12201
12202diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
12203index df5e41f..816c719 100644
12204--- a/arch/x86/kernel/cpu/mtrr/mtrr.h
12205+++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
12206@@ -25,7 +25,7 @@ struct mtrr_ops {
12207 int (*validate_add_page)(unsigned long base, unsigned long size,
12208 unsigned int type);
12209 int (*have_wrcomb)(void);
12210-};
12211+} __do_const;
12212
12213 extern int generic_get_free_region(unsigned long base, unsigned long size,
12214 int replace_reg);
12215diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
12216index cfa62ec..9250dd7 100644
12217--- a/arch/x86/kernel/cpu/perf_event.c
12218+++ b/arch/x86/kernel/cpu/perf_event.c
12219@@ -795,6 +795,8 @@ static int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
12220 int i, j, w, wmax, num = 0;
12221 struct hw_perf_event *hwc;
12222
12223+ pax_track_stack();
12224+
12225 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
12226
12227 for (i = 0; i < n; i++) {
12228@@ -1919,7 +1921,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
12229 break;
12230
12231 perf_callchain_store(entry, frame.return_address);
12232- fp = frame.next_frame;
12233+ fp = (const void __force_user *)frame.next_frame;
12234 }
12235 }
12236
12237diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
12238index 764c7c2..c5d9c7b 100644
12239--- a/arch/x86/kernel/crash.c
12240+++ b/arch/x86/kernel/crash.c
12241@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, struct die_args *args)
12242 regs = args->regs;
12243
12244 #ifdef CONFIG_X86_32
12245- if (!user_mode_vm(regs)) {
12246+ if (!user_mode(regs)) {
12247 crash_fixup_ss_esp(&fixed_regs, regs);
12248 regs = &fixed_regs;
12249 }
12250diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
12251index 37250fe..bf2ec74 100644
12252--- a/arch/x86/kernel/doublefault_32.c
12253+++ b/arch/x86/kernel/doublefault_32.c
12254@@ -11,7 +11,7 @@
12255
12256 #define DOUBLEFAULT_STACKSIZE (1024)
12257 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
12258-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
12259+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
12260
12261 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
12262
12263@@ -21,7 +21,7 @@ static void doublefault_fn(void)
12264 unsigned long gdt, tss;
12265
12266 store_gdt(&gdt_desc);
12267- gdt = gdt_desc.address;
12268+ gdt = (unsigned long)gdt_desc.address;
12269
12270 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
12271
12272@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
12273 /* 0x2 bit is always set */
12274 .flags = X86_EFLAGS_SF | 0x2,
12275 .sp = STACK_START,
12276- .es = __USER_DS,
12277+ .es = __KERNEL_DS,
12278 .cs = __KERNEL_CS,
12279 .ss = __KERNEL_DS,
12280- .ds = __USER_DS,
12281+ .ds = __KERNEL_DS,
12282 .fs = __KERNEL_PERCPU,
12283
12284 .__cr3 = __pa_nodebug(swapper_pg_dir),
12285diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
12286index 1aae78f..aab3a3d 100644
12287--- a/arch/x86/kernel/dumpstack.c
12288+++ b/arch/x86/kernel/dumpstack.c
12289@@ -2,6 +2,9 @@
12290 * Copyright (C) 1991, 1992 Linus Torvalds
12291 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
12292 */
12293+#ifdef CONFIG_GRKERNSEC_HIDESYM
12294+#define __INCLUDED_BY_HIDESYM 1
12295+#endif
12296 #include <linux/kallsyms.h>
12297 #include <linux/kprobes.h>
12298 #include <linux/uaccess.h>
12299@@ -35,9 +38,8 @@ void printk_address(unsigned long address, int reliable)
12300 static void
12301 print_ftrace_graph_addr(unsigned long addr, void *data,
12302 const struct stacktrace_ops *ops,
12303- struct thread_info *tinfo, int *graph)
12304+ struct task_struct *task, int *graph)
12305 {
12306- struct task_struct *task = tinfo->task;
12307 unsigned long ret_addr;
12308 int index = task->curr_ret_stack;
12309
12310@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12311 static inline void
12312 print_ftrace_graph_addr(unsigned long addr, void *data,
12313 const struct stacktrace_ops *ops,
12314- struct thread_info *tinfo, int *graph)
12315+ struct task_struct *task, int *graph)
12316 { }
12317 #endif
12318
12319@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12320 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
12321 */
12322
12323-static inline int valid_stack_ptr(struct thread_info *tinfo,
12324- void *p, unsigned int size, void *end)
12325+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
12326 {
12327- void *t = tinfo;
12328 if (end) {
12329 if (p < end && p >= (end-THREAD_SIZE))
12330 return 1;
12331@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
12332 }
12333
12334 unsigned long
12335-print_context_stack(struct thread_info *tinfo,
12336+print_context_stack(struct task_struct *task, void *stack_start,
12337 unsigned long *stack, unsigned long bp,
12338 const struct stacktrace_ops *ops, void *data,
12339 unsigned long *end, int *graph)
12340 {
12341 struct stack_frame *frame = (struct stack_frame *)bp;
12342
12343- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
12344+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
12345 unsigned long addr;
12346
12347 addr = *stack;
12348@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *tinfo,
12349 } else {
12350 ops->address(data, addr, 0);
12351 }
12352- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12353+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12354 }
12355 stack++;
12356 }
12357@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *tinfo,
12358 EXPORT_SYMBOL_GPL(print_context_stack);
12359
12360 unsigned long
12361-print_context_stack_bp(struct thread_info *tinfo,
12362+print_context_stack_bp(struct task_struct *task, void *stack_start,
12363 unsigned long *stack, unsigned long bp,
12364 const struct stacktrace_ops *ops, void *data,
12365 unsigned long *end, int *graph)
12366@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12367 struct stack_frame *frame = (struct stack_frame *)bp;
12368 unsigned long *ret_addr = &frame->return_address;
12369
12370- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
12371+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
12372 unsigned long addr = *ret_addr;
12373
12374 if (!__kernel_text_address(addr))
12375@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12376 ops->address(data, addr, 1);
12377 frame = frame->next_frame;
12378 ret_addr = &frame->return_address;
12379- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12380+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12381 }
12382
12383 return (unsigned long)frame;
12384@@ -186,7 +186,7 @@ void dump_stack(void)
12385
12386 bp = stack_frame(current, NULL);
12387 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
12388- current->pid, current->comm, print_tainted(),
12389+ task_pid_nr(current), current->comm, print_tainted(),
12390 init_utsname()->release,
12391 (int)strcspn(init_utsname()->version, " "),
12392 init_utsname()->version);
12393@@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void)
12394 }
12395 EXPORT_SYMBOL_GPL(oops_begin);
12396
12397+extern void gr_handle_kernel_exploit(void);
12398+
12399 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12400 {
12401 if (regs && kexec_should_crash(current))
12402@@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12403 panic("Fatal exception in interrupt");
12404 if (panic_on_oops)
12405 panic("Fatal exception");
12406- do_exit(signr);
12407+
12408+ gr_handle_kernel_exploit();
12409+
12410+ do_group_exit(signr);
12411 }
12412
12413 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12414@@ -269,7 +274,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12415
12416 show_registers(regs);
12417 #ifdef CONFIG_X86_32
12418- if (user_mode_vm(regs)) {
12419+ if (user_mode(regs)) {
12420 sp = regs->sp;
12421 ss = regs->ss & 0xffff;
12422 } else {
12423@@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs *regs, long err)
12424 unsigned long flags = oops_begin();
12425 int sig = SIGSEGV;
12426
12427- if (!user_mode_vm(regs))
12428+ if (!user_mode(regs))
12429 report_bug(regs->ip, regs);
12430
12431 if (__die(str, regs, err))
12432diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
12433index 3b97a80..667ce7a 100644
12434--- a/arch/x86/kernel/dumpstack_32.c
12435+++ b/arch/x86/kernel/dumpstack_32.c
12436@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12437 bp = stack_frame(task, regs);
12438
12439 for (;;) {
12440- struct thread_info *context;
12441+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12442
12443- context = (struct thread_info *)
12444- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
12445- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
12446+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12447
12448- stack = (unsigned long *)context->previous_esp;
12449- if (!stack)
12450+ if (stack_start == task_stack_page(task))
12451 break;
12452+ stack = *(unsigned long **)stack_start;
12453 if (ops->stack(data, "IRQ") < 0)
12454 break;
12455 touch_nmi_watchdog();
12456@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs)
12457 * When in-kernel, we also print out the stack and code at the
12458 * time of the fault..
12459 */
12460- if (!user_mode_vm(regs)) {
12461+ if (!user_mode(regs)) {
12462 unsigned int code_prologue = code_bytes * 43 / 64;
12463 unsigned int code_len = code_bytes;
12464 unsigned char c;
12465 u8 *ip;
12466+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
12467
12468 printk(KERN_EMERG "Stack:\n");
12469 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
12470
12471 printk(KERN_EMERG "Code: ");
12472
12473- ip = (u8 *)regs->ip - code_prologue;
12474+ ip = (u8 *)regs->ip - code_prologue + cs_base;
12475 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
12476 /* try starting at IP */
12477- ip = (u8 *)regs->ip;
12478+ ip = (u8 *)regs->ip + cs_base;
12479 code_len = code_len - code_prologue + 1;
12480 }
12481 for (i = 0; i < code_len; i++, ip++) {
12482@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs)
12483 printk(" Bad EIP value.");
12484 break;
12485 }
12486- if (ip == (u8 *)regs->ip)
12487+ if (ip == (u8 *)regs->ip + cs_base)
12488 printk("<%02x> ", c);
12489 else
12490 printk("%02x ", c);
12491@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
12492 {
12493 unsigned short ud2;
12494
12495+ ip = ktla_ktva(ip);
12496 if (ip < PAGE_OFFSET)
12497 return 0;
12498 if (probe_kernel_address((unsigned short *)ip, ud2))
12499@@ -139,3 +139,15 @@ int is_valid_bugaddr(unsigned long ip)
12500
12501 return ud2 == 0x0b0f;
12502 }
12503+
12504+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12505+void pax_check_alloca(unsigned long size)
12506+{
12507+ unsigned long sp = (unsigned long)&sp, stack_left;
12508+
12509+ /* all kernel stacks are of the same size */
12510+ stack_left = sp & (THREAD_SIZE - 1);
12511+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12512+}
12513+EXPORT_SYMBOL(pax_check_alloca);
12514+#endif
12515diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
12516index 19853ad..508ca79 100644
12517--- a/arch/x86/kernel/dumpstack_64.c
12518+++ b/arch/x86/kernel/dumpstack_64.c
12519@@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12520 unsigned long *irq_stack_end =
12521 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
12522 unsigned used = 0;
12523- struct thread_info *tinfo;
12524 int graph = 0;
12525 unsigned long dummy;
12526+ void *stack_start;
12527
12528 if (!task)
12529 task = current;
12530@@ -142,10 +142,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12531 * current stack address. If the stacks consist of nested
12532 * exceptions
12533 */
12534- tinfo = task_thread_info(task);
12535 for (;;) {
12536 char *id;
12537 unsigned long *estack_end;
12538+
12539 estack_end = in_exception_stack(cpu, (unsigned long)stack,
12540 &used, &id);
12541
12542@@ -153,7 +153,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12543 if (ops->stack(data, id) < 0)
12544 break;
12545
12546- bp = ops->walk_stack(tinfo, stack, bp, ops,
12547+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
12548 data, estack_end, &graph);
12549 ops->stack(data, "<EOE>");
12550 /*
12551@@ -172,7 +172,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12552 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
12553 if (ops->stack(data, "IRQ") < 0)
12554 break;
12555- bp = ops->walk_stack(tinfo, stack, bp,
12556+ bp = ops->walk_stack(task, irq_stack, stack, bp,
12557 ops, data, irq_stack_end, &graph);
12558 /*
12559 * We link to the next stack (which would be
12560@@ -191,7 +191,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12561 /*
12562 * This handles the process stack:
12563 */
12564- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
12565+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12566+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12567 put_cpu();
12568 }
12569 EXPORT_SYMBOL(dump_trace);
12570@@ -305,3 +306,50 @@ int is_valid_bugaddr(unsigned long ip)
12571
12572 return ud2 == 0x0b0f;
12573 }
12574+
12575+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12576+void pax_check_alloca(unsigned long size)
12577+{
12578+ unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
12579+ unsigned cpu, used;
12580+ char *id;
12581+
12582+ /* check the process stack first */
12583+ stack_start = (unsigned long)task_stack_page(current);
12584+ stack_end = stack_start + THREAD_SIZE;
12585+ if (likely(stack_start <= sp && sp < stack_end)) {
12586+ unsigned long stack_left = sp & (THREAD_SIZE - 1);
12587+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12588+ return;
12589+ }
12590+
12591+ cpu = get_cpu();
12592+
12593+ /* check the irq stacks */
12594+ stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
12595+ stack_start = stack_end - IRQ_STACK_SIZE;
12596+ if (stack_start <= sp && sp < stack_end) {
12597+ unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
12598+ put_cpu();
12599+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12600+ return;
12601+ }
12602+
12603+ /* check the exception stacks */
12604+ used = 0;
12605+ stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
12606+ stack_start = stack_end - EXCEPTION_STKSZ;
12607+ if (stack_end && stack_start <= sp && sp < stack_end) {
12608+ unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
12609+ put_cpu();
12610+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12611+ return;
12612+ }
12613+
12614+ put_cpu();
12615+
12616+ /* unknown stack */
12617+ BUG();
12618+}
12619+EXPORT_SYMBOL(pax_check_alloca);
12620+#endif
12621diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
12622index cd28a35..2601699 100644
12623--- a/arch/x86/kernel/early_printk.c
12624+++ b/arch/x86/kernel/early_printk.c
12625@@ -7,6 +7,7 @@
12626 #include <linux/pci_regs.h>
12627 #include <linux/pci_ids.h>
12628 #include <linux/errno.h>
12629+#include <linux/sched.h>
12630 #include <asm/io.h>
12631 #include <asm/processor.h>
12632 #include <asm/fcntl.h>
12633@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char *fmt, ...)
12634 int n;
12635 va_list ap;
12636
12637+ pax_track_stack();
12638+
12639 va_start(ap, fmt);
12640 n = vscnprintf(buf, sizeof(buf), fmt, ap);
12641 early_console->write(early_console, buf, n);
12642diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
12643index f3f6f53..0841b66 100644
12644--- a/arch/x86/kernel/entry_32.S
12645+++ b/arch/x86/kernel/entry_32.S
12646@@ -186,13 +186,146 @@
12647 /*CFI_REL_OFFSET gs, PT_GS*/
12648 .endm
12649 .macro SET_KERNEL_GS reg
12650+
12651+#ifdef CONFIG_CC_STACKPROTECTOR
12652 movl $(__KERNEL_STACK_CANARY), \reg
12653+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
12654+ movl $(__USER_DS), \reg
12655+#else
12656+ xorl \reg, \reg
12657+#endif
12658+
12659 movl \reg, %gs
12660 .endm
12661
12662 #endif /* CONFIG_X86_32_LAZY_GS */
12663
12664-.macro SAVE_ALL
12665+.macro pax_enter_kernel
12666+#ifdef CONFIG_PAX_KERNEXEC
12667+ call pax_enter_kernel
12668+#endif
12669+.endm
12670+
12671+.macro pax_exit_kernel
12672+#ifdef CONFIG_PAX_KERNEXEC
12673+ call pax_exit_kernel
12674+#endif
12675+.endm
12676+
12677+#ifdef CONFIG_PAX_KERNEXEC
12678+ENTRY(pax_enter_kernel)
12679+#ifdef CONFIG_PARAVIRT
12680+ pushl %eax
12681+ pushl %ecx
12682+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
12683+ mov %eax, %esi
12684+#else
12685+ mov %cr0, %esi
12686+#endif
12687+ bts $16, %esi
12688+ jnc 1f
12689+ mov %cs, %esi
12690+ cmp $__KERNEL_CS, %esi
12691+ jz 3f
12692+ ljmp $__KERNEL_CS, $3f
12693+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
12694+2:
12695+#ifdef CONFIG_PARAVIRT
12696+ mov %esi, %eax
12697+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
12698+#else
12699+ mov %esi, %cr0
12700+#endif
12701+3:
12702+#ifdef CONFIG_PARAVIRT
12703+ popl %ecx
12704+ popl %eax
12705+#endif
12706+ ret
12707+ENDPROC(pax_enter_kernel)
12708+
12709+ENTRY(pax_exit_kernel)
12710+#ifdef CONFIG_PARAVIRT
12711+ pushl %eax
12712+ pushl %ecx
12713+#endif
12714+ mov %cs, %esi
12715+ cmp $__KERNEXEC_KERNEL_CS, %esi
12716+ jnz 2f
12717+#ifdef CONFIG_PARAVIRT
12718+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
12719+ mov %eax, %esi
12720+#else
12721+ mov %cr0, %esi
12722+#endif
12723+ btr $16, %esi
12724+ ljmp $__KERNEL_CS, $1f
12725+1:
12726+#ifdef CONFIG_PARAVIRT
12727+ mov %esi, %eax
12728+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
12729+#else
12730+ mov %esi, %cr0
12731+#endif
12732+2:
12733+#ifdef CONFIG_PARAVIRT
12734+ popl %ecx
12735+ popl %eax
12736+#endif
12737+ ret
12738+ENDPROC(pax_exit_kernel)
12739+#endif
12740+
12741+.macro pax_erase_kstack
12742+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12743+ call pax_erase_kstack
12744+#endif
12745+.endm
12746+
12747+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12748+/*
12749+ * ebp: thread_info
12750+ * ecx, edx: can be clobbered
12751+ */
12752+ENTRY(pax_erase_kstack)
12753+ pushl %edi
12754+ pushl %eax
12755+
12756+ mov TI_lowest_stack(%ebp), %edi
12757+ mov $-0xBEEF, %eax
12758+ std
12759+
12760+1: mov %edi, %ecx
12761+ and $THREAD_SIZE_asm - 1, %ecx
12762+ shr $2, %ecx
12763+ repne scasl
12764+ jecxz 2f
12765+
12766+ cmp $2*16, %ecx
12767+ jc 2f
12768+
12769+ mov $2*16, %ecx
12770+ repe scasl
12771+ jecxz 2f
12772+ jne 1b
12773+
12774+2: cld
12775+ mov %esp, %ecx
12776+ sub %edi, %ecx
12777+ shr $2, %ecx
12778+ rep stosl
12779+
12780+ mov TI_task_thread_sp0(%ebp), %edi
12781+ sub $128, %edi
12782+ mov %edi, TI_lowest_stack(%ebp)
12783+
12784+ popl %eax
12785+ popl %edi
12786+ ret
12787+ENDPROC(pax_erase_kstack)
12788+#endif
12789+
12790+.macro __SAVE_ALL _DS
12791 cld
12792 PUSH_GS
12793 pushl_cfi %fs
12794@@ -215,7 +348,7 @@
12795 CFI_REL_OFFSET ecx, 0
12796 pushl_cfi %ebx
12797 CFI_REL_OFFSET ebx, 0
12798- movl $(__USER_DS), %edx
12799+ movl $\_DS, %edx
12800 movl %edx, %ds
12801 movl %edx, %es
12802 movl $(__KERNEL_PERCPU), %edx
12803@@ -223,6 +356,15 @@
12804 SET_KERNEL_GS %edx
12805 .endm
12806
12807+.macro SAVE_ALL
12808+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
12809+ __SAVE_ALL __KERNEL_DS
12810+ pax_enter_kernel
12811+#else
12812+ __SAVE_ALL __USER_DS
12813+#endif
12814+.endm
12815+
12816 .macro RESTORE_INT_REGS
12817 popl_cfi %ebx
12818 CFI_RESTORE ebx
12819@@ -308,7 +450,7 @@ ENTRY(ret_from_fork)
12820 popfl_cfi
12821 jmp syscall_exit
12822 CFI_ENDPROC
12823-END(ret_from_fork)
12824+ENDPROC(ret_from_fork)
12825
12826 /*
12827 * Interrupt exit functions should be protected against kprobes
12828@@ -333,7 +475,15 @@ check_userspace:
12829 movb PT_CS(%esp), %al
12830 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
12831 cmpl $USER_RPL, %eax
12832+
12833+#ifdef CONFIG_PAX_KERNEXEC
12834+ jae resume_userspace
12835+
12836+ PAX_EXIT_KERNEL
12837+ jmp resume_kernel
12838+#else
12839 jb resume_kernel # not returning to v8086 or userspace
12840+#endif
12841
12842 ENTRY(resume_userspace)
12843 LOCKDEP_SYS_EXIT
12844@@ -345,8 +495,8 @@ ENTRY(resume_userspace)
12845 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
12846 # int/exception return?
12847 jne work_pending
12848- jmp restore_all
12849-END(ret_from_exception)
12850+ jmp restore_all_pax
12851+ENDPROC(ret_from_exception)
12852
12853 #ifdef CONFIG_PREEMPT
12854 ENTRY(resume_kernel)
12855@@ -361,7 +511,7 @@ need_resched:
12856 jz restore_all
12857 call preempt_schedule_irq
12858 jmp need_resched
12859-END(resume_kernel)
12860+ENDPROC(resume_kernel)
12861 #endif
12862 CFI_ENDPROC
12863 /*
12864@@ -395,23 +545,34 @@ sysenter_past_esp:
12865 /*CFI_REL_OFFSET cs, 0*/
12866 /*
12867 * Push current_thread_info()->sysenter_return to the stack.
12868- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
12869- * pushed above; +8 corresponds to copy_thread's esp0 setting.
12870 */
12871- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
12872+ pushl_cfi $0
12873 CFI_REL_OFFSET eip, 0
12874
12875 pushl_cfi %eax
12876 SAVE_ALL
12877+ GET_THREAD_INFO(%ebp)
12878+ movl TI_sysenter_return(%ebp),%ebp
12879+ movl %ebp,PT_EIP(%esp)
12880 ENABLE_INTERRUPTS(CLBR_NONE)
12881
12882 /*
12883 * Load the potential sixth argument from user stack.
12884 * Careful about security.
12885 */
12886+ movl PT_OLDESP(%esp),%ebp
12887+
12888+#ifdef CONFIG_PAX_MEMORY_UDEREF
12889+ mov PT_OLDSS(%esp),%ds
12890+1: movl %ds:(%ebp),%ebp
12891+ push %ss
12892+ pop %ds
12893+#else
12894 cmpl $__PAGE_OFFSET-3,%ebp
12895 jae syscall_fault
12896 1: movl (%ebp),%ebp
12897+#endif
12898+
12899 movl %ebp,PT_EBP(%esp)
12900 .section __ex_table,"a"
12901 .align 4
12902@@ -434,12 +595,24 @@ sysenter_do_call:
12903 testl $_TIF_ALLWORK_MASK, %ecx
12904 jne sysexit_audit
12905 sysenter_exit:
12906+
12907+#ifdef CONFIG_PAX_RANDKSTACK
12908+ pushl_cfi %eax
12909+ movl %esp, %eax
12910+ call pax_randomize_kstack
12911+ popl_cfi %eax
12912+#endif
12913+
12914+ pax_erase_kstack
12915+
12916 /* if something modifies registers it must also disable sysexit */
12917 movl PT_EIP(%esp), %edx
12918 movl PT_OLDESP(%esp), %ecx
12919 xorl %ebp,%ebp
12920 TRACE_IRQS_ON
12921 1: mov PT_FS(%esp), %fs
12922+2: mov PT_DS(%esp), %ds
12923+3: mov PT_ES(%esp), %es
12924 PTGS_TO_GS
12925 ENABLE_INTERRUPTS_SYSEXIT
12926
12927@@ -456,6 +629,9 @@ sysenter_audit:
12928 movl %eax,%edx /* 2nd arg: syscall number */
12929 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
12930 call audit_syscall_entry
12931+
12932+ pax_erase_kstack
12933+
12934 pushl_cfi %ebx
12935 movl PT_EAX(%esp),%eax /* reload syscall number */
12936 jmp sysenter_do_call
12937@@ -482,11 +658,17 @@ sysexit_audit:
12938
12939 CFI_ENDPROC
12940 .pushsection .fixup,"ax"
12941-2: movl $0,PT_FS(%esp)
12942+4: movl $0,PT_FS(%esp)
12943+ jmp 1b
12944+5: movl $0,PT_DS(%esp)
12945+ jmp 1b
12946+6: movl $0,PT_ES(%esp)
12947 jmp 1b
12948 .section __ex_table,"a"
12949 .align 4
12950- .long 1b,2b
12951+ .long 1b,4b
12952+ .long 2b,5b
12953+ .long 3b,6b
12954 .popsection
12955 PTGS_TO_GS_EX
12956 ENDPROC(ia32_sysenter_target)
12957@@ -519,6 +701,15 @@ syscall_exit:
12958 testl $_TIF_ALLWORK_MASK, %ecx # current->work
12959 jne syscall_exit_work
12960
12961+restore_all_pax:
12962+
12963+#ifdef CONFIG_PAX_RANDKSTACK
12964+ movl %esp, %eax
12965+ call pax_randomize_kstack
12966+#endif
12967+
12968+ pax_erase_kstack
12969+
12970 restore_all:
12971 TRACE_IRQS_IRET
12972 restore_all_notrace:
12973@@ -578,14 +769,34 @@ ldt_ss:
12974 * compensating for the offset by changing to the ESPFIX segment with
12975 * a base address that matches for the difference.
12976 */
12977-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
12978+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
12979 mov %esp, %edx /* load kernel esp */
12980 mov PT_OLDESP(%esp), %eax /* load userspace esp */
12981 mov %dx, %ax /* eax: new kernel esp */
12982 sub %eax, %edx /* offset (low word is 0) */
12983+#ifdef CONFIG_SMP
12984+ movl PER_CPU_VAR(cpu_number), %ebx
12985+ shll $PAGE_SHIFT_asm, %ebx
12986+ addl $cpu_gdt_table, %ebx
12987+#else
12988+ movl $cpu_gdt_table, %ebx
12989+#endif
12990 shr $16, %edx
12991- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
12992- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
12993+
12994+#ifdef CONFIG_PAX_KERNEXEC
12995+ mov %cr0, %esi
12996+ btr $16, %esi
12997+ mov %esi, %cr0
12998+#endif
12999+
13000+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13001+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
13002+
13003+#ifdef CONFIG_PAX_KERNEXEC
13004+ bts $16, %esi
13005+ mov %esi, %cr0
13006+#endif
13007+
13008 pushl_cfi $__ESPFIX_SS
13009 pushl_cfi %eax /* new kernel esp */
13010 /* Disable interrupts, but do not irqtrace this section: we
13011@@ -614,34 +825,28 @@ work_resched:
13012 movl TI_flags(%ebp), %ecx
13013 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13014 # than syscall tracing?
13015- jz restore_all
13016+ jz restore_all_pax
13017 testb $_TIF_NEED_RESCHED, %cl
13018 jnz work_resched
13019
13020 work_notifysig: # deal with pending signals and
13021 # notify-resume requests
13022+ movl %esp, %eax
13023 #ifdef CONFIG_VM86
13024 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13025- movl %esp, %eax
13026- jne work_notifysig_v86 # returning to kernel-space or
13027+ jz 1f # returning to kernel-space or
13028 # vm86-space
13029- xorl %edx, %edx
13030- call do_notify_resume
13031- jmp resume_userspace_sig
13032
13033- ALIGN
13034-work_notifysig_v86:
13035 pushl_cfi %ecx # save ti_flags for do_notify_resume
13036 call save_v86_state # %eax contains pt_regs pointer
13037 popl_cfi %ecx
13038 movl %eax, %esp
13039-#else
13040- movl %esp, %eax
13041+1:
13042 #endif
13043 xorl %edx, %edx
13044 call do_notify_resume
13045 jmp resume_userspace_sig
13046-END(work_pending)
13047+ENDPROC(work_pending)
13048
13049 # perform syscall exit tracing
13050 ALIGN
13051@@ -649,11 +854,14 @@ syscall_trace_entry:
13052 movl $-ENOSYS,PT_EAX(%esp)
13053 movl %esp, %eax
13054 call syscall_trace_enter
13055+
13056+ pax_erase_kstack
13057+
13058 /* What it returned is what we'll actually use. */
13059 cmpl $(nr_syscalls), %eax
13060 jnae syscall_call
13061 jmp syscall_exit
13062-END(syscall_trace_entry)
13063+ENDPROC(syscall_trace_entry)
13064
13065 # perform syscall exit tracing
13066 ALIGN
13067@@ -666,20 +874,24 @@ syscall_exit_work:
13068 movl %esp, %eax
13069 call syscall_trace_leave
13070 jmp resume_userspace
13071-END(syscall_exit_work)
13072+ENDPROC(syscall_exit_work)
13073 CFI_ENDPROC
13074
13075 RING0_INT_FRAME # can't unwind into user space anyway
13076 syscall_fault:
13077+#ifdef CONFIG_PAX_MEMORY_UDEREF
13078+ push %ss
13079+ pop %ds
13080+#endif
13081 GET_THREAD_INFO(%ebp)
13082 movl $-EFAULT,PT_EAX(%esp)
13083 jmp resume_userspace
13084-END(syscall_fault)
13085+ENDPROC(syscall_fault)
13086
13087 syscall_badsys:
13088 movl $-ENOSYS,PT_EAX(%esp)
13089 jmp resume_userspace
13090-END(syscall_badsys)
13091+ENDPROC(syscall_badsys)
13092 CFI_ENDPROC
13093 /*
13094 * End of kprobes section
13095@@ -753,6 +965,36 @@ ptregs_clone:
13096 CFI_ENDPROC
13097 ENDPROC(ptregs_clone)
13098
13099+ ALIGN;
13100+ENTRY(kernel_execve)
13101+ CFI_STARTPROC
13102+ pushl_cfi %ebp
13103+ sub $PT_OLDSS+4,%esp
13104+ pushl_cfi %edi
13105+ pushl_cfi %ecx
13106+ pushl_cfi %eax
13107+ lea 3*4(%esp),%edi
13108+ mov $PT_OLDSS/4+1,%ecx
13109+ xorl %eax,%eax
13110+ rep stosl
13111+ popl_cfi %eax
13112+ popl_cfi %ecx
13113+ popl_cfi %edi
13114+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13115+ pushl_cfi %esp
13116+ call sys_execve
13117+ add $4,%esp
13118+ CFI_ADJUST_CFA_OFFSET -4
13119+ GET_THREAD_INFO(%ebp)
13120+ test %eax,%eax
13121+ jz syscall_exit
13122+ add $PT_OLDSS+4,%esp
13123+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13124+ popl_cfi %ebp
13125+ ret
13126+ CFI_ENDPROC
13127+ENDPROC(kernel_execve)
13128+
13129 .macro FIXUP_ESPFIX_STACK
13130 /*
13131 * Switch back for ESPFIX stack to the normal zerobased stack
13132@@ -762,8 +1004,15 @@ ENDPROC(ptregs_clone)
13133 * normal stack and adjusts ESP with the matching offset.
13134 */
13135 /* fixup the stack */
13136- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13137- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
13138+#ifdef CONFIG_SMP
13139+ movl PER_CPU_VAR(cpu_number), %ebx
13140+ shll $PAGE_SHIFT_asm, %ebx
13141+ addl $cpu_gdt_table, %ebx
13142+#else
13143+ movl $cpu_gdt_table, %ebx
13144+#endif
13145+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
13146+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
13147 shl $16, %eax
13148 addl %esp, %eax /* the adjusted stack pointer */
13149 pushl_cfi $__KERNEL_DS
13150@@ -816,7 +1065,7 @@ vector=vector+1
13151 .endr
13152 2: jmp common_interrupt
13153 .endr
13154-END(irq_entries_start)
13155+ENDPROC(irq_entries_start)
13156
13157 .previous
13158 END(interrupt)
13159@@ -864,7 +1113,7 @@ ENTRY(coprocessor_error)
13160 pushl_cfi $do_coprocessor_error
13161 jmp error_code
13162 CFI_ENDPROC
13163-END(coprocessor_error)
13164+ENDPROC(coprocessor_error)
13165
13166 ENTRY(simd_coprocessor_error)
13167 RING0_INT_FRAME
13168@@ -885,7 +1134,7 @@ ENTRY(simd_coprocessor_error)
13169 #endif
13170 jmp error_code
13171 CFI_ENDPROC
13172-END(simd_coprocessor_error)
13173+ENDPROC(simd_coprocessor_error)
13174
13175 ENTRY(device_not_available)
13176 RING0_INT_FRAME
13177@@ -893,7 +1142,7 @@ ENTRY(device_not_available)
13178 pushl_cfi $do_device_not_available
13179 jmp error_code
13180 CFI_ENDPROC
13181-END(device_not_available)
13182+ENDPROC(device_not_available)
13183
13184 #ifdef CONFIG_PARAVIRT
13185 ENTRY(native_iret)
13186@@ -902,12 +1151,12 @@ ENTRY(native_iret)
13187 .align 4
13188 .long native_iret, iret_exc
13189 .previous
13190-END(native_iret)
13191+ENDPROC(native_iret)
13192
13193 ENTRY(native_irq_enable_sysexit)
13194 sti
13195 sysexit
13196-END(native_irq_enable_sysexit)
13197+ENDPROC(native_irq_enable_sysexit)
13198 #endif
13199
13200 ENTRY(overflow)
13201@@ -916,7 +1165,7 @@ ENTRY(overflow)
13202 pushl_cfi $do_overflow
13203 jmp error_code
13204 CFI_ENDPROC
13205-END(overflow)
13206+ENDPROC(overflow)
13207
13208 ENTRY(bounds)
13209 RING0_INT_FRAME
13210@@ -924,7 +1173,7 @@ ENTRY(bounds)
13211 pushl_cfi $do_bounds
13212 jmp error_code
13213 CFI_ENDPROC
13214-END(bounds)
13215+ENDPROC(bounds)
13216
13217 ENTRY(invalid_op)
13218 RING0_INT_FRAME
13219@@ -932,7 +1181,7 @@ ENTRY(invalid_op)
13220 pushl_cfi $do_invalid_op
13221 jmp error_code
13222 CFI_ENDPROC
13223-END(invalid_op)
13224+ENDPROC(invalid_op)
13225
13226 ENTRY(coprocessor_segment_overrun)
13227 RING0_INT_FRAME
13228@@ -940,35 +1189,35 @@ ENTRY(coprocessor_segment_overrun)
13229 pushl_cfi $do_coprocessor_segment_overrun
13230 jmp error_code
13231 CFI_ENDPROC
13232-END(coprocessor_segment_overrun)
13233+ENDPROC(coprocessor_segment_overrun)
13234
13235 ENTRY(invalid_TSS)
13236 RING0_EC_FRAME
13237 pushl_cfi $do_invalid_TSS
13238 jmp error_code
13239 CFI_ENDPROC
13240-END(invalid_TSS)
13241+ENDPROC(invalid_TSS)
13242
13243 ENTRY(segment_not_present)
13244 RING0_EC_FRAME
13245 pushl_cfi $do_segment_not_present
13246 jmp error_code
13247 CFI_ENDPROC
13248-END(segment_not_present)
13249+ENDPROC(segment_not_present)
13250
13251 ENTRY(stack_segment)
13252 RING0_EC_FRAME
13253 pushl_cfi $do_stack_segment
13254 jmp error_code
13255 CFI_ENDPROC
13256-END(stack_segment)
13257+ENDPROC(stack_segment)
13258
13259 ENTRY(alignment_check)
13260 RING0_EC_FRAME
13261 pushl_cfi $do_alignment_check
13262 jmp error_code
13263 CFI_ENDPROC
13264-END(alignment_check)
13265+ENDPROC(alignment_check)
13266
13267 ENTRY(divide_error)
13268 RING0_INT_FRAME
13269@@ -976,7 +1225,7 @@ ENTRY(divide_error)
13270 pushl_cfi $do_divide_error
13271 jmp error_code
13272 CFI_ENDPROC
13273-END(divide_error)
13274+ENDPROC(divide_error)
13275
13276 #ifdef CONFIG_X86_MCE
13277 ENTRY(machine_check)
13278@@ -985,7 +1234,7 @@ ENTRY(machine_check)
13279 pushl_cfi machine_check_vector
13280 jmp error_code
13281 CFI_ENDPROC
13282-END(machine_check)
13283+ENDPROC(machine_check)
13284 #endif
13285
13286 ENTRY(spurious_interrupt_bug)
13287@@ -994,7 +1243,7 @@ ENTRY(spurious_interrupt_bug)
13288 pushl_cfi $do_spurious_interrupt_bug
13289 jmp error_code
13290 CFI_ENDPROC
13291-END(spurious_interrupt_bug)
13292+ENDPROC(spurious_interrupt_bug)
13293 /*
13294 * End of kprobes section
13295 */
13296@@ -1109,7 +1358,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
13297
13298 ENTRY(mcount)
13299 ret
13300-END(mcount)
13301+ENDPROC(mcount)
13302
13303 ENTRY(ftrace_caller)
13304 cmpl $0, function_trace_stop
13305@@ -1138,7 +1387,7 @@ ftrace_graph_call:
13306 .globl ftrace_stub
13307 ftrace_stub:
13308 ret
13309-END(ftrace_caller)
13310+ENDPROC(ftrace_caller)
13311
13312 #else /* ! CONFIG_DYNAMIC_FTRACE */
13313
13314@@ -1174,7 +1423,7 @@ trace:
13315 popl %ecx
13316 popl %eax
13317 jmp ftrace_stub
13318-END(mcount)
13319+ENDPROC(mcount)
13320 #endif /* CONFIG_DYNAMIC_FTRACE */
13321 #endif /* CONFIG_FUNCTION_TRACER */
13322
13323@@ -1195,7 +1444,7 @@ ENTRY(ftrace_graph_caller)
13324 popl %ecx
13325 popl %eax
13326 ret
13327-END(ftrace_graph_caller)
13328+ENDPROC(ftrace_graph_caller)
13329
13330 .globl return_to_handler
13331 return_to_handler:
13332@@ -1209,7 +1458,6 @@ return_to_handler:
13333 jmp *%ecx
13334 #endif
13335
13336-.section .rodata,"a"
13337 #include "syscall_table_32.S"
13338
13339 syscall_table_size=(.-sys_call_table)
13340@@ -1255,15 +1503,18 @@ error_code:
13341 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13342 REG_TO_PTGS %ecx
13343 SET_KERNEL_GS %ecx
13344- movl $(__USER_DS), %ecx
13345+ movl $(__KERNEL_DS), %ecx
13346 movl %ecx, %ds
13347 movl %ecx, %es
13348+
13349+ pax_enter_kernel
13350+
13351 TRACE_IRQS_OFF
13352 movl %esp,%eax # pt_regs pointer
13353 call *%edi
13354 jmp ret_from_exception
13355 CFI_ENDPROC
13356-END(page_fault)
13357+ENDPROC(page_fault)
13358
13359 /*
13360 * Debug traps and NMI can happen at the one SYSENTER instruction
13361@@ -1305,7 +1556,7 @@ debug_stack_correct:
13362 call do_debug
13363 jmp ret_from_exception
13364 CFI_ENDPROC
13365-END(debug)
13366+ENDPROC(debug)
13367
13368 /*
13369 * NMI is doubly nasty. It can happen _while_ we're handling
13370@@ -1342,6 +1593,9 @@ nmi_stack_correct:
13371 xorl %edx,%edx # zero error code
13372 movl %esp,%eax # pt_regs pointer
13373 call do_nmi
13374+
13375+ pax_exit_kernel
13376+
13377 jmp restore_all_notrace
13378 CFI_ENDPROC
13379
13380@@ -1378,12 +1632,15 @@ nmi_espfix_stack:
13381 FIXUP_ESPFIX_STACK # %eax == %esp
13382 xorl %edx,%edx # zero error code
13383 call do_nmi
13384+
13385+ pax_exit_kernel
13386+
13387 RESTORE_REGS
13388 lss 12+4(%esp), %esp # back to espfix stack
13389 CFI_ADJUST_CFA_OFFSET -24
13390 jmp irq_return
13391 CFI_ENDPROC
13392-END(nmi)
13393+ENDPROC(nmi)
13394
13395 ENTRY(int3)
13396 RING0_INT_FRAME
13397@@ -1395,14 +1652,14 @@ ENTRY(int3)
13398 call do_int3
13399 jmp ret_from_exception
13400 CFI_ENDPROC
13401-END(int3)
13402+ENDPROC(int3)
13403
13404 ENTRY(general_protection)
13405 RING0_EC_FRAME
13406 pushl_cfi $do_general_protection
13407 jmp error_code
13408 CFI_ENDPROC
13409-END(general_protection)
13410+ENDPROC(general_protection)
13411
13412 #ifdef CONFIG_KVM_GUEST
13413 ENTRY(async_page_fault)
13414@@ -1410,7 +1667,7 @@ ENTRY(async_page_fault)
13415 pushl_cfi $do_async_page_fault
13416 jmp error_code
13417 CFI_ENDPROC
13418-END(async_page_fault)
13419+ENDPROC(async_page_fault)
13420 #endif
13421
13422 /*
13423diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
13424index 6419bb0..00440bf 100644
13425--- a/arch/x86/kernel/entry_64.S
13426+++ b/arch/x86/kernel/entry_64.S
13427@@ -55,6 +55,8 @@
13428 #include <asm/paravirt.h>
13429 #include <asm/ftrace.h>
13430 #include <asm/percpu.h>
13431+#include <asm/pgtable.h>
13432+#include <asm/alternative-asm.h>
13433
13434 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
13435 #include <linux/elf-em.h>
13436@@ -68,8 +70,9 @@
13437 #ifdef CONFIG_FUNCTION_TRACER
13438 #ifdef CONFIG_DYNAMIC_FTRACE
13439 ENTRY(mcount)
13440+ pax_force_retaddr
13441 retq
13442-END(mcount)
13443+ENDPROC(mcount)
13444
13445 ENTRY(ftrace_caller)
13446 cmpl $0, function_trace_stop
13447@@ -92,8 +95,9 @@ GLOBAL(ftrace_graph_call)
13448 #endif
13449
13450 GLOBAL(ftrace_stub)
13451+ pax_force_retaddr
13452 retq
13453-END(ftrace_caller)
13454+ENDPROC(ftrace_caller)
13455
13456 #else /* ! CONFIG_DYNAMIC_FTRACE */
13457 ENTRY(mcount)
13458@@ -112,6 +116,7 @@ ENTRY(mcount)
13459 #endif
13460
13461 GLOBAL(ftrace_stub)
13462+ pax_force_retaddr
13463 retq
13464
13465 trace:
13466@@ -121,12 +126,13 @@ trace:
13467 movq 8(%rbp), %rsi
13468 subq $MCOUNT_INSN_SIZE, %rdi
13469
13470+ pax_force_fptr ftrace_trace_function
13471 call *ftrace_trace_function
13472
13473 MCOUNT_RESTORE_FRAME
13474
13475 jmp ftrace_stub
13476-END(mcount)
13477+ENDPROC(mcount)
13478 #endif /* CONFIG_DYNAMIC_FTRACE */
13479 #endif /* CONFIG_FUNCTION_TRACER */
13480
13481@@ -146,8 +152,9 @@ ENTRY(ftrace_graph_caller)
13482
13483 MCOUNT_RESTORE_FRAME
13484
13485+ pax_force_retaddr
13486 retq
13487-END(ftrace_graph_caller)
13488+ENDPROC(ftrace_graph_caller)
13489
13490 GLOBAL(return_to_handler)
13491 subq $24, %rsp
13492@@ -163,6 +170,7 @@ GLOBAL(return_to_handler)
13493 movq 8(%rsp), %rdx
13494 movq (%rsp), %rax
13495 addq $24, %rsp
13496+ pax_force_fptr %rdi
13497 jmp *%rdi
13498 #endif
13499
13500@@ -178,6 +186,282 @@ ENTRY(native_usergs_sysret64)
13501 ENDPROC(native_usergs_sysret64)
13502 #endif /* CONFIG_PARAVIRT */
13503
13504+ .macro ljmpq sel, off
13505+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
13506+ .byte 0x48; ljmp *1234f(%rip)
13507+ .pushsection .rodata
13508+ .align 16
13509+ 1234: .quad \off; .word \sel
13510+ .popsection
13511+#else
13512+ pushq $\sel
13513+ pushq $\off
13514+ lretq
13515+#endif
13516+ .endm
13517+
13518+ .macro pax_enter_kernel
13519+ pax_set_fptr_mask
13520+#ifdef CONFIG_PAX_KERNEXEC
13521+ call pax_enter_kernel
13522+#endif
13523+ .endm
13524+
13525+ .macro pax_exit_kernel
13526+#ifdef CONFIG_PAX_KERNEXEC
13527+ call pax_exit_kernel
13528+#endif
13529+ .endm
13530+
13531+#ifdef CONFIG_PAX_KERNEXEC
13532+ENTRY(pax_enter_kernel)
13533+ pushq %rdi
13534+
13535+#ifdef CONFIG_PARAVIRT
13536+ PV_SAVE_REGS(CLBR_RDI)
13537+#endif
13538+
13539+ GET_CR0_INTO_RDI
13540+ bts $16,%rdi
13541+ jnc 3f
13542+ mov %cs,%edi
13543+ cmp $__KERNEL_CS,%edi
13544+ jnz 2f
13545+1:
13546+
13547+#ifdef CONFIG_PARAVIRT
13548+ PV_RESTORE_REGS(CLBR_RDI)
13549+#endif
13550+
13551+ popq %rdi
13552+ pax_force_retaddr
13553+ retq
13554+
13555+2: ljmpq __KERNEL_CS,1f
13556+3: ljmpq __KERNEXEC_KERNEL_CS,4f
13557+4: SET_RDI_INTO_CR0
13558+ jmp 1b
13559+ENDPROC(pax_enter_kernel)
13560+
13561+ENTRY(pax_exit_kernel)
13562+ pushq %rdi
13563+
13564+#ifdef CONFIG_PARAVIRT
13565+ PV_SAVE_REGS(CLBR_RDI)
13566+#endif
13567+
13568+ mov %cs,%rdi
13569+ cmp $__KERNEXEC_KERNEL_CS,%edi
13570+ jz 2f
13571+1:
13572+
13573+#ifdef CONFIG_PARAVIRT
13574+ PV_RESTORE_REGS(CLBR_RDI);
13575+#endif
13576+
13577+ popq %rdi
13578+ pax_force_retaddr
13579+ retq
13580+
13581+2: GET_CR0_INTO_RDI
13582+ btr $16,%rdi
13583+ ljmpq __KERNEL_CS,3f
13584+3: SET_RDI_INTO_CR0
13585+ jmp 1b
13586+#ifdef CONFIG_PARAVIRT
13587+ PV_RESTORE_REGS(CLBR_RDI);
13588+#endif
13589+
13590+ popq %rdi
13591+ pax_force_retaddr
13592+ retq
13593+ENDPROC(pax_exit_kernel)
13594+#endif
13595+
13596+ .macro pax_enter_kernel_user
13597+ pax_set_fptr_mask
13598+#ifdef CONFIG_PAX_MEMORY_UDEREF
13599+ call pax_enter_kernel_user
13600+#endif
13601+ .endm
13602+
13603+ .macro pax_exit_kernel_user
13604+#ifdef CONFIG_PAX_MEMORY_UDEREF
13605+ call pax_exit_kernel_user
13606+#endif
13607+#ifdef CONFIG_PAX_RANDKSTACK
13608+ push %rax
13609+ call pax_randomize_kstack
13610+ pop %rax
13611+#endif
13612+ .endm
13613+
13614+#ifdef CONFIG_PAX_MEMORY_UDEREF
13615+ENTRY(pax_enter_kernel_user)
13616+ pushq %rdi
13617+ pushq %rbx
13618+
13619+#ifdef CONFIG_PARAVIRT
13620+ PV_SAVE_REGS(CLBR_RDI)
13621+#endif
13622+
13623+ GET_CR3_INTO_RDI
13624+ mov %rdi,%rbx
13625+ add $__START_KERNEL_map,%rbx
13626+ sub phys_base(%rip),%rbx
13627+
13628+#ifdef CONFIG_PARAVIRT
13629+ pushq %rdi
13630+ cmpl $0, pv_info+PARAVIRT_enabled
13631+ jz 1f
13632+ i = 0
13633+ .rept USER_PGD_PTRS
13634+ mov i*8(%rbx),%rsi
13635+ mov $0,%sil
13636+ lea i*8(%rbx),%rdi
13637+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13638+ i = i + 1
13639+ .endr
13640+ jmp 2f
13641+1:
13642+#endif
13643+
13644+ i = 0
13645+ .rept USER_PGD_PTRS
13646+ movb $0,i*8(%rbx)
13647+ i = i + 1
13648+ .endr
13649+
13650+#ifdef CONFIG_PARAVIRT
13651+2: popq %rdi
13652+#endif
13653+ SET_RDI_INTO_CR3
13654+
13655+#ifdef CONFIG_PAX_KERNEXEC
13656+ GET_CR0_INTO_RDI
13657+ bts $16,%rdi
13658+ SET_RDI_INTO_CR0
13659+#endif
13660+
13661+#ifdef CONFIG_PARAVIRT
13662+ PV_RESTORE_REGS(CLBR_RDI)
13663+#endif
13664+
13665+ popq %rbx
13666+ popq %rdi
13667+ pax_force_retaddr
13668+ retq
13669+ENDPROC(pax_enter_kernel_user)
13670+
13671+ENTRY(pax_exit_kernel_user)
13672+ push %rdi
13673+
13674+#ifdef CONFIG_PARAVIRT
13675+ pushq %rbx
13676+ PV_SAVE_REGS(CLBR_RDI)
13677+#endif
13678+
13679+#ifdef CONFIG_PAX_KERNEXEC
13680+ GET_CR0_INTO_RDI
13681+ btr $16,%rdi
13682+ SET_RDI_INTO_CR0
13683+#endif
13684+
13685+ GET_CR3_INTO_RDI
13686+ add $__START_KERNEL_map,%rdi
13687+ sub phys_base(%rip),%rdi
13688+
13689+#ifdef CONFIG_PARAVIRT
13690+ cmpl $0, pv_info+PARAVIRT_enabled
13691+ jz 1f
13692+ mov %rdi,%rbx
13693+ i = 0
13694+ .rept USER_PGD_PTRS
13695+ mov i*8(%rbx),%rsi
13696+ mov $0x67,%sil
13697+ lea i*8(%rbx),%rdi
13698+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13699+ i = i + 1
13700+ .endr
13701+ jmp 2f
13702+1:
13703+#endif
13704+
13705+ i = 0
13706+ .rept USER_PGD_PTRS
13707+ movb $0x67,i*8(%rdi)
13708+ i = i + 1
13709+ .endr
13710+
13711+#ifdef CONFIG_PARAVIRT
13712+2: PV_RESTORE_REGS(CLBR_RDI)
13713+ popq %rbx
13714+#endif
13715+
13716+ popq %rdi
13717+ pax_force_retaddr
13718+ retq
13719+ENDPROC(pax_exit_kernel_user)
13720+#endif
13721+
13722+.macro pax_erase_kstack
13723+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13724+ call pax_erase_kstack
13725+#endif
13726+.endm
13727+
13728+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13729+/*
13730+ * r11: thread_info
13731+ * rcx, rdx: can be clobbered
13732+ */
13733+ENTRY(pax_erase_kstack)
13734+ pushq %rdi
13735+ pushq %rax
13736+ pushq %r11
13737+
13738+ GET_THREAD_INFO(%r11)
13739+ mov TI_lowest_stack(%r11), %rdi
13740+ mov $-0xBEEF, %rax
13741+ std
13742+
13743+1: mov %edi, %ecx
13744+ and $THREAD_SIZE_asm - 1, %ecx
13745+ shr $3, %ecx
13746+ repne scasq
13747+ jecxz 2f
13748+
13749+ cmp $2*8, %ecx
13750+ jc 2f
13751+
13752+ mov $2*8, %ecx
13753+ repe scasq
13754+ jecxz 2f
13755+ jne 1b
13756+
13757+2: cld
13758+ mov %esp, %ecx
13759+ sub %edi, %ecx
13760+
13761+ cmp $THREAD_SIZE_asm, %rcx
13762+ jb 3f
13763+ ud2
13764+3:
13765+
13766+ shr $3, %ecx
13767+ rep stosq
13768+
13769+ mov TI_task_thread_sp0(%r11), %rdi
13770+ sub $256, %rdi
13771+ mov %rdi, TI_lowest_stack(%r11)
13772+
13773+ popq %r11
13774+ popq %rax
13775+ popq %rdi
13776+ pax_force_retaddr
13777+ ret
13778+ENDPROC(pax_erase_kstack)
13779+#endif
13780
13781 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
13782 #ifdef CONFIG_TRACE_IRQFLAGS
13783@@ -231,8 +515,8 @@ ENDPROC(native_usergs_sysret64)
13784 .endm
13785
13786 .macro UNFAKE_STACK_FRAME
13787- addq $8*6, %rsp
13788- CFI_ADJUST_CFA_OFFSET -(6*8)
13789+ addq $8*6 + ARG_SKIP, %rsp
13790+ CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
13791 .endm
13792
13793 /*
13794@@ -319,7 +603,7 @@ ENDPROC(native_usergs_sysret64)
13795 movq %rsp, %rsi
13796
13797 leaq -RBP(%rsp),%rdi /* arg1 for handler */
13798- testl $3, CS(%rdi)
13799+ testb $3, CS(%rdi)
13800 je 1f
13801 SWAPGS
13802 /*
13803@@ -350,9 +634,10 @@ ENTRY(save_rest)
13804 movq_cfi r15, R15+16
13805 movq %r11, 8(%rsp) /* return address */
13806 FIXUP_TOP_OF_STACK %r11, 16
13807+ pax_force_retaddr
13808 ret
13809 CFI_ENDPROC
13810-END(save_rest)
13811+ENDPROC(save_rest)
13812
13813 /* save complete stack frame */
13814 .pushsection .kprobes.text, "ax"
13815@@ -381,9 +666,10 @@ ENTRY(save_paranoid)
13816 js 1f /* negative -> in kernel */
13817 SWAPGS
13818 xorl %ebx,%ebx
13819-1: ret
13820+1: pax_force_retaddr_bts
13821+ ret
13822 CFI_ENDPROC
13823-END(save_paranoid)
13824+ENDPROC(save_paranoid)
13825 .popsection
13826
13827 /*
13828@@ -405,7 +691,7 @@ ENTRY(ret_from_fork)
13829
13830 RESTORE_REST
13831
13832- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13833+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13834 je int_ret_from_sys_call
13835
13836 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
13837@@ -415,7 +701,7 @@ ENTRY(ret_from_fork)
13838 jmp ret_from_sys_call # go to the SYSRET fastpath
13839
13840 CFI_ENDPROC
13841-END(ret_from_fork)
13842+ENDPROC(ret_from_fork)
13843
13844 /*
13845 * System call entry. Up to 6 arguments in registers are supported.
13846@@ -451,7 +737,7 @@ END(ret_from_fork)
13847 ENTRY(system_call)
13848 CFI_STARTPROC simple
13849 CFI_SIGNAL_FRAME
13850- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
13851+ CFI_DEF_CFA rsp,0
13852 CFI_REGISTER rip,rcx
13853 /*CFI_REGISTER rflags,r11*/
13854 SWAPGS_UNSAFE_STACK
13855@@ -464,12 +750,13 @@ ENTRY(system_call_after_swapgs)
13856
13857 movq %rsp,PER_CPU_VAR(old_rsp)
13858 movq PER_CPU_VAR(kernel_stack),%rsp
13859+ SAVE_ARGS 8*6,0
13860+ pax_enter_kernel_user
13861 /*
13862 * No need to follow this irqs off/on section - it's straight
13863 * and short:
13864 */
13865 ENABLE_INTERRUPTS(CLBR_NONE)
13866- SAVE_ARGS 8,0
13867 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
13868 movq %rcx,RIP-ARGOFFSET(%rsp)
13869 CFI_REL_OFFSET rip,RIP-ARGOFFSET
13870@@ -479,7 +766,7 @@ ENTRY(system_call_after_swapgs)
13871 system_call_fastpath:
13872 cmpq $__NR_syscall_max,%rax
13873 ja badsys
13874- movq %r10,%rcx
13875+ movq R10-ARGOFFSET(%rsp),%rcx
13876 call *sys_call_table(,%rax,8) # XXX: rip relative
13877 movq %rax,RAX-ARGOFFSET(%rsp)
13878 /*
13879@@ -498,6 +785,8 @@ sysret_check:
13880 andl %edi,%edx
13881 jnz sysret_careful
13882 CFI_REMEMBER_STATE
13883+ pax_exit_kernel_user
13884+ pax_erase_kstack
13885 /*
13886 * sysretq will re-enable interrupts:
13887 */
13888@@ -549,14 +838,18 @@ badsys:
13889 * jump back to the normal fast path.
13890 */
13891 auditsys:
13892- movq %r10,%r9 /* 6th arg: 4th syscall arg */
13893+ movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
13894 movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
13895 movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
13896 movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
13897 movq %rax,%rsi /* 2nd arg: syscall number */
13898 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
13899 call audit_syscall_entry
13900+
13901+ pax_erase_kstack
13902+
13903 LOAD_ARGS 0 /* reload call-clobbered registers */
13904+ pax_set_fptr_mask
13905 jmp system_call_fastpath
13906
13907 /*
13908@@ -586,16 +879,20 @@ tracesys:
13909 FIXUP_TOP_OF_STACK %rdi
13910 movq %rsp,%rdi
13911 call syscall_trace_enter
13912+
13913+ pax_erase_kstack
13914+
13915 /*
13916 * Reload arg registers from stack in case ptrace changed them.
13917 * We don't reload %rax because syscall_trace_enter() returned
13918 * the value it wants us to use in the table lookup.
13919 */
13920 LOAD_ARGS ARGOFFSET, 1
13921+ pax_set_fptr_mask
13922 RESTORE_REST
13923 cmpq $__NR_syscall_max,%rax
13924 ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
13925- movq %r10,%rcx /* fixup for C */
13926+ movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
13927 call *sys_call_table(,%rax,8)
13928 movq %rax,RAX-ARGOFFSET(%rsp)
13929 /* Use IRET because user could have changed frame */
13930@@ -607,7 +904,7 @@ tracesys:
13931 GLOBAL(int_ret_from_sys_call)
13932 DISABLE_INTERRUPTS(CLBR_NONE)
13933 TRACE_IRQS_OFF
13934- testl $3,CS-ARGOFFSET(%rsp)
13935+ testb $3,CS-ARGOFFSET(%rsp)
13936 je retint_restore_args
13937 movl $_TIF_ALLWORK_MASK,%edi
13938 /* edi: mask to check */
13939@@ -664,7 +961,7 @@ int_restore_rest:
13940 TRACE_IRQS_OFF
13941 jmp int_with_check
13942 CFI_ENDPROC
13943-END(system_call)
13944+ENDPROC(system_call)
13945
13946 /*
13947 * Certain special system calls that need to save a complete full stack frame.
13948@@ -680,7 +977,7 @@ ENTRY(\label)
13949 call \func
13950 jmp ptregscall_common
13951 CFI_ENDPROC
13952-END(\label)
13953+ENDPROC(\label)
13954 .endm
13955
13956 PTREGSCALL stub_clone, sys_clone, %r8
13957@@ -698,9 +995,10 @@ ENTRY(ptregscall_common)
13958 movq_cfi_restore R12+8, r12
13959 movq_cfi_restore RBP+8, rbp
13960 movq_cfi_restore RBX+8, rbx
13961+ pax_force_retaddr
13962 ret $REST_SKIP /* pop extended registers */
13963 CFI_ENDPROC
13964-END(ptregscall_common)
13965+ENDPROC(ptregscall_common)
13966
13967 ENTRY(stub_execve)
13968 CFI_STARTPROC
13969@@ -715,7 +1013,7 @@ ENTRY(stub_execve)
13970 RESTORE_REST
13971 jmp int_ret_from_sys_call
13972 CFI_ENDPROC
13973-END(stub_execve)
13974+ENDPROC(stub_execve)
13975
13976 /*
13977 * sigreturn is special because it needs to restore all registers on return.
13978@@ -733,7 +1031,7 @@ ENTRY(stub_rt_sigreturn)
13979 RESTORE_REST
13980 jmp int_ret_from_sys_call
13981 CFI_ENDPROC
13982-END(stub_rt_sigreturn)
13983+ENDPROC(stub_rt_sigreturn)
13984
13985 /*
13986 * Build the entry stubs and pointer table with some assembler magic.
13987@@ -768,7 +1066,7 @@ vector=vector+1
13988 2: jmp common_interrupt
13989 .endr
13990 CFI_ENDPROC
13991-END(irq_entries_start)
13992+ENDPROC(irq_entries_start)
13993
13994 .previous
13995 END(interrupt)
13996@@ -789,6 +1087,16 @@ END(interrupt)
13997 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
13998 SAVE_ARGS_IRQ
13999 PARTIAL_FRAME 0
14000+#ifdef CONFIG_PAX_MEMORY_UDEREF
14001+ testb $3, CS(%rdi)
14002+ jnz 1f
14003+ pax_enter_kernel
14004+ jmp 2f
14005+1: pax_enter_kernel_user
14006+2:
14007+#else
14008+ pax_enter_kernel
14009+#endif
14010 call \func
14011 .endm
14012
14013@@ -820,7 +1128,7 @@ ret_from_intr:
14014
14015 exit_intr:
14016 GET_THREAD_INFO(%rcx)
14017- testl $3,CS-ARGOFFSET(%rsp)
14018+ testb $3,CS-ARGOFFSET(%rsp)
14019 je retint_kernel
14020
14021 /* Interrupt came from user space */
14022@@ -842,12 +1150,16 @@ retint_swapgs: /* return to user-space */
14023 * The iretq could re-enable interrupts:
14024 */
14025 DISABLE_INTERRUPTS(CLBR_ANY)
14026+ pax_exit_kernel_user
14027+ pax_erase_kstack
14028 TRACE_IRQS_IRETQ
14029 SWAPGS
14030 jmp restore_args
14031
14032 retint_restore_args: /* return to kernel space */
14033 DISABLE_INTERRUPTS(CLBR_ANY)
14034+ pax_exit_kernel
14035+ pax_force_retaddr RIP-ARGOFFSET
14036 /*
14037 * The iretq could re-enable interrupts:
14038 */
14039@@ -936,7 +1248,7 @@ ENTRY(retint_kernel)
14040 #endif
14041
14042 CFI_ENDPROC
14043-END(common_interrupt)
14044+ENDPROC(common_interrupt)
14045 /*
14046 * End of kprobes section
14047 */
14048@@ -952,7 +1264,7 @@ ENTRY(\sym)
14049 interrupt \do_sym
14050 jmp ret_from_intr
14051 CFI_ENDPROC
14052-END(\sym)
14053+ENDPROC(\sym)
14054 .endm
14055
14056 #ifdef CONFIG_SMP
14057@@ -1017,12 +1329,22 @@ ENTRY(\sym)
14058 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14059 call error_entry
14060 DEFAULT_FRAME 0
14061+#ifdef CONFIG_PAX_MEMORY_UDEREF
14062+ testb $3, CS(%rsp)
14063+ jnz 1f
14064+ pax_enter_kernel
14065+ jmp 2f
14066+1: pax_enter_kernel_user
14067+2:
14068+#else
14069+ pax_enter_kernel
14070+#endif
14071 movq %rsp,%rdi /* pt_regs pointer */
14072 xorl %esi,%esi /* no error code */
14073 call \do_sym
14074 jmp error_exit /* %ebx: no swapgs flag */
14075 CFI_ENDPROC
14076-END(\sym)
14077+ENDPROC(\sym)
14078 .endm
14079
14080 .macro paranoidzeroentry sym do_sym
14081@@ -1034,15 +1356,25 @@ ENTRY(\sym)
14082 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14083 call save_paranoid
14084 TRACE_IRQS_OFF
14085+#ifdef CONFIG_PAX_MEMORY_UDEREF
14086+ testb $3, CS(%rsp)
14087+ jnz 1f
14088+ pax_enter_kernel
14089+ jmp 2f
14090+1: pax_enter_kernel_user
14091+2:
14092+#else
14093+ pax_enter_kernel
14094+#endif
14095 movq %rsp,%rdi /* pt_regs pointer */
14096 xorl %esi,%esi /* no error code */
14097 call \do_sym
14098 jmp paranoid_exit /* %ebx: no swapgs flag */
14099 CFI_ENDPROC
14100-END(\sym)
14101+ENDPROC(\sym)
14102 .endm
14103
14104-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14105+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14106 .macro paranoidzeroentry_ist sym do_sym ist
14107 ENTRY(\sym)
14108 INTR_FRAME
14109@@ -1052,14 +1384,30 @@ ENTRY(\sym)
14110 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14111 call save_paranoid
14112 TRACE_IRQS_OFF
14113+#ifdef CONFIG_PAX_MEMORY_UDEREF
14114+ testb $3, CS(%rsp)
14115+ jnz 1f
14116+ pax_enter_kernel
14117+ jmp 2f
14118+1: pax_enter_kernel_user
14119+2:
14120+#else
14121+ pax_enter_kernel
14122+#endif
14123 movq %rsp,%rdi /* pt_regs pointer */
14124 xorl %esi,%esi /* no error code */
14125+#ifdef CONFIG_SMP
14126+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14127+ lea init_tss(%r12), %r12
14128+#else
14129+ lea init_tss(%rip), %r12
14130+#endif
14131 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14132 call \do_sym
14133 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14134 jmp paranoid_exit /* %ebx: no swapgs flag */
14135 CFI_ENDPROC
14136-END(\sym)
14137+ENDPROC(\sym)
14138 .endm
14139
14140 .macro errorentry sym do_sym
14141@@ -1070,13 +1418,23 @@ ENTRY(\sym)
14142 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14143 call error_entry
14144 DEFAULT_FRAME 0
14145+#ifdef CONFIG_PAX_MEMORY_UDEREF
14146+ testb $3, CS(%rsp)
14147+ jnz 1f
14148+ pax_enter_kernel
14149+ jmp 2f
14150+1: pax_enter_kernel_user
14151+2:
14152+#else
14153+ pax_enter_kernel
14154+#endif
14155 movq %rsp,%rdi /* pt_regs pointer */
14156 movq ORIG_RAX(%rsp),%rsi /* get error code */
14157 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14158 call \do_sym
14159 jmp error_exit /* %ebx: no swapgs flag */
14160 CFI_ENDPROC
14161-END(\sym)
14162+ENDPROC(\sym)
14163 .endm
14164
14165 /* error code is on the stack already */
14166@@ -1089,13 +1447,23 @@ ENTRY(\sym)
14167 call save_paranoid
14168 DEFAULT_FRAME 0
14169 TRACE_IRQS_OFF
14170+#ifdef CONFIG_PAX_MEMORY_UDEREF
14171+ testb $3, CS(%rsp)
14172+ jnz 1f
14173+ pax_enter_kernel
14174+ jmp 2f
14175+1: pax_enter_kernel_user
14176+2:
14177+#else
14178+ pax_enter_kernel
14179+#endif
14180 movq %rsp,%rdi /* pt_regs pointer */
14181 movq ORIG_RAX(%rsp),%rsi /* get error code */
14182 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14183 call \do_sym
14184 jmp paranoid_exit /* %ebx: no swapgs flag */
14185 CFI_ENDPROC
14186-END(\sym)
14187+ENDPROC(\sym)
14188 .endm
14189
14190 zeroentry divide_error do_divide_error
14191@@ -1125,9 +1493,10 @@ gs_change:
14192 2: mfence /* workaround */
14193 SWAPGS
14194 popfq_cfi
14195+ pax_force_retaddr
14196 ret
14197 CFI_ENDPROC
14198-END(native_load_gs_index)
14199+ENDPROC(native_load_gs_index)
14200
14201 .section __ex_table,"a"
14202 .align 8
14203@@ -1149,13 +1518,14 @@ ENTRY(kernel_thread_helper)
14204 * Here we are in the child and the registers are set as they were
14205 * at kernel_thread() invocation in the parent.
14206 */
14207+ pax_force_fptr %rsi
14208 call *%rsi
14209 # exit
14210 mov %eax, %edi
14211 call do_exit
14212 ud2 # padding for call trace
14213 CFI_ENDPROC
14214-END(kernel_thread_helper)
14215+ENDPROC(kernel_thread_helper)
14216
14217 /*
14218 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
14219@@ -1182,11 +1552,11 @@ ENTRY(kernel_execve)
14220 RESTORE_REST
14221 testq %rax,%rax
14222 je int_ret_from_sys_call
14223- RESTORE_ARGS
14224 UNFAKE_STACK_FRAME
14225+ pax_force_retaddr
14226 ret
14227 CFI_ENDPROC
14228-END(kernel_execve)
14229+ENDPROC(kernel_execve)
14230
14231 /* Call softirq on interrupt stack. Interrupts are off. */
14232 ENTRY(call_softirq)
14233@@ -1204,9 +1574,10 @@ ENTRY(call_softirq)
14234 CFI_DEF_CFA_REGISTER rsp
14235 CFI_ADJUST_CFA_OFFSET -8
14236 decl PER_CPU_VAR(irq_count)
14237+ pax_force_retaddr
14238 ret
14239 CFI_ENDPROC
14240-END(call_softirq)
14241+ENDPROC(call_softirq)
14242
14243 #ifdef CONFIG_XEN
14244 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
14245@@ -1244,7 +1615,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
14246 decl PER_CPU_VAR(irq_count)
14247 jmp error_exit
14248 CFI_ENDPROC
14249-END(xen_do_hypervisor_callback)
14250+ENDPROC(xen_do_hypervisor_callback)
14251
14252 /*
14253 * Hypervisor uses this for application faults while it executes.
14254@@ -1303,7 +1674,7 @@ ENTRY(xen_failsafe_callback)
14255 SAVE_ALL
14256 jmp error_exit
14257 CFI_ENDPROC
14258-END(xen_failsafe_callback)
14259+ENDPROC(xen_failsafe_callback)
14260
14261 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
14262 xen_hvm_callback_vector xen_evtchn_do_upcall
14263@@ -1352,16 +1723,31 @@ ENTRY(paranoid_exit)
14264 TRACE_IRQS_OFF
14265 testl %ebx,%ebx /* swapgs needed? */
14266 jnz paranoid_restore
14267- testl $3,CS(%rsp)
14268+ testb $3,CS(%rsp)
14269 jnz paranoid_userspace
14270+#ifdef CONFIG_PAX_MEMORY_UDEREF
14271+ pax_exit_kernel
14272+ TRACE_IRQS_IRETQ 0
14273+ SWAPGS_UNSAFE_STACK
14274+ RESTORE_ALL 8
14275+ pax_force_retaddr_bts
14276+ jmp irq_return
14277+#endif
14278 paranoid_swapgs:
14279+#ifdef CONFIG_PAX_MEMORY_UDEREF
14280+ pax_exit_kernel_user
14281+#else
14282+ pax_exit_kernel
14283+#endif
14284 TRACE_IRQS_IRETQ 0
14285 SWAPGS_UNSAFE_STACK
14286 RESTORE_ALL 8
14287 jmp irq_return
14288 paranoid_restore:
14289+ pax_exit_kernel
14290 TRACE_IRQS_IRETQ 0
14291 RESTORE_ALL 8
14292+ pax_force_retaddr_bts
14293 jmp irq_return
14294 paranoid_userspace:
14295 GET_THREAD_INFO(%rcx)
14296@@ -1390,7 +1776,7 @@ paranoid_schedule:
14297 TRACE_IRQS_OFF
14298 jmp paranoid_userspace
14299 CFI_ENDPROC
14300-END(paranoid_exit)
14301+ENDPROC(paranoid_exit)
14302
14303 /*
14304 * Exception entry point. This expects an error code/orig_rax on the stack.
14305@@ -1417,12 +1803,13 @@ ENTRY(error_entry)
14306 movq_cfi r14, R14+8
14307 movq_cfi r15, R15+8
14308 xorl %ebx,%ebx
14309- testl $3,CS+8(%rsp)
14310+ testb $3,CS+8(%rsp)
14311 je error_kernelspace
14312 error_swapgs:
14313 SWAPGS
14314 error_sti:
14315 TRACE_IRQS_OFF
14316+ pax_force_retaddr_bts
14317 ret
14318
14319 /*
14320@@ -1449,7 +1836,7 @@ bstep_iret:
14321 movq %rcx,RIP+8(%rsp)
14322 jmp error_swapgs
14323 CFI_ENDPROC
14324-END(error_entry)
14325+ENDPROC(error_entry)
14326
14327
14328 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
14329@@ -1469,7 +1856,7 @@ ENTRY(error_exit)
14330 jnz retint_careful
14331 jmp retint_swapgs
14332 CFI_ENDPROC
14333-END(error_exit)
14334+ENDPROC(error_exit)
14335
14336
14337 /* runs on exception stack */
14338@@ -1481,6 +1868,16 @@ ENTRY(nmi)
14339 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14340 call save_paranoid
14341 DEFAULT_FRAME 0
14342+#ifdef CONFIG_PAX_MEMORY_UDEREF
14343+ testb $3, CS(%rsp)
14344+ jnz 1f
14345+ pax_enter_kernel
14346+ jmp 2f
14347+1: pax_enter_kernel_user
14348+2:
14349+#else
14350+ pax_enter_kernel
14351+#endif
14352 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14353 movq %rsp,%rdi
14354 movq $-1,%rsi
14355@@ -1491,12 +1888,28 @@ ENTRY(nmi)
14356 DISABLE_INTERRUPTS(CLBR_NONE)
14357 testl %ebx,%ebx /* swapgs needed? */
14358 jnz nmi_restore
14359- testl $3,CS(%rsp)
14360+ testb $3,CS(%rsp)
14361 jnz nmi_userspace
14362+#ifdef CONFIG_PAX_MEMORY_UDEREF
14363+ pax_exit_kernel
14364+ SWAPGS_UNSAFE_STACK
14365+ RESTORE_ALL 8
14366+ pax_force_retaddr_bts
14367+ jmp irq_return
14368+#endif
14369 nmi_swapgs:
14370+#ifdef CONFIG_PAX_MEMORY_UDEREF
14371+ pax_exit_kernel_user
14372+#else
14373+ pax_exit_kernel
14374+#endif
14375 SWAPGS_UNSAFE_STACK
14376+ RESTORE_ALL 8
14377+ jmp irq_return
14378 nmi_restore:
14379+ pax_exit_kernel
14380 RESTORE_ALL 8
14381+ pax_force_retaddr_bts
14382 jmp irq_return
14383 nmi_userspace:
14384 GET_THREAD_INFO(%rcx)
14385@@ -1525,14 +1938,14 @@ nmi_schedule:
14386 jmp paranoid_exit
14387 CFI_ENDPROC
14388 #endif
14389-END(nmi)
14390+ENDPROC(nmi)
14391
14392 ENTRY(ignore_sysret)
14393 CFI_STARTPROC
14394 mov $-ENOSYS,%eax
14395 sysret
14396 CFI_ENDPROC
14397-END(ignore_sysret)
14398+ENDPROC(ignore_sysret)
14399
14400 /*
14401 * End of kprobes section
14402diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
14403index c9a281f..ce2f317 100644
14404--- a/arch/x86/kernel/ftrace.c
14405+++ b/arch/x86/kernel/ftrace.c
14406@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the IP to write to */
14407 static const void *mod_code_newcode; /* holds the text to write to the IP */
14408
14409 static unsigned nmi_wait_count;
14410-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14411+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14412
14413 int ftrace_arch_read_dyn_info(char *buf, int size)
14414 {
14415@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size)
14416
14417 r = snprintf(buf, size, "%u %u",
14418 nmi_wait_count,
14419- atomic_read(&nmi_update_count));
14420+ atomic_read_unchecked(&nmi_update_count));
14421 return r;
14422 }
14423
14424@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14425
14426 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14427 smp_rmb();
14428+ pax_open_kernel();
14429 ftrace_mod_code();
14430- atomic_inc(&nmi_update_count);
14431+ pax_close_kernel();
14432+ atomic_inc_unchecked(&nmi_update_count);
14433 }
14434 /* Must have previous changes seen before executions */
14435 smp_mb();
14436@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code,
14437 {
14438 unsigned char replaced[MCOUNT_INSN_SIZE];
14439
14440+ ip = ktla_ktva(ip);
14441+
14442 /*
14443 * Note: Due to modules and __init, code can
14444 * disappear and change, we need to protect against faulting
14445@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
14446 unsigned char old[MCOUNT_INSN_SIZE], *new;
14447 int ret;
14448
14449- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14450+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14451 new = ftrace_call_replace(ip, (unsigned long)func);
14452 ret = ftrace_modify_code(ip, old, new);
14453
14454@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long ip,
14455 {
14456 unsigned char code[MCOUNT_INSN_SIZE];
14457
14458+ ip = ktla_ktva(ip);
14459+
14460 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14461 return -EFAULT;
14462
14463diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
14464index 3bb0850..55a56f4 100644
14465--- a/arch/x86/kernel/head32.c
14466+++ b/arch/x86/kernel/head32.c
14467@@ -19,6 +19,7 @@
14468 #include <asm/io_apic.h>
14469 #include <asm/bios_ebda.h>
14470 #include <asm/tlbflush.h>
14471+#include <asm/boot.h>
14472
14473 static void __init i386_default_early_setup(void)
14474 {
14475@@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
14476 {
14477 memblock_init();
14478
14479- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14480+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14481
14482 #ifdef CONFIG_BLK_DEV_INITRD
14483 /* Reserve INITRD */
14484diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
14485index ce0be7c..c41476e 100644
14486--- a/arch/x86/kernel/head_32.S
14487+++ b/arch/x86/kernel/head_32.S
14488@@ -25,6 +25,12 @@
14489 /* Physical address */
14490 #define pa(X) ((X) - __PAGE_OFFSET)
14491
14492+#ifdef CONFIG_PAX_KERNEXEC
14493+#define ta(X) (X)
14494+#else
14495+#define ta(X) ((X) - __PAGE_OFFSET)
14496+#endif
14497+
14498 /*
14499 * References to members of the new_cpu_data structure.
14500 */
14501@@ -54,11 +60,7 @@
14502 * and small than max_low_pfn, otherwise will waste some page table entries
14503 */
14504
14505-#if PTRS_PER_PMD > 1
14506-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14507-#else
14508-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14509-#endif
14510+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14511
14512 /* Number of possible pages in the lowmem region */
14513 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14514@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
14515 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14516
14517 /*
14518+ * Real beginning of normal "text" segment
14519+ */
14520+ENTRY(stext)
14521+ENTRY(_stext)
14522+
14523+/*
14524 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14525 * %esi points to the real-mode code as a 32-bit pointer.
14526 * CS and DS must be 4 GB flat segments, but we don't depend on
14527@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14528 * can.
14529 */
14530 __HEAD
14531+
14532+#ifdef CONFIG_PAX_KERNEXEC
14533+ jmp startup_32
14534+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14535+.fill PAGE_SIZE-5,1,0xcc
14536+#endif
14537+
14538 ENTRY(startup_32)
14539 movl pa(stack_start),%ecx
14540
14541@@ -105,6 +120,57 @@ ENTRY(startup_32)
14542 2:
14543 leal -__PAGE_OFFSET(%ecx),%esp
14544
14545+#ifdef CONFIG_SMP
14546+ movl $pa(cpu_gdt_table),%edi
14547+ movl $__per_cpu_load,%eax
14548+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14549+ rorl $16,%eax
14550+ movb %al,__KERNEL_PERCPU + 4(%edi)
14551+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14552+ movl $__per_cpu_end - 1,%eax
14553+ subl $__per_cpu_start,%eax
14554+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14555+#endif
14556+
14557+#ifdef CONFIG_PAX_MEMORY_UDEREF
14558+ movl $NR_CPUS,%ecx
14559+ movl $pa(cpu_gdt_table),%edi
14560+1:
14561+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14562+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14563+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14564+ addl $PAGE_SIZE_asm,%edi
14565+ loop 1b
14566+#endif
14567+
14568+#ifdef CONFIG_PAX_KERNEXEC
14569+ movl $pa(boot_gdt),%edi
14570+ movl $__LOAD_PHYSICAL_ADDR,%eax
14571+ movw %ax,__BOOT_CS + 2(%edi)
14572+ rorl $16,%eax
14573+ movb %al,__BOOT_CS + 4(%edi)
14574+ movb %ah,__BOOT_CS + 7(%edi)
14575+ rorl $16,%eax
14576+
14577+ ljmp $(__BOOT_CS),$1f
14578+1:
14579+
14580+ movl $NR_CPUS,%ecx
14581+ movl $pa(cpu_gdt_table),%edi
14582+ addl $__PAGE_OFFSET,%eax
14583+1:
14584+ movw %ax,__KERNEL_CS + 2(%edi)
14585+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14586+ rorl $16,%eax
14587+ movb %al,__KERNEL_CS + 4(%edi)
14588+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14589+ movb %ah,__KERNEL_CS + 7(%edi)
14590+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14591+ rorl $16,%eax
14592+ addl $PAGE_SIZE_asm,%edi
14593+ loop 1b
14594+#endif
14595+
14596 /*
14597 * Clear BSS first so that there are no surprises...
14598 */
14599@@ -195,8 +261,11 @@ ENTRY(startup_32)
14600 movl %eax, pa(max_pfn_mapped)
14601
14602 /* Do early initialization of the fixmap area */
14603- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14604- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14605+#ifdef CONFIG_COMPAT_VDSO
14606+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14607+#else
14608+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14609+#endif
14610 #else /* Not PAE */
14611
14612 page_pde_offset = (__PAGE_OFFSET >> 20);
14613@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14614 movl %eax, pa(max_pfn_mapped)
14615
14616 /* Do early initialization of the fixmap area */
14617- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14618- movl %eax,pa(initial_page_table+0xffc)
14619+#ifdef CONFIG_COMPAT_VDSO
14620+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14621+#else
14622+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14623+#endif
14624 #endif
14625
14626 #ifdef CONFIG_PARAVIRT
14627@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14628 cmpl $num_subarch_entries, %eax
14629 jae bad_subarch
14630
14631- movl pa(subarch_entries)(,%eax,4), %eax
14632- subl $__PAGE_OFFSET, %eax
14633- jmp *%eax
14634+ jmp *pa(subarch_entries)(,%eax,4)
14635
14636 bad_subarch:
14637 WEAK(lguest_entry)
14638@@ -255,10 +325,10 @@ WEAK(xen_entry)
14639 __INITDATA
14640
14641 subarch_entries:
14642- .long default_entry /* normal x86/PC */
14643- .long lguest_entry /* lguest hypervisor */
14644- .long xen_entry /* Xen hypervisor */
14645- .long default_entry /* Moorestown MID */
14646+ .long ta(default_entry) /* normal x86/PC */
14647+ .long ta(lguest_entry) /* lguest hypervisor */
14648+ .long ta(xen_entry) /* Xen hypervisor */
14649+ .long ta(default_entry) /* Moorestown MID */
14650 num_subarch_entries = (. - subarch_entries) / 4
14651 .previous
14652 #else
14653@@ -312,6 +382,7 @@ default_entry:
14654 orl %edx,%eax
14655 movl %eax,%cr4
14656
14657+#ifdef CONFIG_X86_PAE
14658 testb $X86_CR4_PAE, %al # check if PAE is enabled
14659 jz 6f
14660
14661@@ -340,6 +411,9 @@ default_entry:
14662 /* Make changes effective */
14663 wrmsr
14664
14665+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14666+#endif
14667+
14668 6:
14669
14670 /*
14671@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
14672 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14673 movl %eax,%ss # after changing gdt.
14674
14675- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14676+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14677 movl %eax,%ds
14678 movl %eax,%es
14679
14680@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
14681 */
14682 cmpb $0,ready
14683 jne 1f
14684- movl $gdt_page,%eax
14685+ movl $cpu_gdt_table,%eax
14686 movl $stack_canary,%ecx
14687+#ifdef CONFIG_SMP
14688+ addl $__per_cpu_load,%ecx
14689+#endif
14690 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14691 shrl $16, %ecx
14692 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14693 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14694 1:
14695-#endif
14696 movl $(__KERNEL_STACK_CANARY),%eax
14697+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14698+ movl $(__USER_DS),%eax
14699+#else
14700+ xorl %eax,%eax
14701+#endif
14702 movl %eax,%gs
14703
14704 xorl %eax,%eax # Clear LDT
14705@@ -558,22 +639,22 @@ early_page_fault:
14706 jmp early_fault
14707
14708 early_fault:
14709- cld
14710 #ifdef CONFIG_PRINTK
14711+ cmpl $1,%ss:early_recursion_flag
14712+ je hlt_loop
14713+ incl %ss:early_recursion_flag
14714+ cld
14715 pusha
14716 movl $(__KERNEL_DS),%eax
14717 movl %eax,%ds
14718 movl %eax,%es
14719- cmpl $2,early_recursion_flag
14720- je hlt_loop
14721- incl early_recursion_flag
14722 movl %cr2,%eax
14723 pushl %eax
14724 pushl %edx /* trapno */
14725 pushl $fault_msg
14726 call printk
14727+; call dump_stack
14728 #endif
14729- call dump_stack
14730 hlt_loop:
14731 hlt
14732 jmp hlt_loop
14733@@ -581,8 +662,11 @@ hlt_loop:
14734 /* This is the default interrupt "handler" :-) */
14735 ALIGN
14736 ignore_int:
14737- cld
14738 #ifdef CONFIG_PRINTK
14739+ cmpl $2,%ss:early_recursion_flag
14740+ je hlt_loop
14741+ incl %ss:early_recursion_flag
14742+ cld
14743 pushl %eax
14744 pushl %ecx
14745 pushl %edx
14746@@ -591,9 +675,6 @@ ignore_int:
14747 movl $(__KERNEL_DS),%eax
14748 movl %eax,%ds
14749 movl %eax,%es
14750- cmpl $2,early_recursion_flag
14751- je hlt_loop
14752- incl early_recursion_flag
14753 pushl 16(%esp)
14754 pushl 24(%esp)
14755 pushl 32(%esp)
14756@@ -622,29 +703,43 @@ ENTRY(initial_code)
14757 /*
14758 * BSS section
14759 */
14760-__PAGE_ALIGNED_BSS
14761- .align PAGE_SIZE
14762 #ifdef CONFIG_X86_PAE
14763+.section .initial_pg_pmd,"a",@progbits
14764 initial_pg_pmd:
14765 .fill 1024*KPMDS,4,0
14766 #else
14767+.section .initial_page_table,"a",@progbits
14768 ENTRY(initial_page_table)
14769 .fill 1024,4,0
14770 #endif
14771+.section .initial_pg_fixmap,"a",@progbits
14772 initial_pg_fixmap:
14773 .fill 1024,4,0
14774+.section .empty_zero_page,"a",@progbits
14775 ENTRY(empty_zero_page)
14776 .fill 4096,1,0
14777+.section .swapper_pg_dir,"a",@progbits
14778 ENTRY(swapper_pg_dir)
14779+#ifdef CONFIG_X86_PAE
14780+ .fill 4,8,0
14781+#else
14782 .fill 1024,4,0
14783+#endif
14784+
14785+/*
14786+ * The IDT has to be page-aligned to simplify the Pentium
14787+ * F0 0F bug workaround.. We have a special link segment
14788+ * for this.
14789+ */
14790+.section .idt,"a",@progbits
14791+ENTRY(idt_table)
14792+ .fill 256,8,0
14793
14794 /*
14795 * This starts the data section.
14796 */
14797 #ifdef CONFIG_X86_PAE
14798-__PAGE_ALIGNED_DATA
14799- /* Page-aligned for the benefit of paravirt? */
14800- .align PAGE_SIZE
14801+.section .initial_page_table,"a",@progbits
14802 ENTRY(initial_page_table)
14803 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
14804 # if KPMDS == 3
14805@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
14806 # error "Kernel PMDs should be 1, 2 or 3"
14807 # endif
14808 .align PAGE_SIZE /* needs to be page-sized too */
14809+
14810+#ifdef CONFIG_PAX_PER_CPU_PGD
14811+ENTRY(cpu_pgd)
14812+ .rept NR_CPUS
14813+ .fill 4,8,0
14814+ .endr
14815+#endif
14816+
14817 #endif
14818
14819 .data
14820 .balign 4
14821 ENTRY(stack_start)
14822- .long init_thread_union+THREAD_SIZE
14823+ .long init_thread_union+THREAD_SIZE-8
14824
14825+ready: .byte 0
14826+
14827+.section .rodata,"a",@progbits
14828 early_recursion_flag:
14829 .long 0
14830
14831-ready: .byte 0
14832-
14833 int_msg:
14834 .asciz "Unknown interrupt or fault at: %p %p %p\n"
14835
14836@@ -707,7 +811,7 @@ fault_msg:
14837 .word 0 # 32 bit align gdt_desc.address
14838 boot_gdt_descr:
14839 .word __BOOT_DS+7
14840- .long boot_gdt - __PAGE_OFFSET
14841+ .long pa(boot_gdt)
14842
14843 .word 0 # 32-bit align idt_desc.address
14844 idt_descr:
14845@@ -718,7 +822,7 @@ idt_descr:
14846 .word 0 # 32 bit align gdt_desc.address
14847 ENTRY(early_gdt_descr)
14848 .word GDT_ENTRIES*8-1
14849- .long gdt_page /* Overwritten for secondary CPUs */
14850+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
14851
14852 /*
14853 * The boot_gdt must mirror the equivalent in setup.S and is
14854@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
14855 .align L1_CACHE_BYTES
14856 ENTRY(boot_gdt)
14857 .fill GDT_ENTRY_BOOT_CS,8,0
14858- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
14859- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
14860+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
14861+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
14862+
14863+ .align PAGE_SIZE_asm
14864+ENTRY(cpu_gdt_table)
14865+ .rept NR_CPUS
14866+ .quad 0x0000000000000000 /* NULL descriptor */
14867+ .quad 0x0000000000000000 /* 0x0b reserved */
14868+ .quad 0x0000000000000000 /* 0x13 reserved */
14869+ .quad 0x0000000000000000 /* 0x1b reserved */
14870+
14871+#ifdef CONFIG_PAX_KERNEXEC
14872+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
14873+#else
14874+ .quad 0x0000000000000000 /* 0x20 unused */
14875+#endif
14876+
14877+ .quad 0x0000000000000000 /* 0x28 unused */
14878+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
14879+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
14880+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
14881+ .quad 0x0000000000000000 /* 0x4b reserved */
14882+ .quad 0x0000000000000000 /* 0x53 reserved */
14883+ .quad 0x0000000000000000 /* 0x5b reserved */
14884+
14885+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
14886+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
14887+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
14888+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
14889+
14890+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
14891+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
14892+
14893+ /*
14894+ * Segments used for calling PnP BIOS have byte granularity.
14895+ * The code segments and data segments have fixed 64k limits,
14896+ * the transfer segment sizes are set at run time.
14897+ */
14898+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
14899+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
14900+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
14901+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
14902+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
14903+
14904+ /*
14905+ * The APM segments have byte granularity and their bases
14906+ * are set at run time. All have 64k limits.
14907+ */
14908+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
14909+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
14910+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
14911+
14912+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
14913+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
14914+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
14915+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
14916+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
14917+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
14918+
14919+ /* Be sure this is zeroed to avoid false validations in Xen */
14920+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
14921+ .endr
14922diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
14923index e11e394..9aebc5d 100644
14924--- a/arch/x86/kernel/head_64.S
14925+++ b/arch/x86/kernel/head_64.S
14926@@ -19,6 +19,8 @@
14927 #include <asm/cache.h>
14928 #include <asm/processor-flags.h>
14929 #include <asm/percpu.h>
14930+#include <asm/cpufeature.h>
14931+#include <asm/alternative-asm.h>
14932
14933 #ifdef CONFIG_PARAVIRT
14934 #include <asm/asm-offsets.h>
14935@@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
14936 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
14937 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
14938 L3_START_KERNEL = pud_index(__START_KERNEL_map)
14939+L4_VMALLOC_START = pgd_index(VMALLOC_START)
14940+L3_VMALLOC_START = pud_index(VMALLOC_START)
14941+L4_VMALLOC_END = pgd_index(VMALLOC_END)
14942+L3_VMALLOC_END = pud_index(VMALLOC_END)
14943+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
14944+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
14945
14946 .text
14947 __HEAD
14948@@ -85,35 +93,23 @@ startup_64:
14949 */
14950 addq %rbp, init_level4_pgt + 0(%rip)
14951 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
14952+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
14953+ addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
14954+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
14955 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
14956
14957 addq %rbp, level3_ident_pgt + 0(%rip)
14958+#ifndef CONFIG_XEN
14959+ addq %rbp, level3_ident_pgt + 8(%rip)
14960+#endif
14961
14962- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
14963- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
14964+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
14965+
14966+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
14967+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
14968
14969 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
14970-
14971- /* Add an Identity mapping if I am above 1G */
14972- leaq _text(%rip), %rdi
14973- andq $PMD_PAGE_MASK, %rdi
14974-
14975- movq %rdi, %rax
14976- shrq $PUD_SHIFT, %rax
14977- andq $(PTRS_PER_PUD - 1), %rax
14978- jz ident_complete
14979-
14980- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
14981- leaq level3_ident_pgt(%rip), %rbx
14982- movq %rdx, 0(%rbx, %rax, 8)
14983-
14984- movq %rdi, %rax
14985- shrq $PMD_SHIFT, %rax
14986- andq $(PTRS_PER_PMD - 1), %rax
14987- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
14988- leaq level2_spare_pgt(%rip), %rbx
14989- movq %rdx, 0(%rbx, %rax, 8)
14990-ident_complete:
14991+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
14992
14993 /*
14994 * Fixup the kernel text+data virtual addresses. Note that
14995@@ -160,8 +156,8 @@ ENTRY(secondary_startup_64)
14996 * after the boot processor executes this code.
14997 */
14998
14999- /* Enable PAE mode and PGE */
15000- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15001+ /* Enable PAE mode and PSE/PGE */
15002+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15003 movq %rax, %cr4
15004
15005 /* Setup early boot stage 4 level pagetables. */
15006@@ -183,9 +179,17 @@ ENTRY(secondary_startup_64)
15007 movl $MSR_EFER, %ecx
15008 rdmsr
15009 btsl $_EFER_SCE, %eax /* Enable System Call */
15010- btl $20,%edi /* No Execute supported? */
15011+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15012 jnc 1f
15013 btsl $_EFER_NX, %eax
15014+ leaq init_level4_pgt(%rip), %rdi
15015+#ifndef CONFIG_EFI
15016+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15017+#endif
15018+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15019+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
15020+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15021+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15022 1: wrmsr /* Make changes effective */
15023
15024 /* Setup cr0 */
15025@@ -247,6 +251,7 @@ ENTRY(secondary_startup_64)
15026 * jump. In addition we need to ensure %cs is set so we make this
15027 * a far return.
15028 */
15029+ pax_set_fptr_mask
15030 movq initial_code(%rip),%rax
15031 pushq $0 # fake return address to stop unwinder
15032 pushq $__KERNEL_CS # set correct cs
15033@@ -269,7 +274,7 @@ ENTRY(secondary_startup_64)
15034 bad_address:
15035 jmp bad_address
15036
15037- .section ".init.text","ax"
15038+ __INIT
15039 #ifdef CONFIG_EARLY_PRINTK
15040 .globl early_idt_handlers
15041 early_idt_handlers:
15042@@ -314,18 +319,23 @@ ENTRY(early_idt_handler)
15043 #endif /* EARLY_PRINTK */
15044 1: hlt
15045 jmp 1b
15046+ .previous
15047
15048 #ifdef CONFIG_EARLY_PRINTK
15049+ __INITDATA
15050 early_recursion_flag:
15051 .long 0
15052+ .previous
15053
15054+ .section .rodata,"a",@progbits
15055 early_idt_msg:
15056 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15057 early_idt_ripmsg:
15058 .asciz "RIP %s\n"
15059+ .previous
15060 #endif /* CONFIG_EARLY_PRINTK */
15061- .previous
15062
15063+ .section .rodata,"a",@progbits
15064 #define NEXT_PAGE(name) \
15065 .balign PAGE_SIZE; \
15066 ENTRY(name)
15067@@ -338,7 +348,6 @@ ENTRY(name)
15068 i = i + 1 ; \
15069 .endr
15070
15071- .data
15072 /*
15073 * This default setting generates an ident mapping at address 0x100000
15074 * and a mapping for the kernel that precisely maps virtual address
15075@@ -349,13 +358,41 @@ NEXT_PAGE(init_level4_pgt)
15076 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15077 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15078 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15079+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15080+ .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
15081+ .org init_level4_pgt + L4_VMALLOC_END*8, 0
15082+ .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
15083+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15084+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15085 .org init_level4_pgt + L4_START_KERNEL*8, 0
15086 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15087 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15088
15089+#ifdef CONFIG_PAX_PER_CPU_PGD
15090+NEXT_PAGE(cpu_pgd)
15091+ .rept NR_CPUS
15092+ .fill 512,8,0
15093+ .endr
15094+#endif
15095+
15096 NEXT_PAGE(level3_ident_pgt)
15097 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15098+#ifdef CONFIG_XEN
15099 .fill 511,8,0
15100+#else
15101+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15102+ .fill 510,8,0
15103+#endif
15104+
15105+NEXT_PAGE(level3_vmalloc_start_pgt)
15106+ .fill 512,8,0
15107+
15108+NEXT_PAGE(level3_vmalloc_end_pgt)
15109+ .fill 512,8,0
15110+
15111+NEXT_PAGE(level3_vmemmap_pgt)
15112+ .fill L3_VMEMMAP_START,8,0
15113+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15114
15115 NEXT_PAGE(level3_kernel_pgt)
15116 .fill L3_START_KERNEL,8,0
15117@@ -363,20 +400,23 @@ NEXT_PAGE(level3_kernel_pgt)
15118 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15119 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15120
15121+NEXT_PAGE(level2_vmemmap_pgt)
15122+ .fill 512,8,0
15123+
15124 NEXT_PAGE(level2_fixmap_pgt)
15125- .fill 506,8,0
15126- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15127- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15128- .fill 5,8,0
15129+ .fill 507,8,0
15130+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15131+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15132+ .fill 4,8,0
15133
15134-NEXT_PAGE(level1_fixmap_pgt)
15135+NEXT_PAGE(level1_vsyscall_pgt)
15136 .fill 512,8,0
15137
15138-NEXT_PAGE(level2_ident_pgt)
15139- /* Since I easily can, map the first 1G.
15140+ /* Since I easily can, map the first 2G.
15141 * Don't set NX because code runs from these pages.
15142 */
15143- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15144+NEXT_PAGE(level2_ident_pgt)
15145+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15146
15147 NEXT_PAGE(level2_kernel_pgt)
15148 /*
15149@@ -389,33 +429,55 @@ NEXT_PAGE(level2_kernel_pgt)
15150 * If you want to increase this then increase MODULES_VADDR
15151 * too.)
15152 */
15153- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15154- KERNEL_IMAGE_SIZE/PMD_SIZE)
15155-
15156-NEXT_PAGE(level2_spare_pgt)
15157- .fill 512, 8, 0
15158+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15159
15160 #undef PMDS
15161 #undef NEXT_PAGE
15162
15163- .data
15164+ .align PAGE_SIZE
15165+ENTRY(cpu_gdt_table)
15166+ .rept NR_CPUS
15167+ .quad 0x0000000000000000 /* NULL descriptor */
15168+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15169+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15170+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15171+ .quad 0x00cffb000000ffff /* __USER32_CS */
15172+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15173+ .quad 0x00affb000000ffff /* __USER_CS */
15174+
15175+#ifdef CONFIG_PAX_KERNEXEC
15176+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15177+#else
15178+ .quad 0x0 /* unused */
15179+#endif
15180+
15181+ .quad 0,0 /* TSS */
15182+ .quad 0,0 /* LDT */
15183+ .quad 0,0,0 /* three TLS descriptors */
15184+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15185+ /* asm/segment.h:GDT_ENTRIES must match this */
15186+
15187+ /* zero the remaining page */
15188+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15189+ .endr
15190+
15191 .align 16
15192 .globl early_gdt_descr
15193 early_gdt_descr:
15194 .word GDT_ENTRIES*8-1
15195 early_gdt_descr_base:
15196- .quad INIT_PER_CPU_VAR(gdt_page)
15197+ .quad cpu_gdt_table
15198
15199 ENTRY(phys_base)
15200 /* This must match the first entry in level2_kernel_pgt */
15201 .quad 0x0000000000000000
15202
15203 #include "../../x86/xen/xen-head.S"
15204-
15205- .section .bss, "aw", @nobits
15206+
15207+ .section .rodata,"a",@progbits
15208 .align L1_CACHE_BYTES
15209 ENTRY(idt_table)
15210- .skip IDT_ENTRIES * 16
15211+ .fill 512,8,0
15212
15213 __PAGE_ALIGNED_BSS
15214 .align PAGE_SIZE
15215diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
15216index 9c3bd4a..e1d9b35 100644
15217--- a/arch/x86/kernel/i386_ksyms_32.c
15218+++ b/arch/x86/kernel/i386_ksyms_32.c
15219@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15220 EXPORT_SYMBOL(cmpxchg8b_emu);
15221 #endif
15222
15223+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15224+
15225 /* Networking helper routines. */
15226 EXPORT_SYMBOL(csum_partial_copy_generic);
15227+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15228+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15229
15230 EXPORT_SYMBOL(__get_user_1);
15231 EXPORT_SYMBOL(__get_user_2);
15232@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15233
15234 EXPORT_SYMBOL(csum_partial);
15235 EXPORT_SYMBOL(empty_zero_page);
15236+
15237+#ifdef CONFIG_PAX_KERNEXEC
15238+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15239+#endif
15240diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
15241index 6104852..6114160 100644
15242--- a/arch/x86/kernel/i8259.c
15243+++ b/arch/x86/kernel/i8259.c
15244@@ -210,7 +210,7 @@ spurious_8259A_irq:
15245 "spurious 8259A interrupt: IRQ%d.\n", irq);
15246 spurious_irq_mask |= irqmask;
15247 }
15248- atomic_inc(&irq_err_count);
15249+ atomic_inc_unchecked(&irq_err_count);
15250 /*
15251 * Theoretically we do not have to handle this IRQ,
15252 * but in Linux this does not cause problems and is
15253diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c
15254index 43e9ccf..44ccf6f 100644
15255--- a/arch/x86/kernel/init_task.c
15256+++ b/arch/x86/kernel/init_task.c
15257@@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
15258 * way process stacks are handled. This is done by having a special
15259 * "init_task" linker map entry..
15260 */
15261-union thread_union init_thread_union __init_task_data =
15262- { INIT_THREAD_INFO(init_task) };
15263+union thread_union init_thread_union __init_task_data;
15264
15265 /*
15266 * Initial task structure.
15267@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15268 * section. Since TSS's are completely CPU-local, we want them
15269 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15270 */
15271-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15272-
15273+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15274+EXPORT_SYMBOL(init_tss);
15275diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
15276index 8c96897..be66bfa 100644
15277--- a/arch/x86/kernel/ioport.c
15278+++ b/arch/x86/kernel/ioport.c
15279@@ -6,6 +6,7 @@
15280 #include <linux/sched.h>
15281 #include <linux/kernel.h>
15282 #include <linux/capability.h>
15283+#include <linux/security.h>
15284 #include <linux/errno.h>
15285 #include <linux/types.h>
15286 #include <linux/ioport.h>
15287@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15288
15289 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15290 return -EINVAL;
15291+#ifdef CONFIG_GRKERNSEC_IO
15292+ if (turn_on && grsec_disable_privio) {
15293+ gr_handle_ioperm();
15294+ return -EPERM;
15295+ }
15296+#endif
15297 if (turn_on && !capable(CAP_SYS_RAWIO))
15298 return -EPERM;
15299
15300@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15301 * because the ->io_bitmap_max value must match the bitmap
15302 * contents:
15303 */
15304- tss = &per_cpu(init_tss, get_cpu());
15305+ tss = init_tss + get_cpu();
15306
15307 if (turn_on)
15308 bitmap_clear(t->io_bitmap_ptr, from, num);
15309@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct pt_regs *regs)
15310 return -EINVAL;
15311 /* Trying to gain more privileges? */
15312 if (level > old) {
15313+#ifdef CONFIG_GRKERNSEC_IO
15314+ if (grsec_disable_privio) {
15315+ gr_handle_iopl();
15316+ return -EPERM;
15317+ }
15318+#endif
15319 if (!capable(CAP_SYS_RAWIO))
15320 return -EPERM;
15321 }
15322diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
15323index 6c0802e..bea25ae 100644
15324--- a/arch/x86/kernel/irq.c
15325+++ b/arch/x86/kernel/irq.c
15326@@ -17,7 +17,7 @@
15327 #include <asm/mce.h>
15328 #include <asm/hw_irq.h>
15329
15330-atomic_t irq_err_count;
15331+atomic_unchecked_t irq_err_count;
15332
15333 /* Function pointer for generic interrupt vector handling */
15334 void (*x86_platform_ipi_callback)(void) = NULL;
15335@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
15336 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15337 seq_printf(p, " Machine check polls\n");
15338 #endif
15339- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15340+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15341 #if defined(CONFIG_X86_IO_APIC)
15342- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15343+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15344 #endif
15345 return 0;
15346 }
15347@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15348
15349 u64 arch_irq_stat(void)
15350 {
15351- u64 sum = atomic_read(&irq_err_count);
15352+ u64 sum = atomic_read_unchecked(&irq_err_count);
15353
15354 #ifdef CONFIG_X86_IO_APIC
15355- sum += atomic_read(&irq_mis_count);
15356+ sum += atomic_read_unchecked(&irq_mis_count);
15357 #endif
15358 return sum;
15359 }
15360diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
15361index 7209070..cbcd71a 100644
15362--- a/arch/x86/kernel/irq_32.c
15363+++ b/arch/x86/kernel/irq_32.c
15364@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15365 __asm__ __volatile__("andl %%esp,%0" :
15366 "=r" (sp) : "0" (THREAD_SIZE - 1));
15367
15368- return sp < (sizeof(struct thread_info) + STACK_WARN);
15369+ return sp < STACK_WARN;
15370 }
15371
15372 static void print_stack_overflow(void)
15373@@ -54,8 +54,8 @@ static inline void print_stack_overflow(void) { }
15374 * per-CPU IRQ handling contexts (thread information and stack)
15375 */
15376 union irq_ctx {
15377- struct thread_info tinfo;
15378- u32 stack[THREAD_SIZE/sizeof(u32)];
15379+ unsigned long previous_esp;
15380+ u32 stack[THREAD_SIZE/sizeof(u32)];
15381 } __attribute__((aligned(THREAD_SIZE)));
15382
15383 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15384@@ -75,10 +75,9 @@ static void call_on_stack(void *func, void *stack)
15385 static inline int
15386 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15387 {
15388- union irq_ctx *curctx, *irqctx;
15389+ union irq_ctx *irqctx;
15390 u32 *isp, arg1, arg2;
15391
15392- curctx = (union irq_ctx *) current_thread_info();
15393 irqctx = __this_cpu_read(hardirq_ctx);
15394
15395 /*
15396@@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15397 * handler) we can't do that and just have to keep using the
15398 * current stack (which is the irq stack already after all)
15399 */
15400- if (unlikely(curctx == irqctx))
15401+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15402 return 0;
15403
15404 /* build the stack frame on the IRQ stack */
15405- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15406- irqctx->tinfo.task = curctx->tinfo.task;
15407- irqctx->tinfo.previous_esp = current_stack_pointer;
15408+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15409+ irqctx->previous_esp = current_stack_pointer;
15410
15411- /*
15412- * Copy the softirq bits in preempt_count so that the
15413- * softirq checks work in the hardirq context.
15414- */
15415- irqctx->tinfo.preempt_count =
15416- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15417- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15418+#ifdef CONFIG_PAX_MEMORY_UDEREF
15419+ __set_fs(MAKE_MM_SEG(0));
15420+#endif
15421
15422 if (unlikely(overflow))
15423 call_on_stack(print_stack_overflow, isp);
15424@@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15425 : "0" (irq), "1" (desc), "2" (isp),
15426 "D" (desc->handle_irq)
15427 : "memory", "cc", "ecx");
15428+
15429+#ifdef CONFIG_PAX_MEMORY_UDEREF
15430+ __set_fs(current_thread_info()->addr_limit);
15431+#endif
15432+
15433 return 1;
15434 }
15435
15436@@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15437 */
15438 void __cpuinit irq_ctx_init(int cpu)
15439 {
15440- union irq_ctx *irqctx;
15441-
15442 if (per_cpu(hardirq_ctx, cpu))
15443 return;
15444
15445- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15446- THREAD_FLAGS,
15447- THREAD_ORDER));
15448- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15449- irqctx->tinfo.cpu = cpu;
15450- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15451- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15452-
15453- per_cpu(hardirq_ctx, cpu) = irqctx;
15454-
15455- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15456- THREAD_FLAGS,
15457- THREAD_ORDER));
15458- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15459- irqctx->tinfo.cpu = cpu;
15460- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15461-
15462- per_cpu(softirq_ctx, cpu) = irqctx;
15463+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15464+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15465
15466 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15467 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15468@@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu)
15469 asmlinkage void do_softirq(void)
15470 {
15471 unsigned long flags;
15472- struct thread_info *curctx;
15473 union irq_ctx *irqctx;
15474 u32 *isp;
15475
15476@@ -162,15 +142,22 @@ asmlinkage void do_softirq(void)
15477 local_irq_save(flags);
15478
15479 if (local_softirq_pending()) {
15480- curctx = current_thread_info();
15481 irqctx = __this_cpu_read(softirq_ctx);
15482- irqctx->tinfo.task = curctx->task;
15483- irqctx->tinfo.previous_esp = current_stack_pointer;
15484+ irqctx->previous_esp = current_stack_pointer;
15485
15486 /* build the stack frame on the softirq stack */
15487- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15488+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15489+
15490+#ifdef CONFIG_PAX_MEMORY_UDEREF
15491+ __set_fs(MAKE_MM_SEG(0));
15492+#endif
15493
15494 call_on_stack(__do_softirq, isp);
15495+
15496+#ifdef CONFIG_PAX_MEMORY_UDEREF
15497+ __set_fs(current_thread_info()->addr_limit);
15498+#endif
15499+
15500 /*
15501 * Shouldn't happen, we returned above if in_interrupt():
15502 */
15503diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
15504index 00354d4..187ae44 100644
15505--- a/arch/x86/kernel/kgdb.c
15506+++ b/arch/x86/kernel/kgdb.c
15507@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
15508 #ifdef CONFIG_X86_32
15509 switch (regno) {
15510 case GDB_SS:
15511- if (!user_mode_vm(regs))
15512+ if (!user_mode(regs))
15513 *(unsigned long *)mem = __KERNEL_DS;
15514 break;
15515 case GDB_SP:
15516- if (!user_mode_vm(regs))
15517+ if (!user_mode(regs))
15518 *(unsigned long *)mem = kernel_stack_pointer(regs);
15519 break;
15520 case GDB_GS:
15521@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
15522 case 'k':
15523 /* clear the trace bit */
15524 linux_regs->flags &= ~X86_EFLAGS_TF;
15525- atomic_set(&kgdb_cpu_doing_single_step, -1);
15526+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15527
15528 /* set the trace bit if we're stepping */
15529 if (remcomInBuffer[0] == 's') {
15530 linux_regs->flags |= X86_EFLAGS_TF;
15531- atomic_set(&kgdb_cpu_doing_single_step,
15532+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15533 raw_smp_processor_id());
15534 }
15535
15536@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
15537 return NOTIFY_DONE;
15538
15539 case DIE_DEBUG:
15540- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15541+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15542 if (user_mode(regs))
15543 return single_step_cont(regs, args);
15544 break;
15545diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
15546index 794bc95..c6e29e9 100644
15547--- a/arch/x86/kernel/kprobes.c
15548+++ b/arch/x86/kernel/kprobes.c
15549@@ -117,8 +117,11 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op)
15550 } __attribute__((packed)) *insn;
15551
15552 insn = (struct __arch_relative_insn *)from;
15553+
15554+ pax_open_kernel();
15555 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15556 insn->op = op;
15557+ pax_close_kernel();
15558 }
15559
15560 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15561@@ -155,7 +158,7 @@ static int __kprobes can_boost(kprobe_opcode_t *opcodes)
15562 kprobe_opcode_t opcode;
15563 kprobe_opcode_t *orig_opcodes = opcodes;
15564
15565- if (search_exception_tables((unsigned long)opcodes))
15566+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15567 return 0; /* Page fault may occur on this address. */
15568
15569 retry:
15570@@ -316,7 +319,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15571 }
15572 }
15573 insn_get_length(&insn);
15574+ pax_open_kernel();
15575 memcpy(dest, insn.kaddr, insn.length);
15576+ pax_close_kernel();
15577
15578 #ifdef CONFIG_X86_64
15579 if (insn_rip_relative(&insn)) {
15580@@ -340,7 +345,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15581 (u8 *) dest;
15582 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15583 disp = (u8 *) dest + insn_offset_displacement(&insn);
15584+ pax_open_kernel();
15585 *(s32 *) disp = (s32) newdisp;
15586+ pax_close_kernel();
15587 }
15588 #endif
15589 return insn.length;
15590@@ -354,12 +361,12 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
15591 */
15592 __copy_instruction(p->ainsn.insn, p->addr, 0);
15593
15594- if (can_boost(p->addr))
15595+ if (can_boost(ktla_ktva(p->addr)))
15596 p->ainsn.boostable = 0;
15597 else
15598 p->ainsn.boostable = -1;
15599
15600- p->opcode = *p->addr;
15601+ p->opcode = *(ktla_ktva(p->addr));
15602 }
15603
15604 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15605@@ -476,7 +483,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15606 * nor set current_kprobe, because it doesn't use single
15607 * stepping.
15608 */
15609- regs->ip = (unsigned long)p->ainsn.insn;
15610+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15611 preempt_enable_no_resched();
15612 return;
15613 }
15614@@ -495,7 +502,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15615 if (p->opcode == BREAKPOINT_INSTRUCTION)
15616 regs->ip = (unsigned long)p->addr;
15617 else
15618- regs->ip = (unsigned long)p->ainsn.insn;
15619+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15620 }
15621
15622 /*
15623@@ -574,7 +581,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
15624 setup_singlestep(p, regs, kcb, 0);
15625 return 1;
15626 }
15627- } else if (*addr != BREAKPOINT_INSTRUCTION) {
15628+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15629 /*
15630 * The breakpoint instruction was removed right
15631 * after we hit it. Another cpu has removed
15632@@ -682,6 +689,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
15633 " movq %rax, 152(%rsp)\n"
15634 RESTORE_REGS_STRING
15635 " popfq\n"
15636+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
15637+ " btsq $63,(%rsp)\n"
15638+#endif
15639 #else
15640 " pushf\n"
15641 SAVE_REGS_STRING
15642@@ -819,7 +829,7 @@ static void __kprobes resume_execution(struct kprobe *p,
15643 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15644 {
15645 unsigned long *tos = stack_addr(regs);
15646- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15647+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15648 unsigned long orig_ip = (unsigned long)p->addr;
15649 kprobe_opcode_t *insn = p->ainsn.insn;
15650
15651@@ -1001,7 +1011,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
15652 struct die_args *args = data;
15653 int ret = NOTIFY_DONE;
15654
15655- if (args->regs && user_mode_vm(args->regs))
15656+ if (args->regs && user_mode(args->regs))
15657 return ret;
15658
15659 switch (val) {
15660@@ -1383,7 +1393,7 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15661 * Verify if the address gap is in 2GB range, because this uses
15662 * a relative jump.
15663 */
15664- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15665+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15666 if (abs(rel) > 0x7fffffff)
15667 return -ERANGE;
15668
15669@@ -1404,11 +1414,11 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15670 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15671
15672 /* Set probe function call */
15673- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15674+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15675
15676 /* Set returning jmp instruction at the tail of out-of-line buffer */
15677 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15678- (u8 *)op->kp.addr + op->optinsn.size);
15679+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15680
15681 flush_icache_range((unsigned long) buf,
15682 (unsigned long) buf + TMPL_END_IDX +
15683@@ -1430,7 +1440,7 @@ static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
15684 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15685
15686 /* Backup instructions which will be replaced by jump address */
15687- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15688+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15689 RELATIVE_ADDR_SIZE);
15690
15691 insn_buf[0] = RELATIVEJUMP_OPCODE;
15692diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
15693index a9c2116..a52d4fc 100644
15694--- a/arch/x86/kernel/kvm.c
15695+++ b/arch/x86/kernel/kvm.c
15696@@ -437,6 +437,7 @@ static void __init paravirt_ops_setup(void)
15697 pv_mmu_ops.set_pud = kvm_set_pud;
15698 #if PAGETABLE_LEVELS == 4
15699 pv_mmu_ops.set_pgd = kvm_set_pgd;
15700+ pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
15701 #endif
15702 #endif
15703 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
15704diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
15705index ea69726..604d066 100644
15706--- a/arch/x86/kernel/ldt.c
15707+++ b/arch/x86/kernel/ldt.c
15708@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
15709 if (reload) {
15710 #ifdef CONFIG_SMP
15711 preempt_disable();
15712- load_LDT(pc);
15713+ load_LDT_nolock(pc);
15714 if (!cpumask_equal(mm_cpumask(current->mm),
15715 cpumask_of(smp_processor_id())))
15716 smp_call_function(flush_ldt, current->mm, 1);
15717 preempt_enable();
15718 #else
15719- load_LDT(pc);
15720+ load_LDT_nolock(pc);
15721 #endif
15722 }
15723 if (oldsize) {
15724@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
15725 return err;
15726
15727 for (i = 0; i < old->size; i++)
15728- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15729+ write_ldt_entry(new->ldt, i, old->ldt + i);
15730 return 0;
15731 }
15732
15733@@ -116,6 +116,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
15734 retval = copy_ldt(&mm->context, &old_mm->context);
15735 mutex_unlock(&old_mm->context.lock);
15736 }
15737+
15738+ if (tsk == current) {
15739+ mm->context.vdso = 0;
15740+
15741+#ifdef CONFIG_X86_32
15742+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15743+ mm->context.user_cs_base = 0UL;
15744+ mm->context.user_cs_limit = ~0UL;
15745+
15746+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15747+ cpus_clear(mm->context.cpu_user_cs_mask);
15748+#endif
15749+
15750+#endif
15751+#endif
15752+
15753+ }
15754+
15755 return retval;
15756 }
15757
15758@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
15759 }
15760 }
15761
15762+#ifdef CONFIG_PAX_SEGMEXEC
15763+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15764+ error = -EINVAL;
15765+ goto out_unlock;
15766+ }
15767+#endif
15768+
15769 fill_ldt(&ldt, &ldt_info);
15770 if (oldmode)
15771 ldt.avl = 0;
15772diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
15773index a3fa43b..8966f4c 100644
15774--- a/arch/x86/kernel/machine_kexec_32.c
15775+++ b/arch/x86/kernel/machine_kexec_32.c
15776@@ -27,7 +27,7 @@
15777 #include <asm/cacheflush.h>
15778 #include <asm/debugreg.h>
15779
15780-static void set_idt(void *newidt, __u16 limit)
15781+static void set_idt(struct desc_struct *newidt, __u16 limit)
15782 {
15783 struct desc_ptr curidt;
15784
15785@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16 limit)
15786 }
15787
15788
15789-static void set_gdt(void *newgdt, __u16 limit)
15790+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15791 {
15792 struct desc_ptr curgdt;
15793
15794@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15795 }
15796
15797 control_page = page_address(image->control_code_page);
15798- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15799+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15800
15801 relocate_kernel_ptr = control_page;
15802 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15803diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
15804index 1a1b606..5c89b55 100644
15805--- a/arch/x86/kernel/microcode_intel.c
15806+++ b/arch/x86/kernel/microcode_intel.c
15807@@ -440,13 +440,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
15808
15809 static int get_ucode_user(void *to, const void *from, size_t n)
15810 {
15811- return copy_from_user(to, from, n);
15812+ return copy_from_user(to, (const void __force_user *)from, n);
15813 }
15814
15815 static enum ucode_state
15816 request_microcode_user(int cpu, const void __user *buf, size_t size)
15817 {
15818- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
15819+ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
15820 }
15821
15822 static void microcode_fini_cpu(int cpu)
15823diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
15824index 925179f..85bec6c 100644
15825--- a/arch/x86/kernel/module.c
15826+++ b/arch/x86/kernel/module.c
15827@@ -36,15 +36,60 @@
15828 #define DEBUGP(fmt...)
15829 #endif
15830
15831-void *module_alloc(unsigned long size)
15832+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
15833 {
15834 if (PAGE_ALIGN(size) > MODULES_LEN)
15835 return NULL;
15836 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
15837- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
15838+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
15839 -1, __builtin_return_address(0));
15840 }
15841
15842+void *module_alloc(unsigned long size)
15843+{
15844+
15845+#ifdef CONFIG_PAX_KERNEXEC
15846+ return __module_alloc(size, PAGE_KERNEL);
15847+#else
15848+ return __module_alloc(size, PAGE_KERNEL_EXEC);
15849+#endif
15850+
15851+}
15852+
15853+#ifdef CONFIG_PAX_KERNEXEC
15854+#ifdef CONFIG_X86_32
15855+void *module_alloc_exec(unsigned long size)
15856+{
15857+ struct vm_struct *area;
15858+
15859+ if (size == 0)
15860+ return NULL;
15861+
15862+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
15863+ return area ? area->addr : NULL;
15864+}
15865+EXPORT_SYMBOL(module_alloc_exec);
15866+
15867+void module_free_exec(struct module *mod, void *module_region)
15868+{
15869+ vunmap(module_region);
15870+}
15871+EXPORT_SYMBOL(module_free_exec);
15872+#else
15873+void module_free_exec(struct module *mod, void *module_region)
15874+{
15875+ module_free(mod, module_region);
15876+}
15877+EXPORT_SYMBOL(module_free_exec);
15878+
15879+void *module_alloc_exec(unsigned long size)
15880+{
15881+ return __module_alloc(size, PAGE_KERNEL_RX);
15882+}
15883+EXPORT_SYMBOL(module_alloc_exec);
15884+#endif
15885+#endif
15886+
15887 #ifdef CONFIG_X86_32
15888 int apply_relocate(Elf32_Shdr *sechdrs,
15889 const char *strtab,
15890@@ -55,14 +100,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15891 unsigned int i;
15892 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
15893 Elf32_Sym *sym;
15894- uint32_t *location;
15895+ uint32_t *plocation, location;
15896
15897 DEBUGP("Applying relocate section %u to %u\n", relsec,
15898 sechdrs[relsec].sh_info);
15899 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
15900 /* This is where to make the change */
15901- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
15902- + rel[i].r_offset;
15903+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
15904+ location = (uint32_t)plocation;
15905+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
15906+ plocation = ktla_ktva((void *)plocation);
15907 /* This is the symbol it is referring to. Note that all
15908 undefined symbols have been resolved. */
15909 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
15910@@ -71,11 +118,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15911 switch (ELF32_R_TYPE(rel[i].r_info)) {
15912 case R_386_32:
15913 /* We add the value into the location given */
15914- *location += sym->st_value;
15915+ pax_open_kernel();
15916+ *plocation += sym->st_value;
15917+ pax_close_kernel();
15918 break;
15919 case R_386_PC32:
15920 /* Add the value, subtract its postition */
15921- *location += sym->st_value - (uint32_t)location;
15922+ pax_open_kernel();
15923+ *plocation += sym->st_value - location;
15924+ pax_close_kernel();
15925 break;
15926 default:
15927 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
15928@@ -120,21 +171,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
15929 case R_X86_64_NONE:
15930 break;
15931 case R_X86_64_64:
15932+ pax_open_kernel();
15933 *(u64 *)loc = val;
15934+ pax_close_kernel();
15935 break;
15936 case R_X86_64_32:
15937+ pax_open_kernel();
15938 *(u32 *)loc = val;
15939+ pax_close_kernel();
15940 if (val != *(u32 *)loc)
15941 goto overflow;
15942 break;
15943 case R_X86_64_32S:
15944+ pax_open_kernel();
15945 *(s32 *)loc = val;
15946+ pax_close_kernel();
15947 if ((s64)val != *(s32 *)loc)
15948 goto overflow;
15949 break;
15950 case R_X86_64_PC32:
15951 val -= (u64)loc;
15952+ pax_open_kernel();
15953 *(u32 *)loc = val;
15954+ pax_close_kernel();
15955+
15956 #if 0
15957 if ((s64)val != *(s32 *)loc)
15958 goto overflow;
15959diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
15960index 676b8c7..870ba04 100644
15961--- a/arch/x86/kernel/paravirt-spinlocks.c
15962+++ b/arch/x86/kernel/paravirt-spinlocks.c
15963@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
15964 arch_spin_lock(lock);
15965 }
15966
15967-struct pv_lock_ops pv_lock_ops = {
15968+struct pv_lock_ops pv_lock_ops __read_only = {
15969 #ifdef CONFIG_SMP
15970 .spin_is_locked = __ticket_spin_is_locked,
15971 .spin_is_contended = __ticket_spin_is_contended,
15972diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
15973index d90272e..2d54e8e 100644
15974--- a/arch/x86/kernel/paravirt.c
15975+++ b/arch/x86/kernel/paravirt.c
15976@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
15977 {
15978 return x;
15979 }
15980+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
15981+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
15982+#endif
15983
15984 void __init default_banner(void)
15985 {
15986@@ -133,6 +136,9 @@ static void *get_call_destination(u8 type)
15987 .pv_lock_ops = pv_lock_ops,
15988 #endif
15989 };
15990+
15991+ pax_track_stack();
15992+
15993 return *((void **)&tmpl + type);
15994 }
15995
15996@@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
15997 if (opfunc == NULL)
15998 /* If there's no function, patch it with a ud2a (BUG) */
15999 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16000- else if (opfunc == _paravirt_nop)
16001+ else if (opfunc == (void *)_paravirt_nop)
16002 /* If the operation is a nop, then nop the callsite */
16003 ret = paravirt_patch_nop();
16004
16005 /* identity functions just return their single argument */
16006- else if (opfunc == _paravirt_ident_32)
16007+ else if (opfunc == (void *)_paravirt_ident_32)
16008 ret = paravirt_patch_ident_32(insnbuf, len);
16009- else if (opfunc == _paravirt_ident_64)
16010+ else if (opfunc == (void *)_paravirt_ident_64)
16011 ret = paravirt_patch_ident_64(insnbuf, len);
16012+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16013+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
16014+ ret = paravirt_patch_ident_64(insnbuf, len);
16015+#endif
16016
16017 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16018 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
16019@@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
16020 if (insn_len > len || start == NULL)
16021 insn_len = len;
16022 else
16023- memcpy(insnbuf, start, insn_len);
16024+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16025
16026 return insn_len;
16027 }
16028@@ -302,7 +312,7 @@ void arch_flush_lazy_mmu_mode(void)
16029 preempt_enable();
16030 }
16031
16032-struct pv_info pv_info = {
16033+struct pv_info pv_info __read_only = {
16034 .name = "bare hardware",
16035 .paravirt_enabled = 0,
16036 .kernel_rpl = 0,
16037@@ -313,16 +323,16 @@ struct pv_info pv_info = {
16038 #endif
16039 };
16040
16041-struct pv_init_ops pv_init_ops = {
16042+struct pv_init_ops pv_init_ops __read_only = {
16043 .patch = native_patch,
16044 };
16045
16046-struct pv_time_ops pv_time_ops = {
16047+struct pv_time_ops pv_time_ops __read_only = {
16048 .sched_clock = native_sched_clock,
16049 .steal_clock = native_steal_clock,
16050 };
16051
16052-struct pv_irq_ops pv_irq_ops = {
16053+struct pv_irq_ops pv_irq_ops __read_only = {
16054 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16055 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16056 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16057@@ -334,7 +344,7 @@ struct pv_irq_ops pv_irq_ops = {
16058 #endif
16059 };
16060
16061-struct pv_cpu_ops pv_cpu_ops = {
16062+struct pv_cpu_ops pv_cpu_ops __read_only = {
16063 .cpuid = native_cpuid,
16064 .get_debugreg = native_get_debugreg,
16065 .set_debugreg = native_set_debugreg,
16066@@ -395,21 +405,26 @@ struct pv_cpu_ops pv_cpu_ops = {
16067 .end_context_switch = paravirt_nop,
16068 };
16069
16070-struct pv_apic_ops pv_apic_ops = {
16071+struct pv_apic_ops pv_apic_ops __read_only = {
16072 #ifdef CONFIG_X86_LOCAL_APIC
16073 .startup_ipi_hook = paravirt_nop,
16074 #endif
16075 };
16076
16077-#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
16078+#ifdef CONFIG_X86_32
16079+#ifdef CONFIG_X86_PAE
16080+/* 64-bit pagetable entries */
16081+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
16082+#else
16083 /* 32-bit pagetable entries */
16084 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
16085+#endif
16086 #else
16087 /* 64-bit pagetable entries */
16088 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16089 #endif
16090
16091-struct pv_mmu_ops pv_mmu_ops = {
16092+struct pv_mmu_ops pv_mmu_ops __read_only = {
16093
16094 .read_cr2 = native_read_cr2,
16095 .write_cr2 = native_write_cr2,
16096@@ -459,6 +474,7 @@ struct pv_mmu_ops pv_mmu_ops = {
16097 .make_pud = PTE_IDENT,
16098
16099 .set_pgd = native_set_pgd,
16100+ .set_pgd_batched = native_set_pgd_batched,
16101 #endif
16102 #endif /* PAGETABLE_LEVELS >= 3 */
16103
16104@@ -478,6 +494,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16105 },
16106
16107 .set_fixmap = native_set_fixmap,
16108+
16109+#ifdef CONFIG_PAX_KERNEXEC
16110+ .pax_open_kernel = native_pax_open_kernel,
16111+ .pax_close_kernel = native_pax_close_kernel,
16112+#endif
16113+
16114 };
16115
16116 EXPORT_SYMBOL_GPL(pv_time_ops);
16117diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
16118index 35ccf75..67e7d4d 100644
16119--- a/arch/x86/kernel/pci-iommu_table.c
16120+++ b/arch/x86/kernel/pci-iommu_table.c
16121@@ -2,7 +2,7 @@
16122 #include <asm/iommu_table.h>
16123 #include <linux/string.h>
16124 #include <linux/kallsyms.h>
16125-
16126+#include <linux/sched.h>
16127
16128 #define DEBUG 1
16129
16130@@ -51,6 +51,8 @@ void __init check_iommu_entries(struct iommu_table_entry *start,
16131 {
16132 struct iommu_table_entry *p, *q, *x;
16133
16134+ pax_track_stack();
16135+
16136 /* Simple cyclic dependency checker. */
16137 for (p = start; p < finish; p++) {
16138 q = find_dependents_of(start, finish, p);
16139diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
16140index 30eb651..0758167 100644
16141--- a/arch/x86/kernel/process.c
16142+++ b/arch/x86/kernel/process.c
16143@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_struct *tsk)
16144
16145 void free_thread_info(struct thread_info *ti)
16146 {
16147- free_thread_xstate(ti->task);
16148 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16149 }
16150
16151+static struct kmem_cache *task_struct_cachep;
16152+
16153 void arch_task_cache_init(void)
16154 {
16155- task_xstate_cachep =
16156- kmem_cache_create("task_xstate", xstate_size,
16157+ /* create a slab on which task_structs can be allocated */
16158+ task_struct_cachep =
16159+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16160+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16161+
16162+ task_xstate_cachep =
16163+ kmem_cache_create("task_xstate", xstate_size,
16164 __alignof__(union thread_xstate),
16165- SLAB_PANIC | SLAB_NOTRACK, NULL);
16166+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16167+}
16168+
16169+struct task_struct *alloc_task_struct_node(int node)
16170+{
16171+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16172+}
16173+
16174+void free_task_struct(struct task_struct *task)
16175+{
16176+ free_thread_xstate(task);
16177+ kmem_cache_free(task_struct_cachep, task);
16178 }
16179
16180 /*
16181@@ -70,7 +87,7 @@ void exit_thread(void)
16182 unsigned long *bp = t->io_bitmap_ptr;
16183
16184 if (bp) {
16185- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16186+ struct tss_struct *tss = init_tss + get_cpu();
16187
16188 t->io_bitmap_ptr = NULL;
16189 clear_thread_flag(TIF_IO_BITMAP);
16190@@ -106,7 +123,7 @@ void show_regs_common(void)
16191
16192 printk(KERN_CONT "\n");
16193 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16194- current->pid, current->comm, print_tainted(),
16195+ task_pid_nr(current), current->comm, print_tainted(),
16196 init_utsname()->release,
16197 (int)strcspn(init_utsname()->version, " "),
16198 init_utsname()->version);
16199@@ -120,6 +137,9 @@ void flush_thread(void)
16200 {
16201 struct task_struct *tsk = current;
16202
16203+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16204+ loadsegment(gs, 0);
16205+#endif
16206 flush_ptrace_hw_breakpoint(tsk);
16207 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16208 /*
16209@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
16210 regs.di = (unsigned long) arg;
16211
16212 #ifdef CONFIG_X86_32
16213- regs.ds = __USER_DS;
16214- regs.es = __USER_DS;
16215+ regs.ds = __KERNEL_DS;
16216+ regs.es = __KERNEL_DS;
16217 regs.fs = __KERNEL_PERCPU;
16218- regs.gs = __KERNEL_STACK_CANARY;
16219+ savesegment(gs, regs.gs);
16220 #else
16221 regs.ss = __KERNEL_DS;
16222 #endif
16223@@ -411,7 +431,8 @@ bool set_pm_idle_to_default(void)
16224
16225 return ret;
16226 }
16227-void stop_this_cpu(void *dummy)
16228+
16229+__noreturn void stop_this_cpu(void *dummy)
16230 {
16231 local_irq_disable();
16232 /*
16233@@ -653,16 +674,37 @@ static int __init idle_setup(char *str)
16234 }
16235 early_param("idle", idle_setup);
16236
16237-unsigned long arch_align_stack(unsigned long sp)
16238+#ifdef CONFIG_PAX_RANDKSTACK
16239+void pax_randomize_kstack(struct pt_regs *regs)
16240 {
16241- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16242- sp -= get_random_int() % 8192;
16243- return sp & ~0xf;
16244-}
16245+ struct thread_struct *thread = &current->thread;
16246+ unsigned long time;
16247
16248-unsigned long arch_randomize_brk(struct mm_struct *mm)
16249-{
16250- unsigned long range_end = mm->brk + 0x02000000;
16251- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16252-}
16253+ if (!randomize_va_space)
16254+ return;
16255+
16256+ if (v8086_mode(regs))
16257+ return;
16258
16259+ rdtscl(time);
16260+
16261+ /* P4 seems to return a 0 LSB, ignore it */
16262+#ifdef CONFIG_MPENTIUM4
16263+ time &= 0x3EUL;
16264+ time <<= 2;
16265+#elif defined(CONFIG_X86_64)
16266+ time &= 0xFUL;
16267+ time <<= 4;
16268+#else
16269+ time &= 0x1FUL;
16270+ time <<= 3;
16271+#endif
16272+
16273+ thread->sp0 ^= time;
16274+ load_sp0(init_tss + smp_processor_id(), thread);
16275+
16276+#ifdef CONFIG_X86_64
16277+ percpu_write(kernel_stack, thread->sp0);
16278+#endif
16279+}
16280+#endif
16281diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
16282index 7a3b651..5a946f6 100644
16283--- a/arch/x86/kernel/process_32.c
16284+++ b/arch/x86/kernel/process_32.c
16285@@ -66,6 +66,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
16286 unsigned long thread_saved_pc(struct task_struct *tsk)
16287 {
16288 return ((unsigned long *)tsk->thread.sp)[3];
16289+//XXX return tsk->thread.eip;
16290 }
16291
16292 #ifndef CONFIG_SMP
16293@@ -128,15 +129,14 @@ void __show_regs(struct pt_regs *regs, int all)
16294 unsigned long sp;
16295 unsigned short ss, gs;
16296
16297- if (user_mode_vm(regs)) {
16298+ if (user_mode(regs)) {
16299 sp = regs->sp;
16300 ss = regs->ss & 0xffff;
16301- gs = get_user_gs(regs);
16302 } else {
16303 sp = kernel_stack_pointer(regs);
16304 savesegment(ss, ss);
16305- savesegment(gs, gs);
16306 }
16307+ gs = get_user_gs(regs);
16308
16309 show_regs_common();
16310
16311@@ -198,13 +198,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16312 struct task_struct *tsk;
16313 int err;
16314
16315- childregs = task_pt_regs(p);
16316+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16317 *childregs = *regs;
16318 childregs->ax = 0;
16319 childregs->sp = sp;
16320
16321 p->thread.sp = (unsigned long) childregs;
16322 p->thread.sp0 = (unsigned long) (childregs+1);
16323+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16324
16325 p->thread.ip = (unsigned long) ret_from_fork;
16326
16327@@ -294,7 +295,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16328 struct thread_struct *prev = &prev_p->thread,
16329 *next = &next_p->thread;
16330 int cpu = smp_processor_id();
16331- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16332+ struct tss_struct *tss = init_tss + cpu;
16333 bool preload_fpu;
16334
16335 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16336@@ -329,6 +330,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16337 */
16338 lazy_save_gs(prev->gs);
16339
16340+#ifdef CONFIG_PAX_MEMORY_UDEREF
16341+ __set_fs(task_thread_info(next_p)->addr_limit);
16342+#endif
16343+
16344 /*
16345 * Load the per-thread Thread-Local Storage descriptor.
16346 */
16347@@ -364,6 +369,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16348 */
16349 arch_end_context_switch(next_p);
16350
16351+ percpu_write(current_task, next_p);
16352+ percpu_write(current_tinfo, &next_p->tinfo);
16353+
16354 if (preload_fpu)
16355 __math_state_restore();
16356
16357@@ -373,8 +381,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16358 if (prev->gs | next->gs)
16359 lazy_load_gs(next->gs);
16360
16361- percpu_write(current_task, next_p);
16362-
16363 return prev_p;
16364 }
16365
16366@@ -404,4 +410,3 @@ unsigned long get_wchan(struct task_struct *p)
16367 } while (count++ < 16);
16368 return 0;
16369 }
16370-
16371diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
16372index f693e44..3c979b2 100644
16373--- a/arch/x86/kernel/process_64.c
16374+++ b/arch/x86/kernel/process_64.c
16375@@ -88,7 +88,7 @@ static void __exit_idle(void)
16376 void exit_idle(void)
16377 {
16378 /* idle loop has pid 0 */
16379- if (current->pid)
16380+ if (task_pid_nr(current))
16381 return;
16382 __exit_idle();
16383 }
16384@@ -262,8 +262,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16385 struct pt_regs *childregs;
16386 struct task_struct *me = current;
16387
16388- childregs = ((struct pt_regs *)
16389- (THREAD_SIZE + task_stack_page(p))) - 1;
16390+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16391 *childregs = *regs;
16392
16393 childregs->ax = 0;
16394@@ -275,6 +274,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16395 p->thread.sp = (unsigned long) childregs;
16396 p->thread.sp0 = (unsigned long) (childregs+1);
16397 p->thread.usersp = me->thread.usersp;
16398+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16399
16400 set_tsk_thread_flag(p, TIF_FORK);
16401
16402@@ -377,7 +377,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16403 struct thread_struct *prev = &prev_p->thread;
16404 struct thread_struct *next = &next_p->thread;
16405 int cpu = smp_processor_id();
16406- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16407+ struct tss_struct *tss = init_tss + cpu;
16408 unsigned fsindex, gsindex;
16409 bool preload_fpu;
16410
16411@@ -473,10 +473,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16412 prev->usersp = percpu_read(old_rsp);
16413 percpu_write(old_rsp, next->usersp);
16414 percpu_write(current_task, next_p);
16415+ percpu_write(current_tinfo, &next_p->tinfo);
16416
16417- percpu_write(kernel_stack,
16418- (unsigned long)task_stack_page(next_p) +
16419- THREAD_SIZE - KERNEL_STACK_OFFSET);
16420+ percpu_write(kernel_stack, next->sp0);
16421
16422 /*
16423 * Now maybe reload the debug registers and handle I/O bitmaps
16424@@ -538,12 +537,11 @@ unsigned long get_wchan(struct task_struct *p)
16425 if (!p || p == current || p->state == TASK_RUNNING)
16426 return 0;
16427 stack = (unsigned long)task_stack_page(p);
16428- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16429+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16430 return 0;
16431 fp = *(u64 *)(p->thread.sp);
16432 do {
16433- if (fp < (unsigned long)stack ||
16434- fp >= (unsigned long)stack+THREAD_SIZE)
16435+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16436 return 0;
16437 ip = *(u64 *)(fp+8);
16438 if (!in_sched_functions(ip))
16439diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
16440index 8252879..d3219e0 100644
16441--- a/arch/x86/kernel/ptrace.c
16442+++ b/arch/x86/kernel/ptrace.c
16443@@ -822,7 +822,7 @@ long arch_ptrace(struct task_struct *child, long request,
16444 unsigned long addr, unsigned long data)
16445 {
16446 int ret;
16447- unsigned long __user *datap = (unsigned long __user *)data;
16448+ unsigned long __user *datap = (__force unsigned long __user *)data;
16449
16450 switch (request) {
16451 /* read the word at location addr in the USER area. */
16452@@ -907,14 +907,14 @@ long arch_ptrace(struct task_struct *child, long request,
16453 if ((int) addr < 0)
16454 return -EIO;
16455 ret = do_get_thread_area(child, addr,
16456- (struct user_desc __user *)data);
16457+ (__force struct user_desc __user *) data);
16458 break;
16459
16460 case PTRACE_SET_THREAD_AREA:
16461 if ((int) addr < 0)
16462 return -EIO;
16463 ret = do_set_thread_area(child, addr,
16464- (struct user_desc __user *)data, 0);
16465+ (__force struct user_desc __user *) data, 0);
16466 break;
16467 #endif
16468
16469@@ -1331,7 +1331,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
16470 memset(info, 0, sizeof(*info));
16471 info->si_signo = SIGTRAP;
16472 info->si_code = si_code;
16473- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16474+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16475 }
16476
16477 void user_single_step_siginfo(struct task_struct *tsk,
16478diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
16479index 42eb330..139955c 100644
16480--- a/arch/x86/kernel/pvclock.c
16481+++ b/arch/x86/kernel/pvclock.c
16482@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
16483 return pv_tsc_khz;
16484 }
16485
16486-static atomic64_t last_value = ATOMIC64_INIT(0);
16487+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16488
16489 void pvclock_resume(void)
16490 {
16491- atomic64_set(&last_value, 0);
16492+ atomic64_set_unchecked(&last_value, 0);
16493 }
16494
16495 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16496@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16497 * updating at the same time, and one of them could be slightly behind,
16498 * making the assumption that last_value always go forward fail to hold.
16499 */
16500- last = atomic64_read(&last_value);
16501+ last = atomic64_read_unchecked(&last_value);
16502 do {
16503 if (ret < last)
16504 return last;
16505- last = atomic64_cmpxchg(&last_value, last, ret);
16506+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16507 } while (unlikely(last != ret));
16508
16509 return ret;
16510diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
16511index d4a705f..ef8f1a9 100644
16512--- a/arch/x86/kernel/reboot.c
16513+++ b/arch/x86/kernel/reboot.c
16514@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16515 EXPORT_SYMBOL(pm_power_off);
16516
16517 static const struct desc_ptr no_idt = {};
16518-static int reboot_mode;
16519+static unsigned short reboot_mode;
16520 enum reboot_type reboot_type = BOOT_ACPI;
16521 int reboot_force;
16522
16523@@ -324,13 +324,17 @@ core_initcall(reboot_init);
16524 extern const unsigned char machine_real_restart_asm[];
16525 extern const u64 machine_real_restart_gdt[3];
16526
16527-void machine_real_restart(unsigned int type)
16528+__noreturn void machine_real_restart(unsigned int type)
16529 {
16530 void *restart_va;
16531 unsigned long restart_pa;
16532- void (*restart_lowmem)(unsigned int);
16533+ void (* __noreturn restart_lowmem)(unsigned int);
16534 u64 *lowmem_gdt;
16535
16536+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16537+ struct desc_struct *gdt;
16538+#endif
16539+
16540 local_irq_disable();
16541
16542 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16543@@ -356,14 +360,14 @@ void machine_real_restart(unsigned int type)
16544 boot)". This seems like a fairly standard thing that gets set by
16545 REBOOT.COM programs, and the previous reset routine did this
16546 too. */
16547- *((unsigned short *)0x472) = reboot_mode;
16548+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16549
16550 /* Patch the GDT in the low memory trampoline */
16551 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16552
16553 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16554 restart_pa = virt_to_phys(restart_va);
16555- restart_lowmem = (void (*)(unsigned int))restart_pa;
16556+ restart_lowmem = (void *)restart_pa;
16557
16558 /* GDT[0]: GDT self-pointer */
16559 lowmem_gdt[0] =
16560@@ -374,7 +378,33 @@ void machine_real_restart(unsigned int type)
16561 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16562
16563 /* Jump to the identity-mapped low memory code */
16564+
16565+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16566+ gdt = get_cpu_gdt_table(smp_processor_id());
16567+ pax_open_kernel();
16568+#ifdef CONFIG_PAX_MEMORY_UDEREF
16569+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16570+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16571+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16572+#endif
16573+#ifdef CONFIG_PAX_KERNEXEC
16574+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16575+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16576+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16577+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16578+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16579+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16580+#endif
16581+ pax_close_kernel();
16582+#endif
16583+
16584+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16585+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16586+ unreachable();
16587+#else
16588 restart_lowmem(type);
16589+#endif
16590+
16591 }
16592 #ifdef CONFIG_APM_MODULE
16593 EXPORT_SYMBOL(machine_real_restart);
16594@@ -532,7 +562,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
16595 * try to force a triple fault and then cycle between hitting the keyboard
16596 * controller and doing that
16597 */
16598-static void native_machine_emergency_restart(void)
16599+__noreturn static void native_machine_emergency_restart(void)
16600 {
16601 int i;
16602 int attempt = 0;
16603@@ -656,13 +686,13 @@ void native_machine_shutdown(void)
16604 #endif
16605 }
16606
16607-static void __machine_emergency_restart(int emergency)
16608+static __noreturn void __machine_emergency_restart(int emergency)
16609 {
16610 reboot_emergency = emergency;
16611 machine_ops.emergency_restart();
16612 }
16613
16614-static void native_machine_restart(char *__unused)
16615+static __noreturn void native_machine_restart(char *__unused)
16616 {
16617 printk("machine restart\n");
16618
16619@@ -671,7 +701,7 @@ static void native_machine_restart(char *__unused)
16620 __machine_emergency_restart(0);
16621 }
16622
16623-static void native_machine_halt(void)
16624+static __noreturn void native_machine_halt(void)
16625 {
16626 /* stop other cpus and apics */
16627 machine_shutdown();
16628@@ -682,7 +712,7 @@ static void native_machine_halt(void)
16629 stop_this_cpu(NULL);
16630 }
16631
16632-static void native_machine_power_off(void)
16633+__noreturn static void native_machine_power_off(void)
16634 {
16635 if (pm_power_off) {
16636 if (!reboot_force)
16637@@ -691,6 +721,7 @@ static void native_machine_power_off(void)
16638 }
16639 /* a fallback in case there is no PM info available */
16640 tboot_shutdown(TB_SHUTDOWN_HALT);
16641+ unreachable();
16642 }
16643
16644 struct machine_ops machine_ops = {
16645diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
16646index 7a6f3b3..bed145d7 100644
16647--- a/arch/x86/kernel/relocate_kernel_64.S
16648+++ b/arch/x86/kernel/relocate_kernel_64.S
16649@@ -11,6 +11,7 @@
16650 #include <asm/kexec.h>
16651 #include <asm/processor-flags.h>
16652 #include <asm/pgtable_types.h>
16653+#include <asm/alternative-asm.h>
16654
16655 /*
16656 * Must be relocatable PIC code callable as a C function
16657@@ -160,13 +161,14 @@ identity_mapped:
16658 xorq %rbp, %rbp
16659 xorq %r8, %r8
16660 xorq %r9, %r9
16661- xorq %r10, %r9
16662+ xorq %r10, %r10
16663 xorq %r11, %r11
16664 xorq %r12, %r12
16665 xorq %r13, %r13
16666 xorq %r14, %r14
16667 xorq %r15, %r15
16668
16669+ pax_force_retaddr 0, 1
16670 ret
16671
16672 1:
16673diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
16674index afaf384..1a101fe 100644
16675--- a/arch/x86/kernel/setup.c
16676+++ b/arch/x86/kernel/setup.c
16677@@ -447,7 +447,7 @@ static void __init parse_setup_data(void)
16678
16679 switch (data->type) {
16680 case SETUP_E820_EXT:
16681- parse_e820_ext(data);
16682+ parse_e820_ext((struct setup_data __force_kernel *)data);
16683 break;
16684 case SETUP_DTB:
16685 add_dtb(pa_data);
16686@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
16687 * area (640->1Mb) as ram even though it is not.
16688 * take them out.
16689 */
16690- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16691+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16692 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16693 }
16694
16695@@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p)
16696
16697 if (!boot_params.hdr.root_flags)
16698 root_mountflags &= ~MS_RDONLY;
16699- init_mm.start_code = (unsigned long) _text;
16700- init_mm.end_code = (unsigned long) _etext;
16701+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16702+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16703 init_mm.end_data = (unsigned long) _edata;
16704 init_mm.brk = _brk_end;
16705
16706- code_resource.start = virt_to_phys(_text);
16707- code_resource.end = virt_to_phys(_etext)-1;
16708- data_resource.start = virt_to_phys(_etext);
16709+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16710+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16711+ data_resource.start = virt_to_phys(_sdata);
16712 data_resource.end = virt_to_phys(_edata)-1;
16713 bss_resource.start = virt_to_phys(&__bss_start);
16714 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16715diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
16716index 71f4727..16dc9f7 100644
16717--- a/arch/x86/kernel/setup_percpu.c
16718+++ b/arch/x86/kernel/setup_percpu.c
16719@@ -21,19 +21,17 @@
16720 #include <asm/cpu.h>
16721 #include <asm/stackprotector.h>
16722
16723-DEFINE_PER_CPU(int, cpu_number);
16724+#ifdef CONFIG_SMP
16725+DEFINE_PER_CPU(unsigned int, cpu_number);
16726 EXPORT_PER_CPU_SYMBOL(cpu_number);
16727+#endif
16728
16729-#ifdef CONFIG_X86_64
16730 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16731-#else
16732-#define BOOT_PERCPU_OFFSET 0
16733-#endif
16734
16735 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16736 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16737
16738-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16739+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16740 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16741 };
16742 EXPORT_SYMBOL(__per_cpu_offset);
16743@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
16744 {
16745 #ifdef CONFIG_X86_32
16746 struct desc_struct gdt;
16747+ unsigned long base = per_cpu_offset(cpu);
16748
16749- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16750- 0x2 | DESCTYPE_S, 0x8);
16751- gdt.s = 1;
16752+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16753+ 0x83 | DESCTYPE_S, 0xC);
16754 write_gdt_entry(get_cpu_gdt_table(cpu),
16755 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
16756 #endif
16757@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
16758 /* alrighty, percpu areas up and running */
16759 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16760 for_each_possible_cpu(cpu) {
16761+#ifdef CONFIG_CC_STACKPROTECTOR
16762+#ifdef CONFIG_X86_32
16763+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
16764+#endif
16765+#endif
16766 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
16767 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
16768 per_cpu(cpu_number, cpu) = cpu;
16769@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
16770 */
16771 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
16772 #endif
16773+#ifdef CONFIG_CC_STACKPROTECTOR
16774+#ifdef CONFIG_X86_32
16775+ if (!cpu)
16776+ per_cpu(stack_canary.canary, cpu) = canary;
16777+#endif
16778+#endif
16779 /*
16780 * Up to this point, the boot CPU has been using .init.data
16781 * area. Reload any changed state for the boot CPU.
16782diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
16783index 54ddaeb2..a6aa4d2 100644
16784--- a/arch/x86/kernel/signal.c
16785+++ b/arch/x86/kernel/signal.c
16786@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsigned long sp)
16787 * Align the stack pointer according to the i386 ABI,
16788 * i.e. so that on function entry ((sp + 4) & 15) == 0.
16789 */
16790- sp = ((sp + 4) & -16ul) - 4;
16791+ sp = ((sp - 12) & -16ul) - 4;
16792 #else /* !CONFIG_X86_32 */
16793 sp = round_down(sp, 16) - 8;
16794 #endif
16795@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
16796 * Return an always-bogus address instead so we will die with SIGSEGV.
16797 */
16798 if (onsigstack && !likely(on_sig_stack(sp)))
16799- return (void __user *)-1L;
16800+ return (__force void __user *)-1L;
16801
16802 /* save i387 state */
16803 if (used_math() && save_i387_xstate(*fpstate) < 0)
16804- return (void __user *)-1L;
16805+ return (__force void __user *)-1L;
16806
16807 return (void __user *)sp;
16808 }
16809@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16810 }
16811
16812 if (current->mm->context.vdso)
16813- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16814+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16815 else
16816- restorer = &frame->retcode;
16817+ restorer = (void __user *)&frame->retcode;
16818 if (ka->sa.sa_flags & SA_RESTORER)
16819 restorer = ka->sa.sa_restorer;
16820
16821@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16822 * reasons and because gdb uses it as a signature to notice
16823 * signal handler stack frames.
16824 */
16825- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
16826+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
16827
16828 if (err)
16829 return -EFAULT;
16830@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16831 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
16832
16833 /* Set up to return from userspace. */
16834- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16835+ if (current->mm->context.vdso)
16836+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16837+ else
16838+ restorer = (void __user *)&frame->retcode;
16839 if (ka->sa.sa_flags & SA_RESTORER)
16840 restorer = ka->sa.sa_restorer;
16841 put_user_ex(restorer, &frame->pretcode);
16842@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16843 * reasons and because gdb uses it as a signature to notice
16844 * signal handler stack frames.
16845 */
16846- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
16847+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
16848 } put_user_catch(err);
16849
16850 if (err)
16851@@ -762,6 +765,8 @@ static void do_signal(struct pt_regs *regs)
16852 siginfo_t info;
16853 int signr;
16854
16855+ pax_track_stack();
16856+
16857 /*
16858 * We want the common case to go fast, which is why we may in certain
16859 * cases get here from kernel mode. Just return without doing anything
16860@@ -769,7 +774,7 @@ static void do_signal(struct pt_regs *regs)
16861 * X86_32: vm86 regs switched out by assembly code before reaching
16862 * here, so testing against kernel CS suffices.
16863 */
16864- if (!user_mode(regs))
16865+ if (!user_mode_novm(regs))
16866 return;
16867
16868 signr = get_signal_to_deliver(&info, &ka, regs, NULL);
16869diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
16870index 9f548cb..caf76f7 100644
16871--- a/arch/x86/kernel/smpboot.c
16872+++ b/arch/x86/kernel/smpboot.c
16873@@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
16874 set_idle_for_cpu(cpu, c_idle.idle);
16875 do_rest:
16876 per_cpu(current_task, cpu) = c_idle.idle;
16877+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
16878 #ifdef CONFIG_X86_32
16879 /* Stack for startup_32 can be just as for start_secondary onwards */
16880 irq_ctx_init(cpu);
16881 #else
16882 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
16883 initial_gs = per_cpu_offset(cpu);
16884- per_cpu(kernel_stack, cpu) =
16885- (unsigned long)task_stack_page(c_idle.idle) -
16886- KERNEL_STACK_OFFSET + THREAD_SIZE;
16887+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
16888 #endif
16889+
16890+ pax_open_kernel();
16891 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
16892+ pax_close_kernel();
16893+
16894 initial_code = (unsigned long)start_secondary;
16895 stack_start = c_idle.idle->thread.sp;
16896
16897@@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
16898
16899 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
16900
16901+#ifdef CONFIG_PAX_PER_CPU_PGD
16902+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
16903+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16904+ KERNEL_PGD_PTRS);
16905+#endif
16906+
16907 err = do_boot_cpu(apicid, cpu);
16908 if (err) {
16909 pr_debug("do_boot_cpu failed %d\n", err);
16910diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
16911index c346d11..d43b163 100644
16912--- a/arch/x86/kernel/step.c
16913+++ b/arch/x86/kernel/step.c
16914@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16915 struct desc_struct *desc;
16916 unsigned long base;
16917
16918- seg &= ~7UL;
16919+ seg >>= 3;
16920
16921 mutex_lock(&child->mm->context.lock);
16922- if (unlikely((seg >> 3) >= child->mm->context.size))
16923+ if (unlikely(seg >= child->mm->context.size))
16924 addr = -1L; /* bogus selector, access would fault */
16925 else {
16926 desc = child->mm->context.ldt + seg;
16927@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16928 addr += base;
16929 }
16930 mutex_unlock(&child->mm->context.lock);
16931- }
16932+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
16933+ addr = ktla_ktva(addr);
16934
16935 return addr;
16936 }
16937@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
16938 unsigned char opcode[15];
16939 unsigned long addr = convert_ip_to_linear(child, regs);
16940
16941+ if (addr == -EINVAL)
16942+ return 0;
16943+
16944 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
16945 for (i = 0; i < copied; i++) {
16946 switch (opcode[i]) {
16947diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
16948index 0b0cb5f..db6b9ed 100644
16949--- a/arch/x86/kernel/sys_i386_32.c
16950+++ b/arch/x86/kernel/sys_i386_32.c
16951@@ -24,17 +24,224 @@
16952
16953 #include <asm/syscalls.h>
16954
16955-/*
16956- * Do a system call from kernel instead of calling sys_execve so we
16957- * end up with proper pt_regs.
16958- */
16959-int kernel_execve(const char *filename,
16960- const char *const argv[],
16961- const char *const envp[])
16962+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
16963 {
16964- long __res;
16965- asm volatile ("int $0x80"
16966- : "=a" (__res)
16967- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
16968- return __res;
16969+ unsigned long pax_task_size = TASK_SIZE;
16970+
16971+#ifdef CONFIG_PAX_SEGMEXEC
16972+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
16973+ pax_task_size = SEGMEXEC_TASK_SIZE;
16974+#endif
16975+
16976+ if (len > pax_task_size || addr > pax_task_size - len)
16977+ return -EINVAL;
16978+
16979+ return 0;
16980+}
16981+
16982+unsigned long
16983+arch_get_unmapped_area(struct file *filp, unsigned long addr,
16984+ unsigned long len, unsigned long pgoff, unsigned long flags)
16985+{
16986+ struct mm_struct *mm = current->mm;
16987+ struct vm_area_struct *vma;
16988+ unsigned long start_addr, pax_task_size = TASK_SIZE;
16989+
16990+#ifdef CONFIG_PAX_SEGMEXEC
16991+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
16992+ pax_task_size = SEGMEXEC_TASK_SIZE;
16993+#endif
16994+
16995+ pax_task_size -= PAGE_SIZE;
16996+
16997+ if (len > pax_task_size)
16998+ return -ENOMEM;
16999+
17000+ if (flags & MAP_FIXED)
17001+ return addr;
17002+
17003+#ifdef CONFIG_PAX_RANDMMAP
17004+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17005+#endif
17006+
17007+ if (addr) {
17008+ addr = PAGE_ALIGN(addr);
17009+ if (pax_task_size - len >= addr) {
17010+ vma = find_vma(mm, addr);
17011+ if (check_heap_stack_gap(vma, addr, len))
17012+ return addr;
17013+ }
17014+ }
17015+ if (len > mm->cached_hole_size) {
17016+ start_addr = addr = mm->free_area_cache;
17017+ } else {
17018+ start_addr = addr = mm->mmap_base;
17019+ mm->cached_hole_size = 0;
17020+ }
17021+
17022+#ifdef CONFIG_PAX_PAGEEXEC
17023+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17024+ start_addr = 0x00110000UL;
17025+
17026+#ifdef CONFIG_PAX_RANDMMAP
17027+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17028+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17029+#endif
17030+
17031+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17032+ start_addr = addr = mm->mmap_base;
17033+ else
17034+ addr = start_addr;
17035+ }
17036+#endif
17037+
17038+full_search:
17039+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17040+ /* At this point: (!vma || addr < vma->vm_end). */
17041+ if (pax_task_size - len < addr) {
17042+ /*
17043+ * Start a new search - just in case we missed
17044+ * some holes.
17045+ */
17046+ if (start_addr != mm->mmap_base) {
17047+ start_addr = addr = mm->mmap_base;
17048+ mm->cached_hole_size = 0;
17049+ goto full_search;
17050+ }
17051+ return -ENOMEM;
17052+ }
17053+ if (check_heap_stack_gap(vma, addr, len))
17054+ break;
17055+ if (addr + mm->cached_hole_size < vma->vm_start)
17056+ mm->cached_hole_size = vma->vm_start - addr;
17057+ addr = vma->vm_end;
17058+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17059+ start_addr = addr = mm->mmap_base;
17060+ mm->cached_hole_size = 0;
17061+ goto full_search;
17062+ }
17063+ }
17064+
17065+ /*
17066+ * Remember the place where we stopped the search:
17067+ */
17068+ mm->free_area_cache = addr + len;
17069+ return addr;
17070+}
17071+
17072+unsigned long
17073+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17074+ const unsigned long len, const unsigned long pgoff,
17075+ const unsigned long flags)
17076+{
17077+ struct vm_area_struct *vma;
17078+ struct mm_struct *mm = current->mm;
17079+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17080+
17081+#ifdef CONFIG_PAX_SEGMEXEC
17082+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17083+ pax_task_size = SEGMEXEC_TASK_SIZE;
17084+#endif
17085+
17086+ pax_task_size -= PAGE_SIZE;
17087+
17088+ /* requested length too big for entire address space */
17089+ if (len > pax_task_size)
17090+ return -ENOMEM;
17091+
17092+ if (flags & MAP_FIXED)
17093+ return addr;
17094+
17095+#ifdef CONFIG_PAX_PAGEEXEC
17096+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17097+ goto bottomup;
17098+#endif
17099+
17100+#ifdef CONFIG_PAX_RANDMMAP
17101+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17102+#endif
17103+
17104+ /* requesting a specific address */
17105+ if (addr) {
17106+ addr = PAGE_ALIGN(addr);
17107+ if (pax_task_size - len >= addr) {
17108+ vma = find_vma(mm, addr);
17109+ if (check_heap_stack_gap(vma, addr, len))
17110+ return addr;
17111+ }
17112+ }
17113+
17114+ /* check if free_area_cache is useful for us */
17115+ if (len <= mm->cached_hole_size) {
17116+ mm->cached_hole_size = 0;
17117+ mm->free_area_cache = mm->mmap_base;
17118+ }
17119+
17120+ /* either no address requested or can't fit in requested address hole */
17121+ addr = mm->free_area_cache;
17122+
17123+ /* make sure it can fit in the remaining address space */
17124+ if (addr > len) {
17125+ vma = find_vma(mm, addr-len);
17126+ if (check_heap_stack_gap(vma, addr - len, len))
17127+ /* remember the address as a hint for next time */
17128+ return (mm->free_area_cache = addr-len);
17129+ }
17130+
17131+ if (mm->mmap_base < len)
17132+ goto bottomup;
17133+
17134+ addr = mm->mmap_base-len;
17135+
17136+ do {
17137+ /*
17138+ * Lookup failure means no vma is above this address,
17139+ * else if new region fits below vma->vm_start,
17140+ * return with success:
17141+ */
17142+ vma = find_vma(mm, addr);
17143+ if (check_heap_stack_gap(vma, addr, len))
17144+ /* remember the address as a hint for next time */
17145+ return (mm->free_area_cache = addr);
17146+
17147+ /* remember the largest hole we saw so far */
17148+ if (addr + mm->cached_hole_size < vma->vm_start)
17149+ mm->cached_hole_size = vma->vm_start - addr;
17150+
17151+ /* try just below the current vma->vm_start */
17152+ addr = skip_heap_stack_gap(vma, len);
17153+ } while (!IS_ERR_VALUE(addr));
17154+
17155+bottomup:
17156+ /*
17157+ * A failed mmap() very likely causes application failure,
17158+ * so fall back to the bottom-up function here. This scenario
17159+ * can happen with large stack limits and large mmap()
17160+ * allocations.
17161+ */
17162+
17163+#ifdef CONFIG_PAX_SEGMEXEC
17164+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17165+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17166+ else
17167+#endif
17168+
17169+ mm->mmap_base = TASK_UNMAPPED_BASE;
17170+
17171+#ifdef CONFIG_PAX_RANDMMAP
17172+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17173+ mm->mmap_base += mm->delta_mmap;
17174+#endif
17175+
17176+ mm->free_area_cache = mm->mmap_base;
17177+ mm->cached_hole_size = ~0UL;
17178+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17179+ /*
17180+ * Restore the topdown base:
17181+ */
17182+ mm->mmap_base = base;
17183+ mm->free_area_cache = base;
17184+ mm->cached_hole_size = ~0UL;
17185+
17186+ return addr;
17187 }
17188diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
17189index ff14a50..35626c3 100644
17190--- a/arch/x86/kernel/sys_x86_64.c
17191+++ b/arch/x86/kernel/sys_x86_64.c
17192@@ -32,8 +32,8 @@ out:
17193 return error;
17194 }
17195
17196-static void find_start_end(unsigned long flags, unsigned long *begin,
17197- unsigned long *end)
17198+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17199+ unsigned long *begin, unsigned long *end)
17200 {
17201 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17202 unsigned long new_begin;
17203@@ -52,7 +52,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
17204 *begin = new_begin;
17205 }
17206 } else {
17207- *begin = TASK_UNMAPPED_BASE;
17208+ *begin = mm->mmap_base;
17209 *end = TASK_SIZE;
17210 }
17211 }
17212@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
17213 if (flags & MAP_FIXED)
17214 return addr;
17215
17216- find_start_end(flags, &begin, &end);
17217+ find_start_end(mm, flags, &begin, &end);
17218
17219 if (len > end)
17220 return -ENOMEM;
17221
17222+#ifdef CONFIG_PAX_RANDMMAP
17223+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17224+#endif
17225+
17226 if (addr) {
17227 addr = PAGE_ALIGN(addr);
17228 vma = find_vma(mm, addr);
17229- if (end - len >= addr &&
17230- (!vma || addr + len <= vma->vm_start))
17231+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17232 return addr;
17233 }
17234 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17235@@ -106,7 +109,7 @@ full_search:
17236 }
17237 return -ENOMEM;
17238 }
17239- if (!vma || addr + len <= vma->vm_start) {
17240+ if (check_heap_stack_gap(vma, addr, len)) {
17241 /*
17242 * Remember the place where we stopped the search:
17243 */
17244@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17245 {
17246 struct vm_area_struct *vma;
17247 struct mm_struct *mm = current->mm;
17248- unsigned long addr = addr0;
17249+ unsigned long base = mm->mmap_base, addr = addr0;
17250
17251 /* requested length too big for entire address space */
17252 if (len > TASK_SIZE)
17253@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17254 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17255 goto bottomup;
17256
17257+#ifdef CONFIG_PAX_RANDMMAP
17258+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17259+#endif
17260+
17261 /* requesting a specific address */
17262 if (addr) {
17263 addr = PAGE_ALIGN(addr);
17264- vma = find_vma(mm, addr);
17265- if (TASK_SIZE - len >= addr &&
17266- (!vma || addr + len <= vma->vm_start))
17267- return addr;
17268+ if (TASK_SIZE - len >= addr) {
17269+ vma = find_vma(mm, addr);
17270+ if (check_heap_stack_gap(vma, addr, len))
17271+ return addr;
17272+ }
17273 }
17274
17275 /* check if free_area_cache is useful for us */
17276@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17277 /* make sure it can fit in the remaining address space */
17278 if (addr > len) {
17279 vma = find_vma(mm, addr-len);
17280- if (!vma || addr <= vma->vm_start)
17281+ if (check_heap_stack_gap(vma, addr - len, len))
17282 /* remember the address as a hint for next time */
17283 return mm->free_area_cache = addr-len;
17284 }
17285@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17286 * return with success:
17287 */
17288 vma = find_vma(mm, addr);
17289- if (!vma || addr+len <= vma->vm_start)
17290+ if (check_heap_stack_gap(vma, addr, len))
17291 /* remember the address as a hint for next time */
17292 return mm->free_area_cache = addr;
17293
17294@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17295 mm->cached_hole_size = vma->vm_start - addr;
17296
17297 /* try just below the current vma->vm_start */
17298- addr = vma->vm_start-len;
17299- } while (len < vma->vm_start);
17300+ addr = skip_heap_stack_gap(vma, len);
17301+ } while (!IS_ERR_VALUE(addr));
17302
17303 bottomup:
17304 /*
17305@@ -198,13 +206,21 @@ bottomup:
17306 * can happen with large stack limits and large mmap()
17307 * allocations.
17308 */
17309+ mm->mmap_base = TASK_UNMAPPED_BASE;
17310+
17311+#ifdef CONFIG_PAX_RANDMMAP
17312+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17313+ mm->mmap_base += mm->delta_mmap;
17314+#endif
17315+
17316+ mm->free_area_cache = mm->mmap_base;
17317 mm->cached_hole_size = ~0UL;
17318- mm->free_area_cache = TASK_UNMAPPED_BASE;
17319 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17320 /*
17321 * Restore the topdown base:
17322 */
17323- mm->free_area_cache = mm->mmap_base;
17324+ mm->mmap_base = base;
17325+ mm->free_area_cache = base;
17326 mm->cached_hole_size = ~0UL;
17327
17328 return addr;
17329diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
17330index bc19be3..0f5fbf7 100644
17331--- a/arch/x86/kernel/syscall_table_32.S
17332+++ b/arch/x86/kernel/syscall_table_32.S
17333@@ -1,3 +1,4 @@
17334+.section .rodata,"a",@progbits
17335 ENTRY(sys_call_table)
17336 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17337 .long sys_exit
17338diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
17339index e07a2fc..db0369d 100644
17340--- a/arch/x86/kernel/tboot.c
17341+++ b/arch/x86/kernel/tboot.c
17342@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17343
17344 void tboot_shutdown(u32 shutdown_type)
17345 {
17346- void (*shutdown)(void);
17347+ void (* __noreturn shutdown)(void);
17348
17349 if (!tboot_enabled())
17350 return;
17351@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17352
17353 switch_to_tboot_pt();
17354
17355- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17356+ shutdown = (void *)tboot->shutdown_entry;
17357 shutdown();
17358
17359 /* should not reach here */
17360@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
17361 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17362 }
17363
17364-static atomic_t ap_wfs_count;
17365+static atomic_unchecked_t ap_wfs_count;
17366
17367 static int tboot_wait_for_aps(int num_aps)
17368 {
17369@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
17370 {
17371 switch (action) {
17372 case CPU_DYING:
17373- atomic_inc(&ap_wfs_count);
17374+ atomic_inc_unchecked(&ap_wfs_count);
17375 if (num_online_cpus() == 1)
17376- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17377+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17378 return NOTIFY_BAD;
17379 break;
17380 }
17381@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17382
17383 tboot_create_trampoline();
17384
17385- atomic_set(&ap_wfs_count, 0);
17386+ atomic_set_unchecked(&ap_wfs_count, 0);
17387 register_hotcpu_notifier(&tboot_cpu_notifier);
17388 return 0;
17389 }
17390diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
17391index 5a64d05..804587b 100644
17392--- a/arch/x86/kernel/time.c
17393+++ b/arch/x86/kernel/time.c
17394@@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs)
17395 {
17396 unsigned long pc = instruction_pointer(regs);
17397
17398- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17399+ if (!user_mode(regs) && in_lock_functions(pc)) {
17400 #ifdef CONFIG_FRAME_POINTER
17401- return *(unsigned long *)(regs->bp + sizeof(long));
17402+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17403 #else
17404 unsigned long *sp =
17405 (unsigned long *)kernel_stack_pointer(regs);
17406@@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
17407 * or above a saved flags. Eflags has bits 22-31 zero,
17408 * kernel addresses don't.
17409 */
17410+
17411+#ifdef CONFIG_PAX_KERNEXEC
17412+ return ktla_ktva(sp[0]);
17413+#else
17414 if (sp[0] >> 22)
17415 return sp[0];
17416 if (sp[1] >> 22)
17417 return sp[1];
17418 #endif
17419+
17420+#endif
17421 }
17422 return pc;
17423 }
17424diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
17425index 6bb7b85..dd853e1 100644
17426--- a/arch/x86/kernel/tls.c
17427+++ b/arch/x86/kernel/tls.c
17428@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
17429 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17430 return -EINVAL;
17431
17432+#ifdef CONFIG_PAX_SEGMEXEC
17433+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17434+ return -EINVAL;
17435+#endif
17436+
17437 set_tls_desc(p, idx, &info, 1);
17438
17439 return 0;
17440diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
17441index 451c0a7..e57f551 100644
17442--- a/arch/x86/kernel/trampoline_32.S
17443+++ b/arch/x86/kernel/trampoline_32.S
17444@@ -32,6 +32,12 @@
17445 #include <asm/segment.h>
17446 #include <asm/page_types.h>
17447
17448+#ifdef CONFIG_PAX_KERNEXEC
17449+#define ta(X) (X)
17450+#else
17451+#define ta(X) ((X) - __PAGE_OFFSET)
17452+#endif
17453+
17454 #ifdef CONFIG_SMP
17455
17456 .section ".x86_trampoline","a"
17457@@ -62,7 +68,7 @@ r_base = .
17458 inc %ax # protected mode (PE) bit
17459 lmsw %ax # into protected mode
17460 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17461- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17462+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17463
17464 # These need to be in the same 64K segment as the above;
17465 # hence we don't use the boot_gdt_descr defined in head.S
17466diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
17467index 09ff517..df19fbff 100644
17468--- a/arch/x86/kernel/trampoline_64.S
17469+++ b/arch/x86/kernel/trampoline_64.S
17470@@ -90,7 +90,7 @@ startup_32:
17471 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17472 movl %eax, %ds
17473
17474- movl $X86_CR4_PAE, %eax
17475+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17476 movl %eax, %cr4 # Enable PAE mode
17477
17478 # Setup trampoline 4 level pagetables
17479@@ -138,7 +138,7 @@ tidt:
17480 # so the kernel can live anywhere
17481 .balign 4
17482 tgdt:
17483- .short tgdt_end - tgdt # gdt limit
17484+ .short tgdt_end - tgdt - 1 # gdt limit
17485 .long tgdt - r_base
17486 .short 0
17487 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17488diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
17489index 6913369..7e7dff6 100644
17490--- a/arch/x86/kernel/traps.c
17491+++ b/arch/x86/kernel/traps.c
17492@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17493
17494 /* Do we ignore FPU interrupts ? */
17495 char ignore_fpu_irq;
17496-
17497-/*
17498- * The IDT has to be page-aligned to simplify the Pentium
17499- * F0 0F bug workaround.
17500- */
17501-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17502 #endif
17503
17504 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17505@@ -117,13 +111,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
17506 }
17507
17508 static void __kprobes
17509-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17510+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17511 long error_code, siginfo_t *info)
17512 {
17513 struct task_struct *tsk = current;
17514
17515 #ifdef CONFIG_X86_32
17516- if (regs->flags & X86_VM_MASK) {
17517+ if (v8086_mode(regs)) {
17518 /*
17519 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17520 * On nmi (interrupt 2), do_trap should not be called.
17521@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17522 }
17523 #endif
17524
17525- if (!user_mode(regs))
17526+ if (!user_mode_novm(regs))
17527 goto kernel_trap;
17528
17529 #ifdef CONFIG_X86_32
17530@@ -157,7 +151,7 @@ trap_signal:
17531 printk_ratelimit()) {
17532 printk(KERN_INFO
17533 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17534- tsk->comm, tsk->pid, str,
17535+ tsk->comm, task_pid_nr(tsk), str,
17536 regs->ip, regs->sp, error_code);
17537 print_vma_addr(" in ", regs->ip);
17538 printk("\n");
17539@@ -174,8 +168,20 @@ kernel_trap:
17540 if (!fixup_exception(regs)) {
17541 tsk->thread.error_code = error_code;
17542 tsk->thread.trap_no = trapnr;
17543+
17544+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17545+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17546+ str = "PAX: suspicious stack segment fault";
17547+#endif
17548+
17549 die(str, regs, error_code);
17550 }
17551+
17552+#ifdef CONFIG_PAX_REFCOUNT
17553+ if (trapnr == 4)
17554+ pax_report_refcount_overflow(regs);
17555+#endif
17556+
17557 return;
17558
17559 #ifdef CONFIG_X86_32
17560@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
17561 conditional_sti(regs);
17562
17563 #ifdef CONFIG_X86_32
17564- if (regs->flags & X86_VM_MASK)
17565+ if (v8086_mode(regs))
17566 goto gp_in_vm86;
17567 #endif
17568
17569 tsk = current;
17570- if (!user_mode(regs))
17571+ if (!user_mode_novm(regs))
17572 goto gp_in_kernel;
17573
17574+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17575+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17576+ struct mm_struct *mm = tsk->mm;
17577+ unsigned long limit;
17578+
17579+ down_write(&mm->mmap_sem);
17580+ limit = mm->context.user_cs_limit;
17581+ if (limit < TASK_SIZE) {
17582+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17583+ up_write(&mm->mmap_sem);
17584+ return;
17585+ }
17586+ up_write(&mm->mmap_sem);
17587+ }
17588+#endif
17589+
17590 tsk->thread.error_code = error_code;
17591 tsk->thread.trap_no = 13;
17592
17593@@ -304,6 +326,13 @@ gp_in_kernel:
17594 if (notify_die(DIE_GPF, "general protection fault", regs,
17595 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17596 return;
17597+
17598+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17599+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17600+ die("PAX: suspicious general protection fault", regs, error_code);
17601+ else
17602+#endif
17603+
17604 die("general protection fault", regs, error_code);
17605 }
17606
17607@@ -433,6 +462,17 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
17608 dotraplinkage notrace __kprobes void
17609 do_nmi(struct pt_regs *regs, long error_code)
17610 {
17611+
17612+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17613+ if (!user_mode(regs)) {
17614+ unsigned long cs = regs->cs & 0xFFFF;
17615+ unsigned long ip = ktva_ktla(regs->ip);
17616+
17617+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
17618+ regs->ip = ip;
17619+ }
17620+#endif
17621+
17622 nmi_enter();
17623
17624 inc_irq_stat(__nmi_count);
17625@@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17626 /* It's safe to allow irq's after DR6 has been saved */
17627 preempt_conditional_sti(regs);
17628
17629- if (regs->flags & X86_VM_MASK) {
17630+ if (v8086_mode(regs)) {
17631 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17632 error_code, 1);
17633 preempt_conditional_cli(regs);
17634@@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17635 * We already checked v86 mode above, so we can check for kernel mode
17636 * by just checking the CPL of CS.
17637 */
17638- if ((dr6 & DR_STEP) && !user_mode(regs)) {
17639+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17640 tsk->thread.debugreg6 &= ~DR_STEP;
17641 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17642 regs->flags &= ~X86_EFLAGS_TF;
17643@@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr)
17644 return;
17645 conditional_sti(regs);
17646
17647- if (!user_mode_vm(regs))
17648+ if (!user_mode(regs))
17649 {
17650 if (!fixup_exception(regs)) {
17651 task->thread.error_code = error_code;
17652@@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
17653 void __math_state_restore(void)
17654 {
17655 struct thread_info *thread = current_thread_info();
17656- struct task_struct *tsk = thread->task;
17657+ struct task_struct *tsk = current;
17658
17659 /*
17660 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17661@@ -750,8 +790,7 @@ void __math_state_restore(void)
17662 */
17663 asmlinkage void math_state_restore(void)
17664 {
17665- struct thread_info *thread = current_thread_info();
17666- struct task_struct *tsk = thread->task;
17667+ struct task_struct *tsk = current;
17668
17669 if (!tsk_used_math(tsk)) {
17670 local_irq_enable();
17671diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
17672index b9242ba..50c5edd 100644
17673--- a/arch/x86/kernel/verify_cpu.S
17674+++ b/arch/x86/kernel/verify_cpu.S
17675@@ -20,6 +20,7 @@
17676 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
17677 * arch/x86/kernel/trampoline_64.S: secondary processor verification
17678 * arch/x86/kernel/head_32.S: processor startup
17679+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
17680 *
17681 * verify_cpu, returns the status of longmode and SSE in register %eax.
17682 * 0: Success 1: Failure
17683diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
17684index 863f875..4307295 100644
17685--- a/arch/x86/kernel/vm86_32.c
17686+++ b/arch/x86/kernel/vm86_32.c
17687@@ -41,6 +41,7 @@
17688 #include <linux/ptrace.h>
17689 #include <linux/audit.h>
17690 #include <linux/stddef.h>
17691+#include <linux/grsecurity.h>
17692
17693 #include <asm/uaccess.h>
17694 #include <asm/io.h>
17695@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
17696 do_exit(SIGSEGV);
17697 }
17698
17699- tss = &per_cpu(init_tss, get_cpu());
17700+ tss = init_tss + get_cpu();
17701 current->thread.sp0 = current->thread.saved_sp0;
17702 current->thread.sysenter_cs = __KERNEL_CS;
17703 load_sp0(tss, &current->thread);
17704@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __user *v86, struct pt_regs *regs)
17705 struct task_struct *tsk;
17706 int tmp, ret = -EPERM;
17707
17708+#ifdef CONFIG_GRKERNSEC_VM86
17709+ if (!capable(CAP_SYS_RAWIO)) {
17710+ gr_handle_vm86();
17711+ goto out;
17712+ }
17713+#endif
17714+
17715 tsk = current;
17716 if (tsk->thread.saved_sp0)
17717 goto out;
17718@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned long arg, struct pt_regs *regs)
17719 int tmp, ret;
17720 struct vm86plus_struct __user *v86;
17721
17722+#ifdef CONFIG_GRKERNSEC_VM86
17723+ if (!capable(CAP_SYS_RAWIO)) {
17724+ gr_handle_vm86();
17725+ ret = -EPERM;
17726+ goto out;
17727+ }
17728+#endif
17729+
17730 tsk = current;
17731 switch (cmd) {
17732 case VM86_REQUEST_IRQ:
17733@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
17734 tsk->thread.saved_fs = info->regs32->fs;
17735 tsk->thread.saved_gs = get_user_gs(info->regs32);
17736
17737- tss = &per_cpu(init_tss, get_cpu());
17738+ tss = init_tss + get_cpu();
17739 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17740 if (cpu_has_sep)
17741 tsk->thread.sysenter_cs = 0;
17742@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
17743 goto cannot_handle;
17744 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17745 goto cannot_handle;
17746- intr_ptr = (unsigned long __user *) (i << 2);
17747+ intr_ptr = (__force unsigned long __user *) (i << 2);
17748 if (get_user(segoffs, intr_ptr))
17749 goto cannot_handle;
17750 if ((segoffs >> 16) == BIOSSEG)
17751diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
17752index 0f703f1..9e15f64 100644
17753--- a/arch/x86/kernel/vmlinux.lds.S
17754+++ b/arch/x86/kernel/vmlinux.lds.S
17755@@ -26,6 +26,13 @@
17756 #include <asm/page_types.h>
17757 #include <asm/cache.h>
17758 #include <asm/boot.h>
17759+#include <asm/segment.h>
17760+
17761+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17762+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17763+#else
17764+#define __KERNEL_TEXT_OFFSET 0
17765+#endif
17766
17767 #undef i386 /* in case the preprocessor is a 32bit one */
17768
17769@@ -69,30 +76,43 @@ jiffies_64 = jiffies;
17770
17771 PHDRS {
17772 text PT_LOAD FLAGS(5); /* R_E */
17773+#ifdef CONFIG_X86_32
17774+ module PT_LOAD FLAGS(5); /* R_E */
17775+#endif
17776+#ifdef CONFIG_XEN
17777+ rodata PT_LOAD FLAGS(5); /* R_E */
17778+#else
17779+ rodata PT_LOAD FLAGS(4); /* R__ */
17780+#endif
17781 data PT_LOAD FLAGS(6); /* RW_ */
17782-#ifdef CONFIG_X86_64
17783+ init.begin PT_LOAD FLAGS(6); /* RW_ */
17784 #ifdef CONFIG_SMP
17785 percpu PT_LOAD FLAGS(6); /* RW_ */
17786 #endif
17787+ text.init PT_LOAD FLAGS(5); /* R_E */
17788+ text.exit PT_LOAD FLAGS(5); /* R_E */
17789 init PT_LOAD FLAGS(7); /* RWE */
17790-#endif
17791 note PT_NOTE FLAGS(0); /* ___ */
17792 }
17793
17794 SECTIONS
17795 {
17796 #ifdef CONFIG_X86_32
17797- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
17798- phys_startup_32 = startup_32 - LOAD_OFFSET;
17799+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
17800 #else
17801- . = __START_KERNEL;
17802- phys_startup_64 = startup_64 - LOAD_OFFSET;
17803+ . = __START_KERNEL;
17804 #endif
17805
17806 /* Text and read-only data */
17807- .text : AT(ADDR(.text) - LOAD_OFFSET) {
17808- _text = .;
17809+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17810 /* bootstrapping code */
17811+#ifdef CONFIG_X86_32
17812+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17813+#else
17814+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17815+#endif
17816+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17817+ _text = .;
17818 HEAD_TEXT
17819 #ifdef CONFIG_X86_32
17820 . = ALIGN(PAGE_SIZE);
17821@@ -108,13 +128,47 @@ SECTIONS
17822 IRQENTRY_TEXT
17823 *(.fixup)
17824 *(.gnu.warning)
17825- /* End of text section */
17826- _etext = .;
17827 } :text = 0x9090
17828
17829- NOTES :text :note
17830+ . += __KERNEL_TEXT_OFFSET;
17831
17832- EXCEPTION_TABLE(16) :text = 0x9090
17833+#ifdef CONFIG_X86_32
17834+ . = ALIGN(PAGE_SIZE);
17835+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
17836+
17837+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
17838+ MODULES_EXEC_VADDR = .;
17839+ BYTE(0)
17840+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
17841+ . = ALIGN(HPAGE_SIZE);
17842+ MODULES_EXEC_END = . - 1;
17843+#endif
17844+
17845+ } :module
17846+#endif
17847+
17848+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
17849+ /* End of text section */
17850+ _etext = . - __KERNEL_TEXT_OFFSET;
17851+ }
17852+
17853+#ifdef CONFIG_X86_32
17854+ . = ALIGN(PAGE_SIZE);
17855+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
17856+ *(.idt)
17857+ . = ALIGN(PAGE_SIZE);
17858+ *(.empty_zero_page)
17859+ *(.initial_pg_fixmap)
17860+ *(.initial_pg_pmd)
17861+ *(.initial_page_table)
17862+ *(.swapper_pg_dir)
17863+ } :rodata
17864+#endif
17865+
17866+ . = ALIGN(PAGE_SIZE);
17867+ NOTES :rodata :note
17868+
17869+ EXCEPTION_TABLE(16) :rodata
17870
17871 #if defined(CONFIG_DEBUG_RODATA)
17872 /* .text should occupy whole number of pages */
17873@@ -126,16 +180,20 @@ SECTIONS
17874
17875 /* Data */
17876 .data : AT(ADDR(.data) - LOAD_OFFSET) {
17877+
17878+#ifdef CONFIG_PAX_KERNEXEC
17879+ . = ALIGN(HPAGE_SIZE);
17880+#else
17881+ . = ALIGN(PAGE_SIZE);
17882+#endif
17883+
17884 /* Start of data section */
17885 _sdata = .;
17886
17887 /* init_task */
17888 INIT_TASK_DATA(THREAD_SIZE)
17889
17890-#ifdef CONFIG_X86_32
17891- /* 32 bit has nosave before _edata */
17892 NOSAVE_DATA
17893-#endif
17894
17895 PAGE_ALIGNED_DATA(PAGE_SIZE)
17896
17897@@ -176,12 +234,19 @@ SECTIONS
17898 #endif /* CONFIG_X86_64 */
17899
17900 /* Init code and data - will be freed after init */
17901- . = ALIGN(PAGE_SIZE);
17902 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
17903+ BYTE(0)
17904+
17905+#ifdef CONFIG_PAX_KERNEXEC
17906+ . = ALIGN(HPAGE_SIZE);
17907+#else
17908+ . = ALIGN(PAGE_SIZE);
17909+#endif
17910+
17911 __init_begin = .; /* paired with __init_end */
17912- }
17913+ } :init.begin
17914
17915-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
17916+#ifdef CONFIG_SMP
17917 /*
17918 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
17919 * output PHDR, so the next output section - .init.text - should
17920@@ -190,12 +255,27 @@ SECTIONS
17921 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
17922 #endif
17923
17924- INIT_TEXT_SECTION(PAGE_SIZE)
17925-#ifdef CONFIG_X86_64
17926- :init
17927-#endif
17928+ . = ALIGN(PAGE_SIZE);
17929+ init_begin = .;
17930+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
17931+ VMLINUX_SYMBOL(_sinittext) = .;
17932+ INIT_TEXT
17933+ VMLINUX_SYMBOL(_einittext) = .;
17934+ . = ALIGN(PAGE_SIZE);
17935+ } :text.init
17936
17937- INIT_DATA_SECTION(16)
17938+ /*
17939+ * .exit.text is discard at runtime, not link time, to deal with
17940+ * references from .altinstructions and .eh_frame
17941+ */
17942+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17943+ EXIT_TEXT
17944+ . = ALIGN(16);
17945+ } :text.exit
17946+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
17947+
17948+ . = ALIGN(PAGE_SIZE);
17949+ INIT_DATA_SECTION(16) :init
17950
17951 /*
17952 * Code and data for a variety of lowlevel trampolines, to be
17953@@ -269,19 +349,12 @@ SECTIONS
17954 }
17955
17956 . = ALIGN(8);
17957- /*
17958- * .exit.text is discard at runtime, not link time, to deal with
17959- * references from .altinstructions and .eh_frame
17960- */
17961- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
17962- EXIT_TEXT
17963- }
17964
17965 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
17966 EXIT_DATA
17967 }
17968
17969-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
17970+#ifndef CONFIG_SMP
17971 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
17972 #endif
17973
17974@@ -300,16 +373,10 @@ SECTIONS
17975 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
17976 __smp_locks = .;
17977 *(.smp_locks)
17978- . = ALIGN(PAGE_SIZE);
17979 __smp_locks_end = .;
17980+ . = ALIGN(PAGE_SIZE);
17981 }
17982
17983-#ifdef CONFIG_X86_64
17984- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
17985- NOSAVE_DATA
17986- }
17987-#endif
17988-
17989 /* BSS */
17990 . = ALIGN(PAGE_SIZE);
17991 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
17992@@ -325,6 +392,7 @@ SECTIONS
17993 __brk_base = .;
17994 . += 64 * 1024; /* 64k alignment slop space */
17995 *(.brk_reservation) /* areas brk users have reserved */
17996+ . = ALIGN(HPAGE_SIZE);
17997 __brk_limit = .;
17998 }
17999
18000@@ -351,13 +419,12 @@ SECTIONS
18001 * for the boot processor.
18002 */
18003 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18004-INIT_PER_CPU(gdt_page);
18005 INIT_PER_CPU(irq_stack_union);
18006
18007 /*
18008 * Build-time check on the image size:
18009 */
18010-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18011+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18012 "kernel image bigger than KERNEL_IMAGE_SIZE");
18013
18014 #ifdef CONFIG_SMP
18015diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
18016index b56c65de..561a55b 100644
18017--- a/arch/x86/kernel/vsyscall_64.c
18018+++ b/arch/x86/kernel/vsyscall_64.c
18019@@ -56,15 +56,13 @@ DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
18020 .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
18021 };
18022
18023-static enum { EMULATE, NATIVE, NONE } vsyscall_mode = NATIVE;
18024+static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
18025
18026 static int __init vsyscall_setup(char *str)
18027 {
18028 if (str) {
18029 if (!strcmp("emulate", str))
18030 vsyscall_mode = EMULATE;
18031- else if (!strcmp("native", str))
18032- vsyscall_mode = NATIVE;
18033 else if (!strcmp("none", str))
18034 vsyscall_mode = NONE;
18035 else
18036@@ -177,7 +175,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18037
18038 tsk = current;
18039 if (seccomp_mode(&tsk->seccomp))
18040- do_exit(SIGKILL);
18041+ do_group_exit(SIGKILL);
18042
18043 switch (vsyscall_nr) {
18044 case 0:
18045@@ -219,8 +217,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18046 return true;
18047
18048 sigsegv:
18049- force_sig(SIGSEGV, current);
18050- return true;
18051+ do_group_exit(SIGKILL);
18052 }
18053
18054 /*
18055@@ -273,10 +270,7 @@ void __init map_vsyscall(void)
18056 extern char __vvar_page;
18057 unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
18058
18059- __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
18060- vsyscall_mode == NATIVE
18061- ? PAGE_KERNEL_VSYSCALL
18062- : PAGE_KERNEL_VVAR);
18063+ __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
18064 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
18065 (unsigned long)VSYSCALL_START);
18066
18067diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
18068index 9796c2f..f686fbf 100644
18069--- a/arch/x86/kernel/x8664_ksyms_64.c
18070+++ b/arch/x86/kernel/x8664_ksyms_64.c
18071@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18072 EXPORT_SYMBOL(copy_user_generic_string);
18073 EXPORT_SYMBOL(copy_user_generic_unrolled);
18074 EXPORT_SYMBOL(__copy_user_nocache);
18075-EXPORT_SYMBOL(_copy_from_user);
18076-EXPORT_SYMBOL(_copy_to_user);
18077
18078 EXPORT_SYMBOL(copy_page);
18079 EXPORT_SYMBOL(clear_page);
18080diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
18081index a391134..d0b63b6e 100644
18082--- a/arch/x86/kernel/xsave.c
18083+++ b/arch/x86/kernel/xsave.c
18084@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
18085 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18086 return -EINVAL;
18087
18088- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18089+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18090 fx_sw_user->extended_size -
18091 FP_XSTATE_MAGIC2_SIZE));
18092 if (err)
18093@@ -267,7 +267,7 @@ fx_only:
18094 * the other extended state.
18095 */
18096 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18097- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18098+ return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
18099 }
18100
18101 /*
18102@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf)
18103 if (use_xsave())
18104 err = restore_user_xstate(buf);
18105 else
18106- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18107+ err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
18108 buf);
18109 if (unlikely(err)) {
18110 /*
18111diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
18112index 8b4cc5f..f086b5b 100644
18113--- a/arch/x86/kvm/emulate.c
18114+++ b/arch/x86/kvm/emulate.c
18115@@ -96,7 +96,7 @@
18116 #define Src2ImmByte (2<<29)
18117 #define Src2One (3<<29)
18118 #define Src2Imm (4<<29)
18119-#define Src2Mask (7<<29)
18120+#define Src2Mask (7U<<29)
18121
18122 #define X2(x...) x, x
18123 #define X3(x...) X2(x), x
18124@@ -207,6 +207,7 @@ struct gprefix {
18125
18126 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18127 do { \
18128+ unsigned long _tmp; \
18129 __asm__ __volatile__ ( \
18130 _PRE_EFLAGS("0", "4", "2") \
18131 _op _suffix " %"_x"3,%1; " \
18132@@ -220,8 +221,6 @@ struct gprefix {
18133 /* Raw emulation: instruction has two explicit operands. */
18134 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18135 do { \
18136- unsigned long _tmp; \
18137- \
18138 switch ((_dst).bytes) { \
18139 case 2: \
18140 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18141@@ -237,7 +236,6 @@ struct gprefix {
18142
18143 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18144 do { \
18145- unsigned long _tmp; \
18146 switch ((_dst).bytes) { \
18147 case 1: \
18148 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18149diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
18150index 57dcbd4..79aba9b 100644
18151--- a/arch/x86/kvm/lapic.c
18152+++ b/arch/x86/kvm/lapic.c
18153@@ -53,7 +53,7 @@
18154 #define APIC_BUS_CYCLE_NS 1
18155
18156 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18157-#define apic_debug(fmt, arg...)
18158+#define apic_debug(fmt, arg...) do {} while (0)
18159
18160 #define APIC_LVT_NUM 6
18161 /* 14 is the version for Xeon and Pentium 8.4.8*/
18162diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
18163index 8e8da79..13bc641 100644
18164--- a/arch/x86/kvm/mmu.c
18165+++ b/arch/x86/kvm/mmu.c
18166@@ -3552,7 +3552,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18167
18168 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18169
18170- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18171+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18172
18173 /*
18174 * Assume that the pte write on a page table of the same type
18175@@ -3584,7 +3584,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18176 }
18177
18178 spin_lock(&vcpu->kvm->mmu_lock);
18179- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18180+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18181 gentry = 0;
18182 kvm_mmu_free_some_pages(vcpu);
18183 ++vcpu->kvm->stat.mmu_pte_write;
18184diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
18185index 507e2b8..fc55f89 100644
18186--- a/arch/x86/kvm/paging_tmpl.h
18187+++ b/arch/x86/kvm/paging_tmpl.h
18188@@ -197,7 +197,7 @@ retry_walk:
18189 if (unlikely(kvm_is_error_hva(host_addr)))
18190 goto error;
18191
18192- ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
18193+ ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
18194 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
18195 goto error;
18196
18197@@ -575,6 +575,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
18198 unsigned long mmu_seq;
18199 bool map_writable;
18200
18201+ pax_track_stack();
18202+
18203 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18204
18205 if (unlikely(error_code & PFERR_RSVD_MASK))
18206@@ -701,7 +703,7 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
18207 if (need_flush)
18208 kvm_flush_remote_tlbs(vcpu->kvm);
18209
18210- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18211+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18212
18213 spin_unlock(&vcpu->kvm->mmu_lock);
18214
18215diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
18216index 475d1c9..33658ff 100644
18217--- a/arch/x86/kvm/svm.c
18218+++ b/arch/x86/kvm/svm.c
18219@@ -3381,7 +3381,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
18220 int cpu = raw_smp_processor_id();
18221
18222 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18223+
18224+ pax_open_kernel();
18225 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18226+ pax_close_kernel();
18227+
18228 load_TR_desc();
18229 }
18230
18231@@ -3759,6 +3763,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
18232 #endif
18233 #endif
18234
18235+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18236+ __set_fs(current_thread_info()->addr_limit);
18237+#endif
18238+
18239 reload_tss(vcpu);
18240
18241 local_irq_disable();
18242diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
18243index e65a158..656dc24 100644
18244--- a/arch/x86/kvm/vmx.c
18245+++ b/arch/x86/kvm/vmx.c
18246@@ -1251,7 +1251,11 @@ static void reload_tss(void)
18247 struct desc_struct *descs;
18248
18249 descs = (void *)gdt->address;
18250+
18251+ pax_open_kernel();
18252 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18253+ pax_close_kernel();
18254+
18255 load_TR_desc();
18256 }
18257
18258@@ -2520,8 +2524,11 @@ static __init int hardware_setup(void)
18259 if (!cpu_has_vmx_flexpriority())
18260 flexpriority_enabled = 0;
18261
18262- if (!cpu_has_vmx_tpr_shadow())
18263- kvm_x86_ops->update_cr8_intercept = NULL;
18264+ if (!cpu_has_vmx_tpr_shadow()) {
18265+ pax_open_kernel();
18266+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18267+ pax_close_kernel();
18268+ }
18269
18270 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18271 kvm_disable_largepages();
18272@@ -3535,7 +3542,7 @@ static void vmx_set_constant_host_state(void)
18273 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18274
18275 asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
18276- vmcs_writel(HOST_RIP, tmpl); /* 22.2.5 */
18277+ vmcs_writel(HOST_RIP, ktla_ktva(tmpl)); /* 22.2.5 */
18278
18279 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
18280 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
18281@@ -6021,6 +6028,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18282 "jmp .Lkvm_vmx_return \n\t"
18283 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18284 ".Lkvm_vmx_return: "
18285+
18286+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18287+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18288+ ".Lkvm_vmx_return2: "
18289+#endif
18290+
18291 /* Save guest registers, load host registers, keep flags */
18292 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18293 "pop %0 \n\t"
18294@@ -6069,6 +6082,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18295 #endif
18296 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18297 [wordsize]"i"(sizeof(ulong))
18298+
18299+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18300+ ,[cs]"i"(__KERNEL_CS)
18301+#endif
18302+
18303 : "cc", "memory"
18304 , R"ax", R"bx", R"di", R"si"
18305 #ifdef CONFIG_X86_64
18306@@ -6097,7 +6115,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18307 }
18308 }
18309
18310- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18311+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18312+
18313+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18314+ loadsegment(fs, __KERNEL_PERCPU);
18315+#endif
18316+
18317+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18318+ __set_fs(current_thread_info()->addr_limit);
18319+#endif
18320+
18321 vmx->loaded_vmcs->launched = 1;
18322
18323 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18324diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
18325index 84a28ea..9326501 100644
18326--- a/arch/x86/kvm/x86.c
18327+++ b/arch/x86/kvm/x86.c
18328@@ -1334,8 +1334,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
18329 {
18330 struct kvm *kvm = vcpu->kvm;
18331 int lm = is_long_mode(vcpu);
18332- u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18333- : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18334+ u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18335+ : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18336 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
18337 : kvm->arch.xen_hvm_config.blob_size_32;
18338 u32 page_num = data & ~PAGE_MASK;
18339@@ -2137,6 +2137,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
18340 if (n < msr_list.nmsrs)
18341 goto out;
18342 r = -EFAULT;
18343+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18344+ goto out;
18345 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18346 num_msrs_to_save * sizeof(u32)))
18347 goto out;
18348@@ -2312,15 +2314,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
18349 struct kvm_cpuid2 *cpuid,
18350 struct kvm_cpuid_entry2 __user *entries)
18351 {
18352- int r;
18353+ int r, i;
18354
18355 r = -E2BIG;
18356 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18357 goto out;
18358 r = -EFAULT;
18359- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18360- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18361+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18362 goto out;
18363+ for (i = 0; i < cpuid->nent; ++i) {
18364+ struct kvm_cpuid_entry2 cpuid_entry;
18365+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18366+ goto out;
18367+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18368+ }
18369 vcpu->arch.cpuid_nent = cpuid->nent;
18370 kvm_apic_set_version(vcpu);
18371 kvm_x86_ops->cpuid_update(vcpu);
18372@@ -2335,15 +2342,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
18373 struct kvm_cpuid2 *cpuid,
18374 struct kvm_cpuid_entry2 __user *entries)
18375 {
18376- int r;
18377+ int r, i;
18378
18379 r = -E2BIG;
18380 if (cpuid->nent < vcpu->arch.cpuid_nent)
18381 goto out;
18382 r = -EFAULT;
18383- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18384- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18385+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18386 goto out;
18387+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18388+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18389+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18390+ goto out;
18391+ }
18392 return 0;
18393
18394 out:
18395@@ -2718,7 +2729,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
18396 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18397 struct kvm_interrupt *irq)
18398 {
18399- if (irq->irq < 0 || irq->irq >= 256)
18400+ if (irq->irq >= 256)
18401 return -EINVAL;
18402 if (irqchip_in_kernel(vcpu->kvm))
18403 return -ENXIO;
18404@@ -5089,7 +5100,7 @@ static void kvm_set_mmio_spte_mask(void)
18405 kvm_mmu_set_mmio_spte_mask(mask);
18406 }
18407
18408-int kvm_arch_init(void *opaque)
18409+int kvm_arch_init(const void *opaque)
18410 {
18411 int r;
18412 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18413diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
18414index 13ee258..b9632f6 100644
18415--- a/arch/x86/lguest/boot.c
18416+++ b/arch/x86/lguest/boot.c
18417@@ -1184,9 +1184,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
18418 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
18419 * Launcher to reboot us.
18420 */
18421-static void lguest_restart(char *reason)
18422+static __noreturn void lguest_restart(char *reason)
18423 {
18424 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
18425+ BUG();
18426 }
18427
18428 /*G:050
18429diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
18430index 042f682..c92afb6 100644
18431--- a/arch/x86/lib/atomic64_32.c
18432+++ b/arch/x86/lib/atomic64_32.c
18433@@ -8,18 +8,30 @@
18434
18435 long long atomic64_read_cx8(long long, const atomic64_t *v);
18436 EXPORT_SYMBOL(atomic64_read_cx8);
18437+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18438+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18439 long long atomic64_set_cx8(long long, const atomic64_t *v);
18440 EXPORT_SYMBOL(atomic64_set_cx8);
18441+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18442+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18443 long long atomic64_xchg_cx8(long long, unsigned high);
18444 EXPORT_SYMBOL(atomic64_xchg_cx8);
18445 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18446 EXPORT_SYMBOL(atomic64_add_return_cx8);
18447+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18448+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18449 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18450 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18451+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18452+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18453 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18454 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18455+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18456+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18457 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18458 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18459+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18460+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18461 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18462 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18463 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18464@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18465 #ifndef CONFIG_X86_CMPXCHG64
18466 long long atomic64_read_386(long long, const atomic64_t *v);
18467 EXPORT_SYMBOL(atomic64_read_386);
18468+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18469+EXPORT_SYMBOL(atomic64_read_unchecked_386);
18470 long long atomic64_set_386(long long, const atomic64_t *v);
18471 EXPORT_SYMBOL(atomic64_set_386);
18472+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18473+EXPORT_SYMBOL(atomic64_set_unchecked_386);
18474 long long atomic64_xchg_386(long long, unsigned high);
18475 EXPORT_SYMBOL(atomic64_xchg_386);
18476 long long atomic64_add_return_386(long long a, atomic64_t *v);
18477 EXPORT_SYMBOL(atomic64_add_return_386);
18478+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18479+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18480 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18481 EXPORT_SYMBOL(atomic64_sub_return_386);
18482+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18483+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18484 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18485 EXPORT_SYMBOL(atomic64_inc_return_386);
18486+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18487+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18488 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18489 EXPORT_SYMBOL(atomic64_dec_return_386);
18490+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18491+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18492 long long atomic64_add_386(long long a, atomic64_t *v);
18493 EXPORT_SYMBOL(atomic64_add_386);
18494+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18495+EXPORT_SYMBOL(atomic64_add_unchecked_386);
18496 long long atomic64_sub_386(long long a, atomic64_t *v);
18497 EXPORT_SYMBOL(atomic64_sub_386);
18498+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18499+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18500 long long atomic64_inc_386(long long a, atomic64_t *v);
18501 EXPORT_SYMBOL(atomic64_inc_386);
18502+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18503+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18504 long long atomic64_dec_386(long long a, atomic64_t *v);
18505 EXPORT_SYMBOL(atomic64_dec_386);
18506+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18507+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18508 long long atomic64_dec_if_positive_386(atomic64_t *v);
18509 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18510 int atomic64_inc_not_zero_386(atomic64_t *v);
18511diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
18512index e8e7e0d..56fd1b0 100644
18513--- a/arch/x86/lib/atomic64_386_32.S
18514+++ b/arch/x86/lib/atomic64_386_32.S
18515@@ -48,6 +48,10 @@ BEGIN(read)
18516 movl (v), %eax
18517 movl 4(v), %edx
18518 RET_ENDP
18519+BEGIN(read_unchecked)
18520+ movl (v), %eax
18521+ movl 4(v), %edx
18522+RET_ENDP
18523 #undef v
18524
18525 #define v %esi
18526@@ -55,6 +59,10 @@ BEGIN(set)
18527 movl %ebx, (v)
18528 movl %ecx, 4(v)
18529 RET_ENDP
18530+BEGIN(set_unchecked)
18531+ movl %ebx, (v)
18532+ movl %ecx, 4(v)
18533+RET_ENDP
18534 #undef v
18535
18536 #define v %esi
18537@@ -70,6 +78,20 @@ RET_ENDP
18538 BEGIN(add)
18539 addl %eax, (v)
18540 adcl %edx, 4(v)
18541+
18542+#ifdef CONFIG_PAX_REFCOUNT
18543+ jno 0f
18544+ subl %eax, (v)
18545+ sbbl %edx, 4(v)
18546+ int $4
18547+0:
18548+ _ASM_EXTABLE(0b, 0b)
18549+#endif
18550+
18551+RET_ENDP
18552+BEGIN(add_unchecked)
18553+ addl %eax, (v)
18554+ adcl %edx, 4(v)
18555 RET_ENDP
18556 #undef v
18557
18558@@ -77,6 +99,24 @@ RET_ENDP
18559 BEGIN(add_return)
18560 addl (v), %eax
18561 adcl 4(v), %edx
18562+
18563+#ifdef CONFIG_PAX_REFCOUNT
18564+ into
18565+1234:
18566+ _ASM_EXTABLE(1234b, 2f)
18567+#endif
18568+
18569+ movl %eax, (v)
18570+ movl %edx, 4(v)
18571+
18572+#ifdef CONFIG_PAX_REFCOUNT
18573+2:
18574+#endif
18575+
18576+RET_ENDP
18577+BEGIN(add_return_unchecked)
18578+ addl (v), %eax
18579+ adcl 4(v), %edx
18580 movl %eax, (v)
18581 movl %edx, 4(v)
18582 RET_ENDP
18583@@ -86,6 +126,20 @@ RET_ENDP
18584 BEGIN(sub)
18585 subl %eax, (v)
18586 sbbl %edx, 4(v)
18587+
18588+#ifdef CONFIG_PAX_REFCOUNT
18589+ jno 0f
18590+ addl %eax, (v)
18591+ adcl %edx, 4(v)
18592+ int $4
18593+0:
18594+ _ASM_EXTABLE(0b, 0b)
18595+#endif
18596+
18597+RET_ENDP
18598+BEGIN(sub_unchecked)
18599+ subl %eax, (v)
18600+ sbbl %edx, 4(v)
18601 RET_ENDP
18602 #undef v
18603
18604@@ -96,6 +150,27 @@ BEGIN(sub_return)
18605 sbbl $0, %edx
18606 addl (v), %eax
18607 adcl 4(v), %edx
18608+
18609+#ifdef CONFIG_PAX_REFCOUNT
18610+ into
18611+1234:
18612+ _ASM_EXTABLE(1234b, 2f)
18613+#endif
18614+
18615+ movl %eax, (v)
18616+ movl %edx, 4(v)
18617+
18618+#ifdef CONFIG_PAX_REFCOUNT
18619+2:
18620+#endif
18621+
18622+RET_ENDP
18623+BEGIN(sub_return_unchecked)
18624+ negl %edx
18625+ negl %eax
18626+ sbbl $0, %edx
18627+ addl (v), %eax
18628+ adcl 4(v), %edx
18629 movl %eax, (v)
18630 movl %edx, 4(v)
18631 RET_ENDP
18632@@ -105,6 +180,20 @@ RET_ENDP
18633 BEGIN(inc)
18634 addl $1, (v)
18635 adcl $0, 4(v)
18636+
18637+#ifdef CONFIG_PAX_REFCOUNT
18638+ jno 0f
18639+ subl $1, (v)
18640+ sbbl $0, 4(v)
18641+ int $4
18642+0:
18643+ _ASM_EXTABLE(0b, 0b)
18644+#endif
18645+
18646+RET_ENDP
18647+BEGIN(inc_unchecked)
18648+ addl $1, (v)
18649+ adcl $0, 4(v)
18650 RET_ENDP
18651 #undef v
18652
18653@@ -114,6 +203,26 @@ BEGIN(inc_return)
18654 movl 4(v), %edx
18655 addl $1, %eax
18656 adcl $0, %edx
18657+
18658+#ifdef CONFIG_PAX_REFCOUNT
18659+ into
18660+1234:
18661+ _ASM_EXTABLE(1234b, 2f)
18662+#endif
18663+
18664+ movl %eax, (v)
18665+ movl %edx, 4(v)
18666+
18667+#ifdef CONFIG_PAX_REFCOUNT
18668+2:
18669+#endif
18670+
18671+RET_ENDP
18672+BEGIN(inc_return_unchecked)
18673+ movl (v), %eax
18674+ movl 4(v), %edx
18675+ addl $1, %eax
18676+ adcl $0, %edx
18677 movl %eax, (v)
18678 movl %edx, 4(v)
18679 RET_ENDP
18680@@ -123,6 +232,20 @@ RET_ENDP
18681 BEGIN(dec)
18682 subl $1, (v)
18683 sbbl $0, 4(v)
18684+
18685+#ifdef CONFIG_PAX_REFCOUNT
18686+ jno 0f
18687+ addl $1, (v)
18688+ adcl $0, 4(v)
18689+ int $4
18690+0:
18691+ _ASM_EXTABLE(0b, 0b)
18692+#endif
18693+
18694+RET_ENDP
18695+BEGIN(dec_unchecked)
18696+ subl $1, (v)
18697+ sbbl $0, 4(v)
18698 RET_ENDP
18699 #undef v
18700
18701@@ -132,6 +255,26 @@ BEGIN(dec_return)
18702 movl 4(v), %edx
18703 subl $1, %eax
18704 sbbl $0, %edx
18705+
18706+#ifdef CONFIG_PAX_REFCOUNT
18707+ into
18708+1234:
18709+ _ASM_EXTABLE(1234b, 2f)
18710+#endif
18711+
18712+ movl %eax, (v)
18713+ movl %edx, 4(v)
18714+
18715+#ifdef CONFIG_PAX_REFCOUNT
18716+2:
18717+#endif
18718+
18719+RET_ENDP
18720+BEGIN(dec_return_unchecked)
18721+ movl (v), %eax
18722+ movl 4(v), %edx
18723+ subl $1, %eax
18724+ sbbl $0, %edx
18725 movl %eax, (v)
18726 movl %edx, 4(v)
18727 RET_ENDP
18728@@ -143,6 +286,13 @@ BEGIN(add_unless)
18729 adcl %edx, %edi
18730 addl (v), %eax
18731 adcl 4(v), %edx
18732+
18733+#ifdef CONFIG_PAX_REFCOUNT
18734+ into
18735+1234:
18736+ _ASM_EXTABLE(1234b, 2f)
18737+#endif
18738+
18739 cmpl %eax, %esi
18740 je 3f
18741 1:
18742@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18743 1:
18744 addl $1, %eax
18745 adcl $0, %edx
18746+
18747+#ifdef CONFIG_PAX_REFCOUNT
18748+ into
18749+1234:
18750+ _ASM_EXTABLE(1234b, 2f)
18751+#endif
18752+
18753 movl %eax, (v)
18754 movl %edx, 4(v)
18755 movl $1, %eax
18756@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18757 movl 4(v), %edx
18758 subl $1, %eax
18759 sbbl $0, %edx
18760+
18761+#ifdef CONFIG_PAX_REFCOUNT
18762+ into
18763+1234:
18764+ _ASM_EXTABLE(1234b, 1f)
18765+#endif
18766+
18767 js 1f
18768 movl %eax, (v)
18769 movl %edx, 4(v)
18770diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
18771index 391a083..d658e9f 100644
18772--- a/arch/x86/lib/atomic64_cx8_32.S
18773+++ b/arch/x86/lib/atomic64_cx8_32.S
18774@@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
18775 CFI_STARTPROC
18776
18777 read64 %ecx
18778+ pax_force_retaddr
18779 ret
18780 CFI_ENDPROC
18781 ENDPROC(atomic64_read_cx8)
18782
18783+ENTRY(atomic64_read_unchecked_cx8)
18784+ CFI_STARTPROC
18785+
18786+ read64 %ecx
18787+ pax_force_retaddr
18788+ ret
18789+ CFI_ENDPROC
18790+ENDPROC(atomic64_read_unchecked_cx8)
18791+
18792 ENTRY(atomic64_set_cx8)
18793 CFI_STARTPROC
18794
18795@@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
18796 cmpxchg8b (%esi)
18797 jne 1b
18798
18799+ pax_force_retaddr
18800 ret
18801 CFI_ENDPROC
18802 ENDPROC(atomic64_set_cx8)
18803
18804+ENTRY(atomic64_set_unchecked_cx8)
18805+ CFI_STARTPROC
18806+
18807+1:
18808+/* we don't need LOCK_PREFIX since aligned 64-bit writes
18809+ * are atomic on 586 and newer */
18810+ cmpxchg8b (%esi)
18811+ jne 1b
18812+
18813+ pax_force_retaddr
18814+ ret
18815+ CFI_ENDPROC
18816+ENDPROC(atomic64_set_unchecked_cx8)
18817+
18818 ENTRY(atomic64_xchg_cx8)
18819 CFI_STARTPROC
18820
18821@@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8)
18822 cmpxchg8b (%esi)
18823 jne 1b
18824
18825+ pax_force_retaddr
18826 ret
18827 CFI_ENDPROC
18828 ENDPROC(atomic64_xchg_cx8)
18829
18830-.macro addsub_return func ins insc
18831-ENTRY(atomic64_\func\()_return_cx8)
18832+.macro addsub_return func ins insc unchecked=""
18833+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18834 CFI_STARTPROC
18835 SAVE ebp
18836 SAVE ebx
18837@@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8)
18838 movl %edx, %ecx
18839 \ins\()l %esi, %ebx
18840 \insc\()l %edi, %ecx
18841+
18842+.ifb \unchecked
18843+#ifdef CONFIG_PAX_REFCOUNT
18844+ into
18845+2:
18846+ _ASM_EXTABLE(2b, 3f)
18847+#endif
18848+.endif
18849+
18850 LOCK_PREFIX
18851 cmpxchg8b (%ebp)
18852 jne 1b
18853-
18854-10:
18855 movl %ebx, %eax
18856 movl %ecx, %edx
18857+
18858+.ifb \unchecked
18859+#ifdef CONFIG_PAX_REFCOUNT
18860+3:
18861+#endif
18862+.endif
18863+
18864 RESTORE edi
18865 RESTORE esi
18866 RESTORE ebx
18867 RESTORE ebp
18868+ pax_force_retaddr
18869 ret
18870 CFI_ENDPROC
18871-ENDPROC(atomic64_\func\()_return_cx8)
18872+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18873 .endm
18874
18875 addsub_return add add adc
18876 addsub_return sub sub sbb
18877+addsub_return add add adc _unchecked
18878+addsub_return sub sub sbb _unchecked
18879
18880-.macro incdec_return func ins insc
18881-ENTRY(atomic64_\func\()_return_cx8)
18882+.macro incdec_return func ins insc unchecked
18883+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18884 CFI_STARTPROC
18885 SAVE ebx
18886
18887@@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8)
18888 movl %edx, %ecx
18889 \ins\()l $1, %ebx
18890 \insc\()l $0, %ecx
18891+
18892+.ifb \unchecked
18893+#ifdef CONFIG_PAX_REFCOUNT
18894+ into
18895+2:
18896+ _ASM_EXTABLE(2b, 3f)
18897+#endif
18898+.endif
18899+
18900 LOCK_PREFIX
18901 cmpxchg8b (%esi)
18902 jne 1b
18903
18904-10:
18905 movl %ebx, %eax
18906 movl %ecx, %edx
18907+
18908+.ifb \unchecked
18909+#ifdef CONFIG_PAX_REFCOUNT
18910+3:
18911+#endif
18912+.endif
18913+
18914 RESTORE ebx
18915+ pax_force_retaddr
18916 ret
18917 CFI_ENDPROC
18918-ENDPROC(atomic64_\func\()_return_cx8)
18919+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18920 .endm
18921
18922 incdec_return inc add adc
18923 incdec_return dec sub sbb
18924+incdec_return inc add adc _unchecked
18925+incdec_return dec sub sbb _unchecked
18926
18927 ENTRY(atomic64_dec_if_positive_cx8)
18928 CFI_STARTPROC
18929@@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
18930 movl %edx, %ecx
18931 subl $1, %ebx
18932 sbb $0, %ecx
18933+
18934+#ifdef CONFIG_PAX_REFCOUNT
18935+ into
18936+1234:
18937+ _ASM_EXTABLE(1234b, 2f)
18938+#endif
18939+
18940 js 2f
18941 LOCK_PREFIX
18942 cmpxchg8b (%esi)
18943@@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
18944 movl %ebx, %eax
18945 movl %ecx, %edx
18946 RESTORE ebx
18947+ pax_force_retaddr
18948 ret
18949 CFI_ENDPROC
18950 ENDPROC(atomic64_dec_if_positive_cx8)
18951@@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8)
18952 movl %edx, %ecx
18953 addl %esi, %ebx
18954 adcl %edi, %ecx
18955+
18956+#ifdef CONFIG_PAX_REFCOUNT
18957+ into
18958+1234:
18959+ _ASM_EXTABLE(1234b, 3f)
18960+#endif
18961+
18962 LOCK_PREFIX
18963 cmpxchg8b (%ebp)
18964 jne 1b
18965@@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8)
18966 CFI_ADJUST_CFA_OFFSET -8
18967 RESTORE ebx
18968 RESTORE ebp
18969+ pax_force_retaddr
18970 ret
18971 4:
18972 cmpl %edx, 4(%esp)
18973@@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
18974 movl %edx, %ecx
18975 addl $1, %ebx
18976 adcl $0, %ecx
18977+
18978+#ifdef CONFIG_PAX_REFCOUNT
18979+ into
18980+1234:
18981+ _ASM_EXTABLE(1234b, 3f)
18982+#endif
18983+
18984 LOCK_PREFIX
18985 cmpxchg8b (%esi)
18986 jne 1b
18987@@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
18988 movl $1, %eax
18989 3:
18990 RESTORE ebx
18991+ pax_force_retaddr
18992 ret
18993 4:
18994 testl %edx, %edx
18995diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
18996index 78d16a5..fbcf666 100644
18997--- a/arch/x86/lib/checksum_32.S
18998+++ b/arch/x86/lib/checksum_32.S
18999@@ -28,7 +28,8 @@
19000 #include <linux/linkage.h>
19001 #include <asm/dwarf2.h>
19002 #include <asm/errno.h>
19003-
19004+#include <asm/segment.h>
19005+
19006 /*
19007 * computes a partial checksum, e.g. for TCP/UDP fragments
19008 */
19009@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
19010
19011 #define ARGBASE 16
19012 #define FP 12
19013-
19014-ENTRY(csum_partial_copy_generic)
19015+
19016+ENTRY(csum_partial_copy_generic_to_user)
19017 CFI_STARTPROC
19018+
19019+#ifdef CONFIG_PAX_MEMORY_UDEREF
19020+ pushl_cfi %gs
19021+ popl_cfi %es
19022+ jmp csum_partial_copy_generic
19023+#endif
19024+
19025+ENTRY(csum_partial_copy_generic_from_user)
19026+
19027+#ifdef CONFIG_PAX_MEMORY_UDEREF
19028+ pushl_cfi %gs
19029+ popl_cfi %ds
19030+#endif
19031+
19032+ENTRY(csum_partial_copy_generic)
19033 subl $4,%esp
19034 CFI_ADJUST_CFA_OFFSET 4
19035 pushl_cfi %edi
19036@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19037 jmp 4f
19038 SRC(1: movw (%esi), %bx )
19039 addl $2, %esi
19040-DST( movw %bx, (%edi) )
19041+DST( movw %bx, %es:(%edi) )
19042 addl $2, %edi
19043 addw %bx, %ax
19044 adcl $0, %eax
19045@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19046 SRC(1: movl (%esi), %ebx )
19047 SRC( movl 4(%esi), %edx )
19048 adcl %ebx, %eax
19049-DST( movl %ebx, (%edi) )
19050+DST( movl %ebx, %es:(%edi) )
19051 adcl %edx, %eax
19052-DST( movl %edx, 4(%edi) )
19053+DST( movl %edx, %es:4(%edi) )
19054
19055 SRC( movl 8(%esi), %ebx )
19056 SRC( movl 12(%esi), %edx )
19057 adcl %ebx, %eax
19058-DST( movl %ebx, 8(%edi) )
19059+DST( movl %ebx, %es:8(%edi) )
19060 adcl %edx, %eax
19061-DST( movl %edx, 12(%edi) )
19062+DST( movl %edx, %es:12(%edi) )
19063
19064 SRC( movl 16(%esi), %ebx )
19065 SRC( movl 20(%esi), %edx )
19066 adcl %ebx, %eax
19067-DST( movl %ebx, 16(%edi) )
19068+DST( movl %ebx, %es:16(%edi) )
19069 adcl %edx, %eax
19070-DST( movl %edx, 20(%edi) )
19071+DST( movl %edx, %es:20(%edi) )
19072
19073 SRC( movl 24(%esi), %ebx )
19074 SRC( movl 28(%esi), %edx )
19075 adcl %ebx, %eax
19076-DST( movl %ebx, 24(%edi) )
19077+DST( movl %ebx, %es:24(%edi) )
19078 adcl %edx, %eax
19079-DST( movl %edx, 28(%edi) )
19080+DST( movl %edx, %es:28(%edi) )
19081
19082 lea 32(%esi), %esi
19083 lea 32(%edi), %edi
19084@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19085 shrl $2, %edx # This clears CF
19086 SRC(3: movl (%esi), %ebx )
19087 adcl %ebx, %eax
19088-DST( movl %ebx, (%edi) )
19089+DST( movl %ebx, %es:(%edi) )
19090 lea 4(%esi), %esi
19091 lea 4(%edi), %edi
19092 dec %edx
19093@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19094 jb 5f
19095 SRC( movw (%esi), %cx )
19096 leal 2(%esi), %esi
19097-DST( movw %cx, (%edi) )
19098+DST( movw %cx, %es:(%edi) )
19099 leal 2(%edi), %edi
19100 je 6f
19101 shll $16,%ecx
19102 SRC(5: movb (%esi), %cl )
19103-DST( movb %cl, (%edi) )
19104+DST( movb %cl, %es:(%edi) )
19105 6: addl %ecx, %eax
19106 adcl $0, %eax
19107 7:
19108@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19109
19110 6001:
19111 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19112- movl $-EFAULT, (%ebx)
19113+ movl $-EFAULT, %ss:(%ebx)
19114
19115 # zero the complete destination - computing the rest
19116 # is too much work
19117@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19118
19119 6002:
19120 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19121- movl $-EFAULT,(%ebx)
19122+ movl $-EFAULT,%ss:(%ebx)
19123 jmp 5000b
19124
19125 .previous
19126
19127+ pushl_cfi %ss
19128+ popl_cfi %ds
19129+ pushl_cfi %ss
19130+ popl_cfi %es
19131 popl_cfi %ebx
19132 CFI_RESTORE ebx
19133 popl_cfi %esi
19134@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19135 popl_cfi %ecx # equivalent to addl $4,%esp
19136 ret
19137 CFI_ENDPROC
19138-ENDPROC(csum_partial_copy_generic)
19139+ENDPROC(csum_partial_copy_generic_to_user)
19140
19141 #else
19142
19143 /* Version for PentiumII/PPro */
19144
19145 #define ROUND1(x) \
19146+ nop; nop; nop; \
19147 SRC(movl x(%esi), %ebx ) ; \
19148 addl %ebx, %eax ; \
19149- DST(movl %ebx, x(%edi) ) ;
19150+ DST(movl %ebx, %es:x(%edi)) ;
19151
19152 #define ROUND(x) \
19153+ nop; nop; nop; \
19154 SRC(movl x(%esi), %ebx ) ; \
19155 adcl %ebx, %eax ; \
19156- DST(movl %ebx, x(%edi) ) ;
19157+ DST(movl %ebx, %es:x(%edi)) ;
19158
19159 #define ARGBASE 12
19160-
19161-ENTRY(csum_partial_copy_generic)
19162+
19163+ENTRY(csum_partial_copy_generic_to_user)
19164 CFI_STARTPROC
19165+
19166+#ifdef CONFIG_PAX_MEMORY_UDEREF
19167+ pushl_cfi %gs
19168+ popl_cfi %es
19169+ jmp csum_partial_copy_generic
19170+#endif
19171+
19172+ENTRY(csum_partial_copy_generic_from_user)
19173+
19174+#ifdef CONFIG_PAX_MEMORY_UDEREF
19175+ pushl_cfi %gs
19176+ popl_cfi %ds
19177+#endif
19178+
19179+ENTRY(csum_partial_copy_generic)
19180 pushl_cfi %ebx
19181 CFI_REL_OFFSET ebx, 0
19182 pushl_cfi %edi
19183@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19184 subl %ebx, %edi
19185 lea -1(%esi),%edx
19186 andl $-32,%edx
19187- lea 3f(%ebx,%ebx), %ebx
19188+ lea 3f(%ebx,%ebx,2), %ebx
19189 testl %esi, %esi
19190 jmp *%ebx
19191 1: addl $64,%esi
19192@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19193 jb 5f
19194 SRC( movw (%esi), %dx )
19195 leal 2(%esi), %esi
19196-DST( movw %dx, (%edi) )
19197+DST( movw %dx, %es:(%edi) )
19198 leal 2(%edi), %edi
19199 je 6f
19200 shll $16,%edx
19201 5:
19202 SRC( movb (%esi), %dl )
19203-DST( movb %dl, (%edi) )
19204+DST( movb %dl, %es:(%edi) )
19205 6: addl %edx, %eax
19206 adcl $0, %eax
19207 7:
19208 .section .fixup, "ax"
19209 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19210- movl $-EFAULT, (%ebx)
19211+ movl $-EFAULT, %ss:(%ebx)
19212 # zero the complete destination (computing the rest is too much work)
19213 movl ARGBASE+8(%esp),%edi # dst
19214 movl ARGBASE+12(%esp),%ecx # len
19215@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19216 rep; stosb
19217 jmp 7b
19218 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19219- movl $-EFAULT, (%ebx)
19220+ movl $-EFAULT, %ss:(%ebx)
19221 jmp 7b
19222 .previous
19223
19224+#ifdef CONFIG_PAX_MEMORY_UDEREF
19225+ pushl_cfi %ss
19226+ popl_cfi %ds
19227+ pushl_cfi %ss
19228+ popl_cfi %es
19229+#endif
19230+
19231 popl_cfi %esi
19232 CFI_RESTORE esi
19233 popl_cfi %edi
19234@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19235 CFI_RESTORE ebx
19236 ret
19237 CFI_ENDPROC
19238-ENDPROC(csum_partial_copy_generic)
19239+ENDPROC(csum_partial_copy_generic_to_user)
19240
19241 #undef ROUND
19242 #undef ROUND1
19243diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
19244index f2145cf..cea889d 100644
19245--- a/arch/x86/lib/clear_page_64.S
19246+++ b/arch/x86/lib/clear_page_64.S
19247@@ -11,6 +11,7 @@ ENTRY(clear_page_c)
19248 movl $4096/8,%ecx
19249 xorl %eax,%eax
19250 rep stosq
19251+ pax_force_retaddr
19252 ret
19253 CFI_ENDPROC
19254 ENDPROC(clear_page_c)
19255@@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
19256 movl $4096,%ecx
19257 xorl %eax,%eax
19258 rep stosb
19259+ pax_force_retaddr
19260 ret
19261 CFI_ENDPROC
19262 ENDPROC(clear_page_c_e)
19263@@ -43,6 +45,7 @@ ENTRY(clear_page)
19264 leaq 64(%rdi),%rdi
19265 jnz .Lloop
19266 nop
19267+ pax_force_retaddr
19268 ret
19269 CFI_ENDPROC
19270 .Lclear_page_end:
19271@@ -58,7 +61,7 @@ ENDPROC(clear_page)
19272
19273 #include <asm/cpufeature.h>
19274
19275- .section .altinstr_replacement,"ax"
19276+ .section .altinstr_replacement,"a"
19277 1: .byte 0xeb /* jmp <disp8> */
19278 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19279 2: .byte 0xeb /* jmp <disp8> */
19280diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
19281index 1e572c5..2a162cd 100644
19282--- a/arch/x86/lib/cmpxchg16b_emu.S
19283+++ b/arch/x86/lib/cmpxchg16b_emu.S
19284@@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
19285
19286 popf
19287 mov $1, %al
19288+ pax_force_retaddr
19289 ret
19290
19291 not_same:
19292 popf
19293 xor %al,%al
19294+ pax_force_retaddr
19295 ret
19296
19297 CFI_ENDPROC
19298diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
19299index 01c805b..dccb07f 100644
19300--- a/arch/x86/lib/copy_page_64.S
19301+++ b/arch/x86/lib/copy_page_64.S
19302@@ -9,6 +9,7 @@ copy_page_c:
19303 CFI_STARTPROC
19304 movl $4096/8,%ecx
19305 rep movsq
19306+ pax_force_retaddr
19307 ret
19308 CFI_ENDPROC
19309 ENDPROC(copy_page_c)
19310@@ -39,7 +40,7 @@ ENTRY(copy_page)
19311 movq 16 (%rsi), %rdx
19312 movq 24 (%rsi), %r8
19313 movq 32 (%rsi), %r9
19314- movq 40 (%rsi), %r10
19315+ movq 40 (%rsi), %r13
19316 movq 48 (%rsi), %r11
19317 movq 56 (%rsi), %r12
19318
19319@@ -50,7 +51,7 @@ ENTRY(copy_page)
19320 movq %rdx, 16 (%rdi)
19321 movq %r8, 24 (%rdi)
19322 movq %r9, 32 (%rdi)
19323- movq %r10, 40 (%rdi)
19324+ movq %r13, 40 (%rdi)
19325 movq %r11, 48 (%rdi)
19326 movq %r12, 56 (%rdi)
19327
19328@@ -69,7 +70,7 @@ ENTRY(copy_page)
19329 movq 16 (%rsi), %rdx
19330 movq 24 (%rsi), %r8
19331 movq 32 (%rsi), %r9
19332- movq 40 (%rsi), %r10
19333+ movq 40 (%rsi), %r13
19334 movq 48 (%rsi), %r11
19335 movq 56 (%rsi), %r12
19336
19337@@ -78,7 +79,7 @@ ENTRY(copy_page)
19338 movq %rdx, 16 (%rdi)
19339 movq %r8, 24 (%rdi)
19340 movq %r9, 32 (%rdi)
19341- movq %r10, 40 (%rdi)
19342+ movq %r13, 40 (%rdi)
19343 movq %r11, 48 (%rdi)
19344 movq %r12, 56 (%rdi)
19345
19346@@ -95,6 +96,7 @@ ENTRY(copy_page)
19347 CFI_RESTORE r13
19348 addq $3*8,%rsp
19349 CFI_ADJUST_CFA_OFFSET -3*8
19350+ pax_force_retaddr
19351 ret
19352 .Lcopy_page_end:
19353 CFI_ENDPROC
19354@@ -105,7 +107,7 @@ ENDPROC(copy_page)
19355
19356 #include <asm/cpufeature.h>
19357
19358- .section .altinstr_replacement,"ax"
19359+ .section .altinstr_replacement,"a"
19360 1: .byte 0xeb /* jmp <disp8> */
19361 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19362 2:
19363diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
19364index 0248402..821c786 100644
19365--- a/arch/x86/lib/copy_user_64.S
19366+++ b/arch/x86/lib/copy_user_64.S
19367@@ -16,6 +16,7 @@
19368 #include <asm/thread_info.h>
19369 #include <asm/cpufeature.h>
19370 #include <asm/alternative-asm.h>
19371+#include <asm/pgtable.h>
19372
19373 /*
19374 * By placing feature2 after feature1 in altinstructions section, we logically
19375@@ -29,7 +30,7 @@
19376 .byte 0xe9 /* 32bit jump */
19377 .long \orig-1f /* by default jump to orig */
19378 1:
19379- .section .altinstr_replacement,"ax"
19380+ .section .altinstr_replacement,"a"
19381 2: .byte 0xe9 /* near jump with 32bit immediate */
19382 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
19383 3: .byte 0xe9 /* near jump with 32bit immediate */
19384@@ -71,47 +72,20 @@
19385 #endif
19386 .endm
19387
19388-/* Standard copy_to_user with segment limit checking */
19389-ENTRY(_copy_to_user)
19390- CFI_STARTPROC
19391- GET_THREAD_INFO(%rax)
19392- movq %rdi,%rcx
19393- addq %rdx,%rcx
19394- jc bad_to_user
19395- cmpq TI_addr_limit(%rax),%rcx
19396- ja bad_to_user
19397- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19398- copy_user_generic_unrolled,copy_user_generic_string, \
19399- copy_user_enhanced_fast_string
19400- CFI_ENDPROC
19401-ENDPROC(_copy_to_user)
19402-
19403-/* Standard copy_from_user with segment limit checking */
19404-ENTRY(_copy_from_user)
19405- CFI_STARTPROC
19406- GET_THREAD_INFO(%rax)
19407- movq %rsi,%rcx
19408- addq %rdx,%rcx
19409- jc bad_from_user
19410- cmpq TI_addr_limit(%rax),%rcx
19411- ja bad_from_user
19412- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19413- copy_user_generic_unrolled,copy_user_generic_string, \
19414- copy_user_enhanced_fast_string
19415- CFI_ENDPROC
19416-ENDPROC(_copy_from_user)
19417-
19418 .section .fixup,"ax"
19419 /* must zero dest */
19420 ENTRY(bad_from_user)
19421 bad_from_user:
19422 CFI_STARTPROC
19423+ testl %edx,%edx
19424+ js bad_to_user
19425 movl %edx,%ecx
19426 xorl %eax,%eax
19427 rep
19428 stosb
19429 bad_to_user:
19430 movl %edx,%eax
19431+ pax_force_retaddr
19432 ret
19433 CFI_ENDPROC
19434 ENDPROC(bad_from_user)
19435@@ -141,19 +115,19 @@ ENTRY(copy_user_generic_unrolled)
19436 jz 17f
19437 1: movq (%rsi),%r8
19438 2: movq 1*8(%rsi),%r9
19439-3: movq 2*8(%rsi),%r10
19440+3: movq 2*8(%rsi),%rax
19441 4: movq 3*8(%rsi),%r11
19442 5: movq %r8,(%rdi)
19443 6: movq %r9,1*8(%rdi)
19444-7: movq %r10,2*8(%rdi)
19445+7: movq %rax,2*8(%rdi)
19446 8: movq %r11,3*8(%rdi)
19447 9: movq 4*8(%rsi),%r8
19448 10: movq 5*8(%rsi),%r9
19449-11: movq 6*8(%rsi),%r10
19450+11: movq 6*8(%rsi),%rax
19451 12: movq 7*8(%rsi),%r11
19452 13: movq %r8,4*8(%rdi)
19453 14: movq %r9,5*8(%rdi)
19454-15: movq %r10,6*8(%rdi)
19455+15: movq %rax,6*8(%rdi)
19456 16: movq %r11,7*8(%rdi)
19457 leaq 64(%rsi),%rsi
19458 leaq 64(%rdi),%rdi
19459@@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
19460 decl %ecx
19461 jnz 21b
19462 23: xor %eax,%eax
19463+ pax_force_retaddr
19464 ret
19465
19466 .section .fixup,"ax"
19467@@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string)
19468 3: rep
19469 movsb
19470 4: xorl %eax,%eax
19471+ pax_force_retaddr
19472 ret
19473
19474 .section .fixup,"ax"
19475@@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string)
19476 1: rep
19477 movsb
19478 2: xorl %eax,%eax
19479+ pax_force_retaddr
19480 ret
19481
19482 .section .fixup,"ax"
19483diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
19484index cb0c112..e3a6895 100644
19485--- a/arch/x86/lib/copy_user_nocache_64.S
19486+++ b/arch/x86/lib/copy_user_nocache_64.S
19487@@ -8,12 +8,14 @@
19488
19489 #include <linux/linkage.h>
19490 #include <asm/dwarf2.h>
19491+#include <asm/alternative-asm.h>
19492
19493 #define FIX_ALIGNMENT 1
19494
19495 #include <asm/current.h>
19496 #include <asm/asm-offsets.h>
19497 #include <asm/thread_info.h>
19498+#include <asm/pgtable.h>
19499
19500 .macro ALIGN_DESTINATION
19501 #ifdef FIX_ALIGNMENT
19502@@ -50,6 +52,15 @@
19503 */
19504 ENTRY(__copy_user_nocache)
19505 CFI_STARTPROC
19506+
19507+#ifdef CONFIG_PAX_MEMORY_UDEREF
19508+ mov $PAX_USER_SHADOW_BASE,%rcx
19509+ cmp %rcx,%rsi
19510+ jae 1f
19511+ add %rcx,%rsi
19512+1:
19513+#endif
19514+
19515 cmpl $8,%edx
19516 jb 20f /* less then 8 bytes, go to byte copy loop */
19517 ALIGN_DESTINATION
19518@@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache)
19519 jz 17f
19520 1: movq (%rsi),%r8
19521 2: movq 1*8(%rsi),%r9
19522-3: movq 2*8(%rsi),%r10
19523+3: movq 2*8(%rsi),%rax
19524 4: movq 3*8(%rsi),%r11
19525 5: movnti %r8,(%rdi)
19526 6: movnti %r9,1*8(%rdi)
19527-7: movnti %r10,2*8(%rdi)
19528+7: movnti %rax,2*8(%rdi)
19529 8: movnti %r11,3*8(%rdi)
19530 9: movq 4*8(%rsi),%r8
19531 10: movq 5*8(%rsi),%r9
19532-11: movq 6*8(%rsi),%r10
19533+11: movq 6*8(%rsi),%rax
19534 12: movq 7*8(%rsi),%r11
19535 13: movnti %r8,4*8(%rdi)
19536 14: movnti %r9,5*8(%rdi)
19537-15: movnti %r10,6*8(%rdi)
19538+15: movnti %rax,6*8(%rdi)
19539 16: movnti %r11,7*8(%rdi)
19540 leaq 64(%rsi),%rsi
19541 leaq 64(%rdi),%rdi
19542@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
19543 jnz 21b
19544 23: xorl %eax,%eax
19545 sfence
19546+ pax_force_retaddr
19547 ret
19548
19549 .section .fixup,"ax"
19550diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
19551index fb903b7..c92b7f7 100644
19552--- a/arch/x86/lib/csum-copy_64.S
19553+++ b/arch/x86/lib/csum-copy_64.S
19554@@ -8,6 +8,7 @@
19555 #include <linux/linkage.h>
19556 #include <asm/dwarf2.h>
19557 #include <asm/errno.h>
19558+#include <asm/alternative-asm.h>
19559
19560 /*
19561 * Checksum copy with exception handling.
19562@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
19563 CFI_RESTORE rbp
19564 addq $7*8, %rsp
19565 CFI_ADJUST_CFA_OFFSET -7*8
19566+ pax_force_retaddr 0, 1
19567 ret
19568 CFI_RESTORE_STATE
19569
19570diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
19571index 459b58a..9570bc7 100644
19572--- a/arch/x86/lib/csum-wrappers_64.c
19573+++ b/arch/x86/lib/csum-wrappers_64.c
19574@@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
19575 len -= 2;
19576 }
19577 }
19578- isum = csum_partial_copy_generic((__force const void *)src,
19579+
19580+#ifdef CONFIG_PAX_MEMORY_UDEREF
19581+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19582+ src += PAX_USER_SHADOW_BASE;
19583+#endif
19584+
19585+ isum = csum_partial_copy_generic((const void __force_kernel *)src,
19586 dst, len, isum, errp, NULL);
19587 if (unlikely(*errp))
19588 goto out_err;
19589@@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
19590 }
19591
19592 *errp = 0;
19593- return csum_partial_copy_generic(src, (void __force *)dst,
19594+
19595+#ifdef CONFIG_PAX_MEMORY_UDEREF
19596+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19597+ dst += PAX_USER_SHADOW_BASE;
19598+#endif
19599+
19600+ return csum_partial_copy_generic(src, (void __force_kernel *)dst,
19601 len, isum, NULL, errp);
19602 }
19603 EXPORT_SYMBOL(csum_partial_copy_to_user);
19604diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
19605index 51f1504..ddac4c1 100644
19606--- a/arch/x86/lib/getuser.S
19607+++ b/arch/x86/lib/getuser.S
19608@@ -33,15 +33,38 @@
19609 #include <asm/asm-offsets.h>
19610 #include <asm/thread_info.h>
19611 #include <asm/asm.h>
19612+#include <asm/segment.h>
19613+#include <asm/pgtable.h>
19614+#include <asm/alternative-asm.h>
19615+
19616+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19617+#define __copyuser_seg gs;
19618+#else
19619+#define __copyuser_seg
19620+#endif
19621
19622 .text
19623 ENTRY(__get_user_1)
19624 CFI_STARTPROC
19625+
19626+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19627 GET_THREAD_INFO(%_ASM_DX)
19628 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19629 jae bad_get_user
19630-1: movzb (%_ASM_AX),%edx
19631+
19632+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19633+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19634+ cmp %_ASM_DX,%_ASM_AX
19635+ jae 1234f
19636+ add %_ASM_DX,%_ASM_AX
19637+1234:
19638+#endif
19639+
19640+#endif
19641+
19642+1: __copyuser_seg movzb (%_ASM_AX),%edx
19643 xor %eax,%eax
19644+ pax_force_retaddr
19645 ret
19646 CFI_ENDPROC
19647 ENDPROC(__get_user_1)
19648@@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
19649 ENTRY(__get_user_2)
19650 CFI_STARTPROC
19651 add $1,%_ASM_AX
19652+
19653+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19654 jc bad_get_user
19655 GET_THREAD_INFO(%_ASM_DX)
19656 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19657 jae bad_get_user
19658-2: movzwl -1(%_ASM_AX),%edx
19659+
19660+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19661+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19662+ cmp %_ASM_DX,%_ASM_AX
19663+ jae 1234f
19664+ add %_ASM_DX,%_ASM_AX
19665+1234:
19666+#endif
19667+
19668+#endif
19669+
19670+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19671 xor %eax,%eax
19672+ pax_force_retaddr
19673 ret
19674 CFI_ENDPROC
19675 ENDPROC(__get_user_2)
19676@@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
19677 ENTRY(__get_user_4)
19678 CFI_STARTPROC
19679 add $3,%_ASM_AX
19680+
19681+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19682 jc bad_get_user
19683 GET_THREAD_INFO(%_ASM_DX)
19684 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19685 jae bad_get_user
19686-3: mov -3(%_ASM_AX),%edx
19687+
19688+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19689+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19690+ cmp %_ASM_DX,%_ASM_AX
19691+ jae 1234f
19692+ add %_ASM_DX,%_ASM_AX
19693+1234:
19694+#endif
19695+
19696+#endif
19697+
19698+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19699 xor %eax,%eax
19700+ pax_force_retaddr
19701 ret
19702 CFI_ENDPROC
19703 ENDPROC(__get_user_4)
19704@@ -80,8 +131,18 @@ ENTRY(__get_user_8)
19705 GET_THREAD_INFO(%_ASM_DX)
19706 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19707 jae bad_get_user
19708+
19709+#ifdef CONFIG_PAX_MEMORY_UDEREF
19710+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19711+ cmp %_ASM_DX,%_ASM_AX
19712+ jae 1234f
19713+ add %_ASM_DX,%_ASM_AX
19714+1234:
19715+#endif
19716+
19717 4: movq -7(%_ASM_AX),%_ASM_DX
19718 xor %eax,%eax
19719+ pax_force_retaddr
19720 ret
19721 CFI_ENDPROC
19722 ENDPROC(__get_user_8)
19723@@ -91,6 +152,7 @@ bad_get_user:
19724 CFI_STARTPROC
19725 xor %edx,%edx
19726 mov $(-EFAULT),%_ASM_AX
19727+ pax_force_retaddr
19728 ret
19729 CFI_ENDPROC
19730 END(bad_get_user)
19731diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
19732index 9f33b98..dfc7678 100644
19733--- a/arch/x86/lib/insn.c
19734+++ b/arch/x86/lib/insn.c
19735@@ -21,6 +21,11 @@
19736 #include <linux/string.h>
19737 #include <asm/inat.h>
19738 #include <asm/insn.h>
19739+#ifdef __KERNEL__
19740+#include <asm/pgtable_types.h>
19741+#else
19742+#define ktla_ktva(addr) addr
19743+#endif
19744
19745 #define get_next(t, insn) \
19746 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19747@@ -40,8 +45,8 @@
19748 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19749 {
19750 memset(insn, 0, sizeof(*insn));
19751- insn->kaddr = kaddr;
19752- insn->next_byte = kaddr;
19753+ insn->kaddr = ktla_ktva(kaddr);
19754+ insn->next_byte = ktla_ktva(kaddr);
19755 insn->x86_64 = x86_64 ? 1 : 0;
19756 insn->opnd_bytes = 4;
19757 if (x86_64)
19758diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
19759index 05a95e7..326f2fa 100644
19760--- a/arch/x86/lib/iomap_copy_64.S
19761+++ b/arch/x86/lib/iomap_copy_64.S
19762@@ -17,6 +17,7 @@
19763
19764 #include <linux/linkage.h>
19765 #include <asm/dwarf2.h>
19766+#include <asm/alternative-asm.h>
19767
19768 /*
19769 * override generic version in lib/iomap_copy.c
19770@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
19771 CFI_STARTPROC
19772 movl %edx,%ecx
19773 rep movsd
19774+ pax_force_retaddr
19775 ret
19776 CFI_ENDPROC
19777 ENDPROC(__iowrite32_copy)
19778diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
19779index efbf2a0..8893637 100644
19780--- a/arch/x86/lib/memcpy_64.S
19781+++ b/arch/x86/lib/memcpy_64.S
19782@@ -34,6 +34,7 @@
19783 rep movsq
19784 movl %edx, %ecx
19785 rep movsb
19786+ pax_force_retaddr
19787 ret
19788 .Lmemcpy_e:
19789 .previous
19790@@ -51,6 +52,7 @@
19791
19792 movl %edx, %ecx
19793 rep movsb
19794+ pax_force_retaddr
19795 ret
19796 .Lmemcpy_e_e:
19797 .previous
19798@@ -81,13 +83,13 @@ ENTRY(memcpy)
19799 */
19800 movq 0*8(%rsi), %r8
19801 movq 1*8(%rsi), %r9
19802- movq 2*8(%rsi), %r10
19803+ movq 2*8(%rsi), %rcx
19804 movq 3*8(%rsi), %r11
19805 leaq 4*8(%rsi), %rsi
19806
19807 movq %r8, 0*8(%rdi)
19808 movq %r9, 1*8(%rdi)
19809- movq %r10, 2*8(%rdi)
19810+ movq %rcx, 2*8(%rdi)
19811 movq %r11, 3*8(%rdi)
19812 leaq 4*8(%rdi), %rdi
19813 jae .Lcopy_forward_loop
19814@@ -110,12 +112,12 @@ ENTRY(memcpy)
19815 subq $0x20, %rdx
19816 movq -1*8(%rsi), %r8
19817 movq -2*8(%rsi), %r9
19818- movq -3*8(%rsi), %r10
19819+ movq -3*8(%rsi), %rcx
19820 movq -4*8(%rsi), %r11
19821 leaq -4*8(%rsi), %rsi
19822 movq %r8, -1*8(%rdi)
19823 movq %r9, -2*8(%rdi)
19824- movq %r10, -3*8(%rdi)
19825+ movq %rcx, -3*8(%rdi)
19826 movq %r11, -4*8(%rdi)
19827 leaq -4*8(%rdi), %rdi
19828 jae .Lcopy_backward_loop
19829@@ -135,12 +137,13 @@ ENTRY(memcpy)
19830 */
19831 movq 0*8(%rsi), %r8
19832 movq 1*8(%rsi), %r9
19833- movq -2*8(%rsi, %rdx), %r10
19834+ movq -2*8(%rsi, %rdx), %rcx
19835 movq -1*8(%rsi, %rdx), %r11
19836 movq %r8, 0*8(%rdi)
19837 movq %r9, 1*8(%rdi)
19838- movq %r10, -2*8(%rdi, %rdx)
19839+ movq %rcx, -2*8(%rdi, %rdx)
19840 movq %r11, -1*8(%rdi, %rdx)
19841+ pax_force_retaddr
19842 retq
19843 .p2align 4
19844 .Lless_16bytes:
19845@@ -153,6 +156,7 @@ ENTRY(memcpy)
19846 movq -1*8(%rsi, %rdx), %r9
19847 movq %r8, 0*8(%rdi)
19848 movq %r9, -1*8(%rdi, %rdx)
19849+ pax_force_retaddr
19850 retq
19851 .p2align 4
19852 .Lless_8bytes:
19853@@ -166,6 +170,7 @@ ENTRY(memcpy)
19854 movl -4(%rsi, %rdx), %r8d
19855 movl %ecx, (%rdi)
19856 movl %r8d, -4(%rdi, %rdx)
19857+ pax_force_retaddr
19858 retq
19859 .p2align 4
19860 .Lless_3bytes:
19861@@ -183,6 +188,7 @@ ENTRY(memcpy)
19862 jnz .Lloop_1
19863
19864 .Lend:
19865+ pax_force_retaddr
19866 retq
19867 CFI_ENDPROC
19868 ENDPROC(memcpy)
19869diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
19870index ee16461..c39c199 100644
19871--- a/arch/x86/lib/memmove_64.S
19872+++ b/arch/x86/lib/memmove_64.S
19873@@ -61,13 +61,13 @@ ENTRY(memmove)
19874 5:
19875 sub $0x20, %rdx
19876 movq 0*8(%rsi), %r11
19877- movq 1*8(%rsi), %r10
19878+ movq 1*8(%rsi), %rcx
19879 movq 2*8(%rsi), %r9
19880 movq 3*8(%rsi), %r8
19881 leaq 4*8(%rsi), %rsi
19882
19883 movq %r11, 0*8(%rdi)
19884- movq %r10, 1*8(%rdi)
19885+ movq %rcx, 1*8(%rdi)
19886 movq %r9, 2*8(%rdi)
19887 movq %r8, 3*8(%rdi)
19888 leaq 4*8(%rdi), %rdi
19889@@ -81,10 +81,10 @@ ENTRY(memmove)
19890 4:
19891 movq %rdx, %rcx
19892 movq -8(%rsi, %rdx), %r11
19893- lea -8(%rdi, %rdx), %r10
19894+ lea -8(%rdi, %rdx), %r9
19895 shrq $3, %rcx
19896 rep movsq
19897- movq %r11, (%r10)
19898+ movq %r11, (%r9)
19899 jmp 13f
19900 .Lmemmove_end_forward:
19901
19902@@ -95,14 +95,14 @@ ENTRY(memmove)
19903 7:
19904 movq %rdx, %rcx
19905 movq (%rsi), %r11
19906- movq %rdi, %r10
19907+ movq %rdi, %r9
19908 leaq -8(%rsi, %rdx), %rsi
19909 leaq -8(%rdi, %rdx), %rdi
19910 shrq $3, %rcx
19911 std
19912 rep movsq
19913 cld
19914- movq %r11, (%r10)
19915+ movq %r11, (%r9)
19916 jmp 13f
19917
19918 /*
19919@@ -127,13 +127,13 @@ ENTRY(memmove)
19920 8:
19921 subq $0x20, %rdx
19922 movq -1*8(%rsi), %r11
19923- movq -2*8(%rsi), %r10
19924+ movq -2*8(%rsi), %rcx
19925 movq -3*8(%rsi), %r9
19926 movq -4*8(%rsi), %r8
19927 leaq -4*8(%rsi), %rsi
19928
19929 movq %r11, -1*8(%rdi)
19930- movq %r10, -2*8(%rdi)
19931+ movq %rcx, -2*8(%rdi)
19932 movq %r9, -3*8(%rdi)
19933 movq %r8, -4*8(%rdi)
19934 leaq -4*8(%rdi), %rdi
19935@@ -151,11 +151,11 @@ ENTRY(memmove)
19936 * Move data from 16 bytes to 31 bytes.
19937 */
19938 movq 0*8(%rsi), %r11
19939- movq 1*8(%rsi), %r10
19940+ movq 1*8(%rsi), %rcx
19941 movq -2*8(%rsi, %rdx), %r9
19942 movq -1*8(%rsi, %rdx), %r8
19943 movq %r11, 0*8(%rdi)
19944- movq %r10, 1*8(%rdi)
19945+ movq %rcx, 1*8(%rdi)
19946 movq %r9, -2*8(%rdi, %rdx)
19947 movq %r8, -1*8(%rdi, %rdx)
19948 jmp 13f
19949@@ -167,9 +167,9 @@ ENTRY(memmove)
19950 * Move data from 8 bytes to 15 bytes.
19951 */
19952 movq 0*8(%rsi), %r11
19953- movq -1*8(%rsi, %rdx), %r10
19954+ movq -1*8(%rsi, %rdx), %r9
19955 movq %r11, 0*8(%rdi)
19956- movq %r10, -1*8(%rdi, %rdx)
19957+ movq %r9, -1*8(%rdi, %rdx)
19958 jmp 13f
19959 10:
19960 cmpq $4, %rdx
19961@@ -178,9 +178,9 @@ ENTRY(memmove)
19962 * Move data from 4 bytes to 7 bytes.
19963 */
19964 movl (%rsi), %r11d
19965- movl -4(%rsi, %rdx), %r10d
19966+ movl -4(%rsi, %rdx), %r9d
19967 movl %r11d, (%rdi)
19968- movl %r10d, -4(%rdi, %rdx)
19969+ movl %r9d, -4(%rdi, %rdx)
19970 jmp 13f
19971 11:
19972 cmp $2, %rdx
19973@@ -189,9 +189,9 @@ ENTRY(memmove)
19974 * Move data from 2 bytes to 3 bytes.
19975 */
19976 movw (%rsi), %r11w
19977- movw -2(%rsi, %rdx), %r10w
19978+ movw -2(%rsi, %rdx), %r9w
19979 movw %r11w, (%rdi)
19980- movw %r10w, -2(%rdi, %rdx)
19981+ movw %r9w, -2(%rdi, %rdx)
19982 jmp 13f
19983 12:
19984 cmp $1, %rdx
19985@@ -202,6 +202,7 @@ ENTRY(memmove)
19986 movb (%rsi), %r11b
19987 movb %r11b, (%rdi)
19988 13:
19989+ pax_force_retaddr
19990 retq
19991 CFI_ENDPROC
19992
19993@@ -210,6 +211,7 @@ ENTRY(memmove)
19994 /* Forward moving data. */
19995 movq %rdx, %rcx
19996 rep movsb
19997+ pax_force_retaddr
19998 retq
19999 .Lmemmove_end_forward_efs:
20000 .previous
20001diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
20002index 79bd454..dff325a 100644
20003--- a/arch/x86/lib/memset_64.S
20004+++ b/arch/x86/lib/memset_64.S
20005@@ -31,6 +31,7 @@
20006 movl %r8d,%ecx
20007 rep stosb
20008 movq %r9,%rax
20009+ pax_force_retaddr
20010 ret
20011 .Lmemset_e:
20012 .previous
20013@@ -53,6 +54,7 @@
20014 movl %edx,%ecx
20015 rep stosb
20016 movq %r9,%rax
20017+ pax_force_retaddr
20018 ret
20019 .Lmemset_e_e:
20020 .previous
20021@@ -60,13 +62,13 @@
20022 ENTRY(memset)
20023 ENTRY(__memset)
20024 CFI_STARTPROC
20025- movq %rdi,%r10
20026 movq %rdx,%r11
20027
20028 /* expand byte value */
20029 movzbl %sil,%ecx
20030 movabs $0x0101010101010101,%rax
20031 mul %rcx /* with rax, clobbers rdx */
20032+ movq %rdi,%rdx
20033
20034 /* align dst */
20035 movl %edi,%r9d
20036@@ -120,7 +122,8 @@ ENTRY(__memset)
20037 jnz .Lloop_1
20038
20039 .Lende:
20040- movq %r10,%rax
20041+ movq %rdx,%rax
20042+ pax_force_retaddr
20043 ret
20044
20045 CFI_RESTORE_STATE
20046diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
20047index c9f2d9b..e7fd2c0 100644
20048--- a/arch/x86/lib/mmx_32.c
20049+++ b/arch/x86/lib/mmx_32.c
20050@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20051 {
20052 void *p;
20053 int i;
20054+ unsigned long cr0;
20055
20056 if (unlikely(in_interrupt()))
20057 return __memcpy(to, from, len);
20058@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20059 kernel_fpu_begin();
20060
20061 __asm__ __volatile__ (
20062- "1: prefetch (%0)\n" /* This set is 28 bytes */
20063- " prefetch 64(%0)\n"
20064- " prefetch 128(%0)\n"
20065- " prefetch 192(%0)\n"
20066- " prefetch 256(%0)\n"
20067+ "1: prefetch (%1)\n" /* This set is 28 bytes */
20068+ " prefetch 64(%1)\n"
20069+ " prefetch 128(%1)\n"
20070+ " prefetch 192(%1)\n"
20071+ " prefetch 256(%1)\n"
20072 "2: \n"
20073 ".section .fixup, \"ax\"\n"
20074- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20075+ "3: \n"
20076+
20077+#ifdef CONFIG_PAX_KERNEXEC
20078+ " movl %%cr0, %0\n"
20079+ " movl %0, %%eax\n"
20080+ " andl $0xFFFEFFFF, %%eax\n"
20081+ " movl %%eax, %%cr0\n"
20082+#endif
20083+
20084+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20085+
20086+#ifdef CONFIG_PAX_KERNEXEC
20087+ " movl %0, %%cr0\n"
20088+#endif
20089+
20090 " jmp 2b\n"
20091 ".previous\n"
20092 _ASM_EXTABLE(1b, 3b)
20093- : : "r" (from));
20094+ : "=&r" (cr0) : "r" (from) : "ax");
20095
20096 for ( ; i > 5; i--) {
20097 __asm__ __volatile__ (
20098- "1: prefetch 320(%0)\n"
20099- "2: movq (%0), %%mm0\n"
20100- " movq 8(%0), %%mm1\n"
20101- " movq 16(%0), %%mm2\n"
20102- " movq 24(%0), %%mm3\n"
20103- " movq %%mm0, (%1)\n"
20104- " movq %%mm1, 8(%1)\n"
20105- " movq %%mm2, 16(%1)\n"
20106- " movq %%mm3, 24(%1)\n"
20107- " movq 32(%0), %%mm0\n"
20108- " movq 40(%0), %%mm1\n"
20109- " movq 48(%0), %%mm2\n"
20110- " movq 56(%0), %%mm3\n"
20111- " movq %%mm0, 32(%1)\n"
20112- " movq %%mm1, 40(%1)\n"
20113- " movq %%mm2, 48(%1)\n"
20114- " movq %%mm3, 56(%1)\n"
20115+ "1: prefetch 320(%1)\n"
20116+ "2: movq (%1), %%mm0\n"
20117+ " movq 8(%1), %%mm1\n"
20118+ " movq 16(%1), %%mm2\n"
20119+ " movq 24(%1), %%mm3\n"
20120+ " movq %%mm0, (%2)\n"
20121+ " movq %%mm1, 8(%2)\n"
20122+ " movq %%mm2, 16(%2)\n"
20123+ " movq %%mm3, 24(%2)\n"
20124+ " movq 32(%1), %%mm0\n"
20125+ " movq 40(%1), %%mm1\n"
20126+ " movq 48(%1), %%mm2\n"
20127+ " movq 56(%1), %%mm3\n"
20128+ " movq %%mm0, 32(%2)\n"
20129+ " movq %%mm1, 40(%2)\n"
20130+ " movq %%mm2, 48(%2)\n"
20131+ " movq %%mm3, 56(%2)\n"
20132 ".section .fixup, \"ax\"\n"
20133- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20134+ "3:\n"
20135+
20136+#ifdef CONFIG_PAX_KERNEXEC
20137+ " movl %%cr0, %0\n"
20138+ " movl %0, %%eax\n"
20139+ " andl $0xFFFEFFFF, %%eax\n"
20140+ " movl %%eax, %%cr0\n"
20141+#endif
20142+
20143+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20144+
20145+#ifdef CONFIG_PAX_KERNEXEC
20146+ " movl %0, %%cr0\n"
20147+#endif
20148+
20149 " jmp 2b\n"
20150 ".previous\n"
20151 _ASM_EXTABLE(1b, 3b)
20152- : : "r" (from), "r" (to) : "memory");
20153+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20154
20155 from += 64;
20156 to += 64;
20157@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
20158 static void fast_copy_page(void *to, void *from)
20159 {
20160 int i;
20161+ unsigned long cr0;
20162
20163 kernel_fpu_begin();
20164
20165@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
20166 * but that is for later. -AV
20167 */
20168 __asm__ __volatile__(
20169- "1: prefetch (%0)\n"
20170- " prefetch 64(%0)\n"
20171- " prefetch 128(%0)\n"
20172- " prefetch 192(%0)\n"
20173- " prefetch 256(%0)\n"
20174+ "1: prefetch (%1)\n"
20175+ " prefetch 64(%1)\n"
20176+ " prefetch 128(%1)\n"
20177+ " prefetch 192(%1)\n"
20178+ " prefetch 256(%1)\n"
20179 "2: \n"
20180 ".section .fixup, \"ax\"\n"
20181- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20182+ "3: \n"
20183+
20184+#ifdef CONFIG_PAX_KERNEXEC
20185+ " movl %%cr0, %0\n"
20186+ " movl %0, %%eax\n"
20187+ " andl $0xFFFEFFFF, %%eax\n"
20188+ " movl %%eax, %%cr0\n"
20189+#endif
20190+
20191+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20192+
20193+#ifdef CONFIG_PAX_KERNEXEC
20194+ " movl %0, %%cr0\n"
20195+#endif
20196+
20197 " jmp 2b\n"
20198 ".previous\n"
20199- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20200+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20201
20202 for (i = 0; i < (4096-320)/64; i++) {
20203 __asm__ __volatile__ (
20204- "1: prefetch 320(%0)\n"
20205- "2: movq (%0), %%mm0\n"
20206- " movntq %%mm0, (%1)\n"
20207- " movq 8(%0), %%mm1\n"
20208- " movntq %%mm1, 8(%1)\n"
20209- " movq 16(%0), %%mm2\n"
20210- " movntq %%mm2, 16(%1)\n"
20211- " movq 24(%0), %%mm3\n"
20212- " movntq %%mm3, 24(%1)\n"
20213- " movq 32(%0), %%mm4\n"
20214- " movntq %%mm4, 32(%1)\n"
20215- " movq 40(%0), %%mm5\n"
20216- " movntq %%mm5, 40(%1)\n"
20217- " movq 48(%0), %%mm6\n"
20218- " movntq %%mm6, 48(%1)\n"
20219- " movq 56(%0), %%mm7\n"
20220- " movntq %%mm7, 56(%1)\n"
20221+ "1: prefetch 320(%1)\n"
20222+ "2: movq (%1), %%mm0\n"
20223+ " movntq %%mm0, (%2)\n"
20224+ " movq 8(%1), %%mm1\n"
20225+ " movntq %%mm1, 8(%2)\n"
20226+ " movq 16(%1), %%mm2\n"
20227+ " movntq %%mm2, 16(%2)\n"
20228+ " movq 24(%1), %%mm3\n"
20229+ " movntq %%mm3, 24(%2)\n"
20230+ " movq 32(%1), %%mm4\n"
20231+ " movntq %%mm4, 32(%2)\n"
20232+ " movq 40(%1), %%mm5\n"
20233+ " movntq %%mm5, 40(%2)\n"
20234+ " movq 48(%1), %%mm6\n"
20235+ " movntq %%mm6, 48(%2)\n"
20236+ " movq 56(%1), %%mm7\n"
20237+ " movntq %%mm7, 56(%2)\n"
20238 ".section .fixup, \"ax\"\n"
20239- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20240+ "3:\n"
20241+
20242+#ifdef CONFIG_PAX_KERNEXEC
20243+ " movl %%cr0, %0\n"
20244+ " movl %0, %%eax\n"
20245+ " andl $0xFFFEFFFF, %%eax\n"
20246+ " movl %%eax, %%cr0\n"
20247+#endif
20248+
20249+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20250+
20251+#ifdef CONFIG_PAX_KERNEXEC
20252+ " movl %0, %%cr0\n"
20253+#endif
20254+
20255 " jmp 2b\n"
20256 ".previous\n"
20257- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20258+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20259
20260 from += 64;
20261 to += 64;
20262@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20263 static void fast_copy_page(void *to, void *from)
20264 {
20265 int i;
20266+ unsigned long cr0;
20267
20268 kernel_fpu_begin();
20269
20270 __asm__ __volatile__ (
20271- "1: prefetch (%0)\n"
20272- " prefetch 64(%0)\n"
20273- " prefetch 128(%0)\n"
20274- " prefetch 192(%0)\n"
20275- " prefetch 256(%0)\n"
20276+ "1: prefetch (%1)\n"
20277+ " prefetch 64(%1)\n"
20278+ " prefetch 128(%1)\n"
20279+ " prefetch 192(%1)\n"
20280+ " prefetch 256(%1)\n"
20281 "2: \n"
20282 ".section .fixup, \"ax\"\n"
20283- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20284+ "3: \n"
20285+
20286+#ifdef CONFIG_PAX_KERNEXEC
20287+ " movl %%cr0, %0\n"
20288+ " movl %0, %%eax\n"
20289+ " andl $0xFFFEFFFF, %%eax\n"
20290+ " movl %%eax, %%cr0\n"
20291+#endif
20292+
20293+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20294+
20295+#ifdef CONFIG_PAX_KERNEXEC
20296+ " movl %0, %%cr0\n"
20297+#endif
20298+
20299 " jmp 2b\n"
20300 ".previous\n"
20301- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20302+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20303
20304 for (i = 0; i < 4096/64; i++) {
20305 __asm__ __volatile__ (
20306- "1: prefetch 320(%0)\n"
20307- "2: movq (%0), %%mm0\n"
20308- " movq 8(%0), %%mm1\n"
20309- " movq 16(%0), %%mm2\n"
20310- " movq 24(%0), %%mm3\n"
20311- " movq %%mm0, (%1)\n"
20312- " movq %%mm1, 8(%1)\n"
20313- " movq %%mm2, 16(%1)\n"
20314- " movq %%mm3, 24(%1)\n"
20315- " movq 32(%0), %%mm0\n"
20316- " movq 40(%0), %%mm1\n"
20317- " movq 48(%0), %%mm2\n"
20318- " movq 56(%0), %%mm3\n"
20319- " movq %%mm0, 32(%1)\n"
20320- " movq %%mm1, 40(%1)\n"
20321- " movq %%mm2, 48(%1)\n"
20322- " movq %%mm3, 56(%1)\n"
20323+ "1: prefetch 320(%1)\n"
20324+ "2: movq (%1), %%mm0\n"
20325+ " movq 8(%1), %%mm1\n"
20326+ " movq 16(%1), %%mm2\n"
20327+ " movq 24(%1), %%mm3\n"
20328+ " movq %%mm0, (%2)\n"
20329+ " movq %%mm1, 8(%2)\n"
20330+ " movq %%mm2, 16(%2)\n"
20331+ " movq %%mm3, 24(%2)\n"
20332+ " movq 32(%1), %%mm0\n"
20333+ " movq 40(%1), %%mm1\n"
20334+ " movq 48(%1), %%mm2\n"
20335+ " movq 56(%1), %%mm3\n"
20336+ " movq %%mm0, 32(%2)\n"
20337+ " movq %%mm1, 40(%2)\n"
20338+ " movq %%mm2, 48(%2)\n"
20339+ " movq %%mm3, 56(%2)\n"
20340 ".section .fixup, \"ax\"\n"
20341- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20342+ "3:\n"
20343+
20344+#ifdef CONFIG_PAX_KERNEXEC
20345+ " movl %%cr0, %0\n"
20346+ " movl %0, %%eax\n"
20347+ " andl $0xFFFEFFFF, %%eax\n"
20348+ " movl %%eax, %%cr0\n"
20349+#endif
20350+
20351+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20352+
20353+#ifdef CONFIG_PAX_KERNEXEC
20354+ " movl %0, %%cr0\n"
20355+#endif
20356+
20357 " jmp 2b\n"
20358 ".previous\n"
20359 _ASM_EXTABLE(1b, 3b)
20360- : : "r" (from), "r" (to) : "memory");
20361+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20362
20363 from += 64;
20364 to += 64;
20365diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
20366index 69fa106..adda88b 100644
20367--- a/arch/x86/lib/msr-reg.S
20368+++ b/arch/x86/lib/msr-reg.S
20369@@ -3,6 +3,7 @@
20370 #include <asm/dwarf2.h>
20371 #include <asm/asm.h>
20372 #include <asm/msr.h>
20373+#include <asm/alternative-asm.h>
20374
20375 #ifdef CONFIG_X86_64
20376 /*
20377@@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
20378 CFI_STARTPROC
20379 pushq_cfi %rbx
20380 pushq_cfi %rbp
20381- movq %rdi, %r10 /* Save pointer */
20382+ movq %rdi, %r9 /* Save pointer */
20383 xorl %r11d, %r11d /* Return value */
20384 movl (%rdi), %eax
20385 movl 4(%rdi), %ecx
20386@@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
20387 movl 28(%rdi), %edi
20388 CFI_REMEMBER_STATE
20389 1: \op
20390-2: movl %eax, (%r10)
20391+2: movl %eax, (%r9)
20392 movl %r11d, %eax /* Return value */
20393- movl %ecx, 4(%r10)
20394- movl %edx, 8(%r10)
20395- movl %ebx, 12(%r10)
20396- movl %ebp, 20(%r10)
20397- movl %esi, 24(%r10)
20398- movl %edi, 28(%r10)
20399+ movl %ecx, 4(%r9)
20400+ movl %edx, 8(%r9)
20401+ movl %ebx, 12(%r9)
20402+ movl %ebp, 20(%r9)
20403+ movl %esi, 24(%r9)
20404+ movl %edi, 28(%r9)
20405 popq_cfi %rbp
20406 popq_cfi %rbx
20407+ pax_force_retaddr
20408 ret
20409 3:
20410 CFI_RESTORE_STATE
20411diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
20412index 36b0d15..d381858 100644
20413--- a/arch/x86/lib/putuser.S
20414+++ b/arch/x86/lib/putuser.S
20415@@ -15,7 +15,9 @@
20416 #include <asm/thread_info.h>
20417 #include <asm/errno.h>
20418 #include <asm/asm.h>
20419-
20420+#include <asm/segment.h>
20421+#include <asm/pgtable.h>
20422+#include <asm/alternative-asm.h>
20423
20424 /*
20425 * __put_user_X
20426@@ -29,52 +31,119 @@
20427 * as they get called from within inline assembly.
20428 */
20429
20430-#define ENTER CFI_STARTPROC ; \
20431- GET_THREAD_INFO(%_ASM_BX)
20432-#define EXIT ret ; \
20433+#define ENTER CFI_STARTPROC
20434+#define EXIT pax_force_retaddr; ret ; \
20435 CFI_ENDPROC
20436
20437+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20438+#define _DEST %_ASM_CX,%_ASM_BX
20439+#else
20440+#define _DEST %_ASM_CX
20441+#endif
20442+
20443+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20444+#define __copyuser_seg gs;
20445+#else
20446+#define __copyuser_seg
20447+#endif
20448+
20449 .text
20450 ENTRY(__put_user_1)
20451 ENTER
20452+
20453+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20454+ GET_THREAD_INFO(%_ASM_BX)
20455 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20456 jae bad_put_user
20457-1: movb %al,(%_ASM_CX)
20458+
20459+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20460+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20461+ cmp %_ASM_BX,%_ASM_CX
20462+ jb 1234f
20463+ xor %ebx,%ebx
20464+1234:
20465+#endif
20466+
20467+#endif
20468+
20469+1: __copyuser_seg movb %al,(_DEST)
20470 xor %eax,%eax
20471 EXIT
20472 ENDPROC(__put_user_1)
20473
20474 ENTRY(__put_user_2)
20475 ENTER
20476+
20477+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20478+ GET_THREAD_INFO(%_ASM_BX)
20479 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20480 sub $1,%_ASM_BX
20481 cmp %_ASM_BX,%_ASM_CX
20482 jae bad_put_user
20483-2: movw %ax,(%_ASM_CX)
20484+
20485+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20486+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20487+ cmp %_ASM_BX,%_ASM_CX
20488+ jb 1234f
20489+ xor %ebx,%ebx
20490+1234:
20491+#endif
20492+
20493+#endif
20494+
20495+2: __copyuser_seg movw %ax,(_DEST)
20496 xor %eax,%eax
20497 EXIT
20498 ENDPROC(__put_user_2)
20499
20500 ENTRY(__put_user_4)
20501 ENTER
20502+
20503+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20504+ GET_THREAD_INFO(%_ASM_BX)
20505 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20506 sub $3,%_ASM_BX
20507 cmp %_ASM_BX,%_ASM_CX
20508 jae bad_put_user
20509-3: movl %eax,(%_ASM_CX)
20510+
20511+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20512+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20513+ cmp %_ASM_BX,%_ASM_CX
20514+ jb 1234f
20515+ xor %ebx,%ebx
20516+1234:
20517+#endif
20518+
20519+#endif
20520+
20521+3: __copyuser_seg movl %eax,(_DEST)
20522 xor %eax,%eax
20523 EXIT
20524 ENDPROC(__put_user_4)
20525
20526 ENTRY(__put_user_8)
20527 ENTER
20528+
20529+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20530+ GET_THREAD_INFO(%_ASM_BX)
20531 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20532 sub $7,%_ASM_BX
20533 cmp %_ASM_BX,%_ASM_CX
20534 jae bad_put_user
20535-4: mov %_ASM_AX,(%_ASM_CX)
20536+
20537+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20538+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20539+ cmp %_ASM_BX,%_ASM_CX
20540+ jb 1234f
20541+ xor %ebx,%ebx
20542+1234:
20543+#endif
20544+
20545+#endif
20546+
20547+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20548 #ifdef CONFIG_X86_32
20549-5: movl %edx,4(%_ASM_CX)
20550+5: __copyuser_seg movl %edx,4(_DEST)
20551 #endif
20552 xor %eax,%eax
20553 EXIT
20554diff --git a/arch/x86/lib/rwlock.S b/arch/x86/lib/rwlock.S
20555index 1cad221..de671ee 100644
20556--- a/arch/x86/lib/rwlock.S
20557+++ b/arch/x86/lib/rwlock.S
20558@@ -16,13 +16,34 @@ ENTRY(__write_lock_failed)
20559 FRAME
20560 0: LOCK_PREFIX
20561 WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20562+
20563+#ifdef CONFIG_PAX_REFCOUNT
20564+ jno 1234f
20565+ LOCK_PREFIX
20566+ WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20567+ int $4
20568+1234:
20569+ _ASM_EXTABLE(1234b, 1234b)
20570+#endif
20571+
20572 1: rep; nop
20573 cmpl $WRITE_LOCK_CMP, (%__lock_ptr)
20574 jne 1b
20575 LOCK_PREFIX
20576 WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20577+
20578+#ifdef CONFIG_PAX_REFCOUNT
20579+ jno 1234f
20580+ LOCK_PREFIX
20581+ WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20582+ int $4
20583+1234:
20584+ _ASM_EXTABLE(1234b, 1234b)
20585+#endif
20586+
20587 jnz 0b
20588 ENDFRAME
20589+ pax_force_retaddr
20590 ret
20591 CFI_ENDPROC
20592 END(__write_lock_failed)
20593@@ -32,13 +53,34 @@ ENTRY(__read_lock_failed)
20594 FRAME
20595 0: LOCK_PREFIX
20596 READ_LOCK_SIZE(inc) (%__lock_ptr)
20597+
20598+#ifdef CONFIG_PAX_REFCOUNT
20599+ jno 1234f
20600+ LOCK_PREFIX
20601+ READ_LOCK_SIZE(dec) (%__lock_ptr)
20602+ int $4
20603+1234:
20604+ _ASM_EXTABLE(1234b, 1234b)
20605+#endif
20606+
20607 1: rep; nop
20608 READ_LOCK_SIZE(cmp) $1, (%__lock_ptr)
20609 js 1b
20610 LOCK_PREFIX
20611 READ_LOCK_SIZE(dec) (%__lock_ptr)
20612+
20613+#ifdef CONFIG_PAX_REFCOUNT
20614+ jno 1234f
20615+ LOCK_PREFIX
20616+ READ_LOCK_SIZE(inc) (%__lock_ptr)
20617+ int $4
20618+1234:
20619+ _ASM_EXTABLE(1234b, 1234b)
20620+#endif
20621+
20622 js 0b
20623 ENDFRAME
20624+ pax_force_retaddr
20625 ret
20626 CFI_ENDPROC
20627 END(__read_lock_failed)
20628diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
20629index 5dff5f0..cadebf4 100644
20630--- a/arch/x86/lib/rwsem.S
20631+++ b/arch/x86/lib/rwsem.S
20632@@ -94,6 +94,7 @@ ENTRY(call_rwsem_down_read_failed)
20633 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20634 CFI_RESTORE __ASM_REG(dx)
20635 restore_common_regs
20636+ pax_force_retaddr
20637 ret
20638 CFI_ENDPROC
20639 ENDPROC(call_rwsem_down_read_failed)
20640@@ -104,6 +105,7 @@ ENTRY(call_rwsem_down_write_failed)
20641 movq %rax,%rdi
20642 call rwsem_down_write_failed
20643 restore_common_regs
20644+ pax_force_retaddr
20645 ret
20646 CFI_ENDPROC
20647 ENDPROC(call_rwsem_down_write_failed)
20648@@ -117,7 +119,8 @@ ENTRY(call_rwsem_wake)
20649 movq %rax,%rdi
20650 call rwsem_wake
20651 restore_common_regs
20652-1: ret
20653+1: pax_force_retaddr
20654+ ret
20655 CFI_ENDPROC
20656 ENDPROC(call_rwsem_wake)
20657
20658@@ -131,6 +134,7 @@ ENTRY(call_rwsem_downgrade_wake)
20659 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20660 CFI_RESTORE __ASM_REG(dx)
20661 restore_common_regs
20662+ pax_force_retaddr
20663 ret
20664 CFI_ENDPROC
20665 ENDPROC(call_rwsem_downgrade_wake)
20666diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
20667index a63efd6..ccecad8 100644
20668--- a/arch/x86/lib/thunk_64.S
20669+++ b/arch/x86/lib/thunk_64.S
20670@@ -8,6 +8,7 @@
20671 #include <linux/linkage.h>
20672 #include <asm/dwarf2.h>
20673 #include <asm/calling.h>
20674+#include <asm/alternative-asm.h>
20675
20676 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
20677 .macro THUNK name, func, put_ret_addr_in_rdi=0
20678@@ -41,5 +42,6 @@
20679 SAVE_ARGS
20680 restore:
20681 RESTORE_ARGS
20682+ pax_force_retaddr
20683 ret
20684 CFI_ENDPROC
20685diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
20686index e218d5d..35679b4 100644
20687--- a/arch/x86/lib/usercopy_32.c
20688+++ b/arch/x86/lib/usercopy_32.c
20689@@ -43,7 +43,7 @@ do { \
20690 __asm__ __volatile__( \
20691 " testl %1,%1\n" \
20692 " jz 2f\n" \
20693- "0: lodsb\n" \
20694+ "0: "__copyuser_seg"lodsb\n" \
20695 " stosb\n" \
20696 " testb %%al,%%al\n" \
20697 " jz 1f\n" \
20698@@ -128,10 +128,12 @@ do { \
20699 int __d0; \
20700 might_fault(); \
20701 __asm__ __volatile__( \
20702+ __COPYUSER_SET_ES \
20703 "0: rep; stosl\n" \
20704 " movl %2,%0\n" \
20705 "1: rep; stosb\n" \
20706 "2:\n" \
20707+ __COPYUSER_RESTORE_ES \
20708 ".section .fixup,\"ax\"\n" \
20709 "3: lea 0(%2,%0,4),%0\n" \
20710 " jmp 2b\n" \
20711@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
20712 might_fault();
20713
20714 __asm__ __volatile__(
20715+ __COPYUSER_SET_ES
20716 " testl %0, %0\n"
20717 " jz 3f\n"
20718 " andl %0,%%ecx\n"
20719@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, long n)
20720 " subl %%ecx,%0\n"
20721 " addl %0,%%eax\n"
20722 "1:\n"
20723+ __COPYUSER_RESTORE_ES
20724 ".section .fixup,\"ax\"\n"
20725 "2: xorl %%eax,%%eax\n"
20726 " jmp 1b\n"
20727@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20728
20729 #ifdef CONFIG_X86_INTEL_USERCOPY
20730 static unsigned long
20731-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20732+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20733 {
20734 int d0, d1;
20735 __asm__ __volatile__(
20736@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20737 " .align 2,0x90\n"
20738 "3: movl 0(%4), %%eax\n"
20739 "4: movl 4(%4), %%edx\n"
20740- "5: movl %%eax, 0(%3)\n"
20741- "6: movl %%edx, 4(%3)\n"
20742+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20743+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20744 "7: movl 8(%4), %%eax\n"
20745 "8: movl 12(%4),%%edx\n"
20746- "9: movl %%eax, 8(%3)\n"
20747- "10: movl %%edx, 12(%3)\n"
20748+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20749+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20750 "11: movl 16(%4), %%eax\n"
20751 "12: movl 20(%4), %%edx\n"
20752- "13: movl %%eax, 16(%3)\n"
20753- "14: movl %%edx, 20(%3)\n"
20754+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20755+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20756 "15: movl 24(%4), %%eax\n"
20757 "16: movl 28(%4), %%edx\n"
20758- "17: movl %%eax, 24(%3)\n"
20759- "18: movl %%edx, 28(%3)\n"
20760+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20761+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20762 "19: movl 32(%4), %%eax\n"
20763 "20: movl 36(%4), %%edx\n"
20764- "21: movl %%eax, 32(%3)\n"
20765- "22: movl %%edx, 36(%3)\n"
20766+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20767+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20768 "23: movl 40(%4), %%eax\n"
20769 "24: movl 44(%4), %%edx\n"
20770- "25: movl %%eax, 40(%3)\n"
20771- "26: movl %%edx, 44(%3)\n"
20772+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20773+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20774 "27: movl 48(%4), %%eax\n"
20775 "28: movl 52(%4), %%edx\n"
20776- "29: movl %%eax, 48(%3)\n"
20777- "30: movl %%edx, 52(%3)\n"
20778+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20779+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20780 "31: movl 56(%4), %%eax\n"
20781 "32: movl 60(%4), %%edx\n"
20782- "33: movl %%eax, 56(%3)\n"
20783- "34: movl %%edx, 60(%3)\n"
20784+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20785+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20786 " addl $-64, %0\n"
20787 " addl $64, %4\n"
20788 " addl $64, %3\n"
20789@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20790 " shrl $2, %0\n"
20791 " andl $3, %%eax\n"
20792 " cld\n"
20793+ __COPYUSER_SET_ES
20794 "99: rep; movsl\n"
20795 "36: movl %%eax, %0\n"
20796 "37: rep; movsb\n"
20797 "100:\n"
20798+ __COPYUSER_RESTORE_ES
20799+ ".section .fixup,\"ax\"\n"
20800+ "101: lea 0(%%eax,%0,4),%0\n"
20801+ " jmp 100b\n"
20802+ ".previous\n"
20803+ ".section __ex_table,\"a\"\n"
20804+ " .align 4\n"
20805+ " .long 1b,100b\n"
20806+ " .long 2b,100b\n"
20807+ " .long 3b,100b\n"
20808+ " .long 4b,100b\n"
20809+ " .long 5b,100b\n"
20810+ " .long 6b,100b\n"
20811+ " .long 7b,100b\n"
20812+ " .long 8b,100b\n"
20813+ " .long 9b,100b\n"
20814+ " .long 10b,100b\n"
20815+ " .long 11b,100b\n"
20816+ " .long 12b,100b\n"
20817+ " .long 13b,100b\n"
20818+ " .long 14b,100b\n"
20819+ " .long 15b,100b\n"
20820+ " .long 16b,100b\n"
20821+ " .long 17b,100b\n"
20822+ " .long 18b,100b\n"
20823+ " .long 19b,100b\n"
20824+ " .long 20b,100b\n"
20825+ " .long 21b,100b\n"
20826+ " .long 22b,100b\n"
20827+ " .long 23b,100b\n"
20828+ " .long 24b,100b\n"
20829+ " .long 25b,100b\n"
20830+ " .long 26b,100b\n"
20831+ " .long 27b,100b\n"
20832+ " .long 28b,100b\n"
20833+ " .long 29b,100b\n"
20834+ " .long 30b,100b\n"
20835+ " .long 31b,100b\n"
20836+ " .long 32b,100b\n"
20837+ " .long 33b,100b\n"
20838+ " .long 34b,100b\n"
20839+ " .long 35b,100b\n"
20840+ " .long 36b,100b\n"
20841+ " .long 37b,100b\n"
20842+ " .long 99b,101b\n"
20843+ ".previous"
20844+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20845+ : "1"(to), "2"(from), "0"(size)
20846+ : "eax", "edx", "memory");
20847+ return size;
20848+}
20849+
20850+static unsigned long
20851+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20852+{
20853+ int d0, d1;
20854+ __asm__ __volatile__(
20855+ " .align 2,0x90\n"
20856+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20857+ " cmpl $67, %0\n"
20858+ " jbe 3f\n"
20859+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20860+ " .align 2,0x90\n"
20861+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20862+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20863+ "5: movl %%eax, 0(%3)\n"
20864+ "6: movl %%edx, 4(%3)\n"
20865+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20866+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20867+ "9: movl %%eax, 8(%3)\n"
20868+ "10: movl %%edx, 12(%3)\n"
20869+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20870+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20871+ "13: movl %%eax, 16(%3)\n"
20872+ "14: movl %%edx, 20(%3)\n"
20873+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20874+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20875+ "17: movl %%eax, 24(%3)\n"
20876+ "18: movl %%edx, 28(%3)\n"
20877+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20878+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20879+ "21: movl %%eax, 32(%3)\n"
20880+ "22: movl %%edx, 36(%3)\n"
20881+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20882+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20883+ "25: movl %%eax, 40(%3)\n"
20884+ "26: movl %%edx, 44(%3)\n"
20885+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20886+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20887+ "29: movl %%eax, 48(%3)\n"
20888+ "30: movl %%edx, 52(%3)\n"
20889+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20890+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20891+ "33: movl %%eax, 56(%3)\n"
20892+ "34: movl %%edx, 60(%3)\n"
20893+ " addl $-64, %0\n"
20894+ " addl $64, %4\n"
20895+ " addl $64, %3\n"
20896+ " cmpl $63, %0\n"
20897+ " ja 1b\n"
20898+ "35: movl %0, %%eax\n"
20899+ " shrl $2, %0\n"
20900+ " andl $3, %%eax\n"
20901+ " cld\n"
20902+ "99: rep; "__copyuser_seg" movsl\n"
20903+ "36: movl %%eax, %0\n"
20904+ "37: rep; "__copyuser_seg" movsb\n"
20905+ "100:\n"
20906 ".section .fixup,\"ax\"\n"
20907 "101: lea 0(%%eax,%0,4),%0\n"
20908 " jmp 100b\n"
20909@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20910 int d0, d1;
20911 __asm__ __volatile__(
20912 " .align 2,0x90\n"
20913- "0: movl 32(%4), %%eax\n"
20914+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20915 " cmpl $67, %0\n"
20916 " jbe 2f\n"
20917- "1: movl 64(%4), %%eax\n"
20918+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20919 " .align 2,0x90\n"
20920- "2: movl 0(%4), %%eax\n"
20921- "21: movl 4(%4), %%edx\n"
20922+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20923+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20924 " movl %%eax, 0(%3)\n"
20925 " movl %%edx, 4(%3)\n"
20926- "3: movl 8(%4), %%eax\n"
20927- "31: movl 12(%4),%%edx\n"
20928+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20929+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20930 " movl %%eax, 8(%3)\n"
20931 " movl %%edx, 12(%3)\n"
20932- "4: movl 16(%4), %%eax\n"
20933- "41: movl 20(%4), %%edx\n"
20934+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20935+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20936 " movl %%eax, 16(%3)\n"
20937 " movl %%edx, 20(%3)\n"
20938- "10: movl 24(%4), %%eax\n"
20939- "51: movl 28(%4), %%edx\n"
20940+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20941+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20942 " movl %%eax, 24(%3)\n"
20943 " movl %%edx, 28(%3)\n"
20944- "11: movl 32(%4), %%eax\n"
20945- "61: movl 36(%4), %%edx\n"
20946+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20947+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20948 " movl %%eax, 32(%3)\n"
20949 " movl %%edx, 36(%3)\n"
20950- "12: movl 40(%4), %%eax\n"
20951- "71: movl 44(%4), %%edx\n"
20952+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20953+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20954 " movl %%eax, 40(%3)\n"
20955 " movl %%edx, 44(%3)\n"
20956- "13: movl 48(%4), %%eax\n"
20957- "81: movl 52(%4), %%edx\n"
20958+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20959+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20960 " movl %%eax, 48(%3)\n"
20961 " movl %%edx, 52(%3)\n"
20962- "14: movl 56(%4), %%eax\n"
20963- "91: movl 60(%4), %%edx\n"
20964+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20965+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20966 " movl %%eax, 56(%3)\n"
20967 " movl %%edx, 60(%3)\n"
20968 " addl $-64, %0\n"
20969@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20970 " shrl $2, %0\n"
20971 " andl $3, %%eax\n"
20972 " cld\n"
20973- "6: rep; movsl\n"
20974+ "6: rep; "__copyuser_seg" movsl\n"
20975 " movl %%eax,%0\n"
20976- "7: rep; movsb\n"
20977+ "7: rep; "__copyuser_seg" movsb\n"
20978 "8:\n"
20979 ".section .fixup,\"ax\"\n"
20980 "9: lea 0(%%eax,%0,4),%0\n"
20981@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
20982
20983 __asm__ __volatile__(
20984 " .align 2,0x90\n"
20985- "0: movl 32(%4), %%eax\n"
20986+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20987 " cmpl $67, %0\n"
20988 " jbe 2f\n"
20989- "1: movl 64(%4), %%eax\n"
20990+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20991 " .align 2,0x90\n"
20992- "2: movl 0(%4), %%eax\n"
20993- "21: movl 4(%4), %%edx\n"
20994+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20995+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20996 " movnti %%eax, 0(%3)\n"
20997 " movnti %%edx, 4(%3)\n"
20998- "3: movl 8(%4), %%eax\n"
20999- "31: movl 12(%4),%%edx\n"
21000+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21001+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21002 " movnti %%eax, 8(%3)\n"
21003 " movnti %%edx, 12(%3)\n"
21004- "4: movl 16(%4), %%eax\n"
21005- "41: movl 20(%4), %%edx\n"
21006+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21007+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21008 " movnti %%eax, 16(%3)\n"
21009 " movnti %%edx, 20(%3)\n"
21010- "10: movl 24(%4), %%eax\n"
21011- "51: movl 28(%4), %%edx\n"
21012+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21013+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21014 " movnti %%eax, 24(%3)\n"
21015 " movnti %%edx, 28(%3)\n"
21016- "11: movl 32(%4), %%eax\n"
21017- "61: movl 36(%4), %%edx\n"
21018+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21019+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21020 " movnti %%eax, 32(%3)\n"
21021 " movnti %%edx, 36(%3)\n"
21022- "12: movl 40(%4), %%eax\n"
21023- "71: movl 44(%4), %%edx\n"
21024+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21025+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21026 " movnti %%eax, 40(%3)\n"
21027 " movnti %%edx, 44(%3)\n"
21028- "13: movl 48(%4), %%eax\n"
21029- "81: movl 52(%4), %%edx\n"
21030+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21031+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21032 " movnti %%eax, 48(%3)\n"
21033 " movnti %%edx, 52(%3)\n"
21034- "14: movl 56(%4), %%eax\n"
21035- "91: movl 60(%4), %%edx\n"
21036+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21037+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21038 " movnti %%eax, 56(%3)\n"
21039 " movnti %%edx, 60(%3)\n"
21040 " addl $-64, %0\n"
21041@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
21042 " shrl $2, %0\n"
21043 " andl $3, %%eax\n"
21044 " cld\n"
21045- "6: rep; movsl\n"
21046+ "6: rep; "__copyuser_seg" movsl\n"
21047 " movl %%eax,%0\n"
21048- "7: rep; movsb\n"
21049+ "7: rep; "__copyuser_seg" movsb\n"
21050 "8:\n"
21051 ".section .fixup,\"ax\"\n"
21052 "9: lea 0(%%eax,%0,4),%0\n"
21053@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_nocache(void *to,
21054
21055 __asm__ __volatile__(
21056 " .align 2,0x90\n"
21057- "0: movl 32(%4), %%eax\n"
21058+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21059 " cmpl $67, %0\n"
21060 " jbe 2f\n"
21061- "1: movl 64(%4), %%eax\n"
21062+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21063 " .align 2,0x90\n"
21064- "2: movl 0(%4), %%eax\n"
21065- "21: movl 4(%4), %%edx\n"
21066+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21067+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21068 " movnti %%eax, 0(%3)\n"
21069 " movnti %%edx, 4(%3)\n"
21070- "3: movl 8(%4), %%eax\n"
21071- "31: movl 12(%4),%%edx\n"
21072+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21073+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21074 " movnti %%eax, 8(%3)\n"
21075 " movnti %%edx, 12(%3)\n"
21076- "4: movl 16(%4), %%eax\n"
21077- "41: movl 20(%4), %%edx\n"
21078+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21079+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21080 " movnti %%eax, 16(%3)\n"
21081 " movnti %%edx, 20(%3)\n"
21082- "10: movl 24(%4), %%eax\n"
21083- "51: movl 28(%4), %%edx\n"
21084+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21085+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21086 " movnti %%eax, 24(%3)\n"
21087 " movnti %%edx, 28(%3)\n"
21088- "11: movl 32(%4), %%eax\n"
21089- "61: movl 36(%4), %%edx\n"
21090+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21091+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21092 " movnti %%eax, 32(%3)\n"
21093 " movnti %%edx, 36(%3)\n"
21094- "12: movl 40(%4), %%eax\n"
21095- "71: movl 44(%4), %%edx\n"
21096+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21097+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21098 " movnti %%eax, 40(%3)\n"
21099 " movnti %%edx, 44(%3)\n"
21100- "13: movl 48(%4), %%eax\n"
21101- "81: movl 52(%4), %%edx\n"
21102+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21103+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21104 " movnti %%eax, 48(%3)\n"
21105 " movnti %%edx, 52(%3)\n"
21106- "14: movl 56(%4), %%eax\n"
21107- "91: movl 60(%4), %%edx\n"
21108+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21109+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21110 " movnti %%eax, 56(%3)\n"
21111 " movnti %%edx, 60(%3)\n"
21112 " addl $-64, %0\n"
21113@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
21114 " shrl $2, %0\n"
21115 " andl $3, %%eax\n"
21116 " cld\n"
21117- "6: rep; movsl\n"
21118+ "6: rep; "__copyuser_seg" movsl\n"
21119 " movl %%eax,%0\n"
21120- "7: rep; movsb\n"
21121+ "7: rep; "__copyuser_seg" movsb\n"
21122 "8:\n"
21123 ".section .fixup,\"ax\"\n"
21124 "9: lea 0(%%eax,%0,4),%0\n"
21125@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
21126 */
21127 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
21128 unsigned long size);
21129-unsigned long __copy_user_intel(void __user *to, const void *from,
21130+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
21131+ unsigned long size);
21132+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
21133 unsigned long size);
21134 unsigned long __copy_user_zeroing_intel_nocache(void *to,
21135 const void __user *from, unsigned long size);
21136 #endif /* CONFIG_X86_INTEL_USERCOPY */
21137
21138 /* Generic arbitrary sized copy. */
21139-#define __copy_user(to, from, size) \
21140+#define __copy_user(to, from, size, prefix, set, restore) \
21141 do { \
21142 int __d0, __d1, __d2; \
21143 __asm__ __volatile__( \
21144+ set \
21145 " cmp $7,%0\n" \
21146 " jbe 1f\n" \
21147 " movl %1,%0\n" \
21148 " negl %0\n" \
21149 " andl $7,%0\n" \
21150 " subl %0,%3\n" \
21151- "4: rep; movsb\n" \
21152+ "4: rep; "prefix"movsb\n" \
21153 " movl %3,%0\n" \
21154 " shrl $2,%0\n" \
21155 " andl $3,%3\n" \
21156 " .align 2,0x90\n" \
21157- "0: rep; movsl\n" \
21158+ "0: rep; "prefix"movsl\n" \
21159 " movl %3,%0\n" \
21160- "1: rep; movsb\n" \
21161+ "1: rep; "prefix"movsb\n" \
21162 "2:\n" \
21163+ restore \
21164 ".section .fixup,\"ax\"\n" \
21165 "5: addl %3,%0\n" \
21166 " jmp 2b\n" \
21167@@ -682,14 +799,14 @@ do { \
21168 " negl %0\n" \
21169 " andl $7,%0\n" \
21170 " subl %0,%3\n" \
21171- "4: rep; movsb\n" \
21172+ "4: rep; "__copyuser_seg"movsb\n" \
21173 " movl %3,%0\n" \
21174 " shrl $2,%0\n" \
21175 " andl $3,%3\n" \
21176 " .align 2,0x90\n" \
21177- "0: rep; movsl\n" \
21178+ "0: rep; "__copyuser_seg"movsl\n" \
21179 " movl %3,%0\n" \
21180- "1: rep; movsb\n" \
21181+ "1: rep; "__copyuser_seg"movsb\n" \
21182 "2:\n" \
21183 ".section .fixup,\"ax\"\n" \
21184 "5: addl %3,%0\n" \
21185@@ -775,9 +892,9 @@ survive:
21186 }
21187 #endif
21188 if (movsl_is_ok(to, from, n))
21189- __copy_user(to, from, n);
21190+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
21191 else
21192- n = __copy_user_intel(to, from, n);
21193+ n = __generic_copy_to_user_intel(to, from, n);
21194 return n;
21195 }
21196 EXPORT_SYMBOL(__copy_to_user_ll);
21197@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
21198 unsigned long n)
21199 {
21200 if (movsl_is_ok(to, from, n))
21201- __copy_user(to, from, n);
21202+ __copy_user(to, from, n, __copyuser_seg, "", "");
21203 else
21204- n = __copy_user_intel((void __user *)to,
21205- (const void *)from, n);
21206+ n = __generic_copy_from_user_intel(to, from, n);
21207 return n;
21208 }
21209 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
21210@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
21211 if (n > 64 && cpu_has_xmm2)
21212 n = __copy_user_intel_nocache(to, from, n);
21213 else
21214- __copy_user(to, from, n);
21215+ __copy_user(to, from, n, __copyuser_seg, "", "");
21216 #else
21217- __copy_user(to, from, n);
21218+ __copy_user(to, from, n, __copyuser_seg, "", "");
21219 #endif
21220 return n;
21221 }
21222 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
21223
21224-/**
21225- * copy_to_user: - Copy a block of data into user space.
21226- * @to: Destination address, in user space.
21227- * @from: Source address, in kernel space.
21228- * @n: Number of bytes to copy.
21229- *
21230- * Context: User context only. This function may sleep.
21231- *
21232- * Copy data from kernel space to user space.
21233- *
21234- * Returns number of bytes that could not be copied.
21235- * On success, this will be zero.
21236- */
21237-unsigned long
21238-copy_to_user(void __user *to, const void *from, unsigned long n)
21239-{
21240- if (access_ok(VERIFY_WRITE, to, n))
21241- n = __copy_to_user(to, from, n);
21242- return n;
21243-}
21244-EXPORT_SYMBOL(copy_to_user);
21245-
21246-/**
21247- * copy_from_user: - Copy a block of data from user space.
21248- * @to: Destination address, in kernel space.
21249- * @from: Source address, in user space.
21250- * @n: Number of bytes to copy.
21251- *
21252- * Context: User context only. This function may sleep.
21253- *
21254- * Copy data from user space to kernel space.
21255- *
21256- * Returns number of bytes that could not be copied.
21257- * On success, this will be zero.
21258- *
21259- * If some data could not be copied, this function will pad the copied
21260- * data to the requested size using zero bytes.
21261- */
21262-unsigned long
21263-_copy_from_user(void *to, const void __user *from, unsigned long n)
21264-{
21265- if (access_ok(VERIFY_READ, from, n))
21266- n = __copy_from_user(to, from, n);
21267- else
21268- memset(to, 0, n);
21269- return n;
21270-}
21271-EXPORT_SYMBOL(_copy_from_user);
21272-
21273 void copy_from_user_overflow(void)
21274 {
21275 WARN(1, "Buffer overflow detected!\n");
21276 }
21277 EXPORT_SYMBOL(copy_from_user_overflow);
21278+
21279+void copy_to_user_overflow(void)
21280+{
21281+ WARN(1, "Buffer overflow detected!\n");
21282+}
21283+EXPORT_SYMBOL(copy_to_user_overflow);
21284+
21285+#ifdef CONFIG_PAX_MEMORY_UDEREF
21286+void __set_fs(mm_segment_t x)
21287+{
21288+ switch (x.seg) {
21289+ case 0:
21290+ loadsegment(gs, 0);
21291+ break;
21292+ case TASK_SIZE_MAX:
21293+ loadsegment(gs, __USER_DS);
21294+ break;
21295+ case -1UL:
21296+ loadsegment(gs, __KERNEL_DS);
21297+ break;
21298+ default:
21299+ BUG();
21300+ }
21301+ return;
21302+}
21303+EXPORT_SYMBOL(__set_fs);
21304+
21305+void set_fs(mm_segment_t x)
21306+{
21307+ current_thread_info()->addr_limit = x;
21308+ __set_fs(x);
21309+}
21310+EXPORT_SYMBOL(set_fs);
21311+#endif
21312diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
21313index b7c2849..8633ad8 100644
21314--- a/arch/x86/lib/usercopy_64.c
21315+++ b/arch/x86/lib/usercopy_64.c
21316@@ -42,6 +42,12 @@ long
21317 __strncpy_from_user(char *dst, const char __user *src, long count)
21318 {
21319 long res;
21320+
21321+#ifdef CONFIG_PAX_MEMORY_UDEREF
21322+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21323+ src += PAX_USER_SHADOW_BASE;
21324+#endif
21325+
21326 __do_strncpy_from_user(dst, src, count, res);
21327 return res;
21328 }
21329@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
21330 {
21331 long __d0;
21332 might_fault();
21333+
21334+#ifdef CONFIG_PAX_MEMORY_UDEREF
21335+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
21336+ addr += PAX_USER_SHADOW_BASE;
21337+#endif
21338+
21339 /* no memory constraint because it doesn't change any memory gcc knows
21340 about */
21341 asm volatile(
21342@@ -149,12 +161,20 @@ long strlen_user(const char __user *s)
21343 }
21344 EXPORT_SYMBOL(strlen_user);
21345
21346-unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
21347+unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
21348 {
21349- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21350- return copy_user_generic((__force void *)to, (__force void *)from, len);
21351- }
21352- return len;
21353+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21354+
21355+#ifdef CONFIG_PAX_MEMORY_UDEREF
21356+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
21357+ to += PAX_USER_SHADOW_BASE;
21358+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
21359+ from += PAX_USER_SHADOW_BASE;
21360+#endif
21361+
21362+ return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
21363+ }
21364+ return len;
21365 }
21366 EXPORT_SYMBOL(copy_in_user);
21367
21368@@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
21369 * it is not necessary to optimize tail handling.
21370 */
21371 unsigned long
21372-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
21373+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
21374 {
21375 char c;
21376 unsigned zero_len;
21377diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
21378index d0474ad..36e9257 100644
21379--- a/arch/x86/mm/extable.c
21380+++ b/arch/x86/mm/extable.c
21381@@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs)
21382 const struct exception_table_entry *fixup;
21383
21384 #ifdef CONFIG_PNPBIOS
21385- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21386+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21387 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21388 extern u32 pnp_bios_is_utter_crap;
21389 pnp_bios_is_utter_crap = 1;
21390diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
21391index 0d17c8c..4f4764f 100644
21392--- a/arch/x86/mm/fault.c
21393+++ b/arch/x86/mm/fault.c
21394@@ -13,11 +13,18 @@
21395 #include <linux/perf_event.h> /* perf_sw_event */
21396 #include <linux/hugetlb.h> /* hstate_index_to_shift */
21397 #include <linux/prefetch.h> /* prefetchw */
21398+#include <linux/unistd.h>
21399+#include <linux/compiler.h>
21400
21401 #include <asm/traps.h> /* dotraplinkage, ... */
21402 #include <asm/pgalloc.h> /* pgd_*(), ... */
21403 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21404 #include <asm/vsyscall.h>
21405+#include <asm/tlbflush.h>
21406+
21407+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21408+#include <asm/stacktrace.h>
21409+#endif
21410
21411 /*
21412 * Page fault error code bits:
21413@@ -55,7 +62,7 @@ static inline int __kprobes notify_page_fault(struct pt_regs *regs)
21414 int ret = 0;
21415
21416 /* kprobe_running() needs smp_processor_id() */
21417- if (kprobes_built_in() && !user_mode_vm(regs)) {
21418+ if (kprobes_built_in() && !user_mode(regs)) {
21419 preempt_disable();
21420 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21421 ret = 1;
21422@@ -116,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
21423 return !instr_lo || (instr_lo>>1) == 1;
21424 case 0x00:
21425 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21426- if (probe_kernel_address(instr, opcode))
21427+ if (user_mode(regs)) {
21428+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21429+ return 0;
21430+ } else if (probe_kernel_address(instr, opcode))
21431 return 0;
21432
21433 *prefetch = (instr_lo == 0xF) &&
21434@@ -150,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
21435 while (instr < max_instr) {
21436 unsigned char opcode;
21437
21438- if (probe_kernel_address(instr, opcode))
21439+ if (user_mode(regs)) {
21440+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21441+ break;
21442+ } else if (probe_kernel_address(instr, opcode))
21443 break;
21444
21445 instr++;
21446@@ -181,6 +194,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
21447 force_sig_info(si_signo, &info, tsk);
21448 }
21449
21450+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21451+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
21452+#endif
21453+
21454+#ifdef CONFIG_PAX_EMUTRAMP
21455+static int pax_handle_fetch_fault(struct pt_regs *regs);
21456+#endif
21457+
21458+#ifdef CONFIG_PAX_PAGEEXEC
21459+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21460+{
21461+ pgd_t *pgd;
21462+ pud_t *pud;
21463+ pmd_t *pmd;
21464+
21465+ pgd = pgd_offset(mm, address);
21466+ if (!pgd_present(*pgd))
21467+ return NULL;
21468+ pud = pud_offset(pgd, address);
21469+ if (!pud_present(*pud))
21470+ return NULL;
21471+ pmd = pmd_offset(pud, address);
21472+ if (!pmd_present(*pmd))
21473+ return NULL;
21474+ return pmd;
21475+}
21476+#endif
21477+
21478 DEFINE_SPINLOCK(pgd_lock);
21479 LIST_HEAD(pgd_list);
21480
21481@@ -231,10 +272,22 @@ void vmalloc_sync_all(void)
21482 for (address = VMALLOC_START & PMD_MASK;
21483 address >= TASK_SIZE && address < FIXADDR_TOP;
21484 address += PMD_SIZE) {
21485+
21486+#ifdef CONFIG_PAX_PER_CPU_PGD
21487+ unsigned long cpu;
21488+#else
21489 struct page *page;
21490+#endif
21491
21492 spin_lock(&pgd_lock);
21493+
21494+#ifdef CONFIG_PAX_PER_CPU_PGD
21495+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21496+ pgd_t *pgd = get_cpu_pgd(cpu);
21497+ pmd_t *ret;
21498+#else
21499 list_for_each_entry(page, &pgd_list, lru) {
21500+ pgd_t *pgd = page_address(page);
21501 spinlock_t *pgt_lock;
21502 pmd_t *ret;
21503
21504@@ -242,8 +295,13 @@ void vmalloc_sync_all(void)
21505 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21506
21507 spin_lock(pgt_lock);
21508- ret = vmalloc_sync_one(page_address(page), address);
21509+#endif
21510+
21511+ ret = vmalloc_sync_one(pgd, address);
21512+
21513+#ifndef CONFIG_PAX_PER_CPU_PGD
21514 spin_unlock(pgt_lock);
21515+#endif
21516
21517 if (!ret)
21518 break;
21519@@ -277,6 +335,11 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21520 * an interrupt in the middle of a task switch..
21521 */
21522 pgd_paddr = read_cr3();
21523+
21524+#ifdef CONFIG_PAX_PER_CPU_PGD
21525+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21526+#endif
21527+
21528 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21529 if (!pmd_k)
21530 return -1;
21531@@ -372,7 +435,14 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21532 * happen within a race in page table update. In the later
21533 * case just flush:
21534 */
21535+
21536+#ifdef CONFIG_PAX_PER_CPU_PGD
21537+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21538+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21539+#else
21540 pgd = pgd_offset(current->active_mm, address);
21541+#endif
21542+
21543 pgd_ref = pgd_offset_k(address);
21544 if (pgd_none(*pgd_ref))
21545 return -1;
21546@@ -534,7 +604,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
21547 static int is_errata100(struct pt_regs *regs, unsigned long address)
21548 {
21549 #ifdef CONFIG_X86_64
21550- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21551+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21552 return 1;
21553 #endif
21554 return 0;
21555@@ -561,7 +631,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
21556 }
21557
21558 static const char nx_warning[] = KERN_CRIT
21559-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21560+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21561
21562 static void
21563 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21564@@ -570,15 +640,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21565 if (!oops_may_print())
21566 return;
21567
21568- if (error_code & PF_INSTR) {
21569+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21570 unsigned int level;
21571
21572 pte_t *pte = lookup_address(address, &level);
21573
21574 if (pte && pte_present(*pte) && !pte_exec(*pte))
21575- printk(nx_warning, current_uid());
21576+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21577 }
21578
21579+#ifdef CONFIG_PAX_KERNEXEC
21580+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21581+ if (current->signal->curr_ip)
21582+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21583+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21584+ else
21585+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21586+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21587+ }
21588+#endif
21589+
21590 printk(KERN_ALERT "BUG: unable to handle kernel ");
21591 if (address < PAGE_SIZE)
21592 printk(KERN_CONT "NULL pointer dereference");
21593@@ -733,6 +814,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
21594 }
21595 #endif
21596
21597+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21598+ if (pax_is_fetch_fault(regs, error_code, address)) {
21599+
21600+#ifdef CONFIG_PAX_EMUTRAMP
21601+ switch (pax_handle_fetch_fault(regs)) {
21602+ case 2:
21603+ return;
21604+ }
21605+#endif
21606+
21607+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21608+ do_group_exit(SIGKILL);
21609+ }
21610+#endif
21611+
21612 if (unlikely(show_unhandled_signals))
21613 show_signal_msg(regs, error_code, address, tsk);
21614
21615@@ -829,7 +925,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
21616 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
21617 printk(KERN_ERR
21618 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
21619- tsk->comm, tsk->pid, address);
21620+ tsk->comm, task_pid_nr(tsk), address);
21621 code = BUS_MCEERR_AR;
21622 }
21623 #endif
21624@@ -884,6 +980,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
21625 return 1;
21626 }
21627
21628+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21629+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21630+{
21631+ pte_t *pte;
21632+ pmd_t *pmd;
21633+ spinlock_t *ptl;
21634+ unsigned char pte_mask;
21635+
21636+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21637+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21638+ return 0;
21639+
21640+ /* PaX: it's our fault, let's handle it if we can */
21641+
21642+ /* PaX: take a look at read faults before acquiring any locks */
21643+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21644+ /* instruction fetch attempt from a protected page in user mode */
21645+ up_read(&mm->mmap_sem);
21646+
21647+#ifdef CONFIG_PAX_EMUTRAMP
21648+ switch (pax_handle_fetch_fault(regs)) {
21649+ case 2:
21650+ return 1;
21651+ }
21652+#endif
21653+
21654+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21655+ do_group_exit(SIGKILL);
21656+ }
21657+
21658+ pmd = pax_get_pmd(mm, address);
21659+ if (unlikely(!pmd))
21660+ return 0;
21661+
21662+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21663+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21664+ pte_unmap_unlock(pte, ptl);
21665+ return 0;
21666+ }
21667+
21668+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21669+ /* write attempt to a protected page in user mode */
21670+ pte_unmap_unlock(pte, ptl);
21671+ return 0;
21672+ }
21673+
21674+#ifdef CONFIG_SMP
21675+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21676+#else
21677+ if (likely(address > get_limit(regs->cs)))
21678+#endif
21679+ {
21680+ set_pte(pte, pte_mkread(*pte));
21681+ __flush_tlb_one(address);
21682+ pte_unmap_unlock(pte, ptl);
21683+ up_read(&mm->mmap_sem);
21684+ return 1;
21685+ }
21686+
21687+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21688+
21689+ /*
21690+ * PaX: fill DTLB with user rights and retry
21691+ */
21692+ __asm__ __volatile__ (
21693+ "orb %2,(%1)\n"
21694+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21695+/*
21696+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21697+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21698+ * page fault when examined during a TLB load attempt. this is true not only
21699+ * for PTEs holding a non-present entry but also present entries that will
21700+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21701+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21702+ * for our target pages since their PTEs are simply not in the TLBs at all.
21703+
21704+ * the best thing in omitting it is that we gain around 15-20% speed in the
21705+ * fast path of the page fault handler and can get rid of tracing since we
21706+ * can no longer flush unintended entries.
21707+ */
21708+ "invlpg (%0)\n"
21709+#endif
21710+ __copyuser_seg"testb $0,(%0)\n"
21711+ "xorb %3,(%1)\n"
21712+ :
21713+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21714+ : "memory", "cc");
21715+ pte_unmap_unlock(pte, ptl);
21716+ up_read(&mm->mmap_sem);
21717+ return 1;
21718+}
21719+#endif
21720+
21721 /*
21722 * Handle a spurious fault caused by a stale TLB entry.
21723 *
21724@@ -956,6 +1145,9 @@ int show_unhandled_signals = 1;
21725 static inline int
21726 access_error(unsigned long error_code, struct vm_area_struct *vma)
21727 {
21728+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21729+ return 1;
21730+
21731 if (error_code & PF_WRITE) {
21732 /* write, present and write, not present: */
21733 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21734@@ -989,18 +1181,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21735 {
21736 struct vm_area_struct *vma;
21737 struct task_struct *tsk;
21738- unsigned long address;
21739 struct mm_struct *mm;
21740 int fault;
21741 int write = error_code & PF_WRITE;
21742 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
21743 (write ? FAULT_FLAG_WRITE : 0);
21744
21745- tsk = current;
21746- mm = tsk->mm;
21747-
21748 /* Get the faulting address: */
21749- address = read_cr2();
21750+ unsigned long address = read_cr2();
21751+
21752+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21753+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21754+ if (!search_exception_tables(regs->ip)) {
21755+ bad_area_nosemaphore(regs, error_code, address);
21756+ return;
21757+ }
21758+ if (address < PAX_USER_SHADOW_BASE) {
21759+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21760+ printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
21761+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21762+ } else
21763+ address -= PAX_USER_SHADOW_BASE;
21764+ }
21765+#endif
21766+
21767+ tsk = current;
21768+ mm = tsk->mm;
21769
21770 /*
21771 * Detect and handle instructions that would cause a page fault for
21772@@ -1061,7 +1267,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21773 * User-mode registers count as a user access even for any
21774 * potential system fault or CPU buglet:
21775 */
21776- if (user_mode_vm(regs)) {
21777+ if (user_mode(regs)) {
21778 local_irq_enable();
21779 error_code |= PF_USER;
21780 } else {
21781@@ -1116,6 +1322,11 @@ retry:
21782 might_sleep();
21783 }
21784
21785+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21786+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21787+ return;
21788+#endif
21789+
21790 vma = find_vma(mm, address);
21791 if (unlikely(!vma)) {
21792 bad_area(regs, error_code, address);
21793@@ -1127,18 +1338,24 @@ retry:
21794 bad_area(regs, error_code, address);
21795 return;
21796 }
21797- if (error_code & PF_USER) {
21798- /*
21799- * Accessing the stack below %sp is always a bug.
21800- * The large cushion allows instructions like enter
21801- * and pusha to work. ("enter $65535, $31" pushes
21802- * 32 pointers and then decrements %sp by 65535.)
21803- */
21804- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21805- bad_area(regs, error_code, address);
21806- return;
21807- }
21808+ /*
21809+ * Accessing the stack below %sp is always a bug.
21810+ * The large cushion allows instructions like enter
21811+ * and pusha to work. ("enter $65535, $31" pushes
21812+ * 32 pointers and then decrements %sp by 65535.)
21813+ */
21814+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21815+ bad_area(regs, error_code, address);
21816+ return;
21817 }
21818+
21819+#ifdef CONFIG_PAX_SEGMEXEC
21820+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21821+ bad_area(regs, error_code, address);
21822+ return;
21823+ }
21824+#endif
21825+
21826 if (unlikely(expand_stack(vma, address))) {
21827 bad_area(regs, error_code, address);
21828 return;
21829@@ -1193,3 +1410,240 @@ good_area:
21830
21831 up_read(&mm->mmap_sem);
21832 }
21833+
21834+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21835+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
21836+{
21837+ struct mm_struct *mm = current->mm;
21838+ unsigned long ip = regs->ip;
21839+
21840+ if (v8086_mode(regs))
21841+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21842+
21843+#ifdef CONFIG_PAX_PAGEEXEC
21844+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
21845+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
21846+ return true;
21847+ if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
21848+ return true;
21849+ return false;
21850+ }
21851+#endif
21852+
21853+#ifdef CONFIG_PAX_SEGMEXEC
21854+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
21855+ if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
21856+ return true;
21857+ return false;
21858+ }
21859+#endif
21860+
21861+ return false;
21862+}
21863+#endif
21864+
21865+#ifdef CONFIG_PAX_EMUTRAMP
21866+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21867+{
21868+ int err;
21869+
21870+ do { /* PaX: gcc trampoline emulation #1 */
21871+ unsigned char mov1, mov2;
21872+ unsigned short jmp;
21873+ unsigned int addr1, addr2;
21874+
21875+#ifdef CONFIG_X86_64
21876+ if ((regs->ip + 11) >> 32)
21877+ break;
21878+#endif
21879+
21880+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21881+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21882+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21883+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21884+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21885+
21886+ if (err)
21887+ break;
21888+
21889+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21890+ regs->cx = addr1;
21891+ regs->ax = addr2;
21892+ regs->ip = addr2;
21893+ return 2;
21894+ }
21895+ } while (0);
21896+
21897+ do { /* PaX: gcc trampoline emulation #2 */
21898+ unsigned char mov, jmp;
21899+ unsigned int addr1, addr2;
21900+
21901+#ifdef CONFIG_X86_64
21902+ if ((regs->ip + 9) >> 32)
21903+ break;
21904+#endif
21905+
21906+ err = get_user(mov, (unsigned char __user *)regs->ip);
21907+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21908+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21909+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21910+
21911+ if (err)
21912+ break;
21913+
21914+ if (mov == 0xB9 && jmp == 0xE9) {
21915+ regs->cx = addr1;
21916+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21917+ return 2;
21918+ }
21919+ } while (0);
21920+
21921+ return 1; /* PaX in action */
21922+}
21923+
21924+#ifdef CONFIG_X86_64
21925+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21926+{
21927+ int err;
21928+
21929+ do { /* PaX: gcc trampoline emulation #1 */
21930+ unsigned short mov1, mov2, jmp1;
21931+ unsigned char jmp2;
21932+ unsigned int addr1;
21933+ unsigned long addr2;
21934+
21935+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21936+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21937+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21938+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21939+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21940+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21941+
21942+ if (err)
21943+ break;
21944+
21945+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21946+ regs->r11 = addr1;
21947+ regs->r10 = addr2;
21948+ regs->ip = addr1;
21949+ return 2;
21950+ }
21951+ } while (0);
21952+
21953+ do { /* PaX: gcc trampoline emulation #2 */
21954+ unsigned short mov1, mov2, jmp1;
21955+ unsigned char jmp2;
21956+ unsigned long addr1, addr2;
21957+
21958+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21959+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21960+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21961+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21962+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21963+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21964+
21965+ if (err)
21966+ break;
21967+
21968+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21969+ regs->r11 = addr1;
21970+ regs->r10 = addr2;
21971+ regs->ip = addr1;
21972+ return 2;
21973+ }
21974+ } while (0);
21975+
21976+ return 1; /* PaX in action */
21977+}
21978+#endif
21979+
21980+/*
21981+ * PaX: decide what to do with offenders (regs->ip = fault address)
21982+ *
21983+ * returns 1 when task should be killed
21984+ * 2 when gcc trampoline was detected
21985+ */
21986+static int pax_handle_fetch_fault(struct pt_regs *regs)
21987+{
21988+ if (v8086_mode(regs))
21989+ return 1;
21990+
21991+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21992+ return 1;
21993+
21994+#ifdef CONFIG_X86_32
21995+ return pax_handle_fetch_fault_32(regs);
21996+#else
21997+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21998+ return pax_handle_fetch_fault_32(regs);
21999+ else
22000+ return pax_handle_fetch_fault_64(regs);
22001+#endif
22002+}
22003+#endif
22004+
22005+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22006+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
22007+{
22008+ long i;
22009+
22010+ printk(KERN_ERR "PAX: bytes at PC: ");
22011+ for (i = 0; i < 20; i++) {
22012+ unsigned char c;
22013+ if (get_user(c, (unsigned char __force_user *)pc+i))
22014+ printk(KERN_CONT "?? ");
22015+ else
22016+ printk(KERN_CONT "%02x ", c);
22017+ }
22018+ printk("\n");
22019+
22020+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
22021+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
22022+ unsigned long c;
22023+ if (get_user(c, (unsigned long __force_user *)sp+i)) {
22024+#ifdef CONFIG_X86_32
22025+ printk(KERN_CONT "???????? ");
22026+#else
22027+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
22028+ printk(KERN_CONT "???????? ???????? ");
22029+ else
22030+ printk(KERN_CONT "???????????????? ");
22031+#endif
22032+ } else {
22033+#ifdef CONFIG_X86_64
22034+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
22035+ printk(KERN_CONT "%08x ", (unsigned int)c);
22036+ printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
22037+ } else
22038+#endif
22039+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
22040+ }
22041+ }
22042+ printk("\n");
22043+}
22044+#endif
22045+
22046+/**
22047+ * probe_kernel_write(): safely attempt to write to a location
22048+ * @dst: address to write to
22049+ * @src: pointer to the data that shall be written
22050+ * @size: size of the data chunk
22051+ *
22052+ * Safely write to address @dst from the buffer at @src. If a kernel fault
22053+ * happens, handle that and return -EFAULT.
22054+ */
22055+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
22056+{
22057+ long ret;
22058+ mm_segment_t old_fs = get_fs();
22059+
22060+ set_fs(KERNEL_DS);
22061+ pagefault_disable();
22062+ pax_open_kernel();
22063+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
22064+ pax_close_kernel();
22065+ pagefault_enable();
22066+ set_fs(old_fs);
22067+
22068+ return ret ? -EFAULT : 0;
22069+}
22070diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
22071index dd74e46..7d26398 100644
22072--- a/arch/x86/mm/gup.c
22073+++ b/arch/x86/mm/gup.c
22074@@ -255,7 +255,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
22075 addr = start;
22076 len = (unsigned long) nr_pages << PAGE_SHIFT;
22077 end = start + len;
22078- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22079+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22080 (void __user *)start, len)))
22081 return 0;
22082
22083diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
22084index f4f29b1..5cac4fb 100644
22085--- a/arch/x86/mm/highmem_32.c
22086+++ b/arch/x86/mm/highmem_32.c
22087@@ -44,7 +44,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
22088 idx = type + KM_TYPE_NR*smp_processor_id();
22089 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22090 BUG_ON(!pte_none(*(kmap_pte-idx)));
22091+
22092+ pax_open_kernel();
22093 set_pte(kmap_pte-idx, mk_pte(page, prot));
22094+ pax_close_kernel();
22095+
22096 arch_flush_lazy_mmu_mode();
22097
22098 return (void *)vaddr;
22099diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
22100index f581a18..29efd37 100644
22101--- a/arch/x86/mm/hugetlbpage.c
22102+++ b/arch/x86/mm/hugetlbpage.c
22103@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
22104 struct hstate *h = hstate_file(file);
22105 struct mm_struct *mm = current->mm;
22106 struct vm_area_struct *vma;
22107- unsigned long start_addr;
22108+ unsigned long start_addr, pax_task_size = TASK_SIZE;
22109+
22110+#ifdef CONFIG_PAX_SEGMEXEC
22111+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22112+ pax_task_size = SEGMEXEC_TASK_SIZE;
22113+#endif
22114+
22115+ pax_task_size -= PAGE_SIZE;
22116
22117 if (len > mm->cached_hole_size) {
22118- start_addr = mm->free_area_cache;
22119+ start_addr = mm->free_area_cache;
22120 } else {
22121- start_addr = TASK_UNMAPPED_BASE;
22122- mm->cached_hole_size = 0;
22123+ start_addr = mm->mmap_base;
22124+ mm->cached_hole_size = 0;
22125 }
22126
22127 full_search:
22128@@ -280,26 +287,27 @@ full_search:
22129
22130 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
22131 /* At this point: (!vma || addr < vma->vm_end). */
22132- if (TASK_SIZE - len < addr) {
22133+ if (pax_task_size - len < addr) {
22134 /*
22135 * Start a new search - just in case we missed
22136 * some holes.
22137 */
22138- if (start_addr != TASK_UNMAPPED_BASE) {
22139- start_addr = TASK_UNMAPPED_BASE;
22140+ if (start_addr != mm->mmap_base) {
22141+ start_addr = mm->mmap_base;
22142 mm->cached_hole_size = 0;
22143 goto full_search;
22144 }
22145 return -ENOMEM;
22146 }
22147- if (!vma || addr + len <= vma->vm_start) {
22148- mm->free_area_cache = addr + len;
22149- return addr;
22150- }
22151+ if (check_heap_stack_gap(vma, addr, len))
22152+ break;
22153 if (addr + mm->cached_hole_size < vma->vm_start)
22154 mm->cached_hole_size = vma->vm_start - addr;
22155 addr = ALIGN(vma->vm_end, huge_page_size(h));
22156 }
22157+
22158+ mm->free_area_cache = addr + len;
22159+ return addr;
22160 }
22161
22162 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22163@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22164 {
22165 struct hstate *h = hstate_file(file);
22166 struct mm_struct *mm = current->mm;
22167- struct vm_area_struct *vma, *prev_vma;
22168- unsigned long base = mm->mmap_base, addr = addr0;
22169+ struct vm_area_struct *vma;
22170+ unsigned long base = mm->mmap_base, addr;
22171 unsigned long largest_hole = mm->cached_hole_size;
22172- int first_time = 1;
22173
22174 /* don't allow allocations above current base */
22175 if (mm->free_area_cache > base)
22176@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22177 largest_hole = 0;
22178 mm->free_area_cache = base;
22179 }
22180-try_again:
22181+
22182 /* make sure it can fit in the remaining address space */
22183 if (mm->free_area_cache < len)
22184 goto fail;
22185
22186 /* either no address requested or can't fit in requested address hole */
22187- addr = (mm->free_area_cache - len) & huge_page_mask(h);
22188+ addr = (mm->free_area_cache - len);
22189 do {
22190+ addr &= huge_page_mask(h);
22191+ vma = find_vma(mm, addr);
22192 /*
22193 * Lookup failure means no vma is above this address,
22194 * i.e. return with success:
22195- */
22196- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
22197- return addr;
22198-
22199- /*
22200 * new region fits between prev_vma->vm_end and
22201 * vma->vm_start, use it:
22202 */
22203- if (addr + len <= vma->vm_start &&
22204- (!prev_vma || (addr >= prev_vma->vm_end))) {
22205+ if (check_heap_stack_gap(vma, addr, len)) {
22206 /* remember the address as a hint for next time */
22207- mm->cached_hole_size = largest_hole;
22208- return (mm->free_area_cache = addr);
22209- } else {
22210- /* pull free_area_cache down to the first hole */
22211- if (mm->free_area_cache == vma->vm_end) {
22212- mm->free_area_cache = vma->vm_start;
22213- mm->cached_hole_size = largest_hole;
22214- }
22215+ mm->cached_hole_size = largest_hole;
22216+ return (mm->free_area_cache = addr);
22217+ }
22218+ /* pull free_area_cache down to the first hole */
22219+ if (mm->free_area_cache == vma->vm_end) {
22220+ mm->free_area_cache = vma->vm_start;
22221+ mm->cached_hole_size = largest_hole;
22222 }
22223
22224 /* remember the largest hole we saw so far */
22225 if (addr + largest_hole < vma->vm_start)
22226- largest_hole = vma->vm_start - addr;
22227+ largest_hole = vma->vm_start - addr;
22228
22229 /* try just below the current vma->vm_start */
22230- addr = (vma->vm_start - len) & huge_page_mask(h);
22231- } while (len <= vma->vm_start);
22232+ addr = skip_heap_stack_gap(vma, len);
22233+ } while (!IS_ERR_VALUE(addr));
22234
22235 fail:
22236 /*
22237- * if hint left us with no space for the requested
22238- * mapping then try again:
22239- */
22240- if (first_time) {
22241- mm->free_area_cache = base;
22242- largest_hole = 0;
22243- first_time = 0;
22244- goto try_again;
22245- }
22246- /*
22247 * A failed mmap() very likely causes application failure,
22248 * so fall back to the bottom-up function here. This scenario
22249 * can happen with large stack limits and large mmap()
22250 * allocations.
22251 */
22252- mm->free_area_cache = TASK_UNMAPPED_BASE;
22253+
22254+#ifdef CONFIG_PAX_SEGMEXEC
22255+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22256+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
22257+ else
22258+#endif
22259+
22260+ mm->mmap_base = TASK_UNMAPPED_BASE;
22261+
22262+#ifdef CONFIG_PAX_RANDMMAP
22263+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22264+ mm->mmap_base += mm->delta_mmap;
22265+#endif
22266+
22267+ mm->free_area_cache = mm->mmap_base;
22268 mm->cached_hole_size = ~0UL;
22269 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
22270 len, pgoff, flags);
22271@@ -386,6 +392,7 @@ fail:
22272 /*
22273 * Restore the topdown base:
22274 */
22275+ mm->mmap_base = base;
22276 mm->free_area_cache = base;
22277 mm->cached_hole_size = ~0UL;
22278
22279@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22280 struct hstate *h = hstate_file(file);
22281 struct mm_struct *mm = current->mm;
22282 struct vm_area_struct *vma;
22283+ unsigned long pax_task_size = TASK_SIZE;
22284
22285 if (len & ~huge_page_mask(h))
22286 return -EINVAL;
22287- if (len > TASK_SIZE)
22288+
22289+#ifdef CONFIG_PAX_SEGMEXEC
22290+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22291+ pax_task_size = SEGMEXEC_TASK_SIZE;
22292+#endif
22293+
22294+ pax_task_size -= PAGE_SIZE;
22295+
22296+ if (len > pax_task_size)
22297 return -ENOMEM;
22298
22299 if (flags & MAP_FIXED) {
22300@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22301 if (addr) {
22302 addr = ALIGN(addr, huge_page_size(h));
22303 vma = find_vma(mm, addr);
22304- if (TASK_SIZE - len >= addr &&
22305- (!vma || addr + len <= vma->vm_start))
22306+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
22307 return addr;
22308 }
22309 if (mm->get_unmapped_area == arch_get_unmapped_area)
22310diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
22311index 87488b9..7129f32 100644
22312--- a/arch/x86/mm/init.c
22313+++ b/arch/x86/mm/init.c
22314@@ -31,7 +31,7 @@ int direct_gbpages
22315 static void __init find_early_table_space(unsigned long end, int use_pse,
22316 int use_gbpages)
22317 {
22318- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22319+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22320 phys_addr_t base;
22321
22322 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22323@@ -312,8 +312,29 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
22324 */
22325 int devmem_is_allowed(unsigned long pagenr)
22326 {
22327+#ifdef CONFIG_GRKERNSEC_KMEM
22328+ /* allow BDA */
22329+ if (!pagenr)
22330+ return 1;
22331+ /* allow EBDA */
22332+ if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22333+ return 1;
22334+#else
22335+ if (!pagenr)
22336+ return 1;
22337+#ifdef CONFIG_VM86
22338+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22339+ return 1;
22340+#endif
22341+#endif
22342+
22343+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22344+ return 1;
22345+#ifdef CONFIG_GRKERNSEC_KMEM
22346+ /* throw out everything else below 1MB */
22347 if (pagenr <= 256)
22348- return 1;
22349+ return 0;
22350+#endif
22351 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22352 return 0;
22353 if (!page_is_ram(pagenr))
22354@@ -372,6 +393,86 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
22355
22356 void free_initmem(void)
22357 {
22358+
22359+#ifdef CONFIG_PAX_KERNEXEC
22360+#ifdef CONFIG_X86_32
22361+ /* PaX: limit KERNEL_CS to actual size */
22362+ unsigned long addr, limit;
22363+ struct desc_struct d;
22364+ int cpu;
22365+
22366+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22367+ limit = (limit - 1UL) >> PAGE_SHIFT;
22368+
22369+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22370+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22371+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22372+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22373+ }
22374+
22375+ /* PaX: make KERNEL_CS read-only */
22376+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22377+ if (!paravirt_enabled())
22378+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22379+/*
22380+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22381+ pgd = pgd_offset_k(addr);
22382+ pud = pud_offset(pgd, addr);
22383+ pmd = pmd_offset(pud, addr);
22384+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22385+ }
22386+*/
22387+#ifdef CONFIG_X86_PAE
22388+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22389+/*
22390+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22391+ pgd = pgd_offset_k(addr);
22392+ pud = pud_offset(pgd, addr);
22393+ pmd = pmd_offset(pud, addr);
22394+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22395+ }
22396+*/
22397+#endif
22398+
22399+#ifdef CONFIG_MODULES
22400+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22401+#endif
22402+
22403+#else
22404+ pgd_t *pgd;
22405+ pud_t *pud;
22406+ pmd_t *pmd;
22407+ unsigned long addr, end;
22408+
22409+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22410+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22411+ pgd = pgd_offset_k(addr);
22412+ pud = pud_offset(pgd, addr);
22413+ pmd = pmd_offset(pud, addr);
22414+ if (!pmd_present(*pmd))
22415+ continue;
22416+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22417+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22418+ else
22419+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22420+ }
22421+
22422+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22423+ end = addr + KERNEL_IMAGE_SIZE;
22424+ for (; addr < end; addr += PMD_SIZE) {
22425+ pgd = pgd_offset_k(addr);
22426+ pud = pud_offset(pgd, addr);
22427+ pmd = pmd_offset(pud, addr);
22428+ if (!pmd_present(*pmd))
22429+ continue;
22430+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22431+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22432+ }
22433+#endif
22434+
22435+ flush_tlb_all();
22436+#endif
22437+
22438 free_init_pages("unused kernel memory",
22439 (unsigned long)(&__init_begin),
22440 (unsigned long)(&__init_end));
22441diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
22442index 29f7c6d..b46b35b 100644
22443--- a/arch/x86/mm/init_32.c
22444+++ b/arch/x86/mm/init_32.c
22445@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
22446 }
22447
22448 /*
22449- * Creates a middle page table and puts a pointer to it in the
22450- * given global directory entry. This only returns the gd entry
22451- * in non-PAE compilation mode, since the middle layer is folded.
22452- */
22453-static pmd_t * __init one_md_table_init(pgd_t *pgd)
22454-{
22455- pud_t *pud;
22456- pmd_t *pmd_table;
22457-
22458-#ifdef CONFIG_X86_PAE
22459- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
22460- if (after_bootmem)
22461- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
22462- else
22463- pmd_table = (pmd_t *)alloc_low_page();
22464- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
22465- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
22466- pud = pud_offset(pgd, 0);
22467- BUG_ON(pmd_table != pmd_offset(pud, 0));
22468-
22469- return pmd_table;
22470- }
22471-#endif
22472- pud = pud_offset(pgd, 0);
22473- pmd_table = pmd_offset(pud, 0);
22474-
22475- return pmd_table;
22476-}
22477-
22478-/*
22479 * Create a page table and place a pointer to it in a middle page
22480 * directory entry:
22481 */
22482@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
22483 page_table = (pte_t *)alloc_low_page();
22484
22485 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22486+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22487+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22488+#else
22489 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22490+#endif
22491 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22492 }
22493
22494 return pte_offset_kernel(pmd, 0);
22495 }
22496
22497+static pmd_t * __init one_md_table_init(pgd_t *pgd)
22498+{
22499+ pud_t *pud;
22500+ pmd_t *pmd_table;
22501+
22502+ pud = pud_offset(pgd, 0);
22503+ pmd_table = pmd_offset(pud, 0);
22504+
22505+ return pmd_table;
22506+}
22507+
22508 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22509 {
22510 int pgd_idx = pgd_index(vaddr);
22511@@ -203,6 +188,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22512 int pgd_idx, pmd_idx;
22513 unsigned long vaddr;
22514 pgd_t *pgd;
22515+ pud_t *pud;
22516 pmd_t *pmd;
22517 pte_t *pte = NULL;
22518
22519@@ -212,8 +198,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22520 pgd = pgd_base + pgd_idx;
22521
22522 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22523- pmd = one_md_table_init(pgd);
22524- pmd = pmd + pmd_index(vaddr);
22525+ pud = pud_offset(pgd, vaddr);
22526+ pmd = pmd_offset(pud, vaddr);
22527+
22528+#ifdef CONFIG_X86_PAE
22529+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22530+#endif
22531+
22532 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22533 pmd++, pmd_idx++) {
22534 pte = page_table_kmap_check(one_page_table_init(pmd),
22535@@ -225,11 +216,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22536 }
22537 }
22538
22539-static inline int is_kernel_text(unsigned long addr)
22540+static inline int is_kernel_text(unsigned long start, unsigned long end)
22541 {
22542- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
22543- return 1;
22544- return 0;
22545+ if ((start > ktla_ktva((unsigned long)_etext) ||
22546+ end <= ktla_ktva((unsigned long)_stext)) &&
22547+ (start > ktla_ktva((unsigned long)_einittext) ||
22548+ end <= ktla_ktva((unsigned long)_sinittext)) &&
22549+
22550+#ifdef CONFIG_ACPI_SLEEP
22551+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22552+#endif
22553+
22554+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22555+ return 0;
22556+ return 1;
22557 }
22558
22559 /*
22560@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned long start,
22561 unsigned long last_map_addr = end;
22562 unsigned long start_pfn, end_pfn;
22563 pgd_t *pgd_base = swapper_pg_dir;
22564- int pgd_idx, pmd_idx, pte_ofs;
22565+ unsigned int pgd_idx, pmd_idx, pte_ofs;
22566 unsigned long pfn;
22567 pgd_t *pgd;
22568+ pud_t *pud;
22569 pmd_t *pmd;
22570 pte_t *pte;
22571 unsigned pages_2m, pages_4k;
22572@@ -281,8 +282,13 @@ repeat:
22573 pfn = start_pfn;
22574 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22575 pgd = pgd_base + pgd_idx;
22576- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22577- pmd = one_md_table_init(pgd);
22578+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22579+ pud = pud_offset(pgd, 0);
22580+ pmd = pmd_offset(pud, 0);
22581+
22582+#ifdef CONFIG_X86_PAE
22583+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22584+#endif
22585
22586 if (pfn >= end_pfn)
22587 continue;
22588@@ -294,14 +300,13 @@ repeat:
22589 #endif
22590 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22591 pmd++, pmd_idx++) {
22592- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22593+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22594
22595 /*
22596 * Map with big pages if possible, otherwise
22597 * create normal page tables:
22598 */
22599 if (use_pse) {
22600- unsigned int addr2;
22601 pgprot_t prot = PAGE_KERNEL_LARGE;
22602 /*
22603 * first pass will use the same initial
22604@@ -311,11 +316,7 @@ repeat:
22605 __pgprot(PTE_IDENT_ATTR |
22606 _PAGE_PSE);
22607
22608- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22609- PAGE_OFFSET + PAGE_SIZE-1;
22610-
22611- if (is_kernel_text(addr) ||
22612- is_kernel_text(addr2))
22613+ if (is_kernel_text(address, address + PMD_SIZE))
22614 prot = PAGE_KERNEL_LARGE_EXEC;
22615
22616 pages_2m++;
22617@@ -332,7 +333,7 @@ repeat:
22618 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22619 pte += pte_ofs;
22620 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22621- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22622+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22623 pgprot_t prot = PAGE_KERNEL;
22624 /*
22625 * first pass will use the same initial
22626@@ -340,7 +341,7 @@ repeat:
22627 */
22628 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22629
22630- if (is_kernel_text(addr))
22631+ if (is_kernel_text(address, address + PAGE_SIZE))
22632 prot = PAGE_KERNEL_EXEC;
22633
22634 pages_4k++;
22635@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
22636
22637 pud = pud_offset(pgd, va);
22638 pmd = pmd_offset(pud, va);
22639- if (!pmd_present(*pmd))
22640+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22641 break;
22642
22643 pte = pte_offset_kernel(pmd, va);
22644@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_range_init(void)
22645
22646 static void __init pagetable_init(void)
22647 {
22648- pgd_t *pgd_base = swapper_pg_dir;
22649-
22650- permanent_kmaps_init(pgd_base);
22651+ permanent_kmaps_init(swapper_pg_dir);
22652 }
22653
22654-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22655+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22656 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22657
22658 /* user-defined highmem size */
22659@@ -757,6 +756,12 @@ void __init mem_init(void)
22660
22661 pci_iommu_alloc();
22662
22663+#ifdef CONFIG_PAX_PER_CPU_PGD
22664+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22665+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22666+ KERNEL_PGD_PTRS);
22667+#endif
22668+
22669 #ifdef CONFIG_FLATMEM
22670 BUG_ON(!mem_map);
22671 #endif
22672@@ -774,7 +779,7 @@ void __init mem_init(void)
22673 set_highmem_pages_init();
22674
22675 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22676- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22677+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22678 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22679
22680 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22681@@ -815,10 +820,10 @@ void __init mem_init(void)
22682 ((unsigned long)&__init_end -
22683 (unsigned long)&__init_begin) >> 10,
22684
22685- (unsigned long)&_etext, (unsigned long)&_edata,
22686- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22687+ (unsigned long)&_sdata, (unsigned long)&_edata,
22688+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22689
22690- (unsigned long)&_text, (unsigned long)&_etext,
22691+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22692 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22693
22694 /*
22695@@ -896,6 +901,7 @@ void set_kernel_text_rw(void)
22696 if (!kernel_set_to_readonly)
22697 return;
22698
22699+ start = ktla_ktva(start);
22700 pr_debug("Set kernel text: %lx - %lx for read write\n",
22701 start, start+size);
22702
22703@@ -910,6 +916,7 @@ void set_kernel_text_ro(void)
22704 if (!kernel_set_to_readonly)
22705 return;
22706
22707+ start = ktla_ktva(start);
22708 pr_debug("Set kernel text: %lx - %lx for read only\n",
22709 start, start+size);
22710
22711@@ -938,6 +945,7 @@ void mark_rodata_ro(void)
22712 unsigned long start = PFN_ALIGN(_text);
22713 unsigned long size = PFN_ALIGN(_etext) - start;
22714
22715+ start = ktla_ktva(start);
22716 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22717 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22718 size >> 10);
22719diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
22720index bbaaa00..16dffad 100644
22721--- a/arch/x86/mm/init_64.c
22722+++ b/arch/x86/mm/init_64.c
22723@@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpages_on);
22724 * around without checking the pgd every time.
22725 */
22726
22727-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22728+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22729 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22730
22731 int force_personality32;
22732@@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22733
22734 for (address = start; address <= end; address += PGDIR_SIZE) {
22735 const pgd_t *pgd_ref = pgd_offset_k(address);
22736+
22737+#ifdef CONFIG_PAX_PER_CPU_PGD
22738+ unsigned long cpu;
22739+#else
22740 struct page *page;
22741+#endif
22742
22743 if (pgd_none(*pgd_ref))
22744 continue;
22745
22746 spin_lock(&pgd_lock);
22747+
22748+#ifdef CONFIG_PAX_PER_CPU_PGD
22749+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22750+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22751+#else
22752 list_for_each_entry(page, &pgd_list, lru) {
22753 pgd_t *pgd;
22754 spinlock_t *pgt_lock;
22755@@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22756 /* the pgt_lock only for Xen */
22757 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22758 spin_lock(pgt_lock);
22759+#endif
22760
22761 if (pgd_none(*pgd))
22762 set_pgd(pgd, *pgd_ref);
22763@@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22764 BUG_ON(pgd_page_vaddr(*pgd)
22765 != pgd_page_vaddr(*pgd_ref));
22766
22767+#ifndef CONFIG_PAX_PER_CPU_PGD
22768 spin_unlock(pgt_lock);
22769+#endif
22770+
22771 }
22772 spin_unlock(&pgd_lock);
22773 }
22774@@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
22775 pmd = fill_pmd(pud, vaddr);
22776 pte = fill_pte(pmd, vaddr);
22777
22778+ pax_open_kernel();
22779 set_pte(pte, new_pte);
22780+ pax_close_kernel();
22781
22782 /*
22783 * It's enough to flush this one mapping.
22784@@ -262,14 +278,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
22785 pgd = pgd_offset_k((unsigned long)__va(phys));
22786 if (pgd_none(*pgd)) {
22787 pud = (pud_t *) spp_getpage();
22788- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22789- _PAGE_USER));
22790+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22791 }
22792 pud = pud_offset(pgd, (unsigned long)__va(phys));
22793 if (pud_none(*pud)) {
22794 pmd = (pmd_t *) spp_getpage();
22795- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22796- _PAGE_USER));
22797+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22798 }
22799 pmd = pmd_offset(pud, phys);
22800 BUG_ON(!pmd_none(*pmd));
22801@@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsigned long *phys)
22802 if (pfn >= pgt_buf_top)
22803 panic("alloc_low_page: ran out of memory");
22804
22805- adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22806+ adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22807 clear_page(adr);
22808 *phys = pfn * PAGE_SIZE;
22809 return adr;
22810@@ -346,7 +360,7 @@ static __ref void *map_low_page(void *virt)
22811
22812 phys = __pa(virt);
22813 left = phys & (PAGE_SIZE - 1);
22814- adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22815+ adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22816 adr = (void *)(((unsigned long)adr) | left);
22817
22818 return adr;
22819@@ -693,6 +707,12 @@ void __init mem_init(void)
22820
22821 pci_iommu_alloc();
22822
22823+#ifdef CONFIG_PAX_PER_CPU_PGD
22824+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22825+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22826+ KERNEL_PGD_PTRS);
22827+#endif
22828+
22829 /* clear_bss() already clear the empty_zero_page */
22830
22831 reservedpages = 0;
22832@@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr)
22833 static struct vm_area_struct gate_vma = {
22834 .vm_start = VSYSCALL_START,
22835 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22836- .vm_page_prot = PAGE_READONLY_EXEC,
22837- .vm_flags = VM_READ | VM_EXEC
22838+ .vm_page_prot = PAGE_READONLY,
22839+ .vm_flags = VM_READ
22840 };
22841
22842 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22843@@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long addr)
22844
22845 const char *arch_vma_name(struct vm_area_struct *vma)
22846 {
22847- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22848+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22849 return "[vdso]";
22850 if (vma == &gate_vma)
22851 return "[vsyscall]";
22852diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
22853index 7b179b4..6bd1777 100644
22854--- a/arch/x86/mm/iomap_32.c
22855+++ b/arch/x86/mm/iomap_32.c
22856@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
22857 type = kmap_atomic_idx_push();
22858 idx = type + KM_TYPE_NR * smp_processor_id();
22859 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22860+
22861+ pax_open_kernel();
22862 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22863+ pax_close_kernel();
22864+
22865 arch_flush_lazy_mmu_mode();
22866
22867 return (void *)vaddr;
22868diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
22869index be1ef57..9680edc 100644
22870--- a/arch/x86/mm/ioremap.c
22871+++ b/arch/x86/mm/ioremap.c
22872@@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
22873 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22874 int is_ram = page_is_ram(pfn);
22875
22876- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22877+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22878 return NULL;
22879 WARN_ON_ONCE(is_ram);
22880 }
22881@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_setup(char *str)
22882 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22883
22884 static __initdata int after_paging_init;
22885-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22886+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22887
22888 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22889 {
22890@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22891 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22892
22893 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22894- memset(bm_pte, 0, sizeof(bm_pte));
22895- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22896+ pmd_populate_user(&init_mm, pmd, bm_pte);
22897
22898 /*
22899 * The boot-ioremap range spans multiple pmds, for which
22900diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
22901index d87dd6d..bf3fa66 100644
22902--- a/arch/x86/mm/kmemcheck/kmemcheck.c
22903+++ b/arch/x86/mm/kmemcheck/kmemcheck.c
22904@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
22905 * memory (e.g. tracked pages)? For now, we need this to avoid
22906 * invoking kmemcheck for PnP BIOS calls.
22907 */
22908- if (regs->flags & X86_VM_MASK)
22909+ if (v8086_mode(regs))
22910 return false;
22911- if (regs->cs != __KERNEL_CS)
22912+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22913 return false;
22914
22915 pte = kmemcheck_pte_lookup(address);
22916diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
22917index 1dab519..60a7e5f 100644
22918--- a/arch/x86/mm/mmap.c
22919+++ b/arch/x86/mm/mmap.c
22920@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size(void)
22921 * Leave an at least ~128 MB hole with possible stack randomization.
22922 */
22923 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22924-#define MAX_GAP (TASK_SIZE/6*5)
22925+#define MAX_GAP (pax_task_size/6*5)
22926
22927 /*
22928 * True on X86_32 or when emulating IA32 on X86_64
22929@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22930 return rnd << PAGE_SHIFT;
22931 }
22932
22933-static unsigned long mmap_base(void)
22934+static unsigned long mmap_base(struct mm_struct *mm)
22935 {
22936 unsigned long gap = rlimit(RLIMIT_STACK);
22937+ unsigned long pax_task_size = TASK_SIZE;
22938+
22939+#ifdef CONFIG_PAX_SEGMEXEC
22940+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22941+ pax_task_size = SEGMEXEC_TASK_SIZE;
22942+#endif
22943
22944 if (gap < MIN_GAP)
22945 gap = MIN_GAP;
22946 else if (gap > MAX_GAP)
22947 gap = MAX_GAP;
22948
22949- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22950+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22951 }
22952
22953 /*
22954 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22955 * does, but not when emulating X86_32
22956 */
22957-static unsigned long mmap_legacy_base(void)
22958+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22959 {
22960- if (mmap_is_ia32())
22961+ if (mmap_is_ia32()) {
22962+
22963+#ifdef CONFIG_PAX_SEGMEXEC
22964+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22965+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22966+ else
22967+#endif
22968+
22969 return TASK_UNMAPPED_BASE;
22970- else
22971+ } else
22972 return TASK_UNMAPPED_BASE + mmap_rnd();
22973 }
22974
22975@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(void)
22976 void arch_pick_mmap_layout(struct mm_struct *mm)
22977 {
22978 if (mmap_is_legacy()) {
22979- mm->mmap_base = mmap_legacy_base();
22980+ mm->mmap_base = mmap_legacy_base(mm);
22981+
22982+#ifdef CONFIG_PAX_RANDMMAP
22983+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22984+ mm->mmap_base += mm->delta_mmap;
22985+#endif
22986+
22987 mm->get_unmapped_area = arch_get_unmapped_area;
22988 mm->unmap_area = arch_unmap_area;
22989 } else {
22990- mm->mmap_base = mmap_base();
22991+ mm->mmap_base = mmap_base(mm);
22992+
22993+#ifdef CONFIG_PAX_RANDMMAP
22994+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22995+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22996+#endif
22997+
22998 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22999 mm->unmap_area = arch_unmap_area_topdown;
23000 }
23001diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
23002index 67421f3..8d6b107 100644
23003--- a/arch/x86/mm/mmio-mod.c
23004+++ b/arch/x86/mm/mmio-mod.c
23005@@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
23006 break;
23007 default:
23008 {
23009- unsigned char *ip = (unsigned char *)instptr;
23010+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
23011 my_trace->opcode = MMIO_UNKNOWN_OP;
23012 my_trace->width = 0;
23013 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
23014@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
23015 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23016 void __iomem *addr)
23017 {
23018- static atomic_t next_id;
23019+ static atomic_unchecked_t next_id;
23020 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
23021 /* These are page-unaligned. */
23022 struct mmiotrace_map map = {
23023@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23024 .private = trace
23025 },
23026 .phys = offset,
23027- .id = atomic_inc_return(&next_id)
23028+ .id = atomic_inc_return_unchecked(&next_id)
23029 };
23030 map.map_id = trace->id;
23031
23032diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
23033index b008656..773eac2 100644
23034--- a/arch/x86/mm/pageattr-test.c
23035+++ b/arch/x86/mm/pageattr-test.c
23036@@ -36,7 +36,7 @@ enum {
23037
23038 static int pte_testbit(pte_t pte)
23039 {
23040- return pte_flags(pte) & _PAGE_UNUSED1;
23041+ return pte_flags(pte) & _PAGE_CPA_TEST;
23042 }
23043
23044 struct split_state {
23045diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
23046index f9e5267..6f6e27f 100644
23047--- a/arch/x86/mm/pageattr.c
23048+++ b/arch/x86/mm/pageattr.c
23049@@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23050 */
23051 #ifdef CONFIG_PCI_BIOS
23052 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
23053- pgprot_val(forbidden) |= _PAGE_NX;
23054+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23055 #endif
23056
23057 /*
23058@@ -269,9 +269,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23059 * Does not cover __inittext since that is gone later on. On
23060 * 64bit we do not enforce !NX on the low mapping
23061 */
23062- if (within(address, (unsigned long)_text, (unsigned long)_etext))
23063- pgprot_val(forbidden) |= _PAGE_NX;
23064+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
23065+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23066
23067+#ifdef CONFIG_DEBUG_RODATA
23068 /*
23069 * The .rodata section needs to be read-only. Using the pfn
23070 * catches all aliases.
23071@@ -279,6 +280,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23072 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
23073 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
23074 pgprot_val(forbidden) |= _PAGE_RW;
23075+#endif
23076
23077 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
23078 /*
23079@@ -317,6 +319,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23080 }
23081 #endif
23082
23083+#ifdef CONFIG_PAX_KERNEXEC
23084+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
23085+ pgprot_val(forbidden) |= _PAGE_RW;
23086+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23087+ }
23088+#endif
23089+
23090 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
23091
23092 return prot;
23093@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
23094 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
23095 {
23096 /* change init_mm */
23097+ pax_open_kernel();
23098 set_pte_atomic(kpte, pte);
23099+
23100 #ifdef CONFIG_X86_32
23101 if (!SHARED_KERNEL_PMD) {
23102+
23103+#ifdef CONFIG_PAX_PER_CPU_PGD
23104+ unsigned long cpu;
23105+#else
23106 struct page *page;
23107+#endif
23108
23109+#ifdef CONFIG_PAX_PER_CPU_PGD
23110+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
23111+ pgd_t *pgd = get_cpu_pgd(cpu);
23112+#else
23113 list_for_each_entry(page, &pgd_list, lru) {
23114- pgd_t *pgd;
23115+ pgd_t *pgd = (pgd_t *)page_address(page);
23116+#endif
23117+
23118 pud_t *pud;
23119 pmd_t *pmd;
23120
23121- pgd = (pgd_t *)page_address(page) + pgd_index(address);
23122+ pgd += pgd_index(address);
23123 pud = pud_offset(pgd, address);
23124 pmd = pmd_offset(pud, address);
23125 set_pte_atomic((pte_t *)pmd, pte);
23126 }
23127 }
23128 #endif
23129+ pax_close_kernel();
23130 }
23131
23132 static int
23133diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
23134index f6ff57b..481690f 100644
23135--- a/arch/x86/mm/pat.c
23136+++ b/arch/x86/mm/pat.c
23137@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
23138
23139 if (!entry) {
23140 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
23141- current->comm, current->pid, start, end);
23142+ current->comm, task_pid_nr(current), start, end);
23143 return -EINVAL;
23144 }
23145
23146@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
23147 while (cursor < to) {
23148 if (!devmem_is_allowed(pfn)) {
23149 printk(KERN_INFO
23150- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
23151- current->comm, from, to);
23152+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
23153+ current->comm, from, to, cursor);
23154 return 0;
23155 }
23156 cursor += PAGE_SIZE;
23157@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
23158 printk(KERN_INFO
23159 "%s:%d ioremap_change_attr failed %s "
23160 "for %Lx-%Lx\n",
23161- current->comm, current->pid,
23162+ current->comm, task_pid_nr(current),
23163 cattr_name(flags),
23164 base, (unsigned long long)(base + size));
23165 return -EINVAL;
23166@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23167 if (want_flags != flags) {
23168 printk(KERN_WARNING
23169 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
23170- current->comm, current->pid,
23171+ current->comm, task_pid_nr(current),
23172 cattr_name(want_flags),
23173 (unsigned long long)paddr,
23174 (unsigned long long)(paddr + size),
23175@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23176 free_memtype(paddr, paddr + size);
23177 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
23178 " for %Lx-%Lx, got %s\n",
23179- current->comm, current->pid,
23180+ current->comm, task_pid_nr(current),
23181 cattr_name(want_flags),
23182 (unsigned long long)paddr,
23183 (unsigned long long)(paddr + size),
23184diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
23185index 9f0614d..92ae64a 100644
23186--- a/arch/x86/mm/pf_in.c
23187+++ b/arch/x86/mm/pf_in.c
23188@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
23189 int i;
23190 enum reason_type rv = OTHERS;
23191
23192- p = (unsigned char *)ins_addr;
23193+ p = (unsigned char *)ktla_ktva(ins_addr);
23194 p += skip_prefix(p, &prf);
23195 p += get_opcode(p, &opcode);
23196
23197@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
23198 struct prefix_bits prf;
23199 int i;
23200
23201- p = (unsigned char *)ins_addr;
23202+ p = (unsigned char *)ktla_ktva(ins_addr);
23203 p += skip_prefix(p, &prf);
23204 p += get_opcode(p, &opcode);
23205
23206@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
23207 struct prefix_bits prf;
23208 int i;
23209
23210- p = (unsigned char *)ins_addr;
23211+ p = (unsigned char *)ktla_ktva(ins_addr);
23212 p += skip_prefix(p, &prf);
23213 p += get_opcode(p, &opcode);
23214
23215@@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
23216 struct prefix_bits prf;
23217 int i;
23218
23219- p = (unsigned char *)ins_addr;
23220+ p = (unsigned char *)ktla_ktva(ins_addr);
23221 p += skip_prefix(p, &prf);
23222 p += get_opcode(p, &opcode);
23223 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
23224@@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
23225 struct prefix_bits prf;
23226 int i;
23227
23228- p = (unsigned char *)ins_addr;
23229+ p = (unsigned char *)ktla_ktva(ins_addr);
23230 p += skip_prefix(p, &prf);
23231 p += get_opcode(p, &opcode);
23232 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
23233diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
23234index 8573b83..6372501 100644
23235--- a/arch/x86/mm/pgtable.c
23236+++ b/arch/x86/mm/pgtable.c
23237@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *pgd)
23238 list_del(&page->lru);
23239 }
23240
23241-#define UNSHARED_PTRS_PER_PGD \
23242- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23243+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23244+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
23245
23246+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23247+{
23248+ while (count--)
23249+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
23250+}
23251+#endif
23252
23253+#ifdef CONFIG_PAX_PER_CPU_PGD
23254+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23255+{
23256+ while (count--)
23257+
23258+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23259+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
23260+#else
23261+ *dst++ = *src++;
23262+#endif
23263+
23264+}
23265+#endif
23266+
23267+#ifdef CONFIG_X86_64
23268+#define pxd_t pud_t
23269+#define pyd_t pgd_t
23270+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
23271+#define pxd_free(mm, pud) pud_free((mm), (pud))
23272+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
23273+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
23274+#define PYD_SIZE PGDIR_SIZE
23275+#else
23276+#define pxd_t pmd_t
23277+#define pyd_t pud_t
23278+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
23279+#define pxd_free(mm, pud) pmd_free((mm), (pud))
23280+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
23281+#define pyd_offset(mm ,address) pud_offset((mm), (address))
23282+#define PYD_SIZE PUD_SIZE
23283+#endif
23284+
23285+#ifdef CONFIG_PAX_PER_CPU_PGD
23286+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
23287+static inline void pgd_dtor(pgd_t *pgd) {}
23288+#else
23289 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
23290 {
23291 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
23292@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
23293 pgd_list_del(pgd);
23294 spin_unlock(&pgd_lock);
23295 }
23296+#endif
23297
23298 /*
23299 * List of all pgd's needed for non-PAE so it can invalidate entries
23300@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
23301 * -- wli
23302 */
23303
23304-#ifdef CONFIG_X86_PAE
23305+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23306 /*
23307 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
23308 * updating the top-level pagetable entries to guarantee the
23309@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
23310 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
23311 * and initialize the kernel pmds here.
23312 */
23313-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
23314+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23315
23316 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23317 {
23318@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23319 */
23320 flush_tlb_mm(mm);
23321 }
23322+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
23323+#define PREALLOCATED_PXDS USER_PGD_PTRS
23324 #else /* !CONFIG_X86_PAE */
23325
23326 /* No need to prepopulate any pagetable entries in non-PAE modes. */
23327-#define PREALLOCATED_PMDS 0
23328+#define PREALLOCATED_PXDS 0
23329
23330 #endif /* CONFIG_X86_PAE */
23331
23332-static void free_pmds(pmd_t *pmds[])
23333+static void free_pxds(pxd_t *pxds[])
23334 {
23335 int i;
23336
23337- for(i = 0; i < PREALLOCATED_PMDS; i++)
23338- if (pmds[i])
23339- free_page((unsigned long)pmds[i]);
23340+ for(i = 0; i < PREALLOCATED_PXDS; i++)
23341+ if (pxds[i])
23342+ free_page((unsigned long)pxds[i]);
23343 }
23344
23345-static int preallocate_pmds(pmd_t *pmds[])
23346+static int preallocate_pxds(pxd_t *pxds[])
23347 {
23348 int i;
23349 bool failed = false;
23350
23351- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23352- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
23353- if (pmd == NULL)
23354+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23355+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
23356+ if (pxd == NULL)
23357 failed = true;
23358- pmds[i] = pmd;
23359+ pxds[i] = pxd;
23360 }
23361
23362 if (failed) {
23363- free_pmds(pmds);
23364+ free_pxds(pxds);
23365 return -ENOMEM;
23366 }
23367
23368@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[])
23369 * preallocate which never got a corresponding vma will need to be
23370 * freed manually.
23371 */
23372-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
23373+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
23374 {
23375 int i;
23376
23377- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23378+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23379 pgd_t pgd = pgdp[i];
23380
23381 if (pgd_val(pgd) != 0) {
23382- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
23383+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
23384
23385- pgdp[i] = native_make_pgd(0);
23386+ set_pgd(pgdp + i, native_make_pgd(0));
23387
23388- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
23389- pmd_free(mm, pmd);
23390+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
23391+ pxd_free(mm, pxd);
23392 }
23393 }
23394 }
23395
23396-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23397+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23398 {
23399- pud_t *pud;
23400+ pyd_t *pyd;
23401 unsigned long addr;
23402 int i;
23403
23404- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23405+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23406 return;
23407
23408- pud = pud_offset(pgd, 0);
23409+#ifdef CONFIG_X86_64
23410+ pyd = pyd_offset(mm, 0L);
23411+#else
23412+ pyd = pyd_offset(pgd, 0L);
23413+#endif
23414
23415- for (addr = i = 0; i < PREALLOCATED_PMDS;
23416- i++, pud++, addr += PUD_SIZE) {
23417- pmd_t *pmd = pmds[i];
23418+ for (addr = i = 0; i < PREALLOCATED_PXDS;
23419+ i++, pyd++, addr += PYD_SIZE) {
23420+ pxd_t *pxd = pxds[i];
23421
23422 if (i >= KERNEL_PGD_BOUNDARY)
23423- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23424- sizeof(pmd_t) * PTRS_PER_PMD);
23425+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23426+ sizeof(pxd_t) * PTRS_PER_PMD);
23427
23428- pud_populate(mm, pud, pmd);
23429+ pyd_populate(mm, pyd, pxd);
23430 }
23431 }
23432
23433 pgd_t *pgd_alloc(struct mm_struct *mm)
23434 {
23435 pgd_t *pgd;
23436- pmd_t *pmds[PREALLOCATED_PMDS];
23437+ pxd_t *pxds[PREALLOCATED_PXDS];
23438
23439 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23440
23441@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23442
23443 mm->pgd = pgd;
23444
23445- if (preallocate_pmds(pmds) != 0)
23446+ if (preallocate_pxds(pxds) != 0)
23447 goto out_free_pgd;
23448
23449 if (paravirt_pgd_alloc(mm) != 0)
23450- goto out_free_pmds;
23451+ goto out_free_pxds;
23452
23453 /*
23454 * Make sure that pre-populating the pmds is atomic with
23455@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23456 spin_lock(&pgd_lock);
23457
23458 pgd_ctor(mm, pgd);
23459- pgd_prepopulate_pmd(mm, pgd, pmds);
23460+ pgd_prepopulate_pxd(mm, pgd, pxds);
23461
23462 spin_unlock(&pgd_lock);
23463
23464 return pgd;
23465
23466-out_free_pmds:
23467- free_pmds(pmds);
23468+out_free_pxds:
23469+ free_pxds(pxds);
23470 out_free_pgd:
23471 free_page((unsigned long)pgd);
23472 out:
23473@@ -295,7 +344,7 @@ out:
23474
23475 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23476 {
23477- pgd_mop_up_pmds(mm, pgd);
23478+ pgd_mop_up_pxds(mm, pgd);
23479 pgd_dtor(pgd);
23480 paravirt_pgd_free(mm, pgd);
23481 free_page((unsigned long)pgd);
23482diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
23483index cac7184..09a39fa 100644
23484--- a/arch/x86/mm/pgtable_32.c
23485+++ b/arch/x86/mm/pgtable_32.c
23486@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
23487 return;
23488 }
23489 pte = pte_offset_kernel(pmd, vaddr);
23490+
23491+ pax_open_kernel();
23492 if (pte_val(pteval))
23493 set_pte_at(&init_mm, vaddr, pte, pteval);
23494 else
23495 pte_clear(&init_mm, vaddr, pte);
23496+ pax_close_kernel();
23497
23498 /*
23499 * It's enough to flush this one mapping.
23500diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
23501index 410531d..0f16030 100644
23502--- a/arch/x86/mm/setup_nx.c
23503+++ b/arch/x86/mm/setup_nx.c
23504@@ -5,8 +5,10 @@
23505 #include <asm/pgtable.h>
23506 #include <asm/proto.h>
23507
23508+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23509 static int disable_nx __cpuinitdata;
23510
23511+#ifndef CONFIG_PAX_PAGEEXEC
23512 /*
23513 * noexec = on|off
23514 *
23515@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
23516 return 0;
23517 }
23518 early_param("noexec", noexec_setup);
23519+#endif
23520+
23521+#endif
23522
23523 void __cpuinit x86_configure_nx(void)
23524 {
23525+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23526 if (cpu_has_nx && !disable_nx)
23527 __supported_pte_mask |= _PAGE_NX;
23528 else
23529+#endif
23530 __supported_pte_mask &= ~_PAGE_NX;
23531 }
23532
23533diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
23534index d6c0418..06a0ad5 100644
23535--- a/arch/x86/mm/tlb.c
23536+++ b/arch/x86/mm/tlb.c
23537@@ -65,7 +65,11 @@ void leave_mm(int cpu)
23538 BUG();
23539 cpumask_clear_cpu(cpu,
23540 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23541+
23542+#ifndef CONFIG_PAX_PER_CPU_PGD
23543 load_cr3(swapper_pg_dir);
23544+#endif
23545+
23546 }
23547 EXPORT_SYMBOL_GPL(leave_mm);
23548
23549diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
23550index 6687022..ceabcfa 100644
23551--- a/arch/x86/net/bpf_jit.S
23552+++ b/arch/x86/net/bpf_jit.S
23553@@ -9,6 +9,7 @@
23554 */
23555 #include <linux/linkage.h>
23556 #include <asm/dwarf2.h>
23557+#include <asm/alternative-asm.h>
23558
23559 /*
23560 * Calling convention :
23561@@ -35,6 +36,7 @@ sk_load_word:
23562 jle bpf_slow_path_word
23563 mov (SKBDATA,%rsi),%eax
23564 bswap %eax /* ntohl() */
23565+ pax_force_retaddr
23566 ret
23567
23568
23569@@ -53,6 +55,7 @@ sk_load_half:
23570 jle bpf_slow_path_half
23571 movzwl (SKBDATA,%rsi),%eax
23572 rol $8,%ax # ntohs()
23573+ pax_force_retaddr
23574 ret
23575
23576 sk_load_byte_ind:
23577@@ -66,6 +69,7 @@ sk_load_byte:
23578 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
23579 jle bpf_slow_path_byte
23580 movzbl (SKBDATA,%rsi),%eax
23581+ pax_force_retaddr
23582 ret
23583
23584 /**
23585@@ -82,6 +86,7 @@ ENTRY(sk_load_byte_msh)
23586 movzbl (SKBDATA,%rsi),%ebx
23587 and $15,%bl
23588 shl $2,%bl
23589+ pax_force_retaddr
23590 ret
23591 CFI_ENDPROC
23592 ENDPROC(sk_load_byte_msh)
23593@@ -91,6 +96,7 @@ bpf_error:
23594 xor %eax,%eax
23595 mov -8(%rbp),%rbx
23596 leaveq
23597+ pax_force_retaddr
23598 ret
23599
23600 /* rsi contains offset and can be scratched */
23601@@ -113,6 +119,7 @@ bpf_slow_path_word:
23602 js bpf_error
23603 mov -12(%rbp),%eax
23604 bswap %eax
23605+ pax_force_retaddr
23606 ret
23607
23608 bpf_slow_path_half:
23609@@ -121,12 +128,14 @@ bpf_slow_path_half:
23610 mov -12(%rbp),%ax
23611 rol $8,%ax
23612 movzwl %ax,%eax
23613+ pax_force_retaddr
23614 ret
23615
23616 bpf_slow_path_byte:
23617 bpf_slow_path_common(1)
23618 js bpf_error
23619 movzbl -12(%rbp),%eax
23620+ pax_force_retaddr
23621 ret
23622
23623 bpf_slow_path_byte_msh:
23624@@ -137,4 +146,5 @@ bpf_slow_path_byte_msh:
23625 and $15,%al
23626 shl $2,%al
23627 xchg %eax,%ebx
23628+ pax_force_retaddr
23629 ret
23630diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
23631index bfab3fa..05aac3a 100644
23632--- a/arch/x86/net/bpf_jit_comp.c
23633+++ b/arch/x86/net/bpf_jit_comp.c
23634@@ -117,6 +117,10 @@ static inline void bpf_flush_icache(void *start, void *end)
23635 set_fs(old_fs);
23636 }
23637
23638+struct bpf_jit_work {
23639+ struct work_struct work;
23640+ void *image;
23641+};
23642
23643 void bpf_jit_compile(struct sk_filter *fp)
23644 {
23645@@ -141,6 +145,10 @@ void bpf_jit_compile(struct sk_filter *fp)
23646 if (addrs == NULL)
23647 return;
23648
23649+ fp->work = kmalloc(sizeof(*fp->work), GFP_KERNEL);
23650+ if (!fp->work)
23651+ goto out;
23652+
23653 /* Before first pass, make a rough estimation of addrs[]
23654 * each bpf instruction is translated to less than 64 bytes
23655 */
23656@@ -585,11 +593,12 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23657 if (image) {
23658 if (unlikely(proglen + ilen > oldproglen)) {
23659 pr_err("bpb_jit_compile fatal error\n");
23660- kfree(addrs);
23661- module_free(NULL, image);
23662- return;
23663+ module_free_exec(NULL, image);
23664+ goto out;
23665 }
23666+ pax_open_kernel();
23667 memcpy(image + proglen, temp, ilen);
23668+ pax_close_kernel();
23669 }
23670 proglen += ilen;
23671 addrs[i] = proglen;
23672@@ -609,7 +618,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23673 break;
23674 }
23675 if (proglen == oldproglen) {
23676- image = module_alloc(max_t(unsigned int,
23677+ image = module_alloc_exec(max_t(unsigned int,
23678 proglen,
23679 sizeof(struct work_struct)));
23680 if (!image)
23681@@ -631,24 +640,27 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23682 fp->bpf_func = (void *)image;
23683 }
23684 out:
23685+ kfree(fp->work);
23686 kfree(addrs);
23687 return;
23688 }
23689
23690 static void jit_free_defer(struct work_struct *arg)
23691 {
23692- module_free(NULL, arg);
23693+ module_free_exec(NULL, ((struct bpf_jit_work*)arg)->image);
23694+ kfree(arg);
23695 }
23696
23697 /* run from softirq, we must use a work_struct to call
23698- * module_free() from process context
23699+ * module_free_exec() from process context
23700 */
23701 void bpf_jit_free(struct sk_filter *fp)
23702 {
23703 if (fp->bpf_func != sk_run_filter) {
23704- struct work_struct *work = (struct work_struct *)fp->bpf_func;
23705+ struct work_struct *work = &fp->work->work;
23706
23707 INIT_WORK(work, jit_free_defer);
23708+ fp->work->image = fp->bpf_func;
23709 schedule_work(work);
23710 }
23711 }
23712diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
23713index bff89df..377758a 100644
23714--- a/arch/x86/oprofile/backtrace.c
23715+++ b/arch/x86/oprofile/backtrace.c
23716@@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
23717 struct stack_frame_ia32 *fp;
23718 unsigned long bytes;
23719
23720- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23721+ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23722 if (bytes != sizeof(bufhead))
23723 return NULL;
23724
23725- fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
23726+ fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
23727
23728 oprofile_add_trace(bufhead[0].return_address);
23729
23730@@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
23731 struct stack_frame bufhead[2];
23732 unsigned long bytes;
23733
23734- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23735+ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23736 if (bytes != sizeof(bufhead))
23737 return NULL;
23738
23739@@ -111,7 +111,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
23740 {
23741 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23742
23743- if (!user_mode_vm(regs)) {
23744+ if (!user_mode(regs)) {
23745 unsigned long stack = kernel_stack_pointer(regs);
23746 if (depth)
23747 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23748diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
23749index cb29191..036766d 100644
23750--- a/arch/x86/pci/mrst.c
23751+++ b/arch/x86/pci/mrst.c
23752@@ -234,7 +234,9 @@ int __init pci_mrst_init(void)
23753 printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n");
23754 pci_mmcfg_late_init();
23755 pcibios_enable_irq = mrst_pci_irq_enable;
23756- pci_root_ops = pci_mrst_ops;
23757+ pax_open_kernel();
23758+ memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
23759+ pax_close_kernel();
23760 /* Continue with standard init */
23761 return 1;
23762 }
23763diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
23764index f685535..2b76a81 100644
23765--- a/arch/x86/pci/pcbios.c
23766+++ b/arch/x86/pci/pcbios.c
23767@@ -79,50 +79,93 @@ union bios32 {
23768 static struct {
23769 unsigned long address;
23770 unsigned short segment;
23771-} bios32_indirect = { 0, __KERNEL_CS };
23772+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23773
23774 /*
23775 * Returns the entry point for the given service, NULL on error
23776 */
23777
23778-static unsigned long bios32_service(unsigned long service)
23779+static unsigned long __devinit bios32_service(unsigned long service)
23780 {
23781 unsigned char return_code; /* %al */
23782 unsigned long address; /* %ebx */
23783 unsigned long length; /* %ecx */
23784 unsigned long entry; /* %edx */
23785 unsigned long flags;
23786+ struct desc_struct d, *gdt;
23787
23788 local_irq_save(flags);
23789- __asm__("lcall *(%%edi); cld"
23790+
23791+ gdt = get_cpu_gdt_table(smp_processor_id());
23792+
23793+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23794+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23795+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23796+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23797+
23798+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23799 : "=a" (return_code),
23800 "=b" (address),
23801 "=c" (length),
23802 "=d" (entry)
23803 : "0" (service),
23804 "1" (0),
23805- "D" (&bios32_indirect));
23806+ "D" (&bios32_indirect),
23807+ "r"(__PCIBIOS_DS)
23808+ : "memory");
23809+
23810+ pax_open_kernel();
23811+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23812+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23813+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23814+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23815+ pax_close_kernel();
23816+
23817 local_irq_restore(flags);
23818
23819 switch (return_code) {
23820- case 0:
23821- return address + entry;
23822- case 0x80: /* Not present */
23823- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23824- return 0;
23825- default: /* Shouldn't happen */
23826- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23827- service, return_code);
23828+ case 0: {
23829+ int cpu;
23830+ unsigned char flags;
23831+
23832+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23833+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23834+ printk(KERN_WARNING "bios32_service: not valid\n");
23835 return 0;
23836+ }
23837+ address = address + PAGE_OFFSET;
23838+ length += 16UL; /* some BIOSs underreport this... */
23839+ flags = 4;
23840+ if (length >= 64*1024*1024) {
23841+ length >>= PAGE_SHIFT;
23842+ flags |= 8;
23843+ }
23844+
23845+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23846+ gdt = get_cpu_gdt_table(cpu);
23847+ pack_descriptor(&d, address, length, 0x9b, flags);
23848+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23849+ pack_descriptor(&d, address, length, 0x93, flags);
23850+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23851+ }
23852+ return entry;
23853+ }
23854+ case 0x80: /* Not present */
23855+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23856+ return 0;
23857+ default: /* Shouldn't happen */
23858+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23859+ service, return_code);
23860+ return 0;
23861 }
23862 }
23863
23864 static struct {
23865 unsigned long address;
23866 unsigned short segment;
23867-} pci_indirect = { 0, __KERNEL_CS };
23868+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23869
23870-static int pci_bios_present;
23871+static int pci_bios_present __read_only;
23872
23873 static int __devinit check_pcibios(void)
23874 {
23875@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23876 unsigned long flags, pcibios_entry;
23877
23878 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23879- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23880+ pci_indirect.address = pcibios_entry;
23881
23882 local_irq_save(flags);
23883- __asm__(
23884- "lcall *(%%edi); cld\n\t"
23885+ __asm__("movw %w6, %%ds\n\t"
23886+ "lcall *%%ss:(%%edi); cld\n\t"
23887+ "push %%ss\n\t"
23888+ "pop %%ds\n\t"
23889 "jc 1f\n\t"
23890 "xor %%ah, %%ah\n"
23891 "1:"
23892@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23893 "=b" (ebx),
23894 "=c" (ecx)
23895 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23896- "D" (&pci_indirect)
23897+ "D" (&pci_indirect),
23898+ "r" (__PCIBIOS_DS)
23899 : "memory");
23900 local_irq_restore(flags);
23901
23902@@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23903
23904 switch (len) {
23905 case 1:
23906- __asm__("lcall *(%%esi); cld\n\t"
23907+ __asm__("movw %w6, %%ds\n\t"
23908+ "lcall *%%ss:(%%esi); cld\n\t"
23909+ "push %%ss\n\t"
23910+ "pop %%ds\n\t"
23911 "jc 1f\n\t"
23912 "xor %%ah, %%ah\n"
23913 "1:"
23914@@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23915 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23916 "b" (bx),
23917 "D" ((long)reg),
23918- "S" (&pci_indirect));
23919+ "S" (&pci_indirect),
23920+ "r" (__PCIBIOS_DS));
23921 /*
23922 * Zero-extend the result beyond 8 bits, do not trust the
23923 * BIOS having done it:
23924@@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23925 *value &= 0xff;
23926 break;
23927 case 2:
23928- __asm__("lcall *(%%esi); cld\n\t"
23929+ __asm__("movw %w6, %%ds\n\t"
23930+ "lcall *%%ss:(%%esi); cld\n\t"
23931+ "push %%ss\n\t"
23932+ "pop %%ds\n\t"
23933 "jc 1f\n\t"
23934 "xor %%ah, %%ah\n"
23935 "1:"
23936@@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23937 : "1" (PCIBIOS_READ_CONFIG_WORD),
23938 "b" (bx),
23939 "D" ((long)reg),
23940- "S" (&pci_indirect));
23941+ "S" (&pci_indirect),
23942+ "r" (__PCIBIOS_DS));
23943 /*
23944 * Zero-extend the result beyond 16 bits, do not trust the
23945 * BIOS having done it:
23946@@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23947 *value &= 0xffff;
23948 break;
23949 case 4:
23950- __asm__("lcall *(%%esi); cld\n\t"
23951+ __asm__("movw %w6, %%ds\n\t"
23952+ "lcall *%%ss:(%%esi); cld\n\t"
23953+ "push %%ss\n\t"
23954+ "pop %%ds\n\t"
23955 "jc 1f\n\t"
23956 "xor %%ah, %%ah\n"
23957 "1:"
23958@@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23959 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23960 "b" (bx),
23961 "D" ((long)reg),
23962- "S" (&pci_indirect));
23963+ "S" (&pci_indirect),
23964+ "r" (__PCIBIOS_DS));
23965 break;
23966 }
23967
23968@@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23969
23970 switch (len) {
23971 case 1:
23972- __asm__("lcall *(%%esi); cld\n\t"
23973+ __asm__("movw %w6, %%ds\n\t"
23974+ "lcall *%%ss:(%%esi); cld\n\t"
23975+ "push %%ss\n\t"
23976+ "pop %%ds\n\t"
23977 "jc 1f\n\t"
23978 "xor %%ah, %%ah\n"
23979 "1:"
23980@@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23981 "c" (value),
23982 "b" (bx),
23983 "D" ((long)reg),
23984- "S" (&pci_indirect));
23985+ "S" (&pci_indirect),
23986+ "r" (__PCIBIOS_DS));
23987 break;
23988 case 2:
23989- __asm__("lcall *(%%esi); cld\n\t"
23990+ __asm__("movw %w6, %%ds\n\t"
23991+ "lcall *%%ss:(%%esi); cld\n\t"
23992+ "push %%ss\n\t"
23993+ "pop %%ds\n\t"
23994 "jc 1f\n\t"
23995 "xor %%ah, %%ah\n"
23996 "1:"
23997@@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23998 "c" (value),
23999 "b" (bx),
24000 "D" ((long)reg),
24001- "S" (&pci_indirect));
24002+ "S" (&pci_indirect),
24003+ "r" (__PCIBIOS_DS));
24004 break;
24005 case 4:
24006- __asm__("lcall *(%%esi); cld\n\t"
24007+ __asm__("movw %w6, %%ds\n\t"
24008+ "lcall *%%ss:(%%esi); cld\n\t"
24009+ "push %%ss\n\t"
24010+ "pop %%ds\n\t"
24011 "jc 1f\n\t"
24012 "xor %%ah, %%ah\n"
24013 "1:"
24014@@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24015 "c" (value),
24016 "b" (bx),
24017 "D" ((long)reg),
24018- "S" (&pci_indirect));
24019+ "S" (&pci_indirect),
24020+ "r" (__PCIBIOS_DS));
24021 break;
24022 }
24023
24024@@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24025
24026 DBG("PCI: Fetching IRQ routing table... ");
24027 __asm__("push %%es\n\t"
24028+ "movw %w8, %%ds\n\t"
24029 "push %%ds\n\t"
24030 "pop %%es\n\t"
24031- "lcall *(%%esi); cld\n\t"
24032+ "lcall *%%ss:(%%esi); cld\n\t"
24033 "pop %%es\n\t"
24034+ "push %%ss\n\t"
24035+ "pop %%ds\n"
24036 "jc 1f\n\t"
24037 "xor %%ah, %%ah\n"
24038 "1:"
24039@@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24040 "1" (0),
24041 "D" ((long) &opt),
24042 "S" (&pci_indirect),
24043- "m" (opt)
24044+ "m" (opt),
24045+ "r" (__PCIBIOS_DS)
24046 : "memory");
24047 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
24048 if (ret & 0xff00)
24049@@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24050 {
24051 int ret;
24052
24053- __asm__("lcall *(%%esi); cld\n\t"
24054+ __asm__("movw %w5, %%ds\n\t"
24055+ "lcall *%%ss:(%%esi); cld\n\t"
24056+ "push %%ss\n\t"
24057+ "pop %%ds\n"
24058 "jc 1f\n\t"
24059 "xor %%ah, %%ah\n"
24060 "1:"
24061@@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24062 : "0" (PCIBIOS_SET_PCI_HW_INT),
24063 "b" ((dev->bus->number << 8) | dev->devfn),
24064 "c" ((irq << 8) | (pin + 10)),
24065- "S" (&pci_indirect));
24066+ "S" (&pci_indirect),
24067+ "r" (__PCIBIOS_DS));
24068 return !(ret & 0xff00);
24069 }
24070 EXPORT_SYMBOL(pcibios_set_irq_routing);
24071diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
24072index 5cab48e..b025f9b 100644
24073--- a/arch/x86/platform/efi/efi_32.c
24074+++ b/arch/x86/platform/efi/efi_32.c
24075@@ -38,70 +38,56 @@
24076 */
24077
24078 static unsigned long efi_rt_eflags;
24079-static pgd_t efi_bak_pg_dir_pointer[2];
24080+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
24081
24082-void efi_call_phys_prelog(void)
24083+void __init efi_call_phys_prelog(void)
24084 {
24085- unsigned long cr4;
24086- unsigned long temp;
24087 struct desc_ptr gdt_descr;
24088
24089+#ifdef CONFIG_PAX_KERNEXEC
24090+ struct desc_struct d;
24091+#endif
24092+
24093 local_irq_save(efi_rt_eflags);
24094
24095- /*
24096- * If I don't have PAE, I should just duplicate two entries in page
24097- * directory. If I have PAE, I just need to duplicate one entry in
24098- * page directory.
24099- */
24100- cr4 = read_cr4_safe();
24101-
24102- if (cr4 & X86_CR4_PAE) {
24103- efi_bak_pg_dir_pointer[0].pgd =
24104- swapper_pg_dir[pgd_index(0)].pgd;
24105- swapper_pg_dir[0].pgd =
24106- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24107- } else {
24108- efi_bak_pg_dir_pointer[0].pgd =
24109- swapper_pg_dir[pgd_index(0)].pgd;
24110- efi_bak_pg_dir_pointer[1].pgd =
24111- swapper_pg_dir[pgd_index(0x400000)].pgd;
24112- swapper_pg_dir[pgd_index(0)].pgd =
24113- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24114- temp = PAGE_OFFSET + 0x400000;
24115- swapper_pg_dir[pgd_index(0x400000)].pgd =
24116- swapper_pg_dir[pgd_index(temp)].pgd;
24117- }
24118+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
24119+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
24120+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
24121
24122 /*
24123 * After the lock is released, the original page table is restored.
24124 */
24125 __flush_tlb_all();
24126
24127+#ifdef CONFIG_PAX_KERNEXEC
24128+ pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
24129+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24130+ pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
24131+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24132+#endif
24133+
24134 gdt_descr.address = __pa(get_cpu_gdt_table(0));
24135 gdt_descr.size = GDT_SIZE - 1;
24136 load_gdt(&gdt_descr);
24137 }
24138
24139-void efi_call_phys_epilog(void)
24140+void __init efi_call_phys_epilog(void)
24141 {
24142- unsigned long cr4;
24143 struct desc_ptr gdt_descr;
24144
24145+#ifdef CONFIG_PAX_KERNEXEC
24146+ struct desc_struct d;
24147+
24148+ memset(&d, 0, sizeof d);
24149+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24150+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24151+#endif
24152+
24153 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
24154 gdt_descr.size = GDT_SIZE - 1;
24155 load_gdt(&gdt_descr);
24156
24157- cr4 = read_cr4_safe();
24158-
24159- if (cr4 & X86_CR4_PAE) {
24160- swapper_pg_dir[pgd_index(0)].pgd =
24161- efi_bak_pg_dir_pointer[0].pgd;
24162- } else {
24163- swapper_pg_dir[pgd_index(0)].pgd =
24164- efi_bak_pg_dir_pointer[0].pgd;
24165- swapper_pg_dir[pgd_index(0x400000)].pgd =
24166- efi_bak_pg_dir_pointer[1].pgd;
24167- }
24168+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
24169
24170 /*
24171 * After the lock is released, the original page table is restored.
24172diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
24173index fbe66e6..c5c0dd2 100644
24174--- a/arch/x86/platform/efi/efi_stub_32.S
24175+++ b/arch/x86/platform/efi/efi_stub_32.S
24176@@ -6,7 +6,9 @@
24177 */
24178
24179 #include <linux/linkage.h>
24180+#include <linux/init.h>
24181 #include <asm/page_types.h>
24182+#include <asm/segment.h>
24183
24184 /*
24185 * efi_call_phys(void *, ...) is a function with variable parameters.
24186@@ -20,7 +22,7 @@
24187 * service functions will comply with gcc calling convention, too.
24188 */
24189
24190-.text
24191+__INIT
24192 ENTRY(efi_call_phys)
24193 /*
24194 * 0. The function can only be called in Linux kernel. So CS has been
24195@@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
24196 * The mapping of lower virtual memory has been created in prelog and
24197 * epilog.
24198 */
24199- movl $1f, %edx
24200- subl $__PAGE_OFFSET, %edx
24201- jmp *%edx
24202+ movl $(__KERNEXEC_EFI_DS), %edx
24203+ mov %edx, %ds
24204+ mov %edx, %es
24205+ mov %edx, %ss
24206+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
24207 1:
24208
24209 /*
24210@@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
24211 * parameter 2, ..., param n. To make things easy, we save the return
24212 * address of efi_call_phys in a global variable.
24213 */
24214- popl %edx
24215- movl %edx, saved_return_addr
24216- /* get the function pointer into ECX*/
24217- popl %ecx
24218- movl %ecx, efi_rt_function_ptr
24219- movl $2f, %edx
24220- subl $__PAGE_OFFSET, %edx
24221- pushl %edx
24222+ popl (saved_return_addr)
24223+ popl (efi_rt_function_ptr)
24224
24225 /*
24226 * 3. Clear PG bit in %CR0.
24227@@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
24228 /*
24229 * 5. Call the physical function.
24230 */
24231- jmp *%ecx
24232+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
24233
24234-2:
24235 /*
24236 * 6. After EFI runtime service returns, control will return to
24237 * following instruction. We'd better readjust stack pointer first.
24238@@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
24239 movl %cr0, %edx
24240 orl $0x80000000, %edx
24241 movl %edx, %cr0
24242- jmp 1f
24243-1:
24244+
24245 /*
24246 * 8. Now restore the virtual mode from flat mode by
24247 * adding EIP with PAGE_OFFSET.
24248 */
24249- movl $1f, %edx
24250- jmp *%edx
24251+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
24252 1:
24253+ movl $(__KERNEL_DS), %edx
24254+ mov %edx, %ds
24255+ mov %edx, %es
24256+ mov %edx, %ss
24257
24258 /*
24259 * 9. Balance the stack. And because EAX contain the return value,
24260 * we'd better not clobber it.
24261 */
24262- leal efi_rt_function_ptr, %edx
24263- movl (%edx), %ecx
24264- pushl %ecx
24265+ pushl (efi_rt_function_ptr)
24266
24267 /*
24268- * 10. Push the saved return address onto the stack and return.
24269+ * 10. Return to the saved return address.
24270 */
24271- leal saved_return_addr, %edx
24272- movl (%edx), %ecx
24273- pushl %ecx
24274- ret
24275+ jmpl *(saved_return_addr)
24276 ENDPROC(efi_call_phys)
24277 .previous
24278
24279-.data
24280+__INITDATA
24281 saved_return_addr:
24282 .long 0
24283 efi_rt_function_ptr:
24284diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
24285index 4c07cca..2c8427d 100644
24286--- a/arch/x86/platform/efi/efi_stub_64.S
24287+++ b/arch/x86/platform/efi/efi_stub_64.S
24288@@ -7,6 +7,7 @@
24289 */
24290
24291 #include <linux/linkage.h>
24292+#include <asm/alternative-asm.h>
24293
24294 #define SAVE_XMM \
24295 mov %rsp, %rax; \
24296@@ -40,6 +41,7 @@ ENTRY(efi_call0)
24297 call *%rdi
24298 addq $32, %rsp
24299 RESTORE_XMM
24300+ pax_force_retaddr 0, 1
24301 ret
24302 ENDPROC(efi_call0)
24303
24304@@ -50,6 +52,7 @@ ENTRY(efi_call1)
24305 call *%rdi
24306 addq $32, %rsp
24307 RESTORE_XMM
24308+ pax_force_retaddr 0, 1
24309 ret
24310 ENDPROC(efi_call1)
24311
24312@@ -60,6 +63,7 @@ ENTRY(efi_call2)
24313 call *%rdi
24314 addq $32, %rsp
24315 RESTORE_XMM
24316+ pax_force_retaddr 0, 1
24317 ret
24318 ENDPROC(efi_call2)
24319
24320@@ -71,6 +75,7 @@ ENTRY(efi_call3)
24321 call *%rdi
24322 addq $32, %rsp
24323 RESTORE_XMM
24324+ pax_force_retaddr 0, 1
24325 ret
24326 ENDPROC(efi_call3)
24327
24328@@ -83,6 +88,7 @@ ENTRY(efi_call4)
24329 call *%rdi
24330 addq $32, %rsp
24331 RESTORE_XMM
24332+ pax_force_retaddr 0, 1
24333 ret
24334 ENDPROC(efi_call4)
24335
24336@@ -96,6 +102,7 @@ ENTRY(efi_call5)
24337 call *%rdi
24338 addq $48, %rsp
24339 RESTORE_XMM
24340+ pax_force_retaddr 0, 1
24341 ret
24342 ENDPROC(efi_call5)
24343
24344@@ -112,5 +119,6 @@ ENTRY(efi_call6)
24345 call *%rdi
24346 addq $48, %rsp
24347 RESTORE_XMM
24348+ pax_force_retaddr 0, 1
24349 ret
24350 ENDPROC(efi_call6)
24351diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
24352index fe73276..70fe25a 100644
24353--- a/arch/x86/platform/mrst/mrst.c
24354+++ b/arch/x86/platform/mrst/mrst.c
24355@@ -239,14 +239,16 @@ static int mrst_i8042_detect(void)
24356 }
24357
24358 /* Reboot and power off are handled by the SCU on a MID device */
24359-static void mrst_power_off(void)
24360+static __noreturn void mrst_power_off(void)
24361 {
24362 intel_scu_ipc_simple_command(0xf1, 1);
24363+ BUG();
24364 }
24365
24366-static void mrst_reboot(void)
24367+static __noreturn void mrst_reboot(void)
24368 {
24369 intel_scu_ipc_simple_command(0xf1, 0);
24370+ BUG();
24371 }
24372
24373 /*
24374diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
24375index 5b55219..b326540 100644
24376--- a/arch/x86/platform/uv/tlb_uv.c
24377+++ b/arch/x86/platform/uv/tlb_uv.c
24378@@ -377,6 +377,8 @@ static void reset_with_ipi(struct pnmask *distribution, struct bau_control *bcp)
24379 struct bau_control *smaster = bcp->socket_master;
24380 struct reset_args reset_args;
24381
24382+ pax_track_stack();
24383+
24384 reset_args.sender = sender;
24385 cpus_clear(*mask);
24386 /* find a single cpu for each uvhub in this distribution mask */
24387diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
24388index 87bb35e..eff2da8 100644
24389--- a/arch/x86/power/cpu.c
24390+++ b/arch/x86/power/cpu.c
24391@@ -130,7 +130,7 @@ static void do_fpu_end(void)
24392 static void fix_processor_context(void)
24393 {
24394 int cpu = smp_processor_id();
24395- struct tss_struct *t = &per_cpu(init_tss, cpu);
24396+ struct tss_struct *t = init_tss + cpu;
24397
24398 set_tss_desc(cpu, t); /*
24399 * This just modifies memory; should not be
24400@@ -140,7 +140,9 @@ static void fix_processor_context(void)
24401 */
24402
24403 #ifdef CONFIG_X86_64
24404+ pax_open_kernel();
24405 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24406+ pax_close_kernel();
24407
24408 syscall_init(); /* This sets MSR_*STAR and related */
24409 #endif
24410diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
24411index 5d17950..2253fc9 100644
24412--- a/arch/x86/vdso/Makefile
24413+++ b/arch/x86/vdso/Makefile
24414@@ -137,7 +137,7 @@ quiet_cmd_vdso = VDSO $@
24415 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
24416 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
24417
24418-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24419+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24420 GCOV_PROFILE := n
24421
24422 #
24423diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
24424index 468d591..8e80a0a 100644
24425--- a/arch/x86/vdso/vdso32-setup.c
24426+++ b/arch/x86/vdso/vdso32-setup.c
24427@@ -25,6 +25,7 @@
24428 #include <asm/tlbflush.h>
24429 #include <asm/vdso.h>
24430 #include <asm/proto.h>
24431+#include <asm/mman.h>
24432
24433 enum {
24434 VDSO_DISABLED = 0,
24435@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
24436 void enable_sep_cpu(void)
24437 {
24438 int cpu = get_cpu();
24439- struct tss_struct *tss = &per_cpu(init_tss, cpu);
24440+ struct tss_struct *tss = init_tss + cpu;
24441
24442 if (!boot_cpu_has(X86_FEATURE_SEP)) {
24443 put_cpu();
24444@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
24445 gate_vma.vm_start = FIXADDR_USER_START;
24446 gate_vma.vm_end = FIXADDR_USER_END;
24447 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
24448- gate_vma.vm_page_prot = __P101;
24449+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
24450 /*
24451 * Make sure the vDSO gets into every core dump.
24452 * Dumping its contents makes post-mortem fully interpretable later
24453@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24454 if (compat)
24455 addr = VDSO_HIGH_BASE;
24456 else {
24457- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
24458+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
24459 if (IS_ERR_VALUE(addr)) {
24460 ret = addr;
24461 goto up_fail;
24462 }
24463 }
24464
24465- current->mm->context.vdso = (void *)addr;
24466+ current->mm->context.vdso = addr;
24467
24468 if (compat_uses_vma || !compat) {
24469 /*
24470@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24471 }
24472
24473 current_thread_info()->sysenter_return =
24474- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24475+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24476
24477 up_fail:
24478 if (ret)
24479- current->mm->context.vdso = NULL;
24480+ current->mm->context.vdso = 0;
24481
24482 up_write(&mm->mmap_sem);
24483
24484@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
24485
24486 const char *arch_vma_name(struct vm_area_struct *vma)
24487 {
24488- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24489+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24490 return "[vdso]";
24491+
24492+#ifdef CONFIG_PAX_SEGMEXEC
24493+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24494+ return "[vdso]";
24495+#endif
24496+
24497 return NULL;
24498 }
24499
24500@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
24501 * Check to see if the corresponding task was created in compat vdso
24502 * mode.
24503 */
24504- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24505+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24506 return &gate_vma;
24507 return NULL;
24508 }
24509diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
24510index 316fbca..4638633 100644
24511--- a/arch/x86/vdso/vma.c
24512+++ b/arch/x86/vdso/vma.c
24513@@ -16,8 +16,6 @@
24514 #include <asm/vdso.h>
24515 #include <asm/page.h>
24516
24517-unsigned int __read_mostly vdso_enabled = 1;
24518-
24519 extern char vdso_start[], vdso_end[];
24520 extern unsigned short vdso_sync_cpuid;
24521
24522@@ -97,13 +95,15 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
24523 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24524 {
24525 struct mm_struct *mm = current->mm;
24526- unsigned long addr;
24527+ unsigned long addr = 0;
24528 int ret;
24529
24530- if (!vdso_enabled)
24531- return 0;
24532-
24533 down_write(&mm->mmap_sem);
24534+
24535+#ifdef CONFIG_PAX_RANDMMAP
24536+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
24537+#endif
24538+
24539 addr = vdso_addr(mm->start_stack, vdso_size);
24540 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
24541 if (IS_ERR_VALUE(addr)) {
24542@@ -111,26 +111,18 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24543 goto up_fail;
24544 }
24545
24546- current->mm->context.vdso = (void *)addr;
24547+ mm->context.vdso = addr;
24548
24549 ret = install_special_mapping(mm, addr, vdso_size,
24550 VM_READ|VM_EXEC|
24551 VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
24552 VM_ALWAYSDUMP,
24553 vdso_pages);
24554- if (ret) {
24555- current->mm->context.vdso = NULL;
24556- goto up_fail;
24557- }
24558+
24559+ if (ret)
24560+ mm->context.vdso = 0;
24561
24562 up_fail:
24563 up_write(&mm->mmap_sem);
24564 return ret;
24565 }
24566-
24567-static __init int vdso_setup(char *s)
24568-{
24569- vdso_enabled = simple_strtoul(s, NULL, 0);
24570- return 0;
24571-}
24572-__setup("vdso=", vdso_setup);
24573diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
24574index 46c8069..6330d3c 100644
24575--- a/arch/x86/xen/enlighten.c
24576+++ b/arch/x86/xen/enlighten.c
24577@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24578
24579 struct shared_info xen_dummy_shared_info;
24580
24581-void *xen_initial_gdt;
24582-
24583 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
24584 __read_mostly int xen_have_vector_callback;
24585 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
24586@@ -1028,7 +1026,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
24587 #endif
24588 };
24589
24590-static void xen_reboot(int reason)
24591+static __noreturn void xen_reboot(int reason)
24592 {
24593 struct sched_shutdown r = { .reason = reason };
24594
24595@@ -1036,17 +1034,17 @@ static void xen_reboot(int reason)
24596 BUG();
24597 }
24598
24599-static void xen_restart(char *msg)
24600+static __noreturn void xen_restart(char *msg)
24601 {
24602 xen_reboot(SHUTDOWN_reboot);
24603 }
24604
24605-static void xen_emergency_restart(void)
24606+static __noreturn void xen_emergency_restart(void)
24607 {
24608 xen_reboot(SHUTDOWN_reboot);
24609 }
24610
24611-static void xen_machine_halt(void)
24612+static __noreturn void xen_machine_halt(void)
24613 {
24614 xen_reboot(SHUTDOWN_poweroff);
24615 }
24616@@ -1152,7 +1150,17 @@ asmlinkage void __init xen_start_kernel(void)
24617 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24618
24619 /* Work out if we support NX */
24620- x86_configure_nx();
24621+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24622+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24623+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24624+ unsigned l, h;
24625+
24626+ __supported_pte_mask |= _PAGE_NX;
24627+ rdmsr(MSR_EFER, l, h);
24628+ l |= EFER_NX;
24629+ wrmsr(MSR_EFER, l, h);
24630+ }
24631+#endif
24632
24633 xen_setup_features();
24634
24635@@ -1183,13 +1191,6 @@ asmlinkage void __init xen_start_kernel(void)
24636
24637 machine_ops = xen_machine_ops;
24638
24639- /*
24640- * The only reliable way to retain the initial address of the
24641- * percpu gdt_page is to remember it here, so we can go and
24642- * mark it RW later, when the initial percpu area is freed.
24643- */
24644- xen_initial_gdt = &per_cpu(gdt_page, 0);
24645-
24646 xen_smp_init();
24647
24648 #ifdef CONFIG_ACPI_NUMA
24649diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
24650index 3dd53f9..5aa5df3 100644
24651--- a/arch/x86/xen/mmu.c
24652+++ b/arch/x86/xen/mmu.c
24653@@ -1768,6 +1768,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24654 convert_pfn_mfn(init_level4_pgt);
24655 convert_pfn_mfn(level3_ident_pgt);
24656 convert_pfn_mfn(level3_kernel_pgt);
24657+ convert_pfn_mfn(level3_vmalloc_start_pgt);
24658+ convert_pfn_mfn(level3_vmalloc_end_pgt);
24659+ convert_pfn_mfn(level3_vmemmap_pgt);
24660
24661 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24662 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24663@@ -1786,7 +1789,11 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24664 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24665 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24666 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24667+ set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
24668+ set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
24669+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24670 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24671+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24672 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24673 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24674
24675@@ -2000,6 +2007,7 @@ static void __init xen_post_allocator_init(void)
24676 pv_mmu_ops.set_pud = xen_set_pud;
24677 #if PAGETABLE_LEVELS == 4
24678 pv_mmu_ops.set_pgd = xen_set_pgd;
24679+ pv_mmu_ops.set_pgd_batched = xen_set_pgd;
24680 #endif
24681
24682 /* This will work as long as patching hasn't happened yet
24683@@ -2081,6 +2089,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
24684 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
24685 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
24686 .set_pgd = xen_set_pgd_hyper,
24687+ .set_pgd_batched = xen_set_pgd_hyper,
24688
24689 .alloc_pud = xen_alloc_pmd_init,
24690 .release_pud = xen_release_pmd_init,
24691diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
24692index 041d4fe..7666b7e 100644
24693--- a/arch/x86/xen/smp.c
24694+++ b/arch/x86/xen/smp.c
24695@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
24696 {
24697 BUG_ON(smp_processor_id() != 0);
24698 native_smp_prepare_boot_cpu();
24699-
24700- /* We've switched to the "real" per-cpu gdt, so make sure the
24701- old memory can be recycled */
24702- make_lowmem_page_readwrite(xen_initial_gdt);
24703-
24704 xen_filter_cpu_maps();
24705 xen_setup_vcpu_info_placement();
24706 }
24707@@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
24708 gdt = get_cpu_gdt_table(cpu);
24709
24710 ctxt->flags = VGCF_IN_KERNEL;
24711- ctxt->user_regs.ds = __USER_DS;
24712- ctxt->user_regs.es = __USER_DS;
24713+ ctxt->user_regs.ds = __KERNEL_DS;
24714+ ctxt->user_regs.es = __KERNEL_DS;
24715 ctxt->user_regs.ss = __KERNEL_DS;
24716 #ifdef CONFIG_X86_32
24717 ctxt->user_regs.fs = __KERNEL_PERCPU;
24718- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24719+ savesegment(gs, ctxt->user_regs.gs);
24720 #else
24721 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24722 #endif
24723@@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
24724 int rc;
24725
24726 per_cpu(current_task, cpu) = idle;
24727+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24728 #ifdef CONFIG_X86_32
24729 irq_ctx_init(cpu);
24730 #else
24731 clear_tsk_thread_flag(idle, TIF_FORK);
24732- per_cpu(kernel_stack, cpu) =
24733- (unsigned long)task_stack_page(idle) -
24734- KERNEL_STACK_OFFSET + THREAD_SIZE;
24735+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24736 #endif
24737 xen_setup_runstate_info(cpu);
24738 xen_setup_timer(cpu);
24739diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
24740index b040b0e..8cc4fe0 100644
24741--- a/arch/x86/xen/xen-asm_32.S
24742+++ b/arch/x86/xen/xen-asm_32.S
24743@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24744 ESP_OFFSET=4 # bytes pushed onto stack
24745
24746 /*
24747- * Store vcpu_info pointer for easy access. Do it this way to
24748- * avoid having to reload %fs
24749+ * Store vcpu_info pointer for easy access.
24750 */
24751 #ifdef CONFIG_SMP
24752- GET_THREAD_INFO(%eax)
24753- movl TI_cpu(%eax), %eax
24754- movl __per_cpu_offset(,%eax,4), %eax
24755- mov xen_vcpu(%eax), %eax
24756+ push %fs
24757+ mov $(__KERNEL_PERCPU), %eax
24758+ mov %eax, %fs
24759+ mov PER_CPU_VAR(xen_vcpu), %eax
24760+ pop %fs
24761 #else
24762 movl xen_vcpu, %eax
24763 #endif
24764diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
24765index aaa7291..3f77960 100644
24766--- a/arch/x86/xen/xen-head.S
24767+++ b/arch/x86/xen/xen-head.S
24768@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24769 #ifdef CONFIG_X86_32
24770 mov %esi,xen_start_info
24771 mov $init_thread_union+THREAD_SIZE,%esp
24772+#ifdef CONFIG_SMP
24773+ movl $cpu_gdt_table,%edi
24774+ movl $__per_cpu_load,%eax
24775+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24776+ rorl $16,%eax
24777+ movb %al,__KERNEL_PERCPU + 4(%edi)
24778+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24779+ movl $__per_cpu_end - 1,%eax
24780+ subl $__per_cpu_start,%eax
24781+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24782+#endif
24783 #else
24784 mov %rsi,xen_start_info
24785 mov $init_thread_union+THREAD_SIZE,%rsp
24786diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
24787index b095739..8c17bcd 100644
24788--- a/arch/x86/xen/xen-ops.h
24789+++ b/arch/x86/xen/xen-ops.h
24790@@ -10,8 +10,6 @@
24791 extern const char xen_hypervisor_callback[];
24792 extern const char xen_failsafe_callback[];
24793
24794-extern void *xen_initial_gdt;
24795-
24796 struct trap_info;
24797 void xen_copy_trap_info(struct trap_info *traps);
24798
24799diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
24800index 58916af..9cb880b 100644
24801--- a/block/blk-iopoll.c
24802+++ b/block/blk-iopoll.c
24803@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
24804 }
24805 EXPORT_SYMBOL(blk_iopoll_complete);
24806
24807-static void blk_iopoll_softirq(struct softirq_action *h)
24808+static void blk_iopoll_softirq(void)
24809 {
24810 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24811 int rearm = 0, budget = blk_iopoll_budget;
24812diff --git a/block/blk-map.c b/block/blk-map.c
24813index 164cd00..6d96fc1 100644
24814--- a/block/blk-map.c
24815+++ b/block/blk-map.c
24816@@ -302,7 +302,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
24817 if (!len || !kbuf)
24818 return -EINVAL;
24819
24820- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24821+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24822 if (do_copy)
24823 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24824 else
24825diff --git a/block/blk-softirq.c b/block/blk-softirq.c
24826index 1366a89..e17f54b 100644
24827--- a/block/blk-softirq.c
24828+++ b/block/blk-softirq.c
24829@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
24830 * Softirq action handler - move entries to local list and loop over them
24831 * while passing them to the queue registered handler.
24832 */
24833-static void blk_done_softirq(struct softirq_action *h)
24834+static void blk_done_softirq(void)
24835 {
24836 struct list_head *cpu_list, local_list;
24837
24838diff --git a/block/bsg.c b/block/bsg.c
24839index 702f131..37808bf 100644
24840--- a/block/bsg.c
24841+++ b/block/bsg.c
24842@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
24843 struct sg_io_v4 *hdr, struct bsg_device *bd,
24844 fmode_t has_write_perm)
24845 {
24846+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24847+ unsigned char *cmdptr;
24848+
24849 if (hdr->request_len > BLK_MAX_CDB) {
24850 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24851 if (!rq->cmd)
24852 return -ENOMEM;
24853- }
24854+ cmdptr = rq->cmd;
24855+ } else
24856+ cmdptr = tmpcmd;
24857
24858- if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
24859+ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
24860 hdr->request_len))
24861 return -EFAULT;
24862
24863+ if (cmdptr != rq->cmd)
24864+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24865+
24866 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24867 if (blk_verify_command(rq->cmd, has_write_perm))
24868 return -EPERM;
24869diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
24870index 7b72502..646105c 100644
24871--- a/block/compat_ioctl.c
24872+++ b/block/compat_ioctl.c
24873@@ -340,7 +340,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
24874 err |= __get_user(f->spec1, &uf->spec1);
24875 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
24876 err |= __get_user(name, &uf->name);
24877- f->name = compat_ptr(name);
24878+ f->name = (void __force_kernel *)compat_ptr(name);
24879 if (err) {
24880 err = -EFAULT;
24881 goto out;
24882diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
24883index 4f4230b..0feae9a 100644
24884--- a/block/scsi_ioctl.c
24885+++ b/block/scsi_ioctl.c
24886@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24887 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24888 struct sg_io_hdr *hdr, fmode_t mode)
24889 {
24890- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24891+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24892+ unsigned char *cmdptr;
24893+
24894+ if (rq->cmd != rq->__cmd)
24895+ cmdptr = rq->cmd;
24896+ else
24897+ cmdptr = tmpcmd;
24898+
24899+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24900 return -EFAULT;
24901+
24902+ if (cmdptr != rq->cmd)
24903+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24904+
24905 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24906 return -EPERM;
24907
24908@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24909 int err;
24910 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24911 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24912+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24913+ unsigned char *cmdptr;
24914
24915 if (!sic)
24916 return -EINVAL;
24917@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24918 */
24919 err = -EFAULT;
24920 rq->cmd_len = cmdlen;
24921- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24922+
24923+ if (rq->cmd != rq->__cmd)
24924+ cmdptr = rq->cmd;
24925+ else
24926+ cmdptr = tmpcmd;
24927+
24928+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24929 goto error;
24930
24931+ if (rq->cmd != cmdptr)
24932+ memcpy(rq->cmd, cmdptr, cmdlen);
24933+
24934 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24935 goto error;
24936
24937diff --git a/crypto/cryptd.c b/crypto/cryptd.c
24938index 671d4d6..5f24030 100644
24939--- a/crypto/cryptd.c
24940+++ b/crypto/cryptd.c
24941@@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
24942
24943 struct cryptd_blkcipher_request_ctx {
24944 crypto_completion_t complete;
24945-};
24946+} __no_const;
24947
24948 struct cryptd_hash_ctx {
24949 struct crypto_shash *child;
24950@@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
24951
24952 struct cryptd_aead_request_ctx {
24953 crypto_completion_t complete;
24954-};
24955+} __no_const;
24956
24957 static void cryptd_queue_worker(struct work_struct *work);
24958
24959diff --git a/crypto/serpent.c b/crypto/serpent.c
24960index b651a55..a9ddd79b 100644
24961--- a/crypto/serpent.c
24962+++ b/crypto/serpent.c
24963@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_tfm *tfm, const u8 *key,
24964 u32 r0,r1,r2,r3,r4;
24965 int i;
24966
24967+ pax_track_stack();
24968+
24969 /* Copy key, add padding */
24970
24971 for (i = 0; i < keylen; ++i)
24972diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
24973index 5d41894..22021e4 100644
24974--- a/drivers/acpi/apei/cper.c
24975+++ b/drivers/acpi/apei/cper.c
24976@@ -38,12 +38,12 @@
24977 */
24978 u64 cper_next_record_id(void)
24979 {
24980- static atomic64_t seq;
24981+ static atomic64_unchecked_t seq;
24982
24983- if (!atomic64_read(&seq))
24984- atomic64_set(&seq, ((u64)get_seconds()) << 32);
24985+ if (!atomic64_read_unchecked(&seq))
24986+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24987
24988- return atomic64_inc_return(&seq);
24989+ return atomic64_inc_return_unchecked(&seq);
24990 }
24991 EXPORT_SYMBOL_GPL(cper_next_record_id);
24992
24993diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
24994index 22f918b..9fafb84 100644
24995--- a/drivers/acpi/ec_sys.c
24996+++ b/drivers/acpi/ec_sys.c
24997@@ -11,6 +11,7 @@
24998 #include <linux/kernel.h>
24999 #include <linux/acpi.h>
25000 #include <linux/debugfs.h>
25001+#include <asm/uaccess.h>
25002 #include "internal.h"
25003
25004 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
25005@@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25006 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
25007 */
25008 unsigned int size = EC_SPACE_SIZE;
25009- u8 *data = (u8 *) buf;
25010+ u8 data;
25011 loff_t init_off = *off;
25012 int err = 0;
25013
25014@@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25015 size = count;
25016
25017 while (size) {
25018- err = ec_read(*off, &data[*off - init_off]);
25019+ err = ec_read(*off, &data);
25020 if (err)
25021 return err;
25022+ if (put_user(data, &buf[*off - init_off]))
25023+ return -EFAULT;
25024 *off += 1;
25025 size--;
25026 }
25027@@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25028
25029 unsigned int size = count;
25030 loff_t init_off = *off;
25031- u8 *data = (u8 *) buf;
25032 int err = 0;
25033
25034 if (*off >= EC_SPACE_SIZE)
25035@@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25036 }
25037
25038 while (size) {
25039- u8 byte_write = data[*off - init_off];
25040+ u8 byte_write;
25041+ if (get_user(byte_write, &buf[*off - init_off]))
25042+ return -EFAULT;
25043 err = ec_write(*off, byte_write);
25044 if (err)
25045 return err;
25046diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
25047index f5f9869..da87aeb 100644
25048--- a/drivers/acpi/proc.c
25049+++ b/drivers/acpi/proc.c
25050@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct file *file,
25051 size_t count, loff_t * ppos)
25052 {
25053 struct list_head *node, *next;
25054- char strbuf[5];
25055- char str[5] = "";
25056- unsigned int len = count;
25057+ char strbuf[5] = {0};
25058
25059- if (len > 4)
25060- len = 4;
25061- if (len < 0)
25062+ if (count > 4)
25063+ count = 4;
25064+ if (copy_from_user(strbuf, buffer, count))
25065 return -EFAULT;
25066-
25067- if (copy_from_user(strbuf, buffer, len))
25068- return -EFAULT;
25069- strbuf[len] = '\0';
25070- sscanf(strbuf, "%s", str);
25071+ strbuf[count] = '\0';
25072
25073 mutex_lock(&acpi_device_lock);
25074 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
25075@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct file *file,
25076 if (!dev->wakeup.flags.valid)
25077 continue;
25078
25079- if (!strncmp(dev->pnp.bus_id, str, 4)) {
25080+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
25081 if (device_can_wakeup(&dev->dev)) {
25082 bool enable = !device_may_wakeup(&dev->dev);
25083 device_set_wakeup_enable(&dev->dev, enable);
25084diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
25085index a4e0f1b..9793b28 100644
25086--- a/drivers/acpi/processor_driver.c
25087+++ b/drivers/acpi/processor_driver.c
25088@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
25089 return 0;
25090 #endif
25091
25092- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
25093+ BUG_ON(pr->id >= nr_cpu_ids);
25094
25095 /*
25096 * Buggy BIOS check
25097diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
25098index 4a3a5ae..cbee192 100644
25099--- a/drivers/ata/libata-core.c
25100+++ b/drivers/ata/libata-core.c
25101@@ -4733,7 +4733,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
25102 struct ata_port *ap;
25103 unsigned int tag;
25104
25105- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25106+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25107 ap = qc->ap;
25108
25109 qc->flags = 0;
25110@@ -4749,7 +4749,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
25111 struct ata_port *ap;
25112 struct ata_link *link;
25113
25114- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25115+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25116 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25117 ap = qc->ap;
25118 link = qc->dev->link;
25119@@ -5754,6 +5754,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25120 return;
25121
25122 spin_lock(&lock);
25123+ pax_open_kernel();
25124
25125 for (cur = ops->inherits; cur; cur = cur->inherits) {
25126 void **inherit = (void **)cur;
25127@@ -5767,8 +5768,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25128 if (IS_ERR(*pp))
25129 *pp = NULL;
25130
25131- ops->inherits = NULL;
25132+ *(struct ata_port_operations **)&ops->inherits = NULL;
25133
25134+ pax_close_kernel();
25135 spin_unlock(&lock);
25136 }
25137
25138diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
25139index ed16fbe..fc92cb8 100644
25140--- a/drivers/ata/libata-eh.c
25141+++ b/drivers/ata/libata-eh.c
25142@@ -2515,6 +2515,8 @@ void ata_eh_report(struct ata_port *ap)
25143 {
25144 struct ata_link *link;
25145
25146+ pax_track_stack();
25147+
25148 ata_for_each_link(link, ap, HOST_FIRST)
25149 ata_eh_link_report(link);
25150 }
25151diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
25152index 719bb73..79ce858 100644
25153--- a/drivers/ata/pata_arasan_cf.c
25154+++ b/drivers/ata/pata_arasan_cf.c
25155@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
25156 /* Handle platform specific quirks */
25157 if (pdata->quirk) {
25158 if (pdata->quirk & CF_BROKEN_PIO) {
25159- ap->ops->set_piomode = NULL;
25160+ pax_open_kernel();
25161+ *(void **)&ap->ops->set_piomode = NULL;
25162+ pax_close_kernel();
25163 ap->pio_mask = 0;
25164 }
25165 if (pdata->quirk & CF_BROKEN_MWDMA)
25166diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
25167index f9b983a..887b9d8 100644
25168--- a/drivers/atm/adummy.c
25169+++ b/drivers/atm/adummy.c
25170@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
25171 vcc->pop(vcc, skb);
25172 else
25173 dev_kfree_skb_any(skb);
25174- atomic_inc(&vcc->stats->tx);
25175+ atomic_inc_unchecked(&vcc->stats->tx);
25176
25177 return 0;
25178 }
25179diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
25180index f8f41e0..1f987dd 100644
25181--- a/drivers/atm/ambassador.c
25182+++ b/drivers/atm/ambassador.c
25183@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
25184 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
25185
25186 // VC layer stats
25187- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25188+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25189
25190 // free the descriptor
25191 kfree (tx_descr);
25192@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25193 dump_skb ("<<<", vc, skb);
25194
25195 // VC layer stats
25196- atomic_inc(&atm_vcc->stats->rx);
25197+ atomic_inc_unchecked(&atm_vcc->stats->rx);
25198 __net_timestamp(skb);
25199 // end of our responsibility
25200 atm_vcc->push (atm_vcc, skb);
25201@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25202 } else {
25203 PRINTK (KERN_INFO, "dropped over-size frame");
25204 // should we count this?
25205- atomic_inc(&atm_vcc->stats->rx_drop);
25206+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25207 }
25208
25209 } else {
25210@@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
25211 }
25212
25213 if (check_area (skb->data, skb->len)) {
25214- atomic_inc(&atm_vcc->stats->tx_err);
25215+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
25216 return -ENOMEM; // ?
25217 }
25218
25219diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
25220index b22d71c..d6e1049 100644
25221--- a/drivers/atm/atmtcp.c
25222+++ b/drivers/atm/atmtcp.c
25223@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25224 if (vcc->pop) vcc->pop(vcc,skb);
25225 else dev_kfree_skb(skb);
25226 if (dev_data) return 0;
25227- atomic_inc(&vcc->stats->tx_err);
25228+ atomic_inc_unchecked(&vcc->stats->tx_err);
25229 return -ENOLINK;
25230 }
25231 size = skb->len+sizeof(struct atmtcp_hdr);
25232@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25233 if (!new_skb) {
25234 if (vcc->pop) vcc->pop(vcc,skb);
25235 else dev_kfree_skb(skb);
25236- atomic_inc(&vcc->stats->tx_err);
25237+ atomic_inc_unchecked(&vcc->stats->tx_err);
25238 return -ENOBUFS;
25239 }
25240 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
25241@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25242 if (vcc->pop) vcc->pop(vcc,skb);
25243 else dev_kfree_skb(skb);
25244 out_vcc->push(out_vcc,new_skb);
25245- atomic_inc(&vcc->stats->tx);
25246- atomic_inc(&out_vcc->stats->rx);
25247+ atomic_inc_unchecked(&vcc->stats->tx);
25248+ atomic_inc_unchecked(&out_vcc->stats->rx);
25249 return 0;
25250 }
25251
25252@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25253 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
25254 read_unlock(&vcc_sklist_lock);
25255 if (!out_vcc) {
25256- atomic_inc(&vcc->stats->tx_err);
25257+ atomic_inc_unchecked(&vcc->stats->tx_err);
25258 goto done;
25259 }
25260 skb_pull(skb,sizeof(struct atmtcp_hdr));
25261@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25262 __net_timestamp(new_skb);
25263 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
25264 out_vcc->push(out_vcc,new_skb);
25265- atomic_inc(&vcc->stats->tx);
25266- atomic_inc(&out_vcc->stats->rx);
25267+ atomic_inc_unchecked(&vcc->stats->tx);
25268+ atomic_inc_unchecked(&out_vcc->stats->rx);
25269 done:
25270 if (vcc->pop) vcc->pop(vcc,skb);
25271 else dev_kfree_skb(skb);
25272diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
25273index 9307141..d8521bf 100644
25274--- a/drivers/atm/eni.c
25275+++ b/drivers/atm/eni.c
25276@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
25277 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
25278 vcc->dev->number);
25279 length = 0;
25280- atomic_inc(&vcc->stats->rx_err);
25281+ atomic_inc_unchecked(&vcc->stats->rx_err);
25282 }
25283 else {
25284 length = ATM_CELL_SIZE-1; /* no HEC */
25285@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25286 size);
25287 }
25288 eff = length = 0;
25289- atomic_inc(&vcc->stats->rx_err);
25290+ atomic_inc_unchecked(&vcc->stats->rx_err);
25291 }
25292 else {
25293 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
25294@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25295 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
25296 vcc->dev->number,vcc->vci,length,size << 2,descr);
25297 length = eff = 0;
25298- atomic_inc(&vcc->stats->rx_err);
25299+ atomic_inc_unchecked(&vcc->stats->rx_err);
25300 }
25301 }
25302 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
25303@@ -771,7 +771,7 @@ rx_dequeued++;
25304 vcc->push(vcc,skb);
25305 pushed++;
25306 }
25307- atomic_inc(&vcc->stats->rx);
25308+ atomic_inc_unchecked(&vcc->stats->rx);
25309 }
25310 wake_up(&eni_dev->rx_wait);
25311 }
25312@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *dev)
25313 PCI_DMA_TODEVICE);
25314 if (vcc->pop) vcc->pop(vcc,skb);
25315 else dev_kfree_skb_irq(skb);
25316- atomic_inc(&vcc->stats->tx);
25317+ atomic_inc_unchecked(&vcc->stats->tx);
25318 wake_up(&eni_dev->tx_wait);
25319 dma_complete++;
25320 }
25321@@ -1568,7 +1568,7 @@ tx_complete++;
25322 /*--------------------------------- entries ---------------------------------*/
25323
25324
25325-static const char *media_name[] __devinitdata = {
25326+static const char *media_name[] __devinitconst = {
25327 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
25328 "UTP", "05?", "06?", "07?", /* 4- 7 */
25329 "TAXI","09?", "10?", "11?", /* 8-11 */
25330diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
25331index 5072f8a..fa52520 100644
25332--- a/drivers/atm/firestream.c
25333+++ b/drivers/atm/firestream.c
25334@@ -750,7 +750,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
25335 }
25336 }
25337
25338- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25339+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25340
25341 fs_dprintk (FS_DEBUG_TXMEM, "i");
25342 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
25343@@ -817,7 +817,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25344 #endif
25345 skb_put (skb, qe->p1 & 0xffff);
25346 ATM_SKB(skb)->vcc = atm_vcc;
25347- atomic_inc(&atm_vcc->stats->rx);
25348+ atomic_inc_unchecked(&atm_vcc->stats->rx);
25349 __net_timestamp(skb);
25350 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
25351 atm_vcc->push (atm_vcc, skb);
25352@@ -838,12 +838,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25353 kfree (pe);
25354 }
25355 if (atm_vcc)
25356- atomic_inc(&atm_vcc->stats->rx_drop);
25357+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25358 break;
25359 case 0x1f: /* Reassembly abort: no buffers. */
25360 /* Silently increment error counter. */
25361 if (atm_vcc)
25362- atomic_inc(&atm_vcc->stats->rx_drop);
25363+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25364 break;
25365 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
25366 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
25367diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
25368index 361f5ae..7fc552d 100644
25369--- a/drivers/atm/fore200e.c
25370+++ b/drivers/atm/fore200e.c
25371@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
25372 #endif
25373 /* check error condition */
25374 if (*entry->status & STATUS_ERROR)
25375- atomic_inc(&vcc->stats->tx_err);
25376+ atomic_inc_unchecked(&vcc->stats->tx_err);
25377 else
25378- atomic_inc(&vcc->stats->tx);
25379+ atomic_inc_unchecked(&vcc->stats->tx);
25380 }
25381 }
25382
25383@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25384 if (skb == NULL) {
25385 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
25386
25387- atomic_inc(&vcc->stats->rx_drop);
25388+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25389 return -ENOMEM;
25390 }
25391
25392@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25393
25394 dev_kfree_skb_any(skb);
25395
25396- atomic_inc(&vcc->stats->rx_drop);
25397+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25398 return -ENOMEM;
25399 }
25400
25401 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25402
25403 vcc->push(vcc, skb);
25404- atomic_inc(&vcc->stats->rx);
25405+ atomic_inc_unchecked(&vcc->stats->rx);
25406
25407 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25408
25409@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
25410 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
25411 fore200e->atm_dev->number,
25412 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
25413- atomic_inc(&vcc->stats->rx_err);
25414+ atomic_inc_unchecked(&vcc->stats->rx_err);
25415 }
25416 }
25417
25418@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
25419 goto retry_here;
25420 }
25421
25422- atomic_inc(&vcc->stats->tx_err);
25423+ atomic_inc_unchecked(&vcc->stats->tx_err);
25424
25425 fore200e->tx_sat++;
25426 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
25427diff --git a/drivers/atm/he.c b/drivers/atm/he.c
25428index 9a51df4..f3bb5f8 100644
25429--- a/drivers/atm/he.c
25430+++ b/drivers/atm/he.c
25431@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25432
25433 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
25434 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
25435- atomic_inc(&vcc->stats->rx_drop);
25436+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25437 goto return_host_buffers;
25438 }
25439
25440@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25441 RBRQ_LEN_ERR(he_dev->rbrq_head)
25442 ? "LEN_ERR" : "",
25443 vcc->vpi, vcc->vci);
25444- atomic_inc(&vcc->stats->rx_err);
25445+ atomic_inc_unchecked(&vcc->stats->rx_err);
25446 goto return_host_buffers;
25447 }
25448
25449@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25450 vcc->push(vcc, skb);
25451 spin_lock(&he_dev->global_lock);
25452
25453- atomic_inc(&vcc->stats->rx);
25454+ atomic_inc_unchecked(&vcc->stats->rx);
25455
25456 return_host_buffers:
25457 ++pdus_assembled;
25458@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
25459 tpd->vcc->pop(tpd->vcc, tpd->skb);
25460 else
25461 dev_kfree_skb_any(tpd->skb);
25462- atomic_inc(&tpd->vcc->stats->tx_err);
25463+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
25464 }
25465 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
25466 return;
25467@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25468 vcc->pop(vcc, skb);
25469 else
25470 dev_kfree_skb_any(skb);
25471- atomic_inc(&vcc->stats->tx_err);
25472+ atomic_inc_unchecked(&vcc->stats->tx_err);
25473 return -EINVAL;
25474 }
25475
25476@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25477 vcc->pop(vcc, skb);
25478 else
25479 dev_kfree_skb_any(skb);
25480- atomic_inc(&vcc->stats->tx_err);
25481+ atomic_inc_unchecked(&vcc->stats->tx_err);
25482 return -EINVAL;
25483 }
25484 #endif
25485@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25486 vcc->pop(vcc, skb);
25487 else
25488 dev_kfree_skb_any(skb);
25489- atomic_inc(&vcc->stats->tx_err);
25490+ atomic_inc_unchecked(&vcc->stats->tx_err);
25491 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25492 return -ENOMEM;
25493 }
25494@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25495 vcc->pop(vcc, skb);
25496 else
25497 dev_kfree_skb_any(skb);
25498- atomic_inc(&vcc->stats->tx_err);
25499+ atomic_inc_unchecked(&vcc->stats->tx_err);
25500 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25501 return -ENOMEM;
25502 }
25503@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25504 __enqueue_tpd(he_dev, tpd, cid);
25505 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25506
25507- atomic_inc(&vcc->stats->tx);
25508+ atomic_inc_unchecked(&vcc->stats->tx);
25509
25510 return 0;
25511 }
25512diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
25513index b812103..e391a49 100644
25514--- a/drivers/atm/horizon.c
25515+++ b/drivers/atm/horizon.c
25516@@ -1035,7 +1035,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
25517 {
25518 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
25519 // VC layer stats
25520- atomic_inc(&vcc->stats->rx);
25521+ atomic_inc_unchecked(&vcc->stats->rx);
25522 __net_timestamp(skb);
25523 // end of our responsibility
25524 vcc->push (vcc, skb);
25525@@ -1187,7 +1187,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
25526 dev->tx_iovec = NULL;
25527
25528 // VC layer stats
25529- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25530+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25531
25532 // free the skb
25533 hrz_kfree_skb (skb);
25534diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
25535index db06f34..dcebb61 100644
25536--- a/drivers/atm/idt77252.c
25537+++ b/drivers/atm/idt77252.c
25538@@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
25539 else
25540 dev_kfree_skb(skb);
25541
25542- atomic_inc(&vcc->stats->tx);
25543+ atomic_inc_unchecked(&vcc->stats->tx);
25544 }
25545
25546 atomic_dec(&scq->used);
25547@@ -1075,13 +1075,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25548 if ((sb = dev_alloc_skb(64)) == NULL) {
25549 printk("%s: Can't allocate buffers for aal0.\n",
25550 card->name);
25551- atomic_add(i, &vcc->stats->rx_drop);
25552+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
25553 break;
25554 }
25555 if (!atm_charge(vcc, sb->truesize)) {
25556 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
25557 card->name);
25558- atomic_add(i - 1, &vcc->stats->rx_drop);
25559+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
25560 dev_kfree_skb(sb);
25561 break;
25562 }
25563@@ -1098,7 +1098,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25564 ATM_SKB(sb)->vcc = vcc;
25565 __net_timestamp(sb);
25566 vcc->push(vcc, sb);
25567- atomic_inc(&vcc->stats->rx);
25568+ atomic_inc_unchecked(&vcc->stats->rx);
25569
25570 cell += ATM_CELL_PAYLOAD;
25571 }
25572@@ -1135,13 +1135,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25573 "(CDC: %08x)\n",
25574 card->name, len, rpp->len, readl(SAR_REG_CDC));
25575 recycle_rx_pool_skb(card, rpp);
25576- atomic_inc(&vcc->stats->rx_err);
25577+ atomic_inc_unchecked(&vcc->stats->rx_err);
25578 return;
25579 }
25580 if (stat & SAR_RSQE_CRC) {
25581 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
25582 recycle_rx_pool_skb(card, rpp);
25583- atomic_inc(&vcc->stats->rx_err);
25584+ atomic_inc_unchecked(&vcc->stats->rx_err);
25585 return;
25586 }
25587 if (skb_queue_len(&rpp->queue) > 1) {
25588@@ -1152,7 +1152,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25589 RXPRINTK("%s: Can't alloc RX skb.\n",
25590 card->name);
25591 recycle_rx_pool_skb(card, rpp);
25592- atomic_inc(&vcc->stats->rx_err);
25593+ atomic_inc_unchecked(&vcc->stats->rx_err);
25594 return;
25595 }
25596 if (!atm_charge(vcc, skb->truesize)) {
25597@@ -1171,7 +1171,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25598 __net_timestamp(skb);
25599
25600 vcc->push(vcc, skb);
25601- atomic_inc(&vcc->stats->rx);
25602+ atomic_inc_unchecked(&vcc->stats->rx);
25603
25604 return;
25605 }
25606@@ -1193,7 +1193,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25607 __net_timestamp(skb);
25608
25609 vcc->push(vcc, skb);
25610- atomic_inc(&vcc->stats->rx);
25611+ atomic_inc_unchecked(&vcc->stats->rx);
25612
25613 if (skb->truesize > SAR_FB_SIZE_3)
25614 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
25615@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
25616 if (vcc->qos.aal != ATM_AAL0) {
25617 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
25618 card->name, vpi, vci);
25619- atomic_inc(&vcc->stats->rx_drop);
25620+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25621 goto drop;
25622 }
25623
25624 if ((sb = dev_alloc_skb(64)) == NULL) {
25625 printk("%s: Can't allocate buffers for AAL0.\n",
25626 card->name);
25627- atomic_inc(&vcc->stats->rx_err);
25628+ atomic_inc_unchecked(&vcc->stats->rx_err);
25629 goto drop;
25630 }
25631
25632@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
25633 ATM_SKB(sb)->vcc = vcc;
25634 __net_timestamp(sb);
25635 vcc->push(vcc, sb);
25636- atomic_inc(&vcc->stats->rx);
25637+ atomic_inc_unchecked(&vcc->stats->rx);
25638
25639 drop:
25640 skb_pull(queue, 64);
25641@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25642
25643 if (vc == NULL) {
25644 printk("%s: NULL connection in send().\n", card->name);
25645- atomic_inc(&vcc->stats->tx_err);
25646+ atomic_inc_unchecked(&vcc->stats->tx_err);
25647 dev_kfree_skb(skb);
25648 return -EINVAL;
25649 }
25650 if (!test_bit(VCF_TX, &vc->flags)) {
25651 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
25652- atomic_inc(&vcc->stats->tx_err);
25653+ atomic_inc_unchecked(&vcc->stats->tx_err);
25654 dev_kfree_skb(skb);
25655 return -EINVAL;
25656 }
25657@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25658 break;
25659 default:
25660 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
25661- atomic_inc(&vcc->stats->tx_err);
25662+ atomic_inc_unchecked(&vcc->stats->tx_err);
25663 dev_kfree_skb(skb);
25664 return -EINVAL;
25665 }
25666
25667 if (skb_shinfo(skb)->nr_frags != 0) {
25668 printk("%s: No scatter-gather yet.\n", card->name);
25669- atomic_inc(&vcc->stats->tx_err);
25670+ atomic_inc_unchecked(&vcc->stats->tx_err);
25671 dev_kfree_skb(skb);
25672 return -EINVAL;
25673 }
25674@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25675
25676 err = queue_skb(card, vc, skb, oam);
25677 if (err) {
25678- atomic_inc(&vcc->stats->tx_err);
25679+ atomic_inc_unchecked(&vcc->stats->tx_err);
25680 dev_kfree_skb(skb);
25681 return err;
25682 }
25683@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
25684 skb = dev_alloc_skb(64);
25685 if (!skb) {
25686 printk("%s: Out of memory in send_oam().\n", card->name);
25687- atomic_inc(&vcc->stats->tx_err);
25688+ atomic_inc_unchecked(&vcc->stats->tx_err);
25689 return -ENOMEM;
25690 }
25691 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
25692diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
25693index cb90f7a..bd33566 100644
25694--- a/drivers/atm/iphase.c
25695+++ b/drivers/atm/iphase.c
25696@@ -1121,7 +1121,7 @@ static int rx_pkt(struct atm_dev *dev)
25697 status = (u_short) (buf_desc_ptr->desc_mode);
25698 if (status & (RX_CER | RX_PTE | RX_OFL))
25699 {
25700- atomic_inc(&vcc->stats->rx_err);
25701+ atomic_inc_unchecked(&vcc->stats->rx_err);
25702 IF_ERR(printk("IA: bad packet, dropping it");)
25703 if (status & RX_CER) {
25704 IF_ERR(printk(" cause: packet CRC error\n");)
25705@@ -1144,7 +1144,7 @@ static int rx_pkt(struct atm_dev *dev)
25706 len = dma_addr - buf_addr;
25707 if (len > iadev->rx_buf_sz) {
25708 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
25709- atomic_inc(&vcc->stats->rx_err);
25710+ atomic_inc_unchecked(&vcc->stats->rx_err);
25711 goto out_free_desc;
25712 }
25713
25714@@ -1294,7 +1294,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25715 ia_vcc = INPH_IA_VCC(vcc);
25716 if (ia_vcc == NULL)
25717 {
25718- atomic_inc(&vcc->stats->rx_err);
25719+ atomic_inc_unchecked(&vcc->stats->rx_err);
25720 dev_kfree_skb_any(skb);
25721 atm_return(vcc, atm_guess_pdu2truesize(len));
25722 goto INCR_DLE;
25723@@ -1306,7 +1306,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25724 if ((length > iadev->rx_buf_sz) || (length >
25725 (skb->len - sizeof(struct cpcs_trailer))))
25726 {
25727- atomic_inc(&vcc->stats->rx_err);
25728+ atomic_inc_unchecked(&vcc->stats->rx_err);
25729 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
25730 length, skb->len);)
25731 dev_kfree_skb_any(skb);
25732@@ -1322,7 +1322,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25733
25734 IF_RX(printk("rx_dle_intr: skb push");)
25735 vcc->push(vcc,skb);
25736- atomic_inc(&vcc->stats->rx);
25737+ atomic_inc_unchecked(&vcc->stats->rx);
25738 iadev->rx_pkt_cnt++;
25739 }
25740 INCR_DLE:
25741@@ -2802,15 +2802,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
25742 {
25743 struct k_sonet_stats *stats;
25744 stats = &PRIV(_ia_dev[board])->sonet_stats;
25745- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
25746- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
25747- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
25748- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
25749- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
25750- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
25751- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
25752- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
25753- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
25754+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
25755+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
25756+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
25757+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
25758+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
25759+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
25760+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
25761+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
25762+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
25763 }
25764 ia_cmds.status = 0;
25765 break;
25766@@ -2915,7 +2915,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25767 if ((desc == 0) || (desc > iadev->num_tx_desc))
25768 {
25769 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
25770- atomic_inc(&vcc->stats->tx);
25771+ atomic_inc_unchecked(&vcc->stats->tx);
25772 if (vcc->pop)
25773 vcc->pop(vcc, skb);
25774 else
25775@@ -3020,14 +3020,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25776 ATM_DESC(skb) = vcc->vci;
25777 skb_queue_tail(&iadev->tx_dma_q, skb);
25778
25779- atomic_inc(&vcc->stats->tx);
25780+ atomic_inc_unchecked(&vcc->stats->tx);
25781 iadev->tx_pkt_cnt++;
25782 /* Increment transaction counter */
25783 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
25784
25785 #if 0
25786 /* add flow control logic */
25787- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
25788+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
25789 if (iavcc->vc_desc_cnt > 10) {
25790 vcc->tx_quota = vcc->tx_quota * 3 / 4;
25791 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
25792diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
25793index e828c54..ae83976 100644
25794--- a/drivers/atm/lanai.c
25795+++ b/drivers/atm/lanai.c
25796@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
25797 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
25798 lanai_endtx(lanai, lvcc);
25799 lanai_free_skb(lvcc->tx.atmvcc, skb);
25800- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
25801+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
25802 }
25803
25804 /* Try to fill the buffer - don't call unless there is backlog */
25805@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
25806 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
25807 __net_timestamp(skb);
25808 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
25809- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
25810+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
25811 out:
25812 lvcc->rx.buf.ptr = end;
25813 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
25814@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25815 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
25816 "vcc %d\n", lanai->number, (unsigned int) s, vci);
25817 lanai->stats.service_rxnotaal5++;
25818- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25819+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25820 return 0;
25821 }
25822 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
25823@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25824 int bytes;
25825 read_unlock(&vcc_sklist_lock);
25826 DPRINTK("got trashed rx pdu on vci %d\n", vci);
25827- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25828+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25829 lvcc->stats.x.aal5.service_trash++;
25830 bytes = (SERVICE_GET_END(s) * 16) -
25831 (((unsigned long) lvcc->rx.buf.ptr) -
25832@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25833 }
25834 if (s & SERVICE_STREAM) {
25835 read_unlock(&vcc_sklist_lock);
25836- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25837+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25838 lvcc->stats.x.aal5.service_stream++;
25839 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
25840 "PDU on VCI %d!\n", lanai->number, vci);
25841@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25842 return 0;
25843 }
25844 DPRINTK("got rx crc error on vci %d\n", vci);
25845- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25846+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25847 lvcc->stats.x.aal5.service_rxcrc++;
25848 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
25849 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
25850diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
25851index 1c70c45..300718d 100644
25852--- a/drivers/atm/nicstar.c
25853+++ b/drivers/atm/nicstar.c
25854@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25855 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
25856 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
25857 card->index);
25858- atomic_inc(&vcc->stats->tx_err);
25859+ atomic_inc_unchecked(&vcc->stats->tx_err);
25860 dev_kfree_skb_any(skb);
25861 return -EINVAL;
25862 }
25863@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25864 if (!vc->tx) {
25865 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
25866 card->index);
25867- atomic_inc(&vcc->stats->tx_err);
25868+ atomic_inc_unchecked(&vcc->stats->tx_err);
25869 dev_kfree_skb_any(skb);
25870 return -EINVAL;
25871 }
25872@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25873 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
25874 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
25875 card->index);
25876- atomic_inc(&vcc->stats->tx_err);
25877+ atomic_inc_unchecked(&vcc->stats->tx_err);
25878 dev_kfree_skb_any(skb);
25879 return -EINVAL;
25880 }
25881
25882 if (skb_shinfo(skb)->nr_frags != 0) {
25883 printk("nicstar%d: No scatter-gather yet.\n", card->index);
25884- atomic_inc(&vcc->stats->tx_err);
25885+ atomic_inc_unchecked(&vcc->stats->tx_err);
25886 dev_kfree_skb_any(skb);
25887 return -EINVAL;
25888 }
25889@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25890 }
25891
25892 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
25893- atomic_inc(&vcc->stats->tx_err);
25894+ atomic_inc_unchecked(&vcc->stats->tx_err);
25895 dev_kfree_skb_any(skb);
25896 return -EIO;
25897 }
25898- atomic_inc(&vcc->stats->tx);
25899+ atomic_inc_unchecked(&vcc->stats->tx);
25900
25901 return 0;
25902 }
25903@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25904 printk
25905 ("nicstar%d: Can't allocate buffers for aal0.\n",
25906 card->index);
25907- atomic_add(i, &vcc->stats->rx_drop);
25908+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
25909 break;
25910 }
25911 if (!atm_charge(vcc, sb->truesize)) {
25912 RXPRINTK
25913 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
25914 card->index);
25915- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
25916+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
25917 dev_kfree_skb_any(sb);
25918 break;
25919 }
25920@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25921 ATM_SKB(sb)->vcc = vcc;
25922 __net_timestamp(sb);
25923 vcc->push(vcc, sb);
25924- atomic_inc(&vcc->stats->rx);
25925+ atomic_inc_unchecked(&vcc->stats->rx);
25926 cell += ATM_CELL_PAYLOAD;
25927 }
25928
25929@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25930 if (iovb == NULL) {
25931 printk("nicstar%d: Out of iovec buffers.\n",
25932 card->index);
25933- atomic_inc(&vcc->stats->rx_drop);
25934+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25935 recycle_rx_buf(card, skb);
25936 return;
25937 }
25938@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25939 small or large buffer itself. */
25940 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
25941 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
25942- atomic_inc(&vcc->stats->rx_err);
25943+ atomic_inc_unchecked(&vcc->stats->rx_err);
25944 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25945 NS_MAX_IOVECS);
25946 NS_PRV_IOVCNT(iovb) = 0;
25947@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25948 ("nicstar%d: Expected a small buffer, and this is not one.\n",
25949 card->index);
25950 which_list(card, skb);
25951- atomic_inc(&vcc->stats->rx_err);
25952+ atomic_inc_unchecked(&vcc->stats->rx_err);
25953 recycle_rx_buf(card, skb);
25954 vc->rx_iov = NULL;
25955 recycle_iov_buf(card, iovb);
25956@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25957 ("nicstar%d: Expected a large buffer, and this is not one.\n",
25958 card->index);
25959 which_list(card, skb);
25960- atomic_inc(&vcc->stats->rx_err);
25961+ atomic_inc_unchecked(&vcc->stats->rx_err);
25962 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25963 NS_PRV_IOVCNT(iovb));
25964 vc->rx_iov = NULL;
25965@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25966 printk(" - PDU size mismatch.\n");
25967 else
25968 printk(".\n");
25969- atomic_inc(&vcc->stats->rx_err);
25970+ atomic_inc_unchecked(&vcc->stats->rx_err);
25971 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25972 NS_PRV_IOVCNT(iovb));
25973 vc->rx_iov = NULL;
25974@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25975 /* skb points to a small buffer */
25976 if (!atm_charge(vcc, skb->truesize)) {
25977 push_rxbufs(card, skb);
25978- atomic_inc(&vcc->stats->rx_drop);
25979+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25980 } else {
25981 skb_put(skb, len);
25982 dequeue_sm_buf(card, skb);
25983@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25984 ATM_SKB(skb)->vcc = vcc;
25985 __net_timestamp(skb);
25986 vcc->push(vcc, skb);
25987- atomic_inc(&vcc->stats->rx);
25988+ atomic_inc_unchecked(&vcc->stats->rx);
25989 }
25990 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
25991 struct sk_buff *sb;
25992@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25993 if (len <= NS_SMBUFSIZE) {
25994 if (!atm_charge(vcc, sb->truesize)) {
25995 push_rxbufs(card, sb);
25996- atomic_inc(&vcc->stats->rx_drop);
25997+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25998 } else {
25999 skb_put(sb, len);
26000 dequeue_sm_buf(card, sb);
26001@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26002 ATM_SKB(sb)->vcc = vcc;
26003 __net_timestamp(sb);
26004 vcc->push(vcc, sb);
26005- atomic_inc(&vcc->stats->rx);
26006+ atomic_inc_unchecked(&vcc->stats->rx);
26007 }
26008
26009 push_rxbufs(card, skb);
26010@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26011
26012 if (!atm_charge(vcc, skb->truesize)) {
26013 push_rxbufs(card, skb);
26014- atomic_inc(&vcc->stats->rx_drop);
26015+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26016 } else {
26017 dequeue_lg_buf(card, skb);
26018 #ifdef NS_USE_DESTRUCTORS
26019@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26020 ATM_SKB(skb)->vcc = vcc;
26021 __net_timestamp(skb);
26022 vcc->push(vcc, skb);
26023- atomic_inc(&vcc->stats->rx);
26024+ atomic_inc_unchecked(&vcc->stats->rx);
26025 }
26026
26027 push_rxbufs(card, sb);
26028@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26029 printk
26030 ("nicstar%d: Out of huge buffers.\n",
26031 card->index);
26032- atomic_inc(&vcc->stats->rx_drop);
26033+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26034 recycle_iovec_rx_bufs(card,
26035 (struct iovec *)
26036 iovb->data,
26037@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26038 card->hbpool.count++;
26039 } else
26040 dev_kfree_skb_any(hb);
26041- atomic_inc(&vcc->stats->rx_drop);
26042+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26043 } else {
26044 /* Copy the small buffer to the huge buffer */
26045 sb = (struct sk_buff *)iov->iov_base;
26046@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26047 #endif /* NS_USE_DESTRUCTORS */
26048 __net_timestamp(hb);
26049 vcc->push(vcc, hb);
26050- atomic_inc(&vcc->stats->rx);
26051+ atomic_inc_unchecked(&vcc->stats->rx);
26052 }
26053 }
26054
26055diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
26056index 5d1d076..4f31f42 100644
26057--- a/drivers/atm/solos-pci.c
26058+++ b/drivers/atm/solos-pci.c
26059@@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
26060 }
26061 atm_charge(vcc, skb->truesize);
26062 vcc->push(vcc, skb);
26063- atomic_inc(&vcc->stats->rx);
26064+ atomic_inc_unchecked(&vcc->stats->rx);
26065 break;
26066
26067 case PKT_STATUS:
26068@@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff *buf)
26069 char msg[500];
26070 char item[10];
26071
26072+ pax_track_stack();
26073+
26074 len = buf->len;
26075 for (i = 0; i < len; i++){
26076 if(i % 8 == 0)
26077@@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_card *card)
26078 vcc = SKB_CB(oldskb)->vcc;
26079
26080 if (vcc) {
26081- atomic_inc(&vcc->stats->tx);
26082+ atomic_inc_unchecked(&vcc->stats->tx);
26083 solos_pop(vcc, oldskb);
26084 } else
26085 dev_kfree_skb_irq(oldskb);
26086diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
26087index 90f1ccc..04c4a1e 100644
26088--- a/drivers/atm/suni.c
26089+++ b/drivers/atm/suni.c
26090@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
26091
26092
26093 #define ADD_LIMITED(s,v) \
26094- atomic_add((v),&stats->s); \
26095- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
26096+ atomic_add_unchecked((v),&stats->s); \
26097+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
26098
26099
26100 static void suni_hz(unsigned long from_timer)
26101diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
26102index 5120a96..e2572bd 100644
26103--- a/drivers/atm/uPD98402.c
26104+++ b/drivers/atm/uPD98402.c
26105@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
26106 struct sonet_stats tmp;
26107 int error = 0;
26108
26109- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26110+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26111 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
26112 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
26113 if (zero && !error) {
26114@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
26115
26116
26117 #define ADD_LIMITED(s,v) \
26118- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
26119- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
26120- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26121+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
26122+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
26123+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26124
26125
26126 static void stat_event(struct atm_dev *dev)
26127@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
26128 if (reason & uPD98402_INT_PFM) stat_event(dev);
26129 if (reason & uPD98402_INT_PCO) {
26130 (void) GET(PCOCR); /* clear interrupt cause */
26131- atomic_add(GET(HECCT),
26132+ atomic_add_unchecked(GET(HECCT),
26133 &PRIV(dev)->sonet_stats.uncorr_hcs);
26134 }
26135 if ((reason & uPD98402_INT_RFO) &&
26136@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
26137 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
26138 uPD98402_INT_LOS),PIMR); /* enable them */
26139 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
26140- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26141- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
26142- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
26143+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26144+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
26145+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
26146 return 0;
26147 }
26148
26149diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
26150index d889f56..17eb71e 100644
26151--- a/drivers/atm/zatm.c
26152+++ b/drivers/atm/zatm.c
26153@@ -460,7 +460,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26154 }
26155 if (!size) {
26156 dev_kfree_skb_irq(skb);
26157- if (vcc) atomic_inc(&vcc->stats->rx_err);
26158+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
26159 continue;
26160 }
26161 if (!atm_charge(vcc,skb->truesize)) {
26162@@ -470,7 +470,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26163 skb->len = size;
26164 ATM_SKB(skb)->vcc = vcc;
26165 vcc->push(vcc,skb);
26166- atomic_inc(&vcc->stats->rx);
26167+ atomic_inc_unchecked(&vcc->stats->rx);
26168 }
26169 zout(pos & 0xffff,MTA(mbx));
26170 #if 0 /* probably a stupid idea */
26171@@ -734,7 +734,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
26172 skb_queue_head(&zatm_vcc->backlog,skb);
26173 break;
26174 }
26175- atomic_inc(&vcc->stats->tx);
26176+ atomic_inc_unchecked(&vcc->stats->tx);
26177 wake_up(&zatm_vcc->tx_wait);
26178 }
26179
26180diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
26181index a4760e0..51283cf 100644
26182--- a/drivers/base/devtmpfs.c
26183+++ b/drivers/base/devtmpfs.c
26184@@ -368,7 +368,7 @@ int devtmpfs_mount(const char *mntdir)
26185 if (!thread)
26186 return 0;
26187
26188- err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
26189+ err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
26190 if (err)
26191 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
26192 else
26193diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
26194index 84f7c7d..37cfd87 100644
26195--- a/drivers/base/power/wakeup.c
26196+++ b/drivers/base/power/wakeup.c
26197@@ -29,14 +29,14 @@ bool events_check_enabled;
26198 * They need to be modified together atomically, so it's better to use one
26199 * atomic variable to hold them both.
26200 */
26201-static atomic_t combined_event_count = ATOMIC_INIT(0);
26202+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
26203
26204 #define IN_PROGRESS_BITS (sizeof(int) * 4)
26205 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
26206
26207 static void split_counters(unsigned int *cnt, unsigned int *inpr)
26208 {
26209- unsigned int comb = atomic_read(&combined_event_count);
26210+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
26211
26212 *cnt = (comb >> IN_PROGRESS_BITS);
26213 *inpr = comb & MAX_IN_PROGRESS;
26214@@ -350,7 +350,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
26215 ws->last_time = ktime_get();
26216
26217 /* Increment the counter of events in progress. */
26218- atomic_inc(&combined_event_count);
26219+ atomic_inc_unchecked(&combined_event_count);
26220 }
26221
26222 /**
26223@@ -440,7 +440,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
26224 * Increment the counter of registered wakeup events and decrement the
26225 * couter of wakeup events in progress simultaneously.
26226 */
26227- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
26228+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
26229 }
26230
26231 /**
26232diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
26233index e086fbb..398e1fe 100644
26234--- a/drivers/block/DAC960.c
26235+++ b/drivers/block/DAC960.c
26236@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfiguration(DAC960_Controller_T
26237 unsigned long flags;
26238 int Channel, TargetID;
26239
26240+ pax_track_stack();
26241+
26242 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
26243 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
26244 sizeof(DAC960_SCSI_Inquiry_T) +
26245diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
26246index c2f9b3e..5911988 100644
26247--- a/drivers/block/cciss.c
26248+++ b/drivers/block/cciss.c
26249@@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
26250 int err;
26251 u32 cp;
26252
26253+ memset(&arg64, 0, sizeof(arg64));
26254+
26255 err = 0;
26256 err |=
26257 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
26258@@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h)
26259 while (!list_empty(&h->reqQ)) {
26260 c = list_entry(h->reqQ.next, CommandList_struct, list);
26261 /* can't do anything if fifo is full */
26262- if ((h->access.fifo_full(h))) {
26263+ if ((h->access->fifo_full(h))) {
26264 dev_warn(&h->pdev->dev, "fifo full\n");
26265 break;
26266 }
26267@@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h)
26268 h->Qdepth--;
26269
26270 /* Tell the controller execute command */
26271- h->access.submit_command(h, c);
26272+ h->access->submit_command(h, c);
26273
26274 /* Put job onto the completed Q */
26275 addQ(&h->cmpQ, c);
26276@@ -3422,17 +3424,17 @@ startio:
26277
26278 static inline unsigned long get_next_completion(ctlr_info_t *h)
26279 {
26280- return h->access.command_completed(h);
26281+ return h->access->command_completed(h);
26282 }
26283
26284 static inline int interrupt_pending(ctlr_info_t *h)
26285 {
26286- return h->access.intr_pending(h);
26287+ return h->access->intr_pending(h);
26288 }
26289
26290 static inline long interrupt_not_for_us(ctlr_info_t *h)
26291 {
26292- return ((h->access.intr_pending(h) == 0) ||
26293+ return ((h->access->intr_pending(h) == 0) ||
26294 (h->interrupts_enabled == 0));
26295 }
26296
26297@@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info_t *h)
26298 u32 a;
26299
26300 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
26301- return h->access.command_completed(h);
26302+ return h->access->command_completed(h);
26303
26304 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
26305 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
26306@@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
26307 trans_support & CFGTBL_Trans_use_short_tags);
26308
26309 /* Change the access methods to the performant access methods */
26310- h->access = SA5_performant_access;
26311+ h->access = &SA5_performant_access;
26312 h->transMethod = CFGTBL_Trans_Performant;
26313
26314 return;
26315@@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *h)
26316 if (prod_index < 0)
26317 return -ENODEV;
26318 h->product_name = products[prod_index].product_name;
26319- h->access = *(products[prod_index].access);
26320+ h->access = products[prod_index].access;
26321
26322 if (cciss_board_disabled(h)) {
26323 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
26324@@ -5009,7 +5011,7 @@ reinit_after_soft_reset:
26325 }
26326
26327 /* make sure the board interrupts are off */
26328- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26329+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26330 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
26331 if (rc)
26332 goto clean2;
26333@@ -5061,7 +5063,7 @@ reinit_after_soft_reset:
26334 * fake ones to scoop up any residual completions.
26335 */
26336 spin_lock_irqsave(&h->lock, flags);
26337- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26338+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26339 spin_unlock_irqrestore(&h->lock, flags);
26340 free_irq(h->intr[PERF_MODE_INT], h);
26341 rc = cciss_request_irq(h, cciss_msix_discard_completions,
26342@@ -5081,9 +5083,9 @@ reinit_after_soft_reset:
26343 dev_info(&h->pdev->dev, "Board READY.\n");
26344 dev_info(&h->pdev->dev,
26345 "Waiting for stale completions to drain.\n");
26346- h->access.set_intr_mask(h, CCISS_INTR_ON);
26347+ h->access->set_intr_mask(h, CCISS_INTR_ON);
26348 msleep(10000);
26349- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26350+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26351
26352 rc = controller_reset_failed(h->cfgtable);
26353 if (rc)
26354@@ -5106,7 +5108,7 @@ reinit_after_soft_reset:
26355 cciss_scsi_setup(h);
26356
26357 /* Turn the interrupts on so we can service requests */
26358- h->access.set_intr_mask(h, CCISS_INTR_ON);
26359+ h->access->set_intr_mask(h, CCISS_INTR_ON);
26360
26361 /* Get the firmware version */
26362 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
26363@@ -5178,7 +5180,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
26364 kfree(flush_buf);
26365 if (return_code != IO_OK)
26366 dev_warn(&h->pdev->dev, "Error flushing cache\n");
26367- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26368+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26369 free_irq(h->intr[PERF_MODE_INT], h);
26370 }
26371
26372diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
26373index c049548..a09cb6e 100644
26374--- a/drivers/block/cciss.h
26375+++ b/drivers/block/cciss.h
26376@@ -100,7 +100,7 @@ struct ctlr_info
26377 /* information about each logical volume */
26378 drive_info_struct *drv[CISS_MAX_LUN];
26379
26380- struct access_method access;
26381+ struct access_method *access;
26382
26383 /* queue and queue Info */
26384 struct list_head reqQ;
26385diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
26386index b2fceb5..87fec83 100644
26387--- a/drivers/block/cpqarray.c
26388+++ b/drivers/block/cpqarray.c
26389@@ -404,7 +404,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26390 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
26391 goto Enomem4;
26392 }
26393- hba[i]->access.set_intr_mask(hba[i], 0);
26394+ hba[i]->access->set_intr_mask(hba[i], 0);
26395 if (request_irq(hba[i]->intr, do_ida_intr,
26396 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
26397 {
26398@@ -459,7 +459,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26399 add_timer(&hba[i]->timer);
26400
26401 /* Enable IRQ now that spinlock and rate limit timer are set up */
26402- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26403+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26404
26405 for(j=0; j<NWD; j++) {
26406 struct gendisk *disk = ida_gendisk[i][j];
26407@@ -694,7 +694,7 @@ DBGINFO(
26408 for(i=0; i<NR_PRODUCTS; i++) {
26409 if (board_id == products[i].board_id) {
26410 c->product_name = products[i].product_name;
26411- c->access = *(products[i].access);
26412+ c->access = products[i].access;
26413 break;
26414 }
26415 }
26416@@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detect(void)
26417 hba[ctlr]->intr = intr;
26418 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
26419 hba[ctlr]->product_name = products[j].product_name;
26420- hba[ctlr]->access = *(products[j].access);
26421+ hba[ctlr]->access = products[j].access;
26422 hba[ctlr]->ctlr = ctlr;
26423 hba[ctlr]->board_id = board_id;
26424 hba[ctlr]->pci_dev = NULL; /* not PCI */
26425@@ -911,6 +911,8 @@ static void do_ida_request(struct request_queue *q)
26426 struct scatterlist tmp_sg[SG_MAX];
26427 int i, dir, seg;
26428
26429+ pax_track_stack();
26430+
26431 queue_next:
26432 creq = blk_peek_request(q);
26433 if (!creq)
26434@@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h)
26435
26436 while((c = h->reqQ) != NULL) {
26437 /* Can't do anything if we're busy */
26438- if (h->access.fifo_full(h) == 0)
26439+ if (h->access->fifo_full(h) == 0)
26440 return;
26441
26442 /* Get the first entry from the request Q */
26443@@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h)
26444 h->Qdepth--;
26445
26446 /* Tell the controller to do our bidding */
26447- h->access.submit_command(h, c);
26448+ h->access->submit_command(h, c);
26449
26450 /* Get onto the completion Q */
26451 addQ(&h->cmpQ, c);
26452@@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26453 unsigned long flags;
26454 __u32 a,a1;
26455
26456- istat = h->access.intr_pending(h);
26457+ istat = h->access->intr_pending(h);
26458 /* Is this interrupt for us? */
26459 if (istat == 0)
26460 return IRQ_NONE;
26461@@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26462 */
26463 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
26464 if (istat & FIFO_NOT_EMPTY) {
26465- while((a = h->access.command_completed(h))) {
26466+ while((a = h->access->command_completed(h))) {
26467 a1 = a; a &= ~3;
26468 if ((c = h->cmpQ) == NULL)
26469 {
26470@@ -1449,11 +1451,11 @@ static int sendcmd(
26471 /*
26472 * Disable interrupt
26473 */
26474- info_p->access.set_intr_mask(info_p, 0);
26475+ info_p->access->set_intr_mask(info_p, 0);
26476 /* Make sure there is room in the command FIFO */
26477 /* Actually it should be completely empty at this time. */
26478 for (i = 200000; i > 0; i--) {
26479- temp = info_p->access.fifo_full(info_p);
26480+ temp = info_p->access->fifo_full(info_p);
26481 if (temp != 0) {
26482 break;
26483 }
26484@@ -1466,7 +1468,7 @@ DBG(
26485 /*
26486 * Send the cmd
26487 */
26488- info_p->access.submit_command(info_p, c);
26489+ info_p->access->submit_command(info_p, c);
26490 complete = pollcomplete(ctlr);
26491
26492 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
26493@@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t *host)
26494 * we check the new geometry. Then turn interrupts back on when
26495 * we're done.
26496 */
26497- host->access.set_intr_mask(host, 0);
26498+ host->access->set_intr_mask(host, 0);
26499 getgeometry(ctlr);
26500- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
26501+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
26502
26503 for(i=0; i<NWD; i++) {
26504 struct gendisk *disk = ida_gendisk[ctlr][i];
26505@@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr)
26506 /* Wait (up to 2 seconds) for a command to complete */
26507
26508 for (i = 200000; i > 0; i--) {
26509- done = hba[ctlr]->access.command_completed(hba[ctlr]);
26510+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
26511 if (done == 0) {
26512 udelay(10); /* a short fixed delay */
26513 } else
26514diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
26515index be73e9d..7fbf140 100644
26516--- a/drivers/block/cpqarray.h
26517+++ b/drivers/block/cpqarray.h
26518@@ -99,7 +99,7 @@ struct ctlr_info {
26519 drv_info_t drv[NWD];
26520 struct proc_dir_entry *proc;
26521
26522- struct access_method access;
26523+ struct access_method *access;
26524
26525 cmdlist_t *reqQ;
26526 cmdlist_t *cmpQ;
26527diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
26528index ef2ceed..c9cb18e 100644
26529--- a/drivers/block/drbd/drbd_int.h
26530+++ b/drivers/block/drbd/drbd_int.h
26531@@ -737,7 +737,7 @@ struct drbd_request;
26532 struct drbd_epoch {
26533 struct list_head list;
26534 unsigned int barrier_nr;
26535- atomic_t epoch_size; /* increased on every request added. */
26536+ atomic_unchecked_t epoch_size; /* increased on every request added. */
26537 atomic_t active; /* increased on every req. added, and dec on every finished. */
26538 unsigned long flags;
26539 };
26540@@ -1109,7 +1109,7 @@ struct drbd_conf {
26541 void *int_dig_in;
26542 void *int_dig_vv;
26543 wait_queue_head_t seq_wait;
26544- atomic_t packet_seq;
26545+ atomic_unchecked_t packet_seq;
26546 unsigned int peer_seq;
26547 spinlock_t peer_seq_lock;
26548 unsigned int minor;
26549@@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
26550
26551 static inline void drbd_tcp_cork(struct socket *sock)
26552 {
26553- int __user val = 1;
26554+ int val = 1;
26555 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26556- (char __user *)&val, sizeof(val));
26557+ (char __force_user *)&val, sizeof(val));
26558 }
26559
26560 static inline void drbd_tcp_uncork(struct socket *sock)
26561 {
26562- int __user val = 0;
26563+ int val = 0;
26564 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26565- (char __user *)&val, sizeof(val));
26566+ (char __force_user *)&val, sizeof(val));
26567 }
26568
26569 static inline void drbd_tcp_nodelay(struct socket *sock)
26570 {
26571- int __user val = 1;
26572+ int val = 1;
26573 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
26574- (char __user *)&val, sizeof(val));
26575+ (char __force_user *)&val, sizeof(val));
26576 }
26577
26578 static inline void drbd_tcp_quickack(struct socket *sock)
26579 {
26580- int __user val = 2;
26581+ int val = 2;
26582 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
26583- (char __user *)&val, sizeof(val));
26584+ (char __force_user *)&val, sizeof(val));
26585 }
26586
26587 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
26588diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
26589index 0358e55..bc33689 100644
26590--- a/drivers/block/drbd/drbd_main.c
26591+++ b/drivers/block/drbd/drbd_main.c
26592@@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd,
26593 p.sector = sector;
26594 p.block_id = block_id;
26595 p.blksize = blksize;
26596- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
26597+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
26598
26599 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
26600 return false;
26601@@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
26602 p.sector = cpu_to_be64(req->sector);
26603 p.block_id = (unsigned long)req;
26604 p.seq_num = cpu_to_be32(req->seq_num =
26605- atomic_add_return(1, &mdev->packet_seq));
26606+ atomic_add_return_unchecked(1, &mdev->packet_seq));
26607
26608 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
26609
26610@@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev)
26611 atomic_set(&mdev->unacked_cnt, 0);
26612 atomic_set(&mdev->local_cnt, 0);
26613 atomic_set(&mdev->net_cnt, 0);
26614- atomic_set(&mdev->packet_seq, 0);
26615+ atomic_set_unchecked(&mdev->packet_seq, 0);
26616 atomic_set(&mdev->pp_in_use, 0);
26617 atomic_set(&mdev->pp_in_use_by_net, 0);
26618 atomic_set(&mdev->rs_sect_in, 0);
26619@@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev)
26620 mdev->receiver.t_state);
26621
26622 /* no need to lock it, I'm the only thread alive */
26623- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
26624- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
26625+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
26626+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
26627 mdev->al_writ_cnt =
26628 mdev->bm_writ_cnt =
26629 mdev->read_cnt =
26630diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
26631index 0feab26..5d9b3dd 100644
26632--- a/drivers/block/drbd/drbd_nl.c
26633+++ b/drivers/block/drbd/drbd_nl.c
26634@@ -2359,7 +2359,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms
26635 module_put(THIS_MODULE);
26636 }
26637
26638-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26639+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26640
26641 static unsigned short *
26642 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
26643@@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state)
26644 cn_reply->id.idx = CN_IDX_DRBD;
26645 cn_reply->id.val = CN_VAL_DRBD;
26646
26647- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26648+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26649 cn_reply->ack = 0; /* not used here. */
26650 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26651 (int)((char *)tl - (char *)reply->tag_list);
26652@@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name)
26653 cn_reply->id.idx = CN_IDX_DRBD;
26654 cn_reply->id.val = CN_VAL_DRBD;
26655
26656- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26657+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26658 cn_reply->ack = 0; /* not used here. */
26659 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26660 (int)((char *)tl - (char *)reply->tag_list);
26661@@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev,
26662 cn_reply->id.idx = CN_IDX_DRBD;
26663 cn_reply->id.val = CN_VAL_DRBD;
26664
26665- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
26666+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
26667 cn_reply->ack = 0; // not used here.
26668 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26669 (int)((char*)tl - (char*)reply->tag_list);
26670@@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev)
26671 cn_reply->id.idx = CN_IDX_DRBD;
26672 cn_reply->id.val = CN_VAL_DRBD;
26673
26674- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26675+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26676 cn_reply->ack = 0; /* not used here. */
26677 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26678 (int)((char *)tl - (char *)reply->tag_list);
26679diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
26680index 43beaca..4a5b1dd 100644
26681--- a/drivers/block/drbd/drbd_receiver.c
26682+++ b/drivers/block/drbd/drbd_receiver.c
26683@@ -894,7 +894,7 @@ retry:
26684 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
26685 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
26686
26687- atomic_set(&mdev->packet_seq, 0);
26688+ atomic_set_unchecked(&mdev->packet_seq, 0);
26689 mdev->peer_seq = 0;
26690
26691 drbd_thread_start(&mdev->asender);
26692@@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26693 do {
26694 next_epoch = NULL;
26695
26696- epoch_size = atomic_read(&epoch->epoch_size);
26697+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
26698
26699 switch (ev & ~EV_CLEANUP) {
26700 case EV_PUT:
26701@@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26702 rv = FE_DESTROYED;
26703 } else {
26704 epoch->flags = 0;
26705- atomic_set(&epoch->epoch_size, 0);
26706+ atomic_set_unchecked(&epoch->epoch_size, 0);
26707 /* atomic_set(&epoch->active, 0); is already zero */
26708 if (rv == FE_STILL_LIVE)
26709 rv = FE_RECYCLED;
26710@@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26711 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
26712 drbd_flush(mdev);
26713
26714- if (atomic_read(&mdev->current_epoch->epoch_size)) {
26715+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26716 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
26717 if (epoch)
26718 break;
26719 }
26720
26721 epoch = mdev->current_epoch;
26722- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
26723+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
26724
26725 D_ASSERT(atomic_read(&epoch->active) == 0);
26726 D_ASSERT(epoch->flags == 0);
26727@@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26728 }
26729
26730 epoch->flags = 0;
26731- atomic_set(&epoch->epoch_size, 0);
26732+ atomic_set_unchecked(&epoch->epoch_size, 0);
26733 atomic_set(&epoch->active, 0);
26734
26735 spin_lock(&mdev->epoch_lock);
26736- if (atomic_read(&mdev->current_epoch->epoch_size)) {
26737+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26738 list_add(&epoch->list, &mdev->current_epoch->list);
26739 mdev->current_epoch = epoch;
26740 mdev->epochs++;
26741@@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26742 spin_unlock(&mdev->peer_seq_lock);
26743
26744 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
26745- atomic_inc(&mdev->current_epoch->epoch_size);
26746+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
26747 return drbd_drain_block(mdev, data_size);
26748 }
26749
26750@@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26751
26752 spin_lock(&mdev->epoch_lock);
26753 e->epoch = mdev->current_epoch;
26754- atomic_inc(&e->epoch->epoch_size);
26755+ atomic_inc_unchecked(&e->epoch->epoch_size);
26756 atomic_inc(&e->epoch->active);
26757 spin_unlock(&mdev->epoch_lock);
26758
26759@@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
26760 D_ASSERT(list_empty(&mdev->done_ee));
26761
26762 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
26763- atomic_set(&mdev->current_epoch->epoch_size, 0);
26764+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
26765 D_ASSERT(list_empty(&mdev->current_epoch->list));
26766 }
26767
26768diff --git a/drivers/block/loop.c b/drivers/block/loop.c
26769index 4720c7a..2c49af1 100644
26770--- a/drivers/block/loop.c
26771+++ b/drivers/block/loop.c
26772@@ -283,7 +283,7 @@ static int __do_lo_send_write(struct file *file,
26773 mm_segment_t old_fs = get_fs();
26774
26775 set_fs(get_ds());
26776- bw = file->f_op->write(file, buf, len, &pos);
26777+ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
26778 set_fs(old_fs);
26779 if (likely(bw == len))
26780 return 0;
26781diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
26782index f533f33..6177bcb 100644
26783--- a/drivers/block/nbd.c
26784+++ b/drivers/block/nbd.c
26785@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
26786 struct kvec iov;
26787 sigset_t blocked, oldset;
26788
26789+ pax_track_stack();
26790+
26791 if (unlikely(!sock)) {
26792 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
26793 lo->disk->disk_name, (send ? "send" : "recv"));
26794@@ -572,6 +574,8 @@ static void do_nbd_request(struct request_queue *q)
26795 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
26796 unsigned int cmd, unsigned long arg)
26797 {
26798+ pax_track_stack();
26799+
26800 switch (cmd) {
26801 case NBD_DISCONNECT: {
26802 struct request sreq;
26803diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
26804index 423fd56..06d3be0 100644
26805--- a/drivers/char/Kconfig
26806+++ b/drivers/char/Kconfig
26807@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
26808
26809 config DEVKMEM
26810 bool "/dev/kmem virtual device support"
26811- default y
26812+ default n
26813+ depends on !GRKERNSEC_KMEM
26814 help
26815 Say Y here if you want to support the /dev/kmem device. The
26816 /dev/kmem device is rarely used, but can be used for certain
26817@@ -596,6 +597,7 @@ config DEVPORT
26818 bool
26819 depends on !M68K
26820 depends on ISA || PCI
26821+ depends on !GRKERNSEC_KMEM
26822 default y
26823
26824 source "drivers/s390/char/Kconfig"
26825diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
26826index 2e04433..22afc64 100644
26827--- a/drivers/char/agp/frontend.c
26828+++ b/drivers/char/agp/frontend.c
26829@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
26830 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
26831 return -EFAULT;
26832
26833- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
26834+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
26835 return -EFAULT;
26836
26837 client = agp_find_client_by_pid(reserve.pid);
26838diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
26839index 095ab90..afad0a4 100644
26840--- a/drivers/char/briq_panel.c
26841+++ b/drivers/char/briq_panel.c
26842@@ -9,6 +9,7 @@
26843 #include <linux/types.h>
26844 #include <linux/errno.h>
26845 #include <linux/tty.h>
26846+#include <linux/mutex.h>
26847 #include <linux/timer.h>
26848 #include <linux/kernel.h>
26849 #include <linux/wait.h>
26850@@ -34,6 +35,7 @@ static int vfd_is_open;
26851 static unsigned char vfd[40];
26852 static int vfd_cursor;
26853 static unsigned char ledpb, led;
26854+static DEFINE_MUTEX(vfd_mutex);
26855
26856 static void update_vfd(void)
26857 {
26858@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
26859 if (!vfd_is_open)
26860 return -EBUSY;
26861
26862+ mutex_lock(&vfd_mutex);
26863 for (;;) {
26864 char c;
26865 if (!indx)
26866 break;
26867- if (get_user(c, buf))
26868+ if (get_user(c, buf)) {
26869+ mutex_unlock(&vfd_mutex);
26870 return -EFAULT;
26871+ }
26872 if (esc) {
26873 set_led(c);
26874 esc = 0;
26875@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
26876 buf++;
26877 }
26878 update_vfd();
26879+ mutex_unlock(&vfd_mutex);
26880
26881 return len;
26882 }
26883diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
26884index f773a9d..65cd683 100644
26885--- a/drivers/char/genrtc.c
26886+++ b/drivers/char/genrtc.c
26887@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *file,
26888 switch (cmd) {
26889
26890 case RTC_PLL_GET:
26891+ memset(&pll, 0, sizeof(pll));
26892 if (get_rtc_pll(&pll))
26893 return -EINVAL;
26894 else
26895diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
26896index 0833896..cccce52 100644
26897--- a/drivers/char/hpet.c
26898+++ b/drivers/char/hpet.c
26899@@ -572,7 +572,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
26900 }
26901
26902 static int
26903-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
26904+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
26905 struct hpet_info *info)
26906 {
26907 struct hpet_timer __iomem *timer;
26908diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
26909index 58c0e63..25aed94 100644
26910--- a/drivers/char/ipmi/ipmi_msghandler.c
26911+++ b/drivers/char/ipmi/ipmi_msghandler.c
26912@@ -415,7 +415,7 @@ struct ipmi_smi {
26913 struct proc_dir_entry *proc_dir;
26914 char proc_dir_name[10];
26915
26916- atomic_t stats[IPMI_NUM_STATS];
26917+ atomic_unchecked_t stats[IPMI_NUM_STATS];
26918
26919 /*
26920 * run_to_completion duplicate of smb_info, smi_info
26921@@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
26922
26923
26924 #define ipmi_inc_stat(intf, stat) \
26925- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
26926+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
26927 #define ipmi_get_stat(intf, stat) \
26928- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
26929+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
26930
26931 static int is_lan_addr(struct ipmi_addr *addr)
26932 {
26933@@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
26934 INIT_LIST_HEAD(&intf->cmd_rcvrs);
26935 init_waitqueue_head(&intf->waitq);
26936 for (i = 0; i < IPMI_NUM_STATS; i++)
26937- atomic_set(&intf->stats[i], 0);
26938+ atomic_set_unchecked(&intf->stats[i], 0);
26939
26940 intf->proc_dir = NULL;
26941
26942@@ -4220,6 +4220,8 @@ static void send_panic_events(char *str)
26943 struct ipmi_smi_msg smi_msg;
26944 struct ipmi_recv_msg recv_msg;
26945
26946+ pax_track_stack();
26947+
26948 si = (struct ipmi_system_interface_addr *) &addr;
26949 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
26950 si->channel = IPMI_BMC_CHANNEL;
26951diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
26952index 9397ab4..d01bee1 100644
26953--- a/drivers/char/ipmi/ipmi_si_intf.c
26954+++ b/drivers/char/ipmi/ipmi_si_intf.c
26955@@ -277,7 +277,7 @@ struct smi_info {
26956 unsigned char slave_addr;
26957
26958 /* Counters and things for the proc filesystem. */
26959- atomic_t stats[SI_NUM_STATS];
26960+ atomic_unchecked_t stats[SI_NUM_STATS];
26961
26962 struct task_struct *thread;
26963
26964@@ -286,9 +286,9 @@ struct smi_info {
26965 };
26966
26967 #define smi_inc_stat(smi, stat) \
26968- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
26969+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
26970 #define smi_get_stat(smi, stat) \
26971- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
26972+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
26973
26974 #define SI_MAX_PARMS 4
26975
26976@@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info *new_smi)
26977 atomic_set(&new_smi->req_events, 0);
26978 new_smi->run_to_completion = 0;
26979 for (i = 0; i < SI_NUM_STATS; i++)
26980- atomic_set(&new_smi->stats[i], 0);
26981+ atomic_set_unchecked(&new_smi->stats[i], 0);
26982
26983 new_smi->interrupt_disabled = 1;
26984 atomic_set(&new_smi->stop_operation, 0);
26985diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
26986index 1aeaaba..e018570 100644
26987--- a/drivers/char/mbcs.c
26988+++ b/drivers/char/mbcs.c
26989@@ -800,7 +800,7 @@ static int mbcs_remove(struct cx_dev *dev)
26990 return 0;
26991 }
26992
26993-static const struct cx_device_id __devinitdata mbcs_id_table[] = {
26994+static const struct cx_device_id __devinitconst mbcs_id_table[] = {
26995 {
26996 .part_num = MBCS_PART_NUM,
26997 .mfg_num = MBCS_MFG_NUM,
26998diff --git a/drivers/char/mem.c b/drivers/char/mem.c
26999index 8fc04b4..cebdeec 100644
27000--- a/drivers/char/mem.c
27001+++ b/drivers/char/mem.c
27002@@ -18,6 +18,7 @@
27003 #include <linux/raw.h>
27004 #include <linux/tty.h>
27005 #include <linux/capability.h>
27006+#include <linux/security.h>
27007 #include <linux/ptrace.h>
27008 #include <linux/device.h>
27009 #include <linux/highmem.h>
27010@@ -34,6 +35,10 @@
27011 # include <linux/efi.h>
27012 #endif
27013
27014+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27015+extern const struct file_operations grsec_fops;
27016+#endif
27017+
27018 static inline unsigned long size_inside_page(unsigned long start,
27019 unsigned long size)
27020 {
27021@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27022
27023 while (cursor < to) {
27024 if (!devmem_is_allowed(pfn)) {
27025+#ifdef CONFIG_GRKERNSEC_KMEM
27026+ gr_handle_mem_readwrite(from, to);
27027+#else
27028 printk(KERN_INFO
27029 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
27030 current->comm, from, to);
27031+#endif
27032 return 0;
27033 }
27034 cursor += PAGE_SIZE;
27035@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27036 }
27037 return 1;
27038 }
27039+#elif defined(CONFIG_GRKERNSEC_KMEM)
27040+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27041+{
27042+ return 0;
27043+}
27044 #else
27045 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27046 {
27047@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27048
27049 while (count > 0) {
27050 unsigned long remaining;
27051+ char *temp;
27052
27053 sz = size_inside_page(p, count);
27054
27055@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27056 if (!ptr)
27057 return -EFAULT;
27058
27059- remaining = copy_to_user(buf, ptr, sz);
27060+#ifdef CONFIG_PAX_USERCOPY
27061+ temp = kmalloc(sz, GFP_KERNEL);
27062+ if (!temp) {
27063+ unxlate_dev_mem_ptr(p, ptr);
27064+ return -ENOMEM;
27065+ }
27066+ memcpy(temp, ptr, sz);
27067+#else
27068+ temp = ptr;
27069+#endif
27070+
27071+ remaining = copy_to_user(buf, temp, sz);
27072+
27073+#ifdef CONFIG_PAX_USERCOPY
27074+ kfree(temp);
27075+#endif
27076+
27077 unxlate_dev_mem_ptr(p, ptr);
27078 if (remaining)
27079 return -EFAULT;
27080@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27081 size_t count, loff_t *ppos)
27082 {
27083 unsigned long p = *ppos;
27084- ssize_t low_count, read, sz;
27085+ ssize_t low_count, read, sz, err = 0;
27086 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
27087- int err = 0;
27088
27089 read = 0;
27090 if (p < (unsigned long) high_memory) {
27091@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27092 }
27093 #endif
27094 while (low_count > 0) {
27095+ char *temp;
27096+
27097 sz = size_inside_page(p, low_count);
27098
27099 /*
27100@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27101 */
27102 kbuf = xlate_dev_kmem_ptr((char *)p);
27103
27104- if (copy_to_user(buf, kbuf, sz))
27105+#ifdef CONFIG_PAX_USERCOPY
27106+ temp = kmalloc(sz, GFP_KERNEL);
27107+ if (!temp)
27108+ return -ENOMEM;
27109+ memcpy(temp, kbuf, sz);
27110+#else
27111+ temp = kbuf;
27112+#endif
27113+
27114+ err = copy_to_user(buf, temp, sz);
27115+
27116+#ifdef CONFIG_PAX_USERCOPY
27117+ kfree(temp);
27118+#endif
27119+
27120+ if (err)
27121 return -EFAULT;
27122 buf += sz;
27123 p += sz;
27124@@ -866,6 +913,9 @@ static const struct memdev {
27125 #ifdef CONFIG_CRASH_DUMP
27126 [12] = { "oldmem", 0, &oldmem_fops, NULL },
27127 #endif
27128+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27129+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
27130+#endif
27131 };
27132
27133 static int memory_open(struct inode *inode, struct file *filp)
27134diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
27135index da3cfee..a5a6606 100644
27136--- a/drivers/char/nvram.c
27137+++ b/drivers/char/nvram.c
27138@@ -248,7 +248,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
27139
27140 spin_unlock_irq(&rtc_lock);
27141
27142- if (copy_to_user(buf, contents, tmp - contents))
27143+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
27144 return -EFAULT;
27145
27146 *ppos = i;
27147diff --git a/drivers/char/random.c b/drivers/char/random.c
27148index c35a785..6d82202 100644
27149--- a/drivers/char/random.c
27150+++ b/drivers/char/random.c
27151@@ -261,8 +261,13 @@
27152 /*
27153 * Configuration information
27154 */
27155+#ifdef CONFIG_GRKERNSEC_RANDNET
27156+#define INPUT_POOL_WORDS 512
27157+#define OUTPUT_POOL_WORDS 128
27158+#else
27159 #define INPUT_POOL_WORDS 128
27160 #define OUTPUT_POOL_WORDS 32
27161+#endif
27162 #define SEC_XFER_SIZE 512
27163 #define EXTRACT_SIZE 10
27164
27165@@ -300,10 +305,17 @@ static struct poolinfo {
27166 int poolwords;
27167 int tap1, tap2, tap3, tap4, tap5;
27168 } poolinfo_table[] = {
27169+#ifdef CONFIG_GRKERNSEC_RANDNET
27170+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
27171+ { 512, 411, 308, 208, 104, 1 },
27172+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
27173+ { 128, 103, 76, 51, 25, 1 },
27174+#else
27175 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
27176 { 128, 103, 76, 51, 25, 1 },
27177 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
27178 { 32, 26, 20, 14, 7, 1 },
27179+#endif
27180 #if 0
27181 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
27182 { 2048, 1638, 1231, 819, 411, 1 },
27183@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
27184
27185 extract_buf(r, tmp);
27186 i = min_t(int, nbytes, EXTRACT_SIZE);
27187- if (copy_to_user(buf, tmp, i)) {
27188+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
27189 ret = -EFAULT;
27190 break;
27191 }
27192@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
27193 #include <linux/sysctl.h>
27194
27195 static int min_read_thresh = 8, min_write_thresh;
27196-static int max_read_thresh = INPUT_POOL_WORDS * 32;
27197+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
27198 static int max_write_thresh = INPUT_POOL_WORDS * 32;
27199 static char sysctl_bootid[16];
27200
27201diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
27202index 1ee8ce7..b778bef 100644
27203--- a/drivers/char/sonypi.c
27204+++ b/drivers/char/sonypi.c
27205@@ -55,6 +55,7 @@
27206 #include <asm/uaccess.h>
27207 #include <asm/io.h>
27208 #include <asm/system.h>
27209+#include <asm/local.h>
27210
27211 #include <linux/sonypi.h>
27212
27213@@ -491,7 +492,7 @@ static struct sonypi_device {
27214 spinlock_t fifo_lock;
27215 wait_queue_head_t fifo_proc_list;
27216 struct fasync_struct *fifo_async;
27217- int open_count;
27218+ local_t open_count;
27219 int model;
27220 struct input_dev *input_jog_dev;
27221 struct input_dev *input_key_dev;
27222@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
27223 static int sonypi_misc_release(struct inode *inode, struct file *file)
27224 {
27225 mutex_lock(&sonypi_device.lock);
27226- sonypi_device.open_count--;
27227+ local_dec(&sonypi_device.open_count);
27228 mutex_unlock(&sonypi_device.lock);
27229 return 0;
27230 }
27231@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
27232 {
27233 mutex_lock(&sonypi_device.lock);
27234 /* Flush input queue on first open */
27235- if (!sonypi_device.open_count)
27236+ if (!local_read(&sonypi_device.open_count))
27237 kfifo_reset(&sonypi_device.fifo);
27238- sonypi_device.open_count++;
27239+ local_inc(&sonypi_device.open_count);
27240 mutex_unlock(&sonypi_device.lock);
27241
27242 return 0;
27243diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
27244index 9ca5c02..7ce352c 100644
27245--- a/drivers/char/tpm/tpm.c
27246+++ b/drivers/char/tpm/tpm.c
27247@@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
27248 chip->vendor.req_complete_val)
27249 goto out_recv;
27250
27251- if ((status == chip->vendor.req_canceled)) {
27252+ if (status == chip->vendor.req_canceled) {
27253 dev_err(chip->dev, "Operation Canceled\n");
27254 rc = -ECANCELED;
27255 goto out;
27256@@ -862,6 +862,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
27257
27258 struct tpm_chip *chip = dev_get_drvdata(dev);
27259
27260+ pax_track_stack();
27261+
27262 tpm_cmd.header.in = tpm_readpubek_header;
27263 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
27264 "attempting to read the PUBEK");
27265diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
27266index 0636520..169c1d0 100644
27267--- a/drivers/char/tpm/tpm_bios.c
27268+++ b/drivers/char/tpm/tpm_bios.c
27269@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
27270 event = addr;
27271
27272 if ((event->event_type == 0 && event->event_size == 0) ||
27273- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
27274+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
27275 return NULL;
27276
27277 return addr;
27278@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
27279 return NULL;
27280
27281 if ((event->event_type == 0 && event->event_size == 0) ||
27282- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
27283+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
27284 return NULL;
27285
27286 (*pos)++;
27287@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
27288 int i;
27289
27290 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
27291- seq_putc(m, data[i]);
27292+ if (!seq_putc(m, data[i]))
27293+ return -EFAULT;
27294
27295 return 0;
27296 }
27297@@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log *log)
27298 log->bios_event_log_end = log->bios_event_log + len;
27299
27300 virt = acpi_os_map_memory(start, len);
27301+ if (!virt) {
27302+ kfree(log->bios_event_log);
27303+ log->bios_event_log = NULL;
27304+ return -EFAULT;
27305+ }
27306
27307- memcpy(log->bios_event_log, virt, len);
27308+ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
27309
27310 acpi_os_unmap_memory(virt, len);
27311 return 0;
27312diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
27313index fb68b12..0f6c6ca 100644
27314--- a/drivers/char/virtio_console.c
27315+++ b/drivers/char/virtio_console.c
27316@@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
27317 if (to_user) {
27318 ssize_t ret;
27319
27320- ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
27321+ ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
27322 if (ret)
27323 return -EFAULT;
27324 } else {
27325@@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
27326 if (!port_has_data(port) && !port->host_connected)
27327 return 0;
27328
27329- return fill_readbuf(port, ubuf, count, true);
27330+ return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
27331 }
27332
27333 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
27334diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
27335index a84250a..68c725e 100644
27336--- a/drivers/crypto/hifn_795x.c
27337+++ b/drivers/crypto/hifn_795x.c
27338@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
27339 0xCA, 0x34, 0x2B, 0x2E};
27340 struct scatterlist sg;
27341
27342+ pax_track_stack();
27343+
27344 memset(src, 0, sizeof(src));
27345 memset(ctx.key, 0, sizeof(ctx.key));
27346
27347diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
27348index db33d30..7823369 100644
27349--- a/drivers/crypto/padlock-aes.c
27350+++ b/drivers/crypto/padlock-aes.c
27351@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
27352 struct crypto_aes_ctx gen_aes;
27353 int cpu;
27354
27355+ pax_track_stack();
27356+
27357 if (key_len % 8) {
27358 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
27359 return -EINVAL;
27360diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
27361index 9a8bebc..b1e4989 100644
27362--- a/drivers/edac/amd64_edac.c
27363+++ b/drivers/edac/amd64_edac.c
27364@@ -2670,7 +2670,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
27365 * PCI core identifies what devices are on a system during boot, and then
27366 * inquiry this table to see if this driver is for a given device found.
27367 */
27368-static const struct pci_device_id amd64_pci_table[] __devinitdata = {
27369+static const struct pci_device_id amd64_pci_table[] __devinitconst = {
27370 {
27371 .vendor = PCI_VENDOR_ID_AMD,
27372 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
27373diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
27374index e47e73b..348e0bd 100644
27375--- a/drivers/edac/amd76x_edac.c
27376+++ b/drivers/edac/amd76x_edac.c
27377@@ -321,7 +321,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
27378 edac_mc_free(mci);
27379 }
27380
27381-static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
27382+static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
27383 {
27384 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27385 AMD762},
27386diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
27387index 1af531a..3a8ff27 100644
27388--- a/drivers/edac/e752x_edac.c
27389+++ b/drivers/edac/e752x_edac.c
27390@@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
27391 edac_mc_free(mci);
27392 }
27393
27394-static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
27395+static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
27396 {
27397 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27398 E7520},
27399diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
27400index 6ffb6d2..383d8d7 100644
27401--- a/drivers/edac/e7xxx_edac.c
27402+++ b/drivers/edac/e7xxx_edac.c
27403@@ -525,7 +525,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
27404 edac_mc_free(mci);
27405 }
27406
27407-static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
27408+static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
27409 {
27410 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27411 E7205},
27412diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
27413index 495198a..ac08c85 100644
27414--- a/drivers/edac/edac_pci_sysfs.c
27415+++ b/drivers/edac/edac_pci_sysfs.c
27416@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
27417 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
27418 static int edac_pci_poll_msec = 1000; /* one second workq period */
27419
27420-static atomic_t pci_parity_count = ATOMIC_INIT(0);
27421-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
27422+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
27423+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
27424
27425 static struct kobject *edac_pci_top_main_kobj;
27426 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
27427@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27428 edac_printk(KERN_CRIT, EDAC_PCI,
27429 "Signaled System Error on %s\n",
27430 pci_name(dev));
27431- atomic_inc(&pci_nonparity_count);
27432+ atomic_inc_unchecked(&pci_nonparity_count);
27433 }
27434
27435 if (status & (PCI_STATUS_PARITY)) {
27436@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27437 "Master Data Parity Error on %s\n",
27438 pci_name(dev));
27439
27440- atomic_inc(&pci_parity_count);
27441+ atomic_inc_unchecked(&pci_parity_count);
27442 }
27443
27444 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27445@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27446 "Detected Parity Error on %s\n",
27447 pci_name(dev));
27448
27449- atomic_inc(&pci_parity_count);
27450+ atomic_inc_unchecked(&pci_parity_count);
27451 }
27452 }
27453
27454@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27455 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
27456 "Signaled System Error on %s\n",
27457 pci_name(dev));
27458- atomic_inc(&pci_nonparity_count);
27459+ atomic_inc_unchecked(&pci_nonparity_count);
27460 }
27461
27462 if (status & (PCI_STATUS_PARITY)) {
27463@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27464 "Master Data Parity Error on "
27465 "%s\n", pci_name(dev));
27466
27467- atomic_inc(&pci_parity_count);
27468+ atomic_inc_unchecked(&pci_parity_count);
27469 }
27470
27471 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27472@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27473 "Detected Parity Error on %s\n",
27474 pci_name(dev));
27475
27476- atomic_inc(&pci_parity_count);
27477+ atomic_inc_unchecked(&pci_parity_count);
27478 }
27479 }
27480 }
27481@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
27482 if (!check_pci_errors)
27483 return;
27484
27485- before_count = atomic_read(&pci_parity_count);
27486+ before_count = atomic_read_unchecked(&pci_parity_count);
27487
27488 /* scan all PCI devices looking for a Parity Error on devices and
27489 * bridges.
27490@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
27491 /* Only if operator has selected panic on PCI Error */
27492 if (edac_pci_get_panic_on_pe()) {
27493 /* If the count is different 'after' from 'before' */
27494- if (before_count != atomic_read(&pci_parity_count))
27495+ if (before_count != atomic_read_unchecked(&pci_parity_count))
27496 panic("EDAC: PCI Parity Error");
27497 }
27498 }
27499diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
27500index c0510b3..6e2a954 100644
27501--- a/drivers/edac/i3000_edac.c
27502+++ b/drivers/edac/i3000_edac.c
27503@@ -470,7 +470,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
27504 edac_mc_free(mci);
27505 }
27506
27507-static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
27508+static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
27509 {
27510 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27511 I3000},
27512diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
27513index aa08497..7e6822a 100644
27514--- a/drivers/edac/i3200_edac.c
27515+++ b/drivers/edac/i3200_edac.c
27516@@ -456,7 +456,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
27517 edac_mc_free(mci);
27518 }
27519
27520-static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
27521+static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
27522 {
27523 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27524 I3200},
27525diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
27526index 4dc3ac2..67d05a6 100644
27527--- a/drivers/edac/i5000_edac.c
27528+++ b/drivers/edac/i5000_edac.c
27529@@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
27530 *
27531 * The "E500P" device is the first device supported.
27532 */
27533-static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
27534+static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
27535 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
27536 .driver_data = I5000P},
27537
27538diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
27539index bcbdeec..9886d16 100644
27540--- a/drivers/edac/i5100_edac.c
27541+++ b/drivers/edac/i5100_edac.c
27542@@ -1051,7 +1051,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
27543 edac_mc_free(mci);
27544 }
27545
27546-static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
27547+static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
27548 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
27549 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
27550 { 0, }
27551diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
27552index 74d6ec34..baff517 100644
27553--- a/drivers/edac/i5400_edac.c
27554+++ b/drivers/edac/i5400_edac.c
27555@@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
27556 *
27557 * The "E500P" device is the first device supported.
27558 */
27559-static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
27560+static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
27561 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
27562 {0,} /* 0 terminated list. */
27563 };
27564diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
27565index a76fe83..15479e6 100644
27566--- a/drivers/edac/i7300_edac.c
27567+++ b/drivers/edac/i7300_edac.c
27568@@ -1191,7 +1191,7 @@ static void __devexit i7300_remove_one(struct pci_dev *pdev)
27569 *
27570 * Has only 8086:360c PCI ID
27571 */
27572-static const struct pci_device_id i7300_pci_tbl[] __devinitdata = {
27573+static const struct pci_device_id i7300_pci_tbl[] __devinitconst = {
27574 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
27575 {0,} /* 0 terminated list. */
27576 };
27577diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
27578index f6cf448..3f612e9 100644
27579--- a/drivers/edac/i7core_edac.c
27580+++ b/drivers/edac/i7core_edac.c
27581@@ -359,7 +359,7 @@ static const struct pci_id_table pci_dev_table[] = {
27582 /*
27583 * pci_device_id table for which devices we are looking for
27584 */
27585-static const struct pci_device_id i7core_pci_tbl[] __devinitdata = {
27586+static const struct pci_device_id i7core_pci_tbl[] __devinitconst = {
27587 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
27588 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
27589 {0,} /* 0 terminated list. */
27590diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
27591index 4329d39..f3022ef 100644
27592--- a/drivers/edac/i82443bxgx_edac.c
27593+++ b/drivers/edac/i82443bxgx_edac.c
27594@@ -380,7 +380,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
27595
27596 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
27597
27598-static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
27599+static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
27600 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
27601 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
27602 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
27603diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
27604index 931a057..fd28340 100644
27605--- a/drivers/edac/i82860_edac.c
27606+++ b/drivers/edac/i82860_edac.c
27607@@ -270,7 +270,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
27608 edac_mc_free(mci);
27609 }
27610
27611-static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
27612+static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
27613 {
27614 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27615 I82860},
27616diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
27617index 33864c6..01edc61 100644
27618--- a/drivers/edac/i82875p_edac.c
27619+++ b/drivers/edac/i82875p_edac.c
27620@@ -511,7 +511,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
27621 edac_mc_free(mci);
27622 }
27623
27624-static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
27625+static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
27626 {
27627 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27628 I82875P},
27629diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
27630index a5da732..983363b 100644
27631--- a/drivers/edac/i82975x_edac.c
27632+++ b/drivers/edac/i82975x_edac.c
27633@@ -604,7 +604,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
27634 edac_mc_free(mci);
27635 }
27636
27637-static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
27638+static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
27639 {
27640 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27641 I82975X
27642diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
27643index 795a320..3bbc3d3 100644
27644--- a/drivers/edac/mce_amd.h
27645+++ b/drivers/edac/mce_amd.h
27646@@ -83,7 +83,7 @@ struct amd_decoder_ops {
27647 bool (*dc_mce)(u16, u8);
27648 bool (*ic_mce)(u16, u8);
27649 bool (*nb_mce)(u16, u8);
27650-};
27651+} __no_const;
27652
27653 void amd_report_gart_errors(bool);
27654 void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
27655diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
27656index b153674..ad2ba9b 100644
27657--- a/drivers/edac/r82600_edac.c
27658+++ b/drivers/edac/r82600_edac.c
27659@@ -373,7 +373,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
27660 edac_mc_free(mci);
27661 }
27662
27663-static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
27664+static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
27665 {
27666 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
27667 },
27668diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
27669index b6f47de..c5acf3a 100644
27670--- a/drivers/edac/x38_edac.c
27671+++ b/drivers/edac/x38_edac.c
27672@@ -440,7 +440,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
27673 edac_mc_free(mci);
27674 }
27675
27676-static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
27677+static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
27678 {
27679 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27680 X38},
27681diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
27682index 85661b0..c784559a 100644
27683--- a/drivers/firewire/core-card.c
27684+++ b/drivers/firewire/core-card.c
27685@@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref)
27686
27687 void fw_core_remove_card(struct fw_card *card)
27688 {
27689- struct fw_card_driver dummy_driver = dummy_driver_template;
27690+ fw_card_driver_no_const dummy_driver = dummy_driver_template;
27691
27692 card->driver->update_phy_reg(card, 4,
27693 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
27694diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
27695index 4799393..37bd3ab 100644
27696--- a/drivers/firewire/core-cdev.c
27697+++ b/drivers/firewire/core-cdev.c
27698@@ -1331,8 +1331,7 @@ static int init_iso_resource(struct client *client,
27699 int ret;
27700
27701 if ((request->channels == 0 && request->bandwidth == 0) ||
27702- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
27703- request->bandwidth < 0)
27704+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
27705 return -EINVAL;
27706
27707 r = kmalloc(sizeof(*r), GFP_KERNEL);
27708diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
27709index 334b82a..ea5261d 100644
27710--- a/drivers/firewire/core-transaction.c
27711+++ b/drivers/firewire/core-transaction.c
27712@@ -37,6 +37,7 @@
27713 #include <linux/timer.h>
27714 #include <linux/types.h>
27715 #include <linux/workqueue.h>
27716+#include <linux/sched.h>
27717
27718 #include <asm/byteorder.h>
27719
27720@@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
27721 struct transaction_callback_data d;
27722 struct fw_transaction t;
27723
27724+ pax_track_stack();
27725+
27726 init_timer_on_stack(&t.split_timeout_timer);
27727 init_completion(&d.done);
27728 d.payload = payload;
27729diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
27730index b45be57..5fad18b 100644
27731--- a/drivers/firewire/core.h
27732+++ b/drivers/firewire/core.h
27733@@ -101,6 +101,7 @@ struct fw_card_driver {
27734
27735 int (*stop_iso)(struct fw_iso_context *ctx);
27736 };
27737+typedef struct fw_card_driver __no_const fw_card_driver_no_const;
27738
27739 void fw_card_initialize(struct fw_card *card,
27740 const struct fw_card_driver *driver, struct device *device);
27741diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
27742index bcb1126..2cc2121 100644
27743--- a/drivers/firmware/dmi_scan.c
27744+++ b/drivers/firmware/dmi_scan.c
27745@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
27746 }
27747 }
27748 else {
27749- /*
27750- * no iounmap() for that ioremap(); it would be a no-op, but
27751- * it's so early in setup that sucker gets confused into doing
27752- * what it shouldn't if we actually call it.
27753- */
27754 p = dmi_ioremap(0xF0000, 0x10000);
27755 if (p == NULL)
27756 goto error;
27757@@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
27758 if (buf == NULL)
27759 return -1;
27760
27761- dmi_table(buf, dmi_len, dmi_num, decode, private_data);
27762+ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
27763
27764 iounmap(buf);
27765 return 0;
27766diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
27767index 98723cb..10ca85b 100644
27768--- a/drivers/gpio/gpio-vr41xx.c
27769+++ b/drivers/gpio/gpio-vr41xx.c
27770@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
27771 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
27772 maskl, pendl, maskh, pendh);
27773
27774- atomic_inc(&irq_err_count);
27775+ atomic_inc_unchecked(&irq_err_count);
27776
27777 return -EINVAL;
27778 }
27779diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
27780index 2410c40..2d03563 100644
27781--- a/drivers/gpu/drm/drm_crtc.c
27782+++ b/drivers/gpu/drm/drm_crtc.c
27783@@ -1374,7 +1374,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27784 */
27785 if ((out_resp->count_modes >= mode_count) && mode_count) {
27786 copied = 0;
27787- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
27788+ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
27789 list_for_each_entry(mode, &connector->modes, head) {
27790 drm_crtc_convert_to_umode(&u_mode, mode);
27791 if (copy_to_user(mode_ptr + copied,
27792@@ -1389,8 +1389,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27793
27794 if ((out_resp->count_props >= props_count) && props_count) {
27795 copied = 0;
27796- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
27797- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
27798+ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
27799+ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
27800 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
27801 if (connector->property_ids[i] != 0) {
27802 if (put_user(connector->property_ids[i],
27803@@ -1412,7 +1412,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27804
27805 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
27806 copied = 0;
27807- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
27808+ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
27809 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
27810 if (connector->encoder_ids[i] != 0) {
27811 if (put_user(connector->encoder_ids[i],
27812@@ -1571,7 +1571,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
27813 }
27814
27815 for (i = 0; i < crtc_req->count_connectors; i++) {
27816- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
27817+ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
27818 if (get_user(out_id, &set_connectors_ptr[i])) {
27819 ret = -EFAULT;
27820 goto out;
27821@@ -1852,7 +1852,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
27822 fb = obj_to_fb(obj);
27823
27824 num_clips = r->num_clips;
27825- clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
27826+ clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
27827
27828 if (!num_clips != !clips_ptr) {
27829 ret = -EINVAL;
27830@@ -2276,7 +2276,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27831 out_resp->flags = property->flags;
27832
27833 if ((out_resp->count_values >= value_count) && value_count) {
27834- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
27835+ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
27836 for (i = 0; i < value_count; i++) {
27837 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
27838 ret = -EFAULT;
27839@@ -2289,7 +2289,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27840 if (property->flags & DRM_MODE_PROP_ENUM) {
27841 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
27842 copied = 0;
27843- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
27844+ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
27845 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
27846
27847 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
27848@@ -2312,7 +2312,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27849 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
27850 copied = 0;
27851 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
27852- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
27853+ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
27854
27855 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
27856 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
27857@@ -2373,7 +2373,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
27858 struct drm_mode_get_blob *out_resp = data;
27859 struct drm_property_blob *blob;
27860 int ret = 0;
27861- void *blob_ptr;
27862+ void __user *blob_ptr;
27863
27864 if (!drm_core_check_feature(dev, DRIVER_MODESET))
27865 return -EINVAL;
27866@@ -2387,7 +2387,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
27867 blob = obj_to_blob(obj);
27868
27869 if (out_resp->length == blob->length) {
27870- blob_ptr = (void *)(unsigned long)out_resp->data;
27871+ blob_ptr = (void __user *)(unsigned long)out_resp->data;
27872 if (copy_to_user(blob_ptr, blob->data, blob->length)){
27873 ret = -EFAULT;
27874 goto done;
27875diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
27876index f88a9b2..8f4078f 100644
27877--- a/drivers/gpu/drm/drm_crtc_helper.c
27878+++ b/drivers/gpu/drm/drm_crtc_helper.c
27879@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
27880 struct drm_crtc *tmp;
27881 int crtc_mask = 1;
27882
27883- WARN(!crtc, "checking null crtc?\n");
27884+ BUG_ON(!crtc);
27885
27886 dev = crtc->dev;
27887
27888@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
27889 struct drm_encoder *encoder;
27890 bool ret = true;
27891
27892+ pax_track_stack();
27893+
27894 crtc->enabled = drm_helper_crtc_in_use(crtc);
27895 if (!crtc->enabled)
27896 return true;
27897diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
27898index 93a112d..c8b065d 100644
27899--- a/drivers/gpu/drm/drm_drv.c
27900+++ b/drivers/gpu/drm/drm_drv.c
27901@@ -307,7 +307,7 @@ module_exit(drm_core_exit);
27902 /**
27903 * Copy and IOCTL return string to user space
27904 */
27905-static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
27906+static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
27907 {
27908 int len;
27909
27910@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
27911
27912 dev = file_priv->minor->dev;
27913 atomic_inc(&dev->ioctl_count);
27914- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
27915+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
27916 ++file_priv->ioctl_count;
27917
27918 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
27919diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
27920index 2ec7d48..be14bb1 100644
27921--- a/drivers/gpu/drm/drm_fops.c
27922+++ b/drivers/gpu/drm/drm_fops.c
27923@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device * dev)
27924 }
27925
27926 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
27927- atomic_set(&dev->counts[i], 0);
27928+ atomic_set_unchecked(&dev->counts[i], 0);
27929
27930 dev->sigdata.lock = NULL;
27931
27932@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct file *filp)
27933
27934 retcode = drm_open_helper(inode, filp, dev);
27935 if (!retcode) {
27936- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
27937- if (!dev->open_count++)
27938+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
27939+ if (local_inc_return(&dev->open_count) == 1)
27940 retcode = drm_setup(dev);
27941 }
27942 if (!retcode) {
27943@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, struct file *filp)
27944
27945 mutex_lock(&drm_global_mutex);
27946
27947- DRM_DEBUG("open_count = %d\n", dev->open_count);
27948+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
27949
27950 if (dev->driver->preclose)
27951 dev->driver->preclose(dev, file_priv);
27952@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, struct file *filp)
27953 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
27954 task_pid_nr(current),
27955 (long)old_encode_dev(file_priv->minor->device),
27956- dev->open_count);
27957+ local_read(&dev->open_count));
27958
27959 /* if the master has gone away we can't do anything with the lock */
27960 if (file_priv->minor->master)
27961@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, struct file *filp)
27962 * End inline drm_release
27963 */
27964
27965- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
27966- if (!--dev->open_count) {
27967+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
27968+ if (local_dec_and_test(&dev->open_count)) {
27969 if (atomic_read(&dev->ioctl_count)) {
27970 DRM_ERROR("Device busy: %d\n",
27971 atomic_read(&dev->ioctl_count));
27972diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
27973index c87dc96..326055d 100644
27974--- a/drivers/gpu/drm/drm_global.c
27975+++ b/drivers/gpu/drm/drm_global.c
27976@@ -36,7 +36,7 @@
27977 struct drm_global_item {
27978 struct mutex mutex;
27979 void *object;
27980- int refcount;
27981+ atomic_t refcount;
27982 };
27983
27984 static struct drm_global_item glob[DRM_GLOBAL_NUM];
27985@@ -49,7 +49,7 @@ void drm_global_init(void)
27986 struct drm_global_item *item = &glob[i];
27987 mutex_init(&item->mutex);
27988 item->object = NULL;
27989- item->refcount = 0;
27990+ atomic_set(&item->refcount, 0);
27991 }
27992 }
27993
27994@@ -59,7 +59,7 @@ void drm_global_release(void)
27995 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
27996 struct drm_global_item *item = &glob[i];
27997 BUG_ON(item->object != NULL);
27998- BUG_ON(item->refcount != 0);
27999+ BUG_ON(atomic_read(&item->refcount) != 0);
28000 }
28001 }
28002
28003@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28004 void *object;
28005
28006 mutex_lock(&item->mutex);
28007- if (item->refcount == 0) {
28008+ if (atomic_read(&item->refcount) == 0) {
28009 item->object = kzalloc(ref->size, GFP_KERNEL);
28010 if (unlikely(item->object == NULL)) {
28011 ret = -ENOMEM;
28012@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28013 goto out_err;
28014
28015 }
28016- ++item->refcount;
28017+ atomic_inc(&item->refcount);
28018 ref->object = item->object;
28019 object = item->object;
28020 mutex_unlock(&item->mutex);
28021@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
28022 struct drm_global_item *item = &glob[ref->global_type];
28023
28024 mutex_lock(&item->mutex);
28025- BUG_ON(item->refcount == 0);
28026+ BUG_ON(atomic_read(&item->refcount) == 0);
28027 BUG_ON(ref->object != item->object);
28028- if (--item->refcount == 0) {
28029+ if (atomic_dec_and_test(&item->refcount)) {
28030 ref->release(ref);
28031 item->object = NULL;
28032 }
28033diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
28034index ab1162d..42587b2 100644
28035--- a/drivers/gpu/drm/drm_info.c
28036+++ b/drivers/gpu/drm/drm_info.c
28037@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
28038 struct drm_local_map *map;
28039 struct drm_map_list *r_list;
28040
28041- /* Hardcoded from _DRM_FRAME_BUFFER,
28042- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28043- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28044- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28045+ static const char * const types[] = {
28046+ [_DRM_FRAME_BUFFER] = "FB",
28047+ [_DRM_REGISTERS] = "REG",
28048+ [_DRM_SHM] = "SHM",
28049+ [_DRM_AGP] = "AGP",
28050+ [_DRM_SCATTER_GATHER] = "SG",
28051+ [_DRM_CONSISTENT] = "PCI",
28052+ [_DRM_GEM] = "GEM" };
28053 const char *type;
28054 int i;
28055
28056@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
28057 map = r_list->map;
28058 if (!map)
28059 continue;
28060- if (map->type < 0 || map->type > 5)
28061+ if (map->type >= ARRAY_SIZE(types))
28062 type = "??";
28063 else
28064 type = types[map->type];
28065@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, void *data)
28066 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28067 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28068 vma->vm_flags & VM_IO ? 'i' : '-',
28069+#ifdef CONFIG_GRKERNSEC_HIDESYM
28070+ 0);
28071+#else
28072 vma->vm_pgoff);
28073+#endif
28074
28075 #if defined(__i386__)
28076 pgprot = pgprot_val(vma->vm_page_prot);
28077diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
28078index 4a058c7..b42cd92 100644
28079--- a/drivers/gpu/drm/drm_ioc32.c
28080+++ b/drivers/gpu/drm/drm_ioc32.c
28081@@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
28082 request = compat_alloc_user_space(nbytes);
28083 if (!access_ok(VERIFY_WRITE, request, nbytes))
28084 return -EFAULT;
28085- list = (struct drm_buf_desc *) (request + 1);
28086+ list = (struct drm_buf_desc __user *) (request + 1);
28087
28088 if (__put_user(count, &request->count)
28089 || __put_user(list, &request->list))
28090@@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
28091 request = compat_alloc_user_space(nbytes);
28092 if (!access_ok(VERIFY_WRITE, request, nbytes))
28093 return -EFAULT;
28094- list = (struct drm_buf_pub *) (request + 1);
28095+ list = (struct drm_buf_pub __user *) (request + 1);
28096
28097 if (__put_user(count, &request->count)
28098 || __put_user(list, &request->list))
28099diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
28100index 904d7e9..ab88581 100644
28101--- a/drivers/gpu/drm/drm_ioctl.c
28102+++ b/drivers/gpu/drm/drm_ioctl.c
28103@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev, void *data,
28104 stats->data[i].value =
28105 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28106 else
28107- stats->data[i].value = atomic_read(&dev->counts[i]);
28108+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28109 stats->data[i].type = dev->types[i];
28110 }
28111
28112diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
28113index 632ae24..244cf4a 100644
28114--- a/drivers/gpu/drm/drm_lock.c
28115+++ b/drivers/gpu/drm/drm_lock.c
28116@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28117 if (drm_lock_take(&master->lock, lock->context)) {
28118 master->lock.file_priv = file_priv;
28119 master->lock.lock_time = jiffies;
28120- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28121+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28122 break; /* Got lock */
28123 }
28124
28125@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28126 return -EINVAL;
28127 }
28128
28129- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28130+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28131
28132 if (drm_lock_free(&master->lock, lock->context)) {
28133 /* FIXME: Should really bail out here. */
28134diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
28135index 8f371e8..9f85d52 100644
28136--- a/drivers/gpu/drm/i810/i810_dma.c
28137+++ b/drivers/gpu/drm/i810/i810_dma.c
28138@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
28139 dma->buflist[vertex->idx],
28140 vertex->discard, vertex->used);
28141
28142- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28143- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28144+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28145+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28146 sarea_priv->last_enqueue = dev_priv->counter - 1;
28147 sarea_priv->last_dispatch = (int)hw_status[5];
28148
28149@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
28150 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28151 mc->last_render);
28152
28153- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28154- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28155+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28156+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28157 sarea_priv->last_enqueue = dev_priv->counter - 1;
28158 sarea_priv->last_dispatch = (int)hw_status[5];
28159
28160diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
28161index c9339f4..f5e1b9d 100644
28162--- a/drivers/gpu/drm/i810/i810_drv.h
28163+++ b/drivers/gpu/drm/i810/i810_drv.h
28164@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28165 int page_flipping;
28166
28167 wait_queue_head_t irq_queue;
28168- atomic_t irq_received;
28169- atomic_t irq_emitted;
28170+ atomic_unchecked_t irq_received;
28171+ atomic_unchecked_t irq_emitted;
28172
28173 int front_offset;
28174 } drm_i810_private_t;
28175diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
28176index 3c395a5..02889c2 100644
28177--- a/drivers/gpu/drm/i915/i915_debugfs.c
28178+++ b/drivers/gpu/drm/i915/i915_debugfs.c
28179@@ -497,7 +497,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
28180 I915_READ(GTIMR));
28181 }
28182 seq_printf(m, "Interrupts received: %d\n",
28183- atomic_read(&dev_priv->irq_received));
28184+ atomic_read_unchecked(&dev_priv->irq_received));
28185 for (i = 0; i < I915_NUM_RINGS; i++) {
28186 if (IS_GEN6(dev) || IS_GEN7(dev)) {
28187 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
28188@@ -1185,7 +1185,7 @@ static int i915_opregion(struct seq_file *m, void *unused)
28189 return ret;
28190
28191 if (opregion->header)
28192- seq_write(m, opregion->header, OPREGION_SIZE);
28193+ seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE);
28194
28195 mutex_unlock(&dev->struct_mutex);
28196
28197diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
28198index 8a3942c..1b73bf1 100644
28199--- a/drivers/gpu/drm/i915/i915_dma.c
28200+++ b/drivers/gpu/drm/i915/i915_dma.c
28201@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
28202 bool can_switch;
28203
28204 spin_lock(&dev->count_lock);
28205- can_switch = (dev->open_count == 0);
28206+ can_switch = (local_read(&dev->open_count) == 0);
28207 spin_unlock(&dev->count_lock);
28208 return can_switch;
28209 }
28210diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
28211index 7916bd9..7c17a0f 100644
28212--- a/drivers/gpu/drm/i915/i915_drv.h
28213+++ b/drivers/gpu/drm/i915/i915_drv.h
28214@@ -222,7 +222,7 @@ struct drm_i915_display_funcs {
28215 /* render clock increase/decrease */
28216 /* display clock increase/decrease */
28217 /* pll clock increase/decrease */
28218-};
28219+} __no_const;
28220
28221 struct intel_device_info {
28222 u8 gen;
28223@@ -305,7 +305,7 @@ typedef struct drm_i915_private {
28224 int current_page;
28225 int page_flipping;
28226
28227- atomic_t irq_received;
28228+ atomic_unchecked_t irq_received;
28229
28230 /* protects the irq masks */
28231 spinlock_t irq_lock;
28232@@ -882,7 +882,7 @@ struct drm_i915_gem_object {
28233 * will be page flipped away on the next vblank. When it
28234 * reaches 0, dev_priv->pending_flip_queue will be woken up.
28235 */
28236- atomic_t pending_flip;
28237+ atomic_unchecked_t pending_flip;
28238 };
28239
28240 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
28241@@ -1262,7 +1262,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
28242 extern void intel_teardown_gmbus(struct drm_device *dev);
28243 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
28244 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
28245-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28246+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28247 {
28248 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
28249 }
28250diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28251index 4934cf8..1da9c84 100644
28252--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28253+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28254@@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
28255 i915_gem_clflush_object(obj);
28256
28257 if (obj->base.pending_write_domain)
28258- cd->flips |= atomic_read(&obj->pending_flip);
28259+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
28260
28261 /* The actual obj->write_domain will be updated with
28262 * pending_write_domain after we emit the accumulated flush for all
28263@@ -864,9 +864,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
28264
28265 static int
28266 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
28267- int count)
28268+ unsigned int count)
28269 {
28270- int i;
28271+ unsigned int i;
28272
28273 for (i = 0; i < count; i++) {
28274 char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
28275diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
28276index 73248d0..f7bac29 100644
28277--- a/drivers/gpu/drm/i915/i915_irq.c
28278+++ b/drivers/gpu/drm/i915/i915_irq.c
28279@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
28280 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
28281 struct drm_i915_master_private *master_priv;
28282
28283- atomic_inc(&dev_priv->irq_received);
28284+ atomic_inc_unchecked(&dev_priv->irq_received);
28285
28286 /* disable master interrupt before clearing iir */
28287 de_ier = I915_READ(DEIER);
28288@@ -565,7 +565,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
28289 struct drm_i915_master_private *master_priv;
28290 u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
28291
28292- atomic_inc(&dev_priv->irq_received);
28293+ atomic_inc_unchecked(&dev_priv->irq_received);
28294
28295 if (IS_GEN6(dev))
28296 bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
28297@@ -1229,7 +1229,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
28298 int ret = IRQ_NONE, pipe;
28299 bool blc_event = false;
28300
28301- atomic_inc(&dev_priv->irq_received);
28302+ atomic_inc_unchecked(&dev_priv->irq_received);
28303
28304 iir = I915_READ(IIR);
28305
28306@@ -1741,7 +1741,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
28307 {
28308 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28309
28310- atomic_set(&dev_priv->irq_received, 0);
28311+ atomic_set_unchecked(&dev_priv->irq_received, 0);
28312
28313 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28314 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28315@@ -1905,7 +1905,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
28316 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28317 int pipe;
28318
28319- atomic_set(&dev_priv->irq_received, 0);
28320+ atomic_set_unchecked(&dev_priv->irq_received, 0);
28321
28322 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28323 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28324diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
28325index 07e7cf3..c75f312 100644
28326--- a/drivers/gpu/drm/i915/intel_display.c
28327+++ b/drivers/gpu/drm/i915/intel_display.c
28328@@ -2205,7 +2205,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
28329
28330 wait_event(dev_priv->pending_flip_queue,
28331 atomic_read(&dev_priv->mm.wedged) ||
28332- atomic_read(&obj->pending_flip) == 0);
28333+ atomic_read_unchecked(&obj->pending_flip) == 0);
28334
28335 /* Big Hammer, we also need to ensure that any pending
28336 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
28337@@ -2826,7 +2826,7 @@ static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
28338 obj = to_intel_framebuffer(crtc->fb)->obj;
28339 dev_priv = crtc->dev->dev_private;
28340 wait_event(dev_priv->pending_flip_queue,
28341- atomic_read(&obj->pending_flip) == 0);
28342+ atomic_read_unchecked(&obj->pending_flip) == 0);
28343 }
28344
28345 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
28346@@ -6676,7 +6676,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
28347
28348 atomic_clear_mask(1 << intel_crtc->plane,
28349 &obj->pending_flip.counter);
28350- if (atomic_read(&obj->pending_flip) == 0)
28351+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
28352 wake_up(&dev_priv->pending_flip_queue);
28353
28354 schedule_work(&work->work);
28355@@ -6965,7 +6965,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28356 /* Block clients from rendering to the new back buffer until
28357 * the flip occurs and the object is no longer visible.
28358 */
28359- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28360+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28361
28362 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
28363 if (ret)
28364@@ -6979,7 +6979,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28365 return 0;
28366
28367 cleanup_pending:
28368- atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28369+ atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28370 cleanup_objs:
28371 drm_gem_object_unreference(&work->old_fb_obj->base);
28372 drm_gem_object_unreference(&obj->base);
28373diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
28374index 54558a0..2d97005 100644
28375--- a/drivers/gpu/drm/mga/mga_drv.h
28376+++ b/drivers/gpu/drm/mga/mga_drv.h
28377@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
28378 u32 clear_cmd;
28379 u32 maccess;
28380
28381- atomic_t vbl_received; /**< Number of vblanks received. */
28382+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
28383 wait_queue_head_t fence_queue;
28384- atomic_t last_fence_retired;
28385+ atomic_unchecked_t last_fence_retired;
28386 u32 next_fence_to_post;
28387
28388 unsigned int fb_cpp;
28389diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
28390index 2581202..f230a8d9 100644
28391--- a/drivers/gpu/drm/mga/mga_irq.c
28392+++ b/drivers/gpu/drm/mga/mga_irq.c
28393@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
28394 if (crtc != 0)
28395 return 0;
28396
28397- return atomic_read(&dev_priv->vbl_received);
28398+ return atomic_read_unchecked(&dev_priv->vbl_received);
28399 }
28400
28401
28402@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28403 /* VBLANK interrupt */
28404 if (status & MGA_VLINEPEN) {
28405 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
28406- atomic_inc(&dev_priv->vbl_received);
28407+ atomic_inc_unchecked(&dev_priv->vbl_received);
28408 drm_handle_vblank(dev, 0);
28409 handled = 1;
28410 }
28411@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28412 if ((prim_start & ~0x03) != (prim_end & ~0x03))
28413 MGA_WRITE(MGA_PRIMEND, prim_end);
28414
28415- atomic_inc(&dev_priv->last_fence_retired);
28416+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
28417 DRM_WAKEUP(&dev_priv->fence_queue);
28418 handled = 1;
28419 }
28420@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
28421 * using fences.
28422 */
28423 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
28424- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
28425+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
28426 - *sequence) <= (1 << 23)));
28427
28428 *sequence = cur_fence;
28429diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
28430index b311fab..dc11d6a 100644
28431--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
28432+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
28433@@ -201,7 +201,7 @@ struct methods {
28434 const char desc[8];
28435 void (*loadbios)(struct drm_device *, uint8_t *);
28436 const bool rw;
28437-};
28438+} __do_const;
28439
28440 static struct methods shadow_methods[] = {
28441 { "PRAMIN", load_vbios_pramin, true },
28442@@ -5489,7 +5489,7 @@ parse_bit_displayport_tbl_entry(struct drm_device *dev, struct nvbios *bios,
28443 struct bit_table {
28444 const char id;
28445 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
28446-};
28447+} __no_const;
28448
28449 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
28450
28451diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
28452index d7d51de..7c6a7f1 100644
28453--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
28454+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
28455@@ -238,7 +238,7 @@ struct nouveau_channel {
28456 struct list_head pending;
28457 uint32_t sequence;
28458 uint32_t sequence_ack;
28459- atomic_t last_sequence_irq;
28460+ atomic_unchecked_t last_sequence_irq;
28461 struct nouveau_vma vma;
28462 } fence;
28463
28464@@ -319,7 +319,7 @@ struct nouveau_exec_engine {
28465 u32 handle, u16 class);
28466 void (*set_tile_region)(struct drm_device *dev, int i);
28467 void (*tlb_flush)(struct drm_device *, int engine);
28468-};
28469+} __no_const;
28470
28471 struct nouveau_instmem_engine {
28472 void *priv;
28473@@ -341,13 +341,13 @@ struct nouveau_instmem_engine {
28474 struct nouveau_mc_engine {
28475 int (*init)(struct drm_device *dev);
28476 void (*takedown)(struct drm_device *dev);
28477-};
28478+} __no_const;
28479
28480 struct nouveau_timer_engine {
28481 int (*init)(struct drm_device *dev);
28482 void (*takedown)(struct drm_device *dev);
28483 uint64_t (*read)(struct drm_device *dev);
28484-};
28485+} __no_const;
28486
28487 struct nouveau_fb_engine {
28488 int num_tiles;
28489@@ -513,7 +513,7 @@ struct nouveau_vram_engine {
28490 void (*put)(struct drm_device *, struct nouveau_mem **);
28491
28492 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
28493-};
28494+} __no_const;
28495
28496 struct nouveau_engine {
28497 struct nouveau_instmem_engine instmem;
28498@@ -660,7 +660,7 @@ struct drm_nouveau_private {
28499 struct drm_global_reference mem_global_ref;
28500 struct ttm_bo_global_ref bo_global_ref;
28501 struct ttm_bo_device bdev;
28502- atomic_t validate_sequence;
28503+ atomic_unchecked_t validate_sequence;
28504 } ttm;
28505
28506 struct {
28507diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
28508index ae22dfa..4f09960 100644
28509--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
28510+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
28511@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_channel *chan)
28512 if (USE_REFCNT(dev))
28513 sequence = nvchan_rd32(chan, 0x48);
28514 else
28515- sequence = atomic_read(&chan->fence.last_sequence_irq);
28516+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
28517
28518 if (chan->fence.sequence_ack == sequence)
28519 goto out;
28520@@ -539,7 +539,7 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
28521 return ret;
28522 }
28523
28524- atomic_set(&chan->fence.last_sequence_irq, 0);
28525+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
28526 return 0;
28527 }
28528
28529diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
28530index 5f0bc57..eb9fac8 100644
28531--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
28532+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
28533@@ -314,7 +314,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
28534 int trycnt = 0;
28535 int ret, i;
28536
28537- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
28538+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
28539 retry:
28540 if (++trycnt > 100000) {
28541 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
28542diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
28543index 10656e4..59bf2a4 100644
28544--- a/drivers/gpu/drm/nouveau/nouveau_state.c
28545+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
28546@@ -496,7 +496,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev)
28547 bool can_switch;
28548
28549 spin_lock(&dev->count_lock);
28550- can_switch = (dev->open_count == 0);
28551+ can_switch = (local_read(&dev->open_count) == 0);
28552 spin_unlock(&dev->count_lock);
28553 return can_switch;
28554 }
28555diff --git a/drivers/gpu/drm/nouveau/nv04_graph.c b/drivers/gpu/drm/nouveau/nv04_graph.c
28556index dbdea8e..cd6eeeb 100644
28557--- a/drivers/gpu/drm/nouveau/nv04_graph.c
28558+++ b/drivers/gpu/drm/nouveau/nv04_graph.c
28559@@ -554,7 +554,7 @@ static int
28560 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
28561 u32 class, u32 mthd, u32 data)
28562 {
28563- atomic_set(&chan->fence.last_sequence_irq, data);
28564+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
28565 return 0;
28566 }
28567
28568diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
28569index 570e190..084a31a 100644
28570--- a/drivers/gpu/drm/r128/r128_cce.c
28571+++ b/drivers/gpu/drm/r128/r128_cce.c
28572@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
28573
28574 /* GH: Simple idle check.
28575 */
28576- atomic_set(&dev_priv->idle_count, 0);
28577+ atomic_set_unchecked(&dev_priv->idle_count, 0);
28578
28579 /* We don't support anything other than bus-mastering ring mode,
28580 * but the ring can be in either AGP or PCI space for the ring
28581diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
28582index 930c71b..499aded 100644
28583--- a/drivers/gpu/drm/r128/r128_drv.h
28584+++ b/drivers/gpu/drm/r128/r128_drv.h
28585@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
28586 int is_pci;
28587 unsigned long cce_buffers_offset;
28588
28589- atomic_t idle_count;
28590+ atomic_unchecked_t idle_count;
28591
28592 int page_flipping;
28593 int current_page;
28594 u32 crtc_offset;
28595 u32 crtc_offset_cntl;
28596
28597- atomic_t vbl_received;
28598+ atomic_unchecked_t vbl_received;
28599
28600 u32 color_fmt;
28601 unsigned int front_offset;
28602diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
28603index 429d5a0..7e899ed 100644
28604--- a/drivers/gpu/drm/r128/r128_irq.c
28605+++ b/drivers/gpu/drm/r128/r128_irq.c
28606@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
28607 if (crtc != 0)
28608 return 0;
28609
28610- return atomic_read(&dev_priv->vbl_received);
28611+ return atomic_read_unchecked(&dev_priv->vbl_received);
28612 }
28613
28614 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28615@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28616 /* VBLANK interrupt */
28617 if (status & R128_CRTC_VBLANK_INT) {
28618 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
28619- atomic_inc(&dev_priv->vbl_received);
28620+ atomic_inc_unchecked(&dev_priv->vbl_received);
28621 drm_handle_vblank(dev, 0);
28622 return IRQ_HANDLED;
28623 }
28624diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
28625index a9e33ce..09edd4b 100644
28626--- a/drivers/gpu/drm/r128/r128_state.c
28627+++ b/drivers/gpu/drm/r128/r128_state.c
28628@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
28629
28630 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
28631 {
28632- if (atomic_read(&dev_priv->idle_count) == 0)
28633+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
28634 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
28635 else
28636- atomic_set(&dev_priv->idle_count, 0);
28637+ atomic_set_unchecked(&dev_priv->idle_count, 0);
28638 }
28639
28640 #endif
28641diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
28642index 14cc88a..cc7b3a5 100644
28643--- a/drivers/gpu/drm/radeon/atom.c
28644+++ b/drivers/gpu/drm/radeon/atom.c
28645@@ -1254,6 +1254,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
28646 char name[512];
28647 int i;
28648
28649+ pax_track_stack();
28650+
28651 if (!ctx)
28652 return NULL;
28653
28654diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
28655index 5a82b6b..9e69c73 100644
28656--- a/drivers/gpu/drm/radeon/mkregtable.c
28657+++ b/drivers/gpu/drm/radeon/mkregtable.c
28658@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
28659 regex_t mask_rex;
28660 regmatch_t match[4];
28661 char buf[1024];
28662- size_t end;
28663+ long end;
28664 int len;
28665 int done = 0;
28666 int r;
28667 unsigned o;
28668 struct offset *offset;
28669 char last_reg_s[10];
28670- int last_reg;
28671+ unsigned long last_reg;
28672
28673 if (regcomp
28674 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
28675diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
28676index 184628c..30e1725 100644
28677--- a/drivers/gpu/drm/radeon/radeon.h
28678+++ b/drivers/gpu/drm/radeon/radeon.h
28679@@ -192,7 +192,7 @@ extern int sumo_get_temp(struct radeon_device *rdev);
28680 */
28681 struct radeon_fence_driver {
28682 uint32_t scratch_reg;
28683- atomic_t seq;
28684+ atomic_unchecked_t seq;
28685 uint32_t last_seq;
28686 unsigned long last_jiffies;
28687 unsigned long last_timeout;
28688@@ -962,7 +962,7 @@ struct radeon_asic {
28689 void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
28690 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
28691 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
28692-};
28693+} __no_const;
28694
28695 /*
28696 * Asic structures
28697diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
28698index 285acc4..f4d909f 100644
28699--- a/drivers/gpu/drm/radeon/radeon_atombios.c
28700+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
28701@@ -569,6 +569,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
28702 struct radeon_gpio_rec gpio;
28703 struct radeon_hpd hpd;
28704
28705+ pax_track_stack();
28706+
28707 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
28708 return false;
28709
28710diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
28711index b51e157..8f14fb9 100644
28712--- a/drivers/gpu/drm/radeon/radeon_device.c
28713+++ b/drivers/gpu/drm/radeon/radeon_device.c
28714@@ -684,7 +684,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
28715 bool can_switch;
28716
28717 spin_lock(&dev->count_lock);
28718- can_switch = (dev->open_count == 0);
28719+ can_switch = (local_read(&dev->open_count) == 0);
28720 spin_unlock(&dev->count_lock);
28721 return can_switch;
28722 }
28723diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
28724index 07ac481..41cb437 100644
28725--- a/drivers/gpu/drm/radeon/radeon_display.c
28726+++ b/drivers/gpu/drm/radeon/radeon_display.c
28727@@ -926,6 +926,8 @@ void radeon_compute_pll_legacy(struct radeon_pll *pll,
28728 uint32_t post_div;
28729 u32 pll_out_min, pll_out_max;
28730
28731+ pax_track_stack();
28732+
28733 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
28734 freq = freq * 1000;
28735
28736diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
28737index a1b59ca..86f2d44 100644
28738--- a/drivers/gpu/drm/radeon/radeon_drv.h
28739+++ b/drivers/gpu/drm/radeon/radeon_drv.h
28740@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
28741
28742 /* SW interrupt */
28743 wait_queue_head_t swi_queue;
28744- atomic_t swi_emitted;
28745+ atomic_unchecked_t swi_emitted;
28746 int vblank_crtc;
28747 uint32_t irq_enable_reg;
28748 uint32_t r500_disp_irq_reg;
28749diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
28750index 7fd4e3e..9748ab5 100644
28751--- a/drivers/gpu/drm/radeon/radeon_fence.c
28752+++ b/drivers/gpu/drm/radeon/radeon_fence.c
28753@@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
28754 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
28755 return 0;
28756 }
28757- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
28758+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
28759 if (!rdev->cp.ready)
28760 /* FIXME: cp is not running assume everythings is done right
28761 * away
28762@@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
28763 return r;
28764 }
28765 radeon_fence_write(rdev, 0);
28766- atomic_set(&rdev->fence_drv.seq, 0);
28767+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
28768 INIT_LIST_HEAD(&rdev->fence_drv.created);
28769 INIT_LIST_HEAD(&rdev->fence_drv.emited);
28770 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
28771diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
28772index 48b7cea..342236f 100644
28773--- a/drivers/gpu/drm/radeon/radeon_ioc32.c
28774+++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
28775@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
28776 request = compat_alloc_user_space(sizeof(*request));
28777 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
28778 || __put_user(req32.param, &request->param)
28779- || __put_user((void __user *)(unsigned long)req32.value,
28780+ || __put_user((unsigned long)req32.value,
28781 &request->value))
28782 return -EFAULT;
28783
28784diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
28785index 465746b..cb2b055 100644
28786--- a/drivers/gpu/drm/radeon/radeon_irq.c
28787+++ b/drivers/gpu/drm/radeon/radeon_irq.c
28788@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
28789 unsigned int ret;
28790 RING_LOCALS;
28791
28792- atomic_inc(&dev_priv->swi_emitted);
28793- ret = atomic_read(&dev_priv->swi_emitted);
28794+ atomic_inc_unchecked(&dev_priv->swi_emitted);
28795+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
28796
28797 BEGIN_RING(4);
28798 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
28799@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
28800 drm_radeon_private_t *dev_priv =
28801 (drm_radeon_private_t *) dev->dev_private;
28802
28803- atomic_set(&dev_priv->swi_emitted, 0);
28804+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
28805 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
28806
28807 dev->max_vblank_count = 0x001fffff;
28808diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
28809index 92e7ea7..147ffad 100644
28810--- a/drivers/gpu/drm/radeon/radeon_state.c
28811+++ b/drivers/gpu/drm/radeon/radeon_state.c
28812@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
28813 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
28814 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
28815
28816- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
28817+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
28818 sarea_priv->nbox * sizeof(depth_boxes[0])))
28819 return -EFAULT;
28820
28821@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
28822 {
28823 drm_radeon_private_t *dev_priv = dev->dev_private;
28824 drm_radeon_getparam_t *param = data;
28825- int value;
28826+ int value = 0;
28827
28828 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
28829
28830diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
28831index 0b5468b..9c4b308 100644
28832--- a/drivers/gpu/drm/radeon/radeon_ttm.c
28833+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
28834@@ -672,8 +672,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
28835 }
28836 if (unlikely(ttm_vm_ops == NULL)) {
28837 ttm_vm_ops = vma->vm_ops;
28838- radeon_ttm_vm_ops = *ttm_vm_ops;
28839- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
28840+ pax_open_kernel();
28841+ memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
28842+ *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
28843+ pax_close_kernel();
28844 }
28845 vma->vm_ops = &radeon_ttm_vm_ops;
28846 return 0;
28847diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
28848index a9049ed..501f284 100644
28849--- a/drivers/gpu/drm/radeon/rs690.c
28850+++ b/drivers/gpu/drm/radeon/rs690.c
28851@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
28852 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
28853 rdev->pm.sideport_bandwidth.full)
28854 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
28855- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
28856+ read_delay_latency.full = dfixed_const(800 * 1000);
28857 read_delay_latency.full = dfixed_div(read_delay_latency,
28858 rdev->pm.igp_sideport_mclk);
28859+ a.full = dfixed_const(370);
28860+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
28861 } else {
28862 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
28863 rdev->pm.k8_bandwidth.full)
28864diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
28865index 727e93d..1565650 100644
28866--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
28867+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
28868@@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages(void)
28869 static int ttm_pool_mm_shrink(struct shrinker *shrink,
28870 struct shrink_control *sc)
28871 {
28872- static atomic_t start_pool = ATOMIC_INIT(0);
28873+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
28874 unsigned i;
28875- unsigned pool_offset = atomic_add_return(1, &start_pool);
28876+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
28877 struct ttm_page_pool *pool;
28878 int shrink_pages = sc->nr_to_scan;
28879
28880diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
28881index 9cf87d9..2000b7d 100644
28882--- a/drivers/gpu/drm/via/via_drv.h
28883+++ b/drivers/gpu/drm/via/via_drv.h
28884@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
28885 typedef uint32_t maskarray_t[5];
28886
28887 typedef struct drm_via_irq {
28888- atomic_t irq_received;
28889+ atomic_unchecked_t irq_received;
28890 uint32_t pending_mask;
28891 uint32_t enable_mask;
28892 wait_queue_head_t irq_queue;
28893@@ -75,7 +75,7 @@ typedef struct drm_via_private {
28894 struct timeval last_vblank;
28895 int last_vblank_valid;
28896 unsigned usec_per_vblank;
28897- atomic_t vbl_received;
28898+ atomic_unchecked_t vbl_received;
28899 drm_via_state_t hc_state;
28900 char pci_buf[VIA_PCI_BUF_SIZE];
28901 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
28902diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
28903index d391f48..10c8ca3 100644
28904--- a/drivers/gpu/drm/via/via_irq.c
28905+++ b/drivers/gpu/drm/via/via_irq.c
28906@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
28907 if (crtc != 0)
28908 return 0;
28909
28910- return atomic_read(&dev_priv->vbl_received);
28911+ return atomic_read_unchecked(&dev_priv->vbl_received);
28912 }
28913
28914 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28915@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28916
28917 status = VIA_READ(VIA_REG_INTERRUPT);
28918 if (status & VIA_IRQ_VBLANK_PENDING) {
28919- atomic_inc(&dev_priv->vbl_received);
28920- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
28921+ atomic_inc_unchecked(&dev_priv->vbl_received);
28922+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
28923 do_gettimeofday(&cur_vblank);
28924 if (dev_priv->last_vblank_valid) {
28925 dev_priv->usec_per_vblank =
28926@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28927 dev_priv->last_vblank = cur_vblank;
28928 dev_priv->last_vblank_valid = 1;
28929 }
28930- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
28931+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
28932 DRM_DEBUG("US per vblank is: %u\n",
28933 dev_priv->usec_per_vblank);
28934 }
28935@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28936
28937 for (i = 0; i < dev_priv->num_irqs; ++i) {
28938 if (status & cur_irq->pending_mask) {
28939- atomic_inc(&cur_irq->irq_received);
28940+ atomic_inc_unchecked(&cur_irq->irq_received);
28941 DRM_WAKEUP(&cur_irq->irq_queue);
28942 handled = 1;
28943 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
28944@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
28945 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
28946 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
28947 masks[irq][4]));
28948- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
28949+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
28950 } else {
28951 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
28952 (((cur_irq_sequence =
28953- atomic_read(&cur_irq->irq_received)) -
28954+ atomic_read_unchecked(&cur_irq->irq_received)) -
28955 *sequence) <= (1 << 23)));
28956 }
28957 *sequence = cur_irq_sequence;
28958@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
28959 }
28960
28961 for (i = 0; i < dev_priv->num_irqs; ++i) {
28962- atomic_set(&cur_irq->irq_received, 0);
28963+ atomic_set_unchecked(&cur_irq->irq_received, 0);
28964 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
28965 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
28966 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
28967@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
28968 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
28969 case VIA_IRQ_RELATIVE:
28970 irqwait->request.sequence +=
28971- atomic_read(&cur_irq->irq_received);
28972+ atomic_read_unchecked(&cur_irq->irq_received);
28973 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
28974 case VIA_IRQ_ABSOLUTE:
28975 break;
28976diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28977index 10fc01f..b4e9822 100644
28978--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28979+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28980@@ -240,7 +240,7 @@ struct vmw_private {
28981 * Fencing and IRQs.
28982 */
28983
28984- atomic_t fence_seq;
28985+ atomic_unchecked_t fence_seq;
28986 wait_queue_head_t fence_queue;
28987 wait_queue_head_t fifo_queue;
28988 atomic_t fence_queue_waiters;
28989diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28990index 41b95ed..69ea504 100644
28991--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28992+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28993@@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
28994 struct drm_vmw_fence_rep fence_rep;
28995 struct drm_vmw_fence_rep __user *user_fence_rep;
28996 int ret;
28997- void *user_cmd;
28998+ void __user *user_cmd;
28999 void *cmd;
29000 uint32_t sequence;
29001 struct vmw_sw_context *sw_context = &dev_priv->ctx;
29002diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29003index 61eacc1..ee38ce8 100644
29004--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29005+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29006@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
29007 while (!vmw_lag_lt(queue, us)) {
29008 spin_lock(&queue->lock);
29009 if (list_empty(&queue->head))
29010- sequence = atomic_read(&dev_priv->fence_seq);
29011+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29012 else {
29013 fence = list_first_entry(&queue->head,
29014 struct vmw_fence, head);
29015diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29016index 635c0ff..2641bbb 100644
29017--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29018+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29019@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
29020 (unsigned int) min,
29021 (unsigned int) fifo->capabilities);
29022
29023- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29024+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29025 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29026 vmw_fence_queue_init(&fifo->fence_queue);
29027 return vmw_fifo_send_fence(dev_priv, &dummy);
29028@@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
29029 if (reserveable)
29030 iowrite32(bytes, fifo_mem +
29031 SVGA_FIFO_RESERVED);
29032- return fifo_mem + (next_cmd >> 2);
29033+ return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
29034 } else {
29035 need_bounce = true;
29036 }
29037@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29038
29039 fm = vmw_fifo_reserve(dev_priv, bytes);
29040 if (unlikely(fm == NULL)) {
29041- *sequence = atomic_read(&dev_priv->fence_seq);
29042+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29043 ret = -ENOMEM;
29044 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29045 false, 3*HZ);
29046@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29047 }
29048
29049 do {
29050- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29051+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29052 } while (*sequence == 0);
29053
29054 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
29055diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29056index e92298a..f68f2d6 100644
29057--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29058+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29059@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_private *dev_priv,
29060 * emitted. Then the fence is stale and signaled.
29061 */
29062
29063- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29064+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29065 > VMW_FENCE_WRAP);
29066
29067 return ret;
29068@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
29069
29070 if (fifo_idle)
29071 down_read(&fifo_state->rwsem);
29072- signal_seq = atomic_read(&dev_priv->fence_seq);
29073+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29074 ret = 0;
29075
29076 for (;;) {
29077diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
29078index c72f1c0..18376f1 100644
29079--- a/drivers/gpu/vga/vgaarb.c
29080+++ b/drivers/gpu/vga/vgaarb.c
29081@@ -993,14 +993,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
29082 uc = &priv->cards[i];
29083 }
29084
29085- if (!uc)
29086- return -EINVAL;
29087+ if (!uc) {
29088+ ret_val = -EINVAL;
29089+ goto done;
29090+ }
29091
29092- if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
29093- return -EINVAL;
29094+ if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
29095+ ret_val = -EINVAL;
29096+ goto done;
29097+ }
29098
29099- if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
29100- return -EINVAL;
29101+ if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
29102+ ret_val = -EINVAL;
29103+ goto done;
29104+ }
29105
29106 vga_put(pdev, io_state);
29107
29108diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
29109index f26ae31..721fe1b 100644
29110--- a/drivers/hid/hid-core.c
29111+++ b/drivers/hid/hid-core.c
29112@@ -1951,7 +1951,7 @@ static bool hid_ignore(struct hid_device *hdev)
29113
29114 int hid_add_device(struct hid_device *hdev)
29115 {
29116- static atomic_t id = ATOMIC_INIT(0);
29117+ static atomic_unchecked_t id = ATOMIC_INIT(0);
29118 int ret;
29119
29120 if (WARN_ON(hdev->status & HID_STAT_ADDED))
29121@@ -1966,7 +1966,7 @@ int hid_add_device(struct hid_device *hdev)
29122 /* XXX hack, any other cleaner solution after the driver core
29123 * is converted to allow more than 20 bytes as the device name? */
29124 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29125- hdev->vendor, hdev->product, atomic_inc_return(&id));
29126+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29127
29128 hid_debug_register(hdev, dev_name(&hdev->dev));
29129 ret = device_add(&hdev->dev);
29130diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
29131index 7c1188b..5a64357 100644
29132--- a/drivers/hid/usbhid/hiddev.c
29133+++ b/drivers/hid/usbhid/hiddev.c
29134@@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
29135 break;
29136
29137 case HIDIOCAPPLICATION:
29138- if (arg < 0 || arg >= hid->maxapplication)
29139+ if (arg >= hid->maxapplication)
29140 break;
29141
29142 for (i = 0; i < hid->maxcollection; i++)
29143diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
29144index 66f6729..2d6de0a 100644
29145--- a/drivers/hwmon/acpi_power_meter.c
29146+++ b/drivers/hwmon/acpi_power_meter.c
29147@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
29148 return res;
29149
29150 temp /= 1000;
29151- if (temp < 0)
29152- return -EINVAL;
29153
29154 mutex_lock(&resource->lock);
29155 resource->trip[attr->index - 7] = temp;
29156diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
29157index fe4104c..346febb 100644
29158--- a/drivers/hwmon/sht15.c
29159+++ b/drivers/hwmon/sht15.c
29160@@ -166,7 +166,7 @@ struct sht15_data {
29161 int supply_uV;
29162 bool supply_uV_valid;
29163 struct work_struct update_supply_work;
29164- atomic_t interrupt_handled;
29165+ atomic_unchecked_t interrupt_handled;
29166 };
29167
29168 /**
29169@@ -509,13 +509,13 @@ static int sht15_measurement(struct sht15_data *data,
29170 return ret;
29171
29172 gpio_direction_input(data->pdata->gpio_data);
29173- atomic_set(&data->interrupt_handled, 0);
29174+ atomic_set_unchecked(&data->interrupt_handled, 0);
29175
29176 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29177 if (gpio_get_value(data->pdata->gpio_data) == 0) {
29178 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
29179 /* Only relevant if the interrupt hasn't occurred. */
29180- if (!atomic_read(&data->interrupt_handled))
29181+ if (!atomic_read_unchecked(&data->interrupt_handled))
29182 schedule_work(&data->read_work);
29183 }
29184 ret = wait_event_timeout(data->wait_queue,
29185@@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
29186
29187 /* First disable the interrupt */
29188 disable_irq_nosync(irq);
29189- atomic_inc(&data->interrupt_handled);
29190+ atomic_inc_unchecked(&data->interrupt_handled);
29191 /* Then schedule a reading work struct */
29192 if (data->state != SHT15_READING_NOTHING)
29193 schedule_work(&data->read_work);
29194@@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
29195 * If not, then start the interrupt again - care here as could
29196 * have gone low in meantime so verify it hasn't!
29197 */
29198- atomic_set(&data->interrupt_handled, 0);
29199+ atomic_set_unchecked(&data->interrupt_handled, 0);
29200 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29201 /* If still not occurred or another handler has been scheduled */
29202 if (gpio_get_value(data->pdata->gpio_data)
29203- || atomic_read(&data->interrupt_handled))
29204+ || atomic_read_unchecked(&data->interrupt_handled))
29205 return;
29206 }
29207
29208diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
29209index 378fcb5..5e91fa8 100644
29210--- a/drivers/i2c/busses/i2c-amd756-s4882.c
29211+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
29212@@ -43,7 +43,7 @@
29213 extern struct i2c_adapter amd756_smbus;
29214
29215 static struct i2c_adapter *s4882_adapter;
29216-static struct i2c_algorithm *s4882_algo;
29217+static i2c_algorithm_no_const *s4882_algo;
29218
29219 /* Wrapper access functions for multiplexed SMBus */
29220 static DEFINE_MUTEX(amd756_lock);
29221diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
29222index 29015eb..af2d8e9 100644
29223--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
29224+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
29225@@ -41,7 +41,7 @@
29226 extern struct i2c_adapter *nforce2_smbus;
29227
29228 static struct i2c_adapter *s4985_adapter;
29229-static struct i2c_algorithm *s4985_algo;
29230+static i2c_algorithm_no_const *s4985_algo;
29231
29232 /* Wrapper access functions for multiplexed SMBus */
29233 static DEFINE_MUTEX(nforce2_lock);
29234diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
29235index d7a4833..7fae376 100644
29236--- a/drivers/i2c/i2c-mux.c
29237+++ b/drivers/i2c/i2c-mux.c
29238@@ -28,7 +28,7 @@
29239 /* multiplexer per channel data */
29240 struct i2c_mux_priv {
29241 struct i2c_adapter adap;
29242- struct i2c_algorithm algo;
29243+ i2c_algorithm_no_const algo;
29244
29245 struct i2c_adapter *parent;
29246 void *mux_dev; /* the mux chip/device */
29247diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
29248index 57d00ca..0145194 100644
29249--- a/drivers/ide/aec62xx.c
29250+++ b/drivers/ide/aec62xx.c
29251@@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_port_ops = {
29252 .cable_detect = atp86x_cable_detect,
29253 };
29254
29255-static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
29256+static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
29257 { /* 0: AEC6210 */
29258 .name = DRV_NAME,
29259 .init_chipset = init_chipset_aec62xx,
29260diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
29261index 2c8016a..911a27c 100644
29262--- a/drivers/ide/alim15x3.c
29263+++ b/drivers/ide/alim15x3.c
29264@@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_ops = {
29265 .dma_sff_read_status = ide_dma_sff_read_status,
29266 };
29267
29268-static const struct ide_port_info ali15x3_chipset __devinitdata = {
29269+static const struct ide_port_info ali15x3_chipset __devinitconst = {
29270 .name = DRV_NAME,
29271 .init_chipset = init_chipset_ali15x3,
29272 .init_hwif = init_hwif_ali15x3,
29273diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
29274index 3747b25..56fc995 100644
29275--- a/drivers/ide/amd74xx.c
29276+++ b/drivers/ide/amd74xx.c
29277@@ -223,7 +223,7 @@ static const struct ide_port_ops amd_port_ops = {
29278 .udma_mask = udma, \
29279 }
29280
29281-static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
29282+static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
29283 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
29284 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
29285 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
29286diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
29287index 15f0ead..cb43480 100644
29288--- a/drivers/ide/atiixp.c
29289+++ b/drivers/ide/atiixp.c
29290@@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_port_ops = {
29291 .cable_detect = atiixp_cable_detect,
29292 };
29293
29294-static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
29295+static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
29296 { /* 0: IXP200/300/400/700 */
29297 .name = DRV_NAME,
29298 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
29299diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
29300index 5f80312..d1fc438 100644
29301--- a/drivers/ide/cmd64x.c
29302+++ b/drivers/ide/cmd64x.c
29303@@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
29304 .dma_sff_read_status = ide_dma_sff_read_status,
29305 };
29306
29307-static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
29308+static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
29309 { /* 0: CMD643 */
29310 .name = DRV_NAME,
29311 .init_chipset = init_chipset_cmd64x,
29312diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
29313index 2c1e5f7..1444762 100644
29314--- a/drivers/ide/cs5520.c
29315+++ b/drivers/ide/cs5520.c
29316@@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_port_ops = {
29317 .set_dma_mode = cs5520_set_dma_mode,
29318 };
29319
29320-static const struct ide_port_info cyrix_chipset __devinitdata = {
29321+static const struct ide_port_info cyrix_chipset __devinitconst = {
29322 .name = DRV_NAME,
29323 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
29324 .port_ops = &cs5520_port_ops,
29325diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
29326index 4dc4eb9..49b40ad 100644
29327--- a/drivers/ide/cs5530.c
29328+++ b/drivers/ide/cs5530.c
29329@@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_port_ops = {
29330 .udma_filter = cs5530_udma_filter,
29331 };
29332
29333-static const struct ide_port_info cs5530_chipset __devinitdata = {
29334+static const struct ide_port_info cs5530_chipset __devinitconst = {
29335 .name = DRV_NAME,
29336 .init_chipset = init_chipset_cs5530,
29337 .init_hwif = init_hwif_cs5530,
29338diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
29339index 5059faf..18d4c85 100644
29340--- a/drivers/ide/cs5535.c
29341+++ b/drivers/ide/cs5535.c
29342@@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
29343 .cable_detect = cs5535_cable_detect,
29344 };
29345
29346-static const struct ide_port_info cs5535_chipset __devinitdata = {
29347+static const struct ide_port_info cs5535_chipset __devinitconst = {
29348 .name = DRV_NAME,
29349 .port_ops = &cs5535_port_ops,
29350 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
29351diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
29352index 67cbcfa..37ea151 100644
29353--- a/drivers/ide/cy82c693.c
29354+++ b/drivers/ide/cy82c693.c
29355@@ -163,7 +163,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
29356 .set_dma_mode = cy82c693_set_dma_mode,
29357 };
29358
29359-static const struct ide_port_info cy82c693_chipset __devinitdata = {
29360+static const struct ide_port_info cy82c693_chipset __devinitconst = {
29361 .name = DRV_NAME,
29362 .init_iops = init_iops_cy82c693,
29363 .port_ops = &cy82c693_port_ops,
29364diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
29365index 58c51cd..4aec3b8 100644
29366--- a/drivers/ide/hpt366.c
29367+++ b/drivers/ide/hpt366.c
29368@@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings = {
29369 }
29370 };
29371
29372-static const struct hpt_info hpt36x __devinitdata = {
29373+static const struct hpt_info hpt36x __devinitconst = {
29374 .chip_name = "HPT36x",
29375 .chip_type = HPT36x,
29376 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
29377@@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __devinitdata = {
29378 .timings = &hpt36x_timings
29379 };
29380
29381-static const struct hpt_info hpt370 __devinitdata = {
29382+static const struct hpt_info hpt370 __devinitconst = {
29383 .chip_name = "HPT370",
29384 .chip_type = HPT370,
29385 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29386@@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __devinitdata = {
29387 .timings = &hpt37x_timings
29388 };
29389
29390-static const struct hpt_info hpt370a __devinitdata = {
29391+static const struct hpt_info hpt370a __devinitconst = {
29392 .chip_name = "HPT370A",
29393 .chip_type = HPT370A,
29394 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29395@@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __devinitdata = {
29396 .timings = &hpt37x_timings
29397 };
29398
29399-static const struct hpt_info hpt374 __devinitdata = {
29400+static const struct hpt_info hpt374 __devinitconst = {
29401 .chip_name = "HPT374",
29402 .chip_type = HPT374,
29403 .udma_mask = ATA_UDMA5,
29404@@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __devinitdata = {
29405 .timings = &hpt37x_timings
29406 };
29407
29408-static const struct hpt_info hpt372 __devinitdata = {
29409+static const struct hpt_info hpt372 __devinitconst = {
29410 .chip_name = "HPT372",
29411 .chip_type = HPT372,
29412 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29413@@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __devinitdata = {
29414 .timings = &hpt37x_timings
29415 };
29416
29417-static const struct hpt_info hpt372a __devinitdata = {
29418+static const struct hpt_info hpt372a __devinitconst = {
29419 .chip_name = "HPT372A",
29420 .chip_type = HPT372A,
29421 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29422@@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __devinitdata = {
29423 .timings = &hpt37x_timings
29424 };
29425
29426-static const struct hpt_info hpt302 __devinitdata = {
29427+static const struct hpt_info hpt302 __devinitconst = {
29428 .chip_name = "HPT302",
29429 .chip_type = HPT302,
29430 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29431@@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __devinitdata = {
29432 .timings = &hpt37x_timings
29433 };
29434
29435-static const struct hpt_info hpt371 __devinitdata = {
29436+static const struct hpt_info hpt371 __devinitconst = {
29437 .chip_name = "HPT371",
29438 .chip_type = HPT371,
29439 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29440@@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __devinitdata = {
29441 .timings = &hpt37x_timings
29442 };
29443
29444-static const struct hpt_info hpt372n __devinitdata = {
29445+static const struct hpt_info hpt372n __devinitconst = {
29446 .chip_name = "HPT372N",
29447 .chip_type = HPT372N,
29448 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29449@@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __devinitdata = {
29450 .timings = &hpt37x_timings
29451 };
29452
29453-static const struct hpt_info hpt302n __devinitdata = {
29454+static const struct hpt_info hpt302n __devinitconst = {
29455 .chip_name = "HPT302N",
29456 .chip_type = HPT302N,
29457 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29458@@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __devinitdata = {
29459 .timings = &hpt37x_timings
29460 };
29461
29462-static const struct hpt_info hpt371n __devinitdata = {
29463+static const struct hpt_info hpt371n __devinitconst = {
29464 .chip_name = "HPT371N",
29465 .chip_type = HPT371N,
29466 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29467@@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
29468 .dma_sff_read_status = ide_dma_sff_read_status,
29469 };
29470
29471-static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
29472+static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
29473 { /* 0: HPT36x */
29474 .name = DRV_NAME,
29475 .init_chipset = init_chipset_hpt366,
29476diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
29477index 04b0956..f5b47dc 100644
29478--- a/drivers/ide/ide-cd.c
29479+++ b/drivers/ide/ide-cd.c
29480@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
29481 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
29482 if ((unsigned long)buf & alignment
29483 || blk_rq_bytes(rq) & q->dma_pad_mask
29484- || object_is_on_stack(buf))
29485+ || object_starts_on_stack(buf))
29486 drive->dma = 0;
29487 }
29488 }
29489diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
29490index 61fdf54..2834ea6 100644
29491--- a/drivers/ide/ide-floppy.c
29492+++ b/drivers/ide/ide-floppy.c
29493@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
29494 u8 pc_buf[256], header_len, desc_cnt;
29495 int i, rc = 1, blocks, length;
29496
29497+ pax_track_stack();
29498+
29499 ide_debug_log(IDE_DBG_FUNC, "enter");
29500
29501 drive->bios_cyl = 0;
29502diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
29503index a743e68..1cfd674 100644
29504--- a/drivers/ide/ide-pci-generic.c
29505+++ b/drivers/ide/ide-pci-generic.c
29506@@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
29507 .udma_mask = ATA_UDMA6, \
29508 }
29509
29510-static const struct ide_port_info generic_chipsets[] __devinitdata = {
29511+static const struct ide_port_info generic_chipsets[] __devinitconst = {
29512 /* 0: Unknown */
29513 DECLARE_GENERIC_PCI_DEV(0),
29514
29515diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
29516index 560e66d..d5dd180 100644
29517--- a/drivers/ide/it8172.c
29518+++ b/drivers/ide/it8172.c
29519@@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
29520 .set_dma_mode = it8172_set_dma_mode,
29521 };
29522
29523-static const struct ide_port_info it8172_port_info __devinitdata = {
29524+static const struct ide_port_info it8172_port_info __devinitconst = {
29525 .name = DRV_NAME,
29526 .port_ops = &it8172_port_ops,
29527 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
29528diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
29529index 46816ba..1847aeb 100644
29530--- a/drivers/ide/it8213.c
29531+++ b/drivers/ide/it8213.c
29532@@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
29533 .cable_detect = it8213_cable_detect,
29534 };
29535
29536-static const struct ide_port_info it8213_chipset __devinitdata = {
29537+static const struct ide_port_info it8213_chipset __devinitconst = {
29538 .name = DRV_NAME,
29539 .enablebits = { {0x41, 0x80, 0x80} },
29540 .port_ops = &it8213_port_ops,
29541diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
29542index 2e3169f..c5611db 100644
29543--- a/drivers/ide/it821x.c
29544+++ b/drivers/ide/it821x.c
29545@@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_port_ops = {
29546 .cable_detect = it821x_cable_detect,
29547 };
29548
29549-static const struct ide_port_info it821x_chipset __devinitdata = {
29550+static const struct ide_port_info it821x_chipset __devinitconst = {
29551 .name = DRV_NAME,
29552 .init_chipset = init_chipset_it821x,
29553 .init_hwif = init_hwif_it821x,
29554diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
29555index 74c2c4a..efddd7d 100644
29556--- a/drivers/ide/jmicron.c
29557+++ b/drivers/ide/jmicron.c
29558@@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
29559 .cable_detect = jmicron_cable_detect,
29560 };
29561
29562-static const struct ide_port_info jmicron_chipset __devinitdata = {
29563+static const struct ide_port_info jmicron_chipset __devinitconst = {
29564 .name = DRV_NAME,
29565 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
29566 .port_ops = &jmicron_port_ops,
29567diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
29568index 95327a2..73f78d8 100644
29569--- a/drivers/ide/ns87415.c
29570+++ b/drivers/ide/ns87415.c
29571@@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
29572 .dma_sff_read_status = superio_dma_sff_read_status,
29573 };
29574
29575-static const struct ide_port_info ns87415_chipset __devinitdata = {
29576+static const struct ide_port_info ns87415_chipset __devinitconst = {
29577 .name = DRV_NAME,
29578 .init_hwif = init_hwif_ns87415,
29579 .tp_ops = &ns87415_tp_ops,
29580diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
29581index 1a53a4c..39edc66 100644
29582--- a/drivers/ide/opti621.c
29583+++ b/drivers/ide/opti621.c
29584@@ -131,7 +131,7 @@ static const struct ide_port_ops opti621_port_ops = {
29585 .set_pio_mode = opti621_set_pio_mode,
29586 };
29587
29588-static const struct ide_port_info opti621_chipset __devinitdata = {
29589+static const struct ide_port_info opti621_chipset __devinitconst = {
29590 .name = DRV_NAME,
29591 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
29592 .port_ops = &opti621_port_ops,
29593diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
29594index 9546fe2..2e5ceb6 100644
29595--- a/drivers/ide/pdc202xx_new.c
29596+++ b/drivers/ide/pdc202xx_new.c
29597@@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
29598 .udma_mask = udma, \
29599 }
29600
29601-static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
29602+static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
29603 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
29604 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
29605 };
29606diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
29607index 3a35ec6..5634510 100644
29608--- a/drivers/ide/pdc202xx_old.c
29609+++ b/drivers/ide/pdc202xx_old.c
29610@@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
29611 .max_sectors = sectors, \
29612 }
29613
29614-static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
29615+static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
29616 { /* 0: PDC20246 */
29617 .name = DRV_NAME,
29618 .init_chipset = init_chipset_pdc202xx,
29619diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
29620index b59d04c..368c2a7 100644
29621--- a/drivers/ide/piix.c
29622+++ b/drivers/ide/piix.c
29623@@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
29624 .udma_mask = udma, \
29625 }
29626
29627-static const struct ide_port_info piix_pci_info[] __devinitdata = {
29628+static const struct ide_port_info piix_pci_info[] __devinitconst = {
29629 /* 0: MPIIX */
29630 { /*
29631 * MPIIX actually has only a single IDE channel mapped to
29632diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
29633index a6414a8..c04173e 100644
29634--- a/drivers/ide/rz1000.c
29635+++ b/drivers/ide/rz1000.c
29636@@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
29637 }
29638 }
29639
29640-static const struct ide_port_info rz1000_chipset __devinitdata = {
29641+static const struct ide_port_info rz1000_chipset __devinitconst = {
29642 .name = DRV_NAME,
29643 .host_flags = IDE_HFLAG_NO_DMA,
29644 };
29645diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
29646index 356b9b5..d4758eb 100644
29647--- a/drivers/ide/sc1200.c
29648+++ b/drivers/ide/sc1200.c
29649@@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
29650 .dma_sff_read_status = ide_dma_sff_read_status,
29651 };
29652
29653-static const struct ide_port_info sc1200_chipset __devinitdata = {
29654+static const struct ide_port_info sc1200_chipset __devinitconst = {
29655 .name = DRV_NAME,
29656 .port_ops = &sc1200_port_ops,
29657 .dma_ops = &sc1200_dma_ops,
29658diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
29659index b7f5b0c..9701038 100644
29660--- a/drivers/ide/scc_pata.c
29661+++ b/drivers/ide/scc_pata.c
29662@@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
29663 .dma_sff_read_status = scc_dma_sff_read_status,
29664 };
29665
29666-static const struct ide_port_info scc_chipset __devinitdata = {
29667+static const struct ide_port_info scc_chipset __devinitconst = {
29668 .name = "sccIDE",
29669 .init_iops = init_iops_scc,
29670 .init_dma = scc_init_dma,
29671diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
29672index 35fb8da..24d72ef 100644
29673--- a/drivers/ide/serverworks.c
29674+++ b/drivers/ide/serverworks.c
29675@@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_port_ops = {
29676 .cable_detect = svwks_cable_detect,
29677 };
29678
29679-static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
29680+static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
29681 { /* 0: OSB4 */
29682 .name = DRV_NAME,
29683 .init_chipset = init_chipset_svwks,
29684diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
29685index ab3db61..afed580 100644
29686--- a/drivers/ide/setup-pci.c
29687+++ b/drivers/ide/setup-pci.c
29688@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
29689 int ret, i, n_ports = dev2 ? 4 : 2;
29690 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
29691
29692+ pax_track_stack();
29693+
29694 for (i = 0; i < n_ports / 2; i++) {
29695 ret = ide_setup_pci_controller(pdev[i], d, !i);
29696 if (ret < 0)
29697diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
29698index ddeda44..46f7e30 100644
29699--- a/drivers/ide/siimage.c
29700+++ b/drivers/ide/siimage.c
29701@@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
29702 .udma_mask = ATA_UDMA6, \
29703 }
29704
29705-static const struct ide_port_info siimage_chipsets[] __devinitdata = {
29706+static const struct ide_port_info siimage_chipsets[] __devinitconst = {
29707 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
29708 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
29709 };
29710diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
29711index 4a00225..09e61b4 100644
29712--- a/drivers/ide/sis5513.c
29713+++ b/drivers/ide/sis5513.c
29714@@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
29715 .cable_detect = sis_cable_detect,
29716 };
29717
29718-static const struct ide_port_info sis5513_chipset __devinitdata = {
29719+static const struct ide_port_info sis5513_chipset __devinitconst = {
29720 .name = DRV_NAME,
29721 .init_chipset = init_chipset_sis5513,
29722 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
29723diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
29724index f21dc2a..d051cd2 100644
29725--- a/drivers/ide/sl82c105.c
29726+++ b/drivers/ide/sl82c105.c
29727@@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
29728 .dma_sff_read_status = ide_dma_sff_read_status,
29729 };
29730
29731-static const struct ide_port_info sl82c105_chipset __devinitdata = {
29732+static const struct ide_port_info sl82c105_chipset __devinitconst = {
29733 .name = DRV_NAME,
29734 .init_chipset = init_chipset_sl82c105,
29735 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
29736diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
29737index 864ffe0..863a5e9 100644
29738--- a/drivers/ide/slc90e66.c
29739+++ b/drivers/ide/slc90e66.c
29740@@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
29741 .cable_detect = slc90e66_cable_detect,
29742 };
29743
29744-static const struct ide_port_info slc90e66_chipset __devinitdata = {
29745+static const struct ide_port_info slc90e66_chipset __devinitconst = {
29746 .name = DRV_NAME,
29747 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
29748 .port_ops = &slc90e66_port_ops,
29749diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
29750index e444d24..ba577de 100644
29751--- a/drivers/ide/tc86c001.c
29752+++ b/drivers/ide/tc86c001.c
29753@@ -191,7 +191,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
29754 .dma_sff_read_status = ide_dma_sff_read_status,
29755 };
29756
29757-static const struct ide_port_info tc86c001_chipset __devinitdata = {
29758+static const struct ide_port_info tc86c001_chipset __devinitconst = {
29759 .name = DRV_NAME,
29760 .init_hwif = init_hwif_tc86c001,
29761 .port_ops = &tc86c001_port_ops,
29762diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
29763index e53a1b7..d11aff7 100644
29764--- a/drivers/ide/triflex.c
29765+++ b/drivers/ide/triflex.c
29766@@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
29767 .set_dma_mode = triflex_set_mode,
29768 };
29769
29770-static const struct ide_port_info triflex_device __devinitdata = {
29771+static const struct ide_port_info triflex_device __devinitconst = {
29772 .name = DRV_NAME,
29773 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
29774 .port_ops = &triflex_port_ops,
29775diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
29776index 4b42ca0..e494a98 100644
29777--- a/drivers/ide/trm290.c
29778+++ b/drivers/ide/trm290.c
29779@@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
29780 .dma_check = trm290_dma_check,
29781 };
29782
29783-static const struct ide_port_info trm290_chipset __devinitdata = {
29784+static const struct ide_port_info trm290_chipset __devinitconst = {
29785 .name = DRV_NAME,
29786 .init_hwif = init_hwif_trm290,
29787 .tp_ops = &trm290_tp_ops,
29788diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
29789index f46f49c..eb77678 100644
29790--- a/drivers/ide/via82cxxx.c
29791+++ b/drivers/ide/via82cxxx.c
29792@@ -403,7 +403,7 @@ static const struct ide_port_ops via_port_ops = {
29793 .cable_detect = via82cxxx_cable_detect,
29794 };
29795
29796-static const struct ide_port_info via82cxxx_chipset __devinitdata = {
29797+static const struct ide_port_info via82cxxx_chipset __devinitconst = {
29798 .name = DRV_NAME,
29799 .init_chipset = init_chipset_via82cxxx,
29800 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
29801diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
29802index fc0f2bd..ac2f8a5 100644
29803--- a/drivers/infiniband/core/cm.c
29804+++ b/drivers/infiniband/core/cm.c
29805@@ -113,7 +113,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
29806
29807 struct cm_counter_group {
29808 struct kobject obj;
29809- atomic_long_t counter[CM_ATTR_COUNT];
29810+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
29811 };
29812
29813 struct cm_counter_attribute {
29814@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm_work *work,
29815 struct ib_mad_send_buf *msg = NULL;
29816 int ret;
29817
29818- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29819+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29820 counter[CM_REQ_COUNTER]);
29821
29822 /* Quick state check to discard duplicate REQs. */
29823@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
29824 if (!cm_id_priv)
29825 return;
29826
29827- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29828+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29829 counter[CM_REP_COUNTER]);
29830 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
29831 if (ret)
29832@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work *work)
29833 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
29834 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
29835 spin_unlock_irq(&cm_id_priv->lock);
29836- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29837+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29838 counter[CM_RTU_COUNTER]);
29839 goto out;
29840 }
29841@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_work *work)
29842 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
29843 dreq_msg->local_comm_id);
29844 if (!cm_id_priv) {
29845- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29846+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29847 counter[CM_DREQ_COUNTER]);
29848 cm_issue_drep(work->port, work->mad_recv_wc);
29849 return -EINVAL;
29850@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_work *work)
29851 case IB_CM_MRA_REP_RCVD:
29852 break;
29853 case IB_CM_TIMEWAIT:
29854- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29855+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29856 counter[CM_DREQ_COUNTER]);
29857 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
29858 goto unlock;
29859@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_work *work)
29860 cm_free_msg(msg);
29861 goto deref;
29862 case IB_CM_DREQ_RCVD:
29863- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29864+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29865 counter[CM_DREQ_COUNTER]);
29866 goto unlock;
29867 default:
29868@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work *work)
29869 ib_modify_mad(cm_id_priv->av.port->mad_agent,
29870 cm_id_priv->msg, timeout)) {
29871 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
29872- atomic_long_inc(&work->port->
29873+ atomic_long_inc_unchecked(&work->port->
29874 counter_group[CM_RECV_DUPLICATES].
29875 counter[CM_MRA_COUNTER]);
29876 goto out;
29877@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work *work)
29878 break;
29879 case IB_CM_MRA_REQ_RCVD:
29880 case IB_CM_MRA_REP_RCVD:
29881- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29882+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29883 counter[CM_MRA_COUNTER]);
29884 /* fall through */
29885 default:
29886@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work *work)
29887 case IB_CM_LAP_IDLE:
29888 break;
29889 case IB_CM_MRA_LAP_SENT:
29890- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29891+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29892 counter[CM_LAP_COUNTER]);
29893 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
29894 goto unlock;
29895@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work *work)
29896 cm_free_msg(msg);
29897 goto deref;
29898 case IB_CM_LAP_RCVD:
29899- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29900+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29901 counter[CM_LAP_COUNTER]);
29902 goto unlock;
29903 default:
29904@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
29905 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
29906 if (cur_cm_id_priv) {
29907 spin_unlock_irq(&cm.lock);
29908- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29909+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29910 counter[CM_SIDR_REQ_COUNTER]);
29911 goto out; /* Duplicate message. */
29912 }
29913@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
29914 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
29915 msg->retries = 1;
29916
29917- atomic_long_add(1 + msg->retries,
29918+ atomic_long_add_unchecked(1 + msg->retries,
29919 &port->counter_group[CM_XMIT].counter[attr_index]);
29920 if (msg->retries)
29921- atomic_long_add(msg->retries,
29922+ atomic_long_add_unchecked(msg->retries,
29923 &port->counter_group[CM_XMIT_RETRIES].
29924 counter[attr_index]);
29925
29926@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
29927 }
29928
29929 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
29930- atomic_long_inc(&port->counter_group[CM_RECV].
29931+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
29932 counter[attr_id - CM_ATTR_ID_OFFSET]);
29933
29934 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
29935@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
29936 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
29937
29938 return sprintf(buf, "%ld\n",
29939- atomic_long_read(&group->counter[cm_attr->index]));
29940+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
29941 }
29942
29943 static const struct sysfs_ops cm_counter_ops = {
29944diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
29945index 4507043..14ad522 100644
29946--- a/drivers/infiniband/core/fmr_pool.c
29947+++ b/drivers/infiniband/core/fmr_pool.c
29948@@ -97,8 +97,8 @@ struct ib_fmr_pool {
29949
29950 struct task_struct *thread;
29951
29952- atomic_t req_ser;
29953- atomic_t flush_ser;
29954+ atomic_unchecked_t req_ser;
29955+ atomic_unchecked_t flush_ser;
29956
29957 wait_queue_head_t force_wait;
29958 };
29959@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
29960 struct ib_fmr_pool *pool = pool_ptr;
29961
29962 do {
29963- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
29964+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
29965 ib_fmr_batch_release(pool);
29966
29967- atomic_inc(&pool->flush_ser);
29968+ atomic_inc_unchecked(&pool->flush_ser);
29969 wake_up_interruptible(&pool->force_wait);
29970
29971 if (pool->flush_function)
29972@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
29973 }
29974
29975 set_current_state(TASK_INTERRUPTIBLE);
29976- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
29977+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
29978 !kthread_should_stop())
29979 schedule();
29980 __set_current_state(TASK_RUNNING);
29981@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
29982 pool->dirty_watermark = params->dirty_watermark;
29983 pool->dirty_len = 0;
29984 spin_lock_init(&pool->pool_lock);
29985- atomic_set(&pool->req_ser, 0);
29986- atomic_set(&pool->flush_ser, 0);
29987+ atomic_set_unchecked(&pool->req_ser, 0);
29988+ atomic_set_unchecked(&pool->flush_ser, 0);
29989 init_waitqueue_head(&pool->force_wait);
29990
29991 pool->thread = kthread_run(ib_fmr_cleanup_thread,
29992@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
29993 }
29994 spin_unlock_irq(&pool->pool_lock);
29995
29996- serial = atomic_inc_return(&pool->req_ser);
29997+ serial = atomic_inc_return_unchecked(&pool->req_ser);
29998 wake_up_process(pool->thread);
29999
30000 if (wait_event_interruptible(pool->force_wait,
30001- atomic_read(&pool->flush_ser) - serial >= 0))
30002+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30003 return -EINTR;
30004
30005 return 0;
30006@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
30007 } else {
30008 list_add_tail(&fmr->list, &pool->dirty_list);
30009 if (++pool->dirty_len >= pool->dirty_watermark) {
30010- atomic_inc(&pool->req_ser);
30011+ atomic_inc_unchecked(&pool->req_ser);
30012 wake_up_process(pool->thread);
30013 }
30014 }
30015diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
30016index 40c8353..946b0e4 100644
30017--- a/drivers/infiniband/hw/cxgb4/mem.c
30018+++ b/drivers/infiniband/hw/cxgb4/mem.c
30019@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30020 int err;
30021 struct fw_ri_tpte tpt;
30022 u32 stag_idx;
30023- static atomic_t key;
30024+ static atomic_unchecked_t key;
30025
30026 if (c4iw_fatal_error(rdev))
30027 return -EIO;
30028@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30029 &rdev->resource.tpt_fifo_lock);
30030 if (!stag_idx)
30031 return -ENOMEM;
30032- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30033+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30034 }
30035 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30036 __func__, stag_state, type, pdid, stag_idx);
30037diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
30038index 31ae1b1..2f5b038 100644
30039--- a/drivers/infiniband/hw/ipath/ipath_fs.c
30040+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
30041@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
30042 struct infinipath_counters counters;
30043 struct ipath_devdata *dd;
30044
30045+ pax_track_stack();
30046+
30047 dd = file->f_path.dentry->d_inode->i_private;
30048 dd->ipath_f_read_counters(dd, &counters);
30049
30050diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
30051index 79b3dbc..96e5fcc 100644
30052--- a/drivers/infiniband/hw/ipath/ipath_rc.c
30053+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
30054@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30055 struct ib_atomic_eth *ateth;
30056 struct ipath_ack_entry *e;
30057 u64 vaddr;
30058- atomic64_t *maddr;
30059+ atomic64_unchecked_t *maddr;
30060 u64 sdata;
30061 u32 rkey;
30062 u8 next;
30063@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30064 IB_ACCESS_REMOTE_ATOMIC)))
30065 goto nack_acc_unlck;
30066 /* Perform atomic OP and save result. */
30067- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30068+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30069 sdata = be64_to_cpu(ateth->swap_data);
30070 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30071 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30072- (u64) atomic64_add_return(sdata, maddr) - sdata :
30073+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30074 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30075 be64_to_cpu(ateth->compare_data),
30076 sdata);
30077diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
30078index 1f95bba..9530f87 100644
30079--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
30080+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
30081@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
30082 unsigned long flags;
30083 struct ib_wc wc;
30084 u64 sdata;
30085- atomic64_t *maddr;
30086+ atomic64_unchecked_t *maddr;
30087 enum ib_wc_status send_status;
30088
30089 /*
30090@@ -382,11 +382,11 @@ again:
30091 IB_ACCESS_REMOTE_ATOMIC)))
30092 goto acc_err;
30093 /* Perform atomic OP and save result. */
30094- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30095+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30096 sdata = wqe->wr.wr.atomic.compare_add;
30097 *(u64 *) sqp->s_sge.sge.vaddr =
30098 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30099- (u64) atomic64_add_return(sdata, maddr) - sdata :
30100+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30101 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30102 sdata, wqe->wr.wr.atomic.swap);
30103 goto send_comp;
30104diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
30105index 2d668c6..3312bb7 100644
30106--- a/drivers/infiniband/hw/nes/nes.c
30107+++ b/drivers/infiniband/hw/nes/nes.c
30108@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
30109 LIST_HEAD(nes_adapter_list);
30110 static LIST_HEAD(nes_dev_list);
30111
30112-atomic_t qps_destroyed;
30113+atomic_unchecked_t qps_destroyed;
30114
30115 static unsigned int ee_flsh_adapter;
30116 static unsigned int sysfs_nonidx_addr;
30117@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
30118 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30119 struct nes_adapter *nesadapter = nesdev->nesadapter;
30120
30121- atomic_inc(&qps_destroyed);
30122+ atomic_inc_unchecked(&qps_destroyed);
30123
30124 /* Free the control structures */
30125
30126diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
30127index 6fe7987..68637b5 100644
30128--- a/drivers/infiniband/hw/nes/nes.h
30129+++ b/drivers/infiniband/hw/nes/nes.h
30130@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30131 extern unsigned int wqm_quanta;
30132 extern struct list_head nes_adapter_list;
30133
30134-extern atomic_t cm_connects;
30135-extern atomic_t cm_accepts;
30136-extern atomic_t cm_disconnects;
30137-extern atomic_t cm_closes;
30138-extern atomic_t cm_connecteds;
30139-extern atomic_t cm_connect_reqs;
30140-extern atomic_t cm_rejects;
30141-extern atomic_t mod_qp_timouts;
30142-extern atomic_t qps_created;
30143-extern atomic_t qps_destroyed;
30144-extern atomic_t sw_qps_destroyed;
30145+extern atomic_unchecked_t cm_connects;
30146+extern atomic_unchecked_t cm_accepts;
30147+extern atomic_unchecked_t cm_disconnects;
30148+extern atomic_unchecked_t cm_closes;
30149+extern atomic_unchecked_t cm_connecteds;
30150+extern atomic_unchecked_t cm_connect_reqs;
30151+extern atomic_unchecked_t cm_rejects;
30152+extern atomic_unchecked_t mod_qp_timouts;
30153+extern atomic_unchecked_t qps_created;
30154+extern atomic_unchecked_t qps_destroyed;
30155+extern atomic_unchecked_t sw_qps_destroyed;
30156 extern u32 mh_detected;
30157 extern u32 mh_pauses_sent;
30158 extern u32 cm_packets_sent;
30159@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30160 extern u32 cm_packets_received;
30161 extern u32 cm_packets_dropped;
30162 extern u32 cm_packets_retrans;
30163-extern atomic_t cm_listens_created;
30164-extern atomic_t cm_listens_destroyed;
30165+extern atomic_unchecked_t cm_listens_created;
30166+extern atomic_unchecked_t cm_listens_destroyed;
30167 extern u32 cm_backlog_drops;
30168-extern atomic_t cm_loopbacks;
30169-extern atomic_t cm_nodes_created;
30170-extern atomic_t cm_nodes_destroyed;
30171-extern atomic_t cm_accel_dropped_pkts;
30172-extern atomic_t cm_resets_recvd;
30173+extern atomic_unchecked_t cm_loopbacks;
30174+extern atomic_unchecked_t cm_nodes_created;
30175+extern atomic_unchecked_t cm_nodes_destroyed;
30176+extern atomic_unchecked_t cm_accel_dropped_pkts;
30177+extern atomic_unchecked_t cm_resets_recvd;
30178
30179 extern u32 int_mod_timer_init;
30180 extern u32 int_mod_cq_depth_256;
30181diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
30182index a237547..28a9819 100644
30183--- a/drivers/infiniband/hw/nes/nes_cm.c
30184+++ b/drivers/infiniband/hw/nes/nes_cm.c
30185@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30186 u32 cm_packets_retrans;
30187 u32 cm_packets_created;
30188 u32 cm_packets_received;
30189-atomic_t cm_listens_created;
30190-atomic_t cm_listens_destroyed;
30191+atomic_unchecked_t cm_listens_created;
30192+atomic_unchecked_t cm_listens_destroyed;
30193 u32 cm_backlog_drops;
30194-atomic_t cm_loopbacks;
30195-atomic_t cm_nodes_created;
30196-atomic_t cm_nodes_destroyed;
30197-atomic_t cm_accel_dropped_pkts;
30198-atomic_t cm_resets_recvd;
30199+atomic_unchecked_t cm_loopbacks;
30200+atomic_unchecked_t cm_nodes_created;
30201+atomic_unchecked_t cm_nodes_destroyed;
30202+atomic_unchecked_t cm_accel_dropped_pkts;
30203+atomic_unchecked_t cm_resets_recvd;
30204
30205 static inline int mini_cm_accelerated(struct nes_cm_core *,
30206 struct nes_cm_node *);
30207@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30208
30209 static struct nes_cm_core *g_cm_core;
30210
30211-atomic_t cm_connects;
30212-atomic_t cm_accepts;
30213-atomic_t cm_disconnects;
30214-atomic_t cm_closes;
30215-atomic_t cm_connecteds;
30216-atomic_t cm_connect_reqs;
30217-atomic_t cm_rejects;
30218+atomic_unchecked_t cm_connects;
30219+atomic_unchecked_t cm_accepts;
30220+atomic_unchecked_t cm_disconnects;
30221+atomic_unchecked_t cm_closes;
30222+atomic_unchecked_t cm_connecteds;
30223+atomic_unchecked_t cm_connect_reqs;
30224+atomic_unchecked_t cm_rejects;
30225
30226
30227 /**
30228@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
30229 kfree(listener);
30230 listener = NULL;
30231 ret = 0;
30232- atomic_inc(&cm_listens_destroyed);
30233+ atomic_inc_unchecked(&cm_listens_destroyed);
30234 } else {
30235 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30236 }
30237@@ -1242,7 +1242,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
30238 cm_node->rem_mac);
30239
30240 add_hte_node(cm_core, cm_node);
30241- atomic_inc(&cm_nodes_created);
30242+ atomic_inc_unchecked(&cm_nodes_created);
30243
30244 return cm_node;
30245 }
30246@@ -1300,7 +1300,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
30247 }
30248
30249 atomic_dec(&cm_core->node_cnt);
30250- atomic_inc(&cm_nodes_destroyed);
30251+ atomic_inc_unchecked(&cm_nodes_destroyed);
30252 nesqp = cm_node->nesqp;
30253 if (nesqp) {
30254 nesqp->cm_node = NULL;
30255@@ -1367,7 +1367,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
30256
30257 static void drop_packet(struct sk_buff *skb)
30258 {
30259- atomic_inc(&cm_accel_dropped_pkts);
30260+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30261 dev_kfree_skb_any(skb);
30262 }
30263
30264@@ -1430,7 +1430,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
30265 {
30266
30267 int reset = 0; /* whether to send reset in case of err.. */
30268- atomic_inc(&cm_resets_recvd);
30269+ atomic_inc_unchecked(&cm_resets_recvd);
30270 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30271 " refcnt=%d\n", cm_node, cm_node->state,
30272 atomic_read(&cm_node->ref_count));
30273@@ -2059,7 +2059,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
30274 rem_ref_cm_node(cm_node->cm_core, cm_node);
30275 return NULL;
30276 }
30277- atomic_inc(&cm_loopbacks);
30278+ atomic_inc_unchecked(&cm_loopbacks);
30279 loopbackremotenode->loopbackpartner = cm_node;
30280 loopbackremotenode->tcp_cntxt.rcv_wscale =
30281 NES_CM_DEFAULT_RCV_WND_SCALE;
30282@@ -2334,7 +2334,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
30283 add_ref_cm_node(cm_node);
30284 } else if (cm_node->state == NES_CM_STATE_TSA) {
30285 rem_ref_cm_node(cm_core, cm_node);
30286- atomic_inc(&cm_accel_dropped_pkts);
30287+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30288 dev_kfree_skb_any(skb);
30289 break;
30290 }
30291@@ -2640,7 +2640,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30292
30293 if ((cm_id) && (cm_id->event_handler)) {
30294 if (issue_disconn) {
30295- atomic_inc(&cm_disconnects);
30296+ atomic_inc_unchecked(&cm_disconnects);
30297 cm_event.event = IW_CM_EVENT_DISCONNECT;
30298 cm_event.status = disconn_status;
30299 cm_event.local_addr = cm_id->local_addr;
30300@@ -2662,7 +2662,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30301 }
30302
30303 if (issue_close) {
30304- atomic_inc(&cm_closes);
30305+ atomic_inc_unchecked(&cm_closes);
30306 nes_disconnect(nesqp, 1);
30307
30308 cm_id->provider_data = nesqp;
30309@@ -2793,7 +2793,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30310
30311 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30312 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30313- atomic_inc(&cm_accepts);
30314+ atomic_inc_unchecked(&cm_accepts);
30315
30316 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30317 netdev_refcnt_read(nesvnic->netdev));
30318@@ -3003,7 +3003,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
30319
30320 struct nes_cm_core *cm_core;
30321
30322- atomic_inc(&cm_rejects);
30323+ atomic_inc_unchecked(&cm_rejects);
30324 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30325 loopback = cm_node->loopbackpartner;
30326 cm_core = cm_node->cm_core;
30327@@ -3069,7 +3069,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30328 ntohl(cm_id->local_addr.sin_addr.s_addr),
30329 ntohs(cm_id->local_addr.sin_port));
30330
30331- atomic_inc(&cm_connects);
30332+ atomic_inc_unchecked(&cm_connects);
30333 nesqp->active_conn = 1;
30334
30335 /* cache the cm_id in the qp */
30336@@ -3175,7 +3175,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
30337 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30338 return err;
30339 }
30340- atomic_inc(&cm_listens_created);
30341+ atomic_inc_unchecked(&cm_listens_created);
30342 }
30343
30344 cm_id->add_ref(cm_id);
30345@@ -3280,7 +3280,7 @@ static void cm_event_connected(struct nes_cm_event *event)
30346 if (nesqp->destroyed) {
30347 return;
30348 }
30349- atomic_inc(&cm_connecteds);
30350+ atomic_inc_unchecked(&cm_connecteds);
30351 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30352 " local port 0x%04X. jiffies = %lu.\n",
30353 nesqp->hwqp.qp_id,
30354@@ -3495,7 +3495,7 @@ static void cm_event_reset(struct nes_cm_event *event)
30355
30356 cm_id->add_ref(cm_id);
30357 ret = cm_id->event_handler(cm_id, &cm_event);
30358- atomic_inc(&cm_closes);
30359+ atomic_inc_unchecked(&cm_closes);
30360 cm_event.event = IW_CM_EVENT_CLOSE;
30361 cm_event.status = 0;
30362 cm_event.provider_data = cm_id->provider_data;
30363@@ -3531,7 +3531,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
30364 return;
30365 cm_id = cm_node->cm_id;
30366
30367- atomic_inc(&cm_connect_reqs);
30368+ atomic_inc_unchecked(&cm_connect_reqs);
30369 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30370 cm_node, cm_id, jiffies);
30371
30372@@ -3569,7 +3569,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
30373 return;
30374 cm_id = cm_node->cm_id;
30375
30376- atomic_inc(&cm_connect_reqs);
30377+ atomic_inc_unchecked(&cm_connect_reqs);
30378 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30379 cm_node, cm_id, jiffies);
30380
30381diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
30382index 9d7ffeb..a95dd7d 100644
30383--- a/drivers/infiniband/hw/nes/nes_nic.c
30384+++ b/drivers/infiniband/hw/nes/nes_nic.c
30385@@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
30386 target_stat_values[++index] = mh_detected;
30387 target_stat_values[++index] = mh_pauses_sent;
30388 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30389- target_stat_values[++index] = atomic_read(&cm_connects);
30390- target_stat_values[++index] = atomic_read(&cm_accepts);
30391- target_stat_values[++index] = atomic_read(&cm_disconnects);
30392- target_stat_values[++index] = atomic_read(&cm_connecteds);
30393- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30394- target_stat_values[++index] = atomic_read(&cm_rejects);
30395- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30396- target_stat_values[++index] = atomic_read(&qps_created);
30397- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30398- target_stat_values[++index] = atomic_read(&qps_destroyed);
30399- target_stat_values[++index] = atomic_read(&cm_closes);
30400+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30401+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30402+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30403+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30404+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30405+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30406+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30407+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30408+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30409+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30410+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30411 target_stat_values[++index] = cm_packets_sent;
30412 target_stat_values[++index] = cm_packets_bounced;
30413 target_stat_values[++index] = cm_packets_created;
30414 target_stat_values[++index] = cm_packets_received;
30415 target_stat_values[++index] = cm_packets_dropped;
30416 target_stat_values[++index] = cm_packets_retrans;
30417- target_stat_values[++index] = atomic_read(&cm_listens_created);
30418- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30419+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30420+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30421 target_stat_values[++index] = cm_backlog_drops;
30422- target_stat_values[++index] = atomic_read(&cm_loopbacks);
30423- target_stat_values[++index] = atomic_read(&cm_nodes_created);
30424- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30425- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30426- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30427+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30428+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30429+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30430+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30431+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30432 target_stat_values[++index] = nesadapter->free_4kpbl;
30433 target_stat_values[++index] = nesadapter->free_256pbl;
30434 target_stat_values[++index] = int_mod_timer_init;
30435diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
30436index 9f2f7d4..6d2fee2 100644
30437--- a/drivers/infiniband/hw/nes/nes_verbs.c
30438+++ b/drivers/infiniband/hw/nes/nes_verbs.c
30439@@ -46,9 +46,9 @@
30440
30441 #include <rdma/ib_umem.h>
30442
30443-atomic_t mod_qp_timouts;
30444-atomic_t qps_created;
30445-atomic_t sw_qps_destroyed;
30446+atomic_unchecked_t mod_qp_timouts;
30447+atomic_unchecked_t qps_created;
30448+atomic_unchecked_t sw_qps_destroyed;
30449
30450 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30451
30452@@ -1131,7 +1131,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
30453 if (init_attr->create_flags)
30454 return ERR_PTR(-EINVAL);
30455
30456- atomic_inc(&qps_created);
30457+ atomic_inc_unchecked(&qps_created);
30458 switch (init_attr->qp_type) {
30459 case IB_QPT_RC:
30460 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30461@@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
30462 struct iw_cm_event cm_event;
30463 int ret;
30464
30465- atomic_inc(&sw_qps_destroyed);
30466+ atomic_inc_unchecked(&sw_qps_destroyed);
30467 nesqp->destroyed = 1;
30468
30469 /* Blow away the connection if it exists. */
30470diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
30471index c9624ea..e025b66 100644
30472--- a/drivers/infiniband/hw/qib/qib.h
30473+++ b/drivers/infiniband/hw/qib/qib.h
30474@@ -51,6 +51,7 @@
30475 #include <linux/completion.h>
30476 #include <linux/kref.h>
30477 #include <linux/sched.h>
30478+#include <linux/slab.h>
30479
30480 #include "qib_common.h"
30481 #include "qib_verbs.h"
30482diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
30483index c351aa4..e6967c2 100644
30484--- a/drivers/input/gameport/gameport.c
30485+++ b/drivers/input/gameport/gameport.c
30486@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
30487 */
30488 static void gameport_init_port(struct gameport *gameport)
30489 {
30490- static atomic_t gameport_no = ATOMIC_INIT(0);
30491+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
30492
30493 __module_get(THIS_MODULE);
30494
30495 mutex_init(&gameport->drv_mutex);
30496 device_initialize(&gameport->dev);
30497 dev_set_name(&gameport->dev, "gameport%lu",
30498- (unsigned long)atomic_inc_return(&gameport_no) - 1);
30499+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
30500 gameport->dev.bus = &gameport_bus;
30501 gameport->dev.release = gameport_release_port;
30502 if (gameport->parent)
30503diff --git a/drivers/input/input.c b/drivers/input/input.c
30504index da38d97..2aa0b79 100644
30505--- a/drivers/input/input.c
30506+++ b/drivers/input/input.c
30507@@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struct input_dev *dev)
30508 */
30509 int input_register_device(struct input_dev *dev)
30510 {
30511- static atomic_t input_no = ATOMIC_INIT(0);
30512+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
30513 struct input_handler *handler;
30514 const char *path;
30515 int error;
30516@@ -1851,7 +1851,7 @@ int input_register_device(struct input_dev *dev)
30517 dev->setkeycode = input_default_setkeycode;
30518
30519 dev_set_name(&dev->dev, "input%ld",
30520- (unsigned long) atomic_inc_return(&input_no) - 1);
30521+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
30522
30523 error = device_add(&dev->dev);
30524 if (error)
30525diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
30526index b8d8611..15f8d2c 100644
30527--- a/drivers/input/joystick/sidewinder.c
30528+++ b/drivers/input/joystick/sidewinder.c
30529@@ -30,6 +30,7 @@
30530 #include <linux/kernel.h>
30531 #include <linux/module.h>
30532 #include <linux/slab.h>
30533+#include <linux/sched.h>
30534 #include <linux/init.h>
30535 #include <linux/input.h>
30536 #include <linux/gameport.h>
30537@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
30538 unsigned char buf[SW_LENGTH];
30539 int i;
30540
30541+ pax_track_stack();
30542+
30543 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
30544
30545 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
30546diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
30547index d728875..844c89b 100644
30548--- a/drivers/input/joystick/xpad.c
30549+++ b/drivers/input/joystick/xpad.c
30550@@ -710,7 +710,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
30551
30552 static int xpad_led_probe(struct usb_xpad *xpad)
30553 {
30554- static atomic_t led_seq = ATOMIC_INIT(0);
30555+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
30556 long led_no;
30557 struct xpad_led *led;
30558 struct led_classdev *led_cdev;
30559@@ -723,7 +723,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
30560 if (!led)
30561 return -ENOMEM;
30562
30563- led_no = (long)atomic_inc_return(&led_seq) - 1;
30564+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
30565
30566 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
30567 led->xpad = xpad;
30568diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
30569index 0110b5a..d3ad144 100644
30570--- a/drivers/input/mousedev.c
30571+++ b/drivers/input/mousedev.c
30572@@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
30573
30574 spin_unlock_irq(&client->packet_lock);
30575
30576- if (copy_to_user(buffer, data, count))
30577+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
30578 return -EFAULT;
30579
30580 return count;
30581diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
30582index ba70058..571d25d 100644
30583--- a/drivers/input/serio/serio.c
30584+++ b/drivers/input/serio/serio.c
30585@@ -497,7 +497,7 @@ static void serio_release_port(struct device *dev)
30586 */
30587 static void serio_init_port(struct serio *serio)
30588 {
30589- static atomic_t serio_no = ATOMIC_INIT(0);
30590+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
30591
30592 __module_get(THIS_MODULE);
30593
30594@@ -508,7 +508,7 @@ static void serio_init_port(struct serio *serio)
30595 mutex_init(&serio->drv_mutex);
30596 device_initialize(&serio->dev);
30597 dev_set_name(&serio->dev, "serio%ld",
30598- (long)atomic_inc_return(&serio_no) - 1);
30599+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
30600 serio->dev.bus = &serio_bus;
30601 serio->dev.release = serio_release_port;
30602 serio->dev.groups = serio_device_attr_groups;
30603diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
30604index e44933d..9ba484a 100644
30605--- a/drivers/isdn/capi/capi.c
30606+++ b/drivers/isdn/capi/capi.c
30607@@ -83,8 +83,8 @@ struct capiminor {
30608
30609 struct capi20_appl *ap;
30610 u32 ncci;
30611- atomic_t datahandle;
30612- atomic_t msgid;
30613+ atomic_unchecked_t datahandle;
30614+ atomic_unchecked_t msgid;
30615
30616 struct tty_port port;
30617 int ttyinstop;
30618@@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
30619 capimsg_setu16(s, 2, mp->ap->applid);
30620 capimsg_setu8 (s, 4, CAPI_DATA_B3);
30621 capimsg_setu8 (s, 5, CAPI_RESP);
30622- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
30623+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
30624 capimsg_setu32(s, 8, mp->ncci);
30625 capimsg_setu16(s, 12, datahandle);
30626 }
30627@@ -518,14 +518,14 @@ static void handle_minor_send(struct capiminor *mp)
30628 mp->outbytes -= len;
30629 spin_unlock_bh(&mp->outlock);
30630
30631- datahandle = atomic_inc_return(&mp->datahandle);
30632+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
30633 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
30634 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30635 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30636 capimsg_setu16(skb->data, 2, mp->ap->applid);
30637 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
30638 capimsg_setu8 (skb->data, 5, CAPI_REQ);
30639- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
30640+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
30641 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
30642 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
30643 capimsg_setu16(skb->data, 16, len); /* Data length */
30644diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
30645index db621db..825ea1a 100644
30646--- a/drivers/isdn/gigaset/common.c
30647+++ b/drivers/isdn/gigaset/common.c
30648@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
30649 cs->commands_pending = 0;
30650 cs->cur_at_seq = 0;
30651 cs->gotfwver = -1;
30652- cs->open_count = 0;
30653+ local_set(&cs->open_count, 0);
30654 cs->dev = NULL;
30655 cs->tty = NULL;
30656 cs->tty_dev = NULL;
30657diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
30658index 212efaf..f187c6b 100644
30659--- a/drivers/isdn/gigaset/gigaset.h
30660+++ b/drivers/isdn/gigaset/gigaset.h
30661@@ -35,6 +35,7 @@
30662 #include <linux/tty_driver.h>
30663 #include <linux/list.h>
30664 #include <linux/atomic.h>
30665+#include <asm/local.h>
30666
30667 #define GIG_VERSION {0, 5, 0, 0}
30668 #define GIG_COMPAT {0, 4, 0, 0}
30669@@ -433,7 +434,7 @@ struct cardstate {
30670 spinlock_t cmdlock;
30671 unsigned curlen, cmdbytes;
30672
30673- unsigned open_count;
30674+ local_t open_count;
30675 struct tty_struct *tty;
30676 struct tasklet_struct if_wake_tasklet;
30677 unsigned control_state;
30678diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
30679index e35058b..5898a8b 100644
30680--- a/drivers/isdn/gigaset/interface.c
30681+++ b/drivers/isdn/gigaset/interface.c
30682@@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
30683 }
30684 tty->driver_data = cs;
30685
30686- ++cs->open_count;
30687-
30688- if (cs->open_count == 1) {
30689+ if (local_inc_return(&cs->open_count) == 1) {
30690 spin_lock_irqsave(&cs->lock, flags);
30691 cs->tty = tty;
30692 spin_unlock_irqrestore(&cs->lock, flags);
30693@@ -192,10 +190,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
30694
30695 if (!cs->connected)
30696 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30697- else if (!cs->open_count)
30698+ else if (!local_read(&cs->open_count))
30699 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30700 else {
30701- if (!--cs->open_count) {
30702+ if (!local_dec_return(&cs->open_count)) {
30703 spin_lock_irqsave(&cs->lock, flags);
30704 cs->tty = NULL;
30705 spin_unlock_irqrestore(&cs->lock, flags);
30706@@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *tty,
30707 if (!cs->connected) {
30708 gig_dbg(DEBUG_IF, "not connected");
30709 retval = -ENODEV;
30710- } else if (!cs->open_count)
30711+ } else if (!local_read(&cs->open_count))
30712 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30713 else {
30714 retval = 0;
30715@@ -360,7 +358,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
30716 retval = -ENODEV;
30717 goto done;
30718 }
30719- if (!cs->open_count) {
30720+ if (!local_read(&cs->open_count)) {
30721 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30722 retval = -ENODEV;
30723 goto done;
30724@@ -413,7 +411,7 @@ static int if_write_room(struct tty_struct *tty)
30725 if (!cs->connected) {
30726 gig_dbg(DEBUG_IF, "not connected");
30727 retval = -ENODEV;
30728- } else if (!cs->open_count)
30729+ } else if (!local_read(&cs->open_count))
30730 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30731 else if (cs->mstate != MS_LOCKED) {
30732 dev_warn(cs->dev, "can't write to unlocked device\n");
30733@@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
30734
30735 if (!cs->connected)
30736 gig_dbg(DEBUG_IF, "not connected");
30737- else if (!cs->open_count)
30738+ else if (!local_read(&cs->open_count))
30739 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30740 else if (cs->mstate != MS_LOCKED)
30741 dev_warn(cs->dev, "can't write to unlocked device\n");
30742@@ -471,7 +469,7 @@ static void if_throttle(struct tty_struct *tty)
30743
30744 if (!cs->connected)
30745 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30746- else if (!cs->open_count)
30747+ else if (!local_read(&cs->open_count))
30748 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30749 else
30750 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
30751@@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_struct *tty)
30752
30753 if (!cs->connected)
30754 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30755- else if (!cs->open_count)
30756+ else if (!local_read(&cs->open_count))
30757 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30758 else
30759 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
30760@@ -526,7 +524,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
30761 goto out;
30762 }
30763
30764- if (!cs->open_count) {
30765+ if (!local_read(&cs->open_count)) {
30766 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30767 goto out;
30768 }
30769diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
30770index 2a57da59..e7a12ed 100644
30771--- a/drivers/isdn/hardware/avm/b1.c
30772+++ b/drivers/isdn/hardware/avm/b1.c
30773@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
30774 }
30775 if (left) {
30776 if (t4file->user) {
30777- if (copy_from_user(buf, dp, left))
30778+ if (left > sizeof buf || copy_from_user(buf, dp, left))
30779 return -EFAULT;
30780 } else {
30781 memcpy(buf, dp, left);
30782@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
30783 }
30784 if (left) {
30785 if (config->user) {
30786- if (copy_from_user(buf, dp, left))
30787+ if (left > sizeof buf || copy_from_user(buf, dp, left))
30788 return -EFAULT;
30789 } else {
30790 memcpy(buf, dp, left);
30791diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
30792index f130724..c373c68 100644
30793--- a/drivers/isdn/hardware/eicon/capidtmf.c
30794+++ b/drivers/isdn/hardware/eicon/capidtmf.c
30795@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
30796 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
30797 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
30798
30799+ pax_track_stack();
30800
30801 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
30802 {
30803diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
30804index 4d425c6..a9be6c4 100644
30805--- a/drivers/isdn/hardware/eicon/capifunc.c
30806+++ b/drivers/isdn/hardware/eicon/capifunc.c
30807@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
30808 IDI_SYNC_REQ req;
30809 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30810
30811+ pax_track_stack();
30812+
30813 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30814
30815 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30816diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
30817index 3029234..ef0d9e2 100644
30818--- a/drivers/isdn/hardware/eicon/diddfunc.c
30819+++ b/drivers/isdn/hardware/eicon/diddfunc.c
30820@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30821 IDI_SYNC_REQ req;
30822 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30823
30824+ pax_track_stack();
30825+
30826 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30827
30828 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30829diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
30830index 0bbee78..a0d0a01 100644
30831--- a/drivers/isdn/hardware/eicon/divasfunc.c
30832+++ b/drivers/isdn/hardware/eicon/divasfunc.c
30833@@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30834 IDI_SYNC_REQ req;
30835 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30836
30837+ pax_track_stack();
30838+
30839 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30840
30841 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30842diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
30843index 85784a7..a19ca98 100644
30844--- a/drivers/isdn/hardware/eicon/divasync.h
30845+++ b/drivers/isdn/hardware/eicon/divasync.h
30846@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
30847 } diva_didd_add_adapter_t;
30848 typedef struct _diva_didd_remove_adapter {
30849 IDI_CALL p_request;
30850-} diva_didd_remove_adapter_t;
30851+} __no_const diva_didd_remove_adapter_t;
30852 typedef struct _diva_didd_read_adapter_array {
30853 void * buffer;
30854 dword length;
30855diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
30856index db87d51..7d09acf 100644
30857--- a/drivers/isdn/hardware/eicon/idifunc.c
30858+++ b/drivers/isdn/hardware/eicon/idifunc.c
30859@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30860 IDI_SYNC_REQ req;
30861 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30862
30863+ pax_track_stack();
30864+
30865 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30866
30867 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30868diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
30869index a339598..b6a8bfc 100644
30870--- a/drivers/isdn/hardware/eicon/message.c
30871+++ b/drivers/isdn/hardware/eicon/message.c
30872@@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci)
30873 dword d;
30874 word w;
30875
30876+ pax_track_stack();
30877+
30878 a = plci->adapter;
30879 Id = ((word)plci->Id<<8)|a->Id;
30880 PUT_WORD(&SS_Ind[4],0x0000);
30881@@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
30882 word j, n, w;
30883 dword d;
30884
30885+ pax_track_stack();
30886+
30887
30888 for(i=0;i<8;i++) bp_parms[i].length = 0;
30889 for(i=0;i<2;i++) global_config[i].length = 0;
30890@@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
30891 const byte llc3[] = {4,3,2,2,6,6,0};
30892 const byte header[] = {0,2,3,3,0,0,0};
30893
30894+ pax_track_stack();
30895+
30896 for(i=0;i<8;i++) bp_parms[i].length = 0;
30897 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
30898 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
30899@@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
30900 word appl_number_group_type[MAX_APPL];
30901 PLCI *auxplci;
30902
30903+ pax_track_stack();
30904+
30905 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
30906
30907 if(!a->group_optimization_enabled)
30908diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
30909index a564b75..f3cf8b5 100644
30910--- a/drivers/isdn/hardware/eicon/mntfunc.c
30911+++ b/drivers/isdn/hardware/eicon/mntfunc.c
30912@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30913 IDI_SYNC_REQ req;
30914 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30915
30916+ pax_track_stack();
30917+
30918 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30919
30920 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30921diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
30922index a3bd163..8956575 100644
30923--- a/drivers/isdn/hardware/eicon/xdi_adapter.h
30924+++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
30925@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
30926 typedef struct _diva_os_idi_adapter_interface {
30927 diva_init_card_proc_t cleanup_adapter_proc;
30928 diva_cmd_card_proc_t cmd_proc;
30929-} diva_os_idi_adapter_interface_t;
30930+} __no_const diva_os_idi_adapter_interface_t;
30931
30932 typedef struct _diva_os_xdi_adapter {
30933 struct list_head link;
30934diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
30935index 6ed82ad..b05ac05 100644
30936--- a/drivers/isdn/i4l/isdn_common.c
30937+++ b/drivers/isdn/i4l/isdn_common.c
30938@@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
30939 } iocpar;
30940 void __user *argp = (void __user *)arg;
30941
30942+ pax_track_stack();
30943+
30944 #define name iocpar.name
30945 #define bname iocpar.bname
30946 #define iocts iocpar.iocts
30947diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
30948index 1f355bb..43f1fea 100644
30949--- a/drivers/isdn/icn/icn.c
30950+++ b/drivers/isdn/icn/icn.c
30951@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
30952 if (count > len)
30953 count = len;
30954 if (user) {
30955- if (copy_from_user(msg, buf, count))
30956+ if (count > sizeof msg || copy_from_user(msg, buf, count))
30957 return -EFAULT;
30958 } else
30959 memcpy(msg, buf, count);
30960diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
30961index 2535933..09a8e86 100644
30962--- a/drivers/lguest/core.c
30963+++ b/drivers/lguest/core.c
30964@@ -92,9 +92,17 @@ static __init int map_switcher(void)
30965 * it's worked so far. The end address needs +1 because __get_vm_area
30966 * allocates an extra guard page, so we need space for that.
30967 */
30968+
30969+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
30970+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
30971+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
30972+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
30973+#else
30974 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
30975 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
30976 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
30977+#endif
30978+
30979 if (!switcher_vma) {
30980 err = -ENOMEM;
30981 printk("lguest: could not map switcher pages high\n");
30982@@ -119,7 +127,7 @@ static __init int map_switcher(void)
30983 * Now the Switcher is mapped at the right address, we can't fail!
30984 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
30985 */
30986- memcpy(switcher_vma->addr, start_switcher_text,
30987+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
30988 end_switcher_text - start_switcher_text);
30989
30990 printk(KERN_INFO "lguest: mapped switcher at %p\n",
30991diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
30992index 65af42f..530c87a 100644
30993--- a/drivers/lguest/x86/core.c
30994+++ b/drivers/lguest/x86/core.c
30995@@ -59,7 +59,7 @@ static struct {
30996 /* Offset from where switcher.S was compiled to where we've copied it */
30997 static unsigned long switcher_offset(void)
30998 {
30999- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31000+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31001 }
31002
31003 /* This cpu's struct lguest_pages. */
31004@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
31005 * These copies are pretty cheap, so we do them unconditionally: */
31006 /* Save the current Host top-level page directory.
31007 */
31008+
31009+#ifdef CONFIG_PAX_PER_CPU_PGD
31010+ pages->state.host_cr3 = read_cr3();
31011+#else
31012 pages->state.host_cr3 = __pa(current->mm->pgd);
31013+#endif
31014+
31015 /*
31016 * Set up the Guest's page tables to see this CPU's pages (and no
31017 * other CPU's pages).
31018@@ -472,7 +478,7 @@ void __init lguest_arch_host_init(void)
31019 * compiled-in switcher code and the high-mapped copy we just made.
31020 */
31021 for (i = 0; i < IDT_ENTRIES; i++)
31022- default_idt_entries[i] += switcher_offset();
31023+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31024
31025 /*
31026 * Set up the Switcher's per-cpu areas.
31027@@ -555,7 +561,7 @@ void __init lguest_arch_host_init(void)
31028 * it will be undisturbed when we switch. To change %cs and jump we
31029 * need this structure to feed to Intel's "lcall" instruction.
31030 */
31031- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31032+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31033 lguest_entry.segment = LGUEST_CS;
31034
31035 /*
31036diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
31037index 40634b0..4f5855e 100644
31038--- a/drivers/lguest/x86/switcher_32.S
31039+++ b/drivers/lguest/x86/switcher_32.S
31040@@ -87,6 +87,7 @@
31041 #include <asm/page.h>
31042 #include <asm/segment.h>
31043 #include <asm/lguest.h>
31044+#include <asm/processor-flags.h>
31045
31046 // We mark the start of the code to copy
31047 // It's placed in .text tho it's never run here
31048@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31049 // Changes type when we load it: damn Intel!
31050 // For after we switch over our page tables
31051 // That entry will be read-only: we'd crash.
31052+
31053+#ifdef CONFIG_PAX_KERNEXEC
31054+ mov %cr0, %edx
31055+ xor $X86_CR0_WP, %edx
31056+ mov %edx, %cr0
31057+#endif
31058+
31059 movl $(GDT_ENTRY_TSS*8), %edx
31060 ltr %dx
31061
31062@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31063 // Let's clear it again for our return.
31064 // The GDT descriptor of the Host
31065 // Points to the table after two "size" bytes
31066- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31067+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31068 // Clear "used" from type field (byte 5, bit 2)
31069- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31070+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31071+
31072+#ifdef CONFIG_PAX_KERNEXEC
31073+ mov %cr0, %eax
31074+ xor $X86_CR0_WP, %eax
31075+ mov %eax, %cr0
31076+#endif
31077
31078 // Once our page table's switched, the Guest is live!
31079 // The Host fades as we run this final step.
31080@@ -295,13 +309,12 @@ deliver_to_host:
31081 // I consulted gcc, and it gave
31082 // These instructions, which I gladly credit:
31083 leal (%edx,%ebx,8), %eax
31084- movzwl (%eax),%edx
31085- movl 4(%eax), %eax
31086- xorw %ax, %ax
31087- orl %eax, %edx
31088+ movl 4(%eax), %edx
31089+ movw (%eax), %dx
31090 // Now the address of the handler's in %edx
31091 // We call it now: its "iret" drops us home.
31092- jmp *%edx
31093+ ljmp $__KERNEL_CS, $1f
31094+1: jmp *%edx
31095
31096 // Every interrupt can come to us here
31097 // But we must truly tell each apart.
31098diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
31099index 4daf9e5..b8d1d0f 100644
31100--- a/drivers/macintosh/macio_asic.c
31101+++ b/drivers/macintosh/macio_asic.c
31102@@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
31103 * MacIO is matched against any Apple ID, it's probe() function
31104 * will then decide wether it applies or not
31105 */
31106-static const struct pci_device_id __devinitdata pci_ids [] = { {
31107+static const struct pci_device_id __devinitconst pci_ids [] = { {
31108 .vendor = PCI_VENDOR_ID_APPLE,
31109 .device = PCI_ANY_ID,
31110 .subvendor = PCI_ANY_ID,
31111diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
31112index 2e9a3ca..c2fb229 100644
31113--- a/drivers/md/dm-ioctl.c
31114+++ b/drivers/md/dm-ioctl.c
31115@@ -1578,7 +1578,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
31116 cmd == DM_LIST_VERSIONS_CMD)
31117 return 0;
31118
31119- if ((cmd == DM_DEV_CREATE_CMD)) {
31120+ if (cmd == DM_DEV_CREATE_CMD) {
31121 if (!*param->name) {
31122 DMWARN("name not supplied when creating device");
31123 return -EINVAL;
31124diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
31125index 9bfd057..01180bc 100644
31126--- a/drivers/md/dm-raid1.c
31127+++ b/drivers/md/dm-raid1.c
31128@@ -40,7 +40,7 @@ enum dm_raid1_error {
31129
31130 struct mirror {
31131 struct mirror_set *ms;
31132- atomic_t error_count;
31133+ atomic_unchecked_t error_count;
31134 unsigned long error_type;
31135 struct dm_dev *dev;
31136 sector_t offset;
31137@@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
31138 struct mirror *m;
31139
31140 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31141- if (!atomic_read(&m->error_count))
31142+ if (!atomic_read_unchecked(&m->error_count))
31143 return m;
31144
31145 return NULL;
31146@@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
31147 * simple way to tell if a device has encountered
31148 * errors.
31149 */
31150- atomic_inc(&m->error_count);
31151+ atomic_inc_unchecked(&m->error_count);
31152
31153 if (test_and_set_bit(error_type, &m->error_type))
31154 return;
31155@@ -408,7 +408,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
31156 struct mirror *m = get_default_mirror(ms);
31157
31158 do {
31159- if (likely(!atomic_read(&m->error_count)))
31160+ if (likely(!atomic_read_unchecked(&m->error_count)))
31161 return m;
31162
31163 if (m-- == ms->mirror)
31164@@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
31165 {
31166 struct mirror *default_mirror = get_default_mirror(m->ms);
31167
31168- return !atomic_read(&default_mirror->error_count);
31169+ return !atomic_read_unchecked(&default_mirror->error_count);
31170 }
31171
31172 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31173@@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
31174 */
31175 if (likely(region_in_sync(ms, region, 1)))
31176 m = choose_mirror(ms, bio->bi_sector);
31177- else if (m && atomic_read(&m->error_count))
31178+ else if (m && atomic_read_unchecked(&m->error_count))
31179 m = NULL;
31180
31181 if (likely(m))
31182@@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
31183 }
31184
31185 ms->mirror[mirror].ms = ms;
31186- atomic_set(&(ms->mirror[mirror].error_count), 0);
31187+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31188 ms->mirror[mirror].error_type = 0;
31189 ms->mirror[mirror].offset = offset;
31190
31191@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_target *ti)
31192 */
31193 static char device_status_char(struct mirror *m)
31194 {
31195- if (!atomic_read(&(m->error_count)))
31196+ if (!atomic_read_unchecked(&(m->error_count)))
31197 return 'A';
31198
31199 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
31200diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
31201index 3d80cf0..b77cc47 100644
31202--- a/drivers/md/dm-stripe.c
31203+++ b/drivers/md/dm-stripe.c
31204@@ -20,7 +20,7 @@ struct stripe {
31205 struct dm_dev *dev;
31206 sector_t physical_start;
31207
31208- atomic_t error_count;
31209+ atomic_unchecked_t error_count;
31210 };
31211
31212 struct stripe_c {
31213@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
31214 kfree(sc);
31215 return r;
31216 }
31217- atomic_set(&(sc->stripe[i].error_count), 0);
31218+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31219 }
31220
31221 ti->private = sc;
31222@@ -314,7 +314,7 @@ static int stripe_status(struct dm_target *ti,
31223 DMEMIT("%d ", sc->stripes);
31224 for (i = 0; i < sc->stripes; i++) {
31225 DMEMIT("%s ", sc->stripe[i].dev->name);
31226- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31227+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31228 'D' : 'A';
31229 }
31230 buffer[i] = '\0';
31231@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
31232 */
31233 for (i = 0; i < sc->stripes; i++)
31234 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31235- atomic_inc(&(sc->stripe[i].error_count));
31236- if (atomic_read(&(sc->stripe[i].error_count)) <
31237+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31238+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31239 DM_IO_ERROR_THRESHOLD)
31240 schedule_work(&sc->trigger_event);
31241 }
31242diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
31243index bc04518..7a83b81 100644
31244--- a/drivers/md/dm-table.c
31245+++ b/drivers/md/dm-table.c
31246@@ -389,7 +389,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
31247 if (!dev_size)
31248 return 0;
31249
31250- if ((start >= dev_size) || (start + len > dev_size)) {
31251+ if ((start >= dev_size) || (len > dev_size - start)) {
31252 DMWARN("%s: %s too small for target: "
31253 "start=%llu, len=%llu, dev_size=%llu",
31254 dm_device_name(ti->table->md), bdevname(bdev, b),
31255diff --git a/drivers/md/dm.c b/drivers/md/dm.c
31256index 52b39f3..83a8b6b 100644
31257--- a/drivers/md/dm.c
31258+++ b/drivers/md/dm.c
31259@@ -165,9 +165,9 @@ struct mapped_device {
31260 /*
31261 * Event handling.
31262 */
31263- atomic_t event_nr;
31264+ atomic_unchecked_t event_nr;
31265 wait_queue_head_t eventq;
31266- atomic_t uevent_seq;
31267+ atomic_unchecked_t uevent_seq;
31268 struct list_head uevent_list;
31269 spinlock_t uevent_lock; /* Protect access to uevent_list */
31270
31271@@ -1843,8 +1843,8 @@ static struct mapped_device *alloc_dev(int minor)
31272 rwlock_init(&md->map_lock);
31273 atomic_set(&md->holders, 1);
31274 atomic_set(&md->open_count, 0);
31275- atomic_set(&md->event_nr, 0);
31276- atomic_set(&md->uevent_seq, 0);
31277+ atomic_set_unchecked(&md->event_nr, 0);
31278+ atomic_set_unchecked(&md->uevent_seq, 0);
31279 INIT_LIST_HEAD(&md->uevent_list);
31280 spin_lock_init(&md->uevent_lock);
31281
31282@@ -1978,7 +1978,7 @@ static void event_callback(void *context)
31283
31284 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31285
31286- atomic_inc(&md->event_nr);
31287+ atomic_inc_unchecked(&md->event_nr);
31288 wake_up(&md->eventq);
31289 }
31290
31291@@ -2614,18 +2614,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
31292
31293 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31294 {
31295- return atomic_add_return(1, &md->uevent_seq);
31296+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31297 }
31298
31299 uint32_t dm_get_event_nr(struct mapped_device *md)
31300 {
31301- return atomic_read(&md->event_nr);
31302+ return atomic_read_unchecked(&md->event_nr);
31303 }
31304
31305 int dm_wait_event(struct mapped_device *md, int event_nr)
31306 {
31307 return wait_event_interruptible(md->eventq,
31308- (event_nr != atomic_read(&md->event_nr)));
31309+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31310 }
31311
31312 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31313diff --git a/drivers/md/md.c b/drivers/md/md.c
31314index 5c95ccb..217fa57 100644
31315--- a/drivers/md/md.c
31316+++ b/drivers/md/md.c
31317@@ -280,10 +280,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
31318 * start build, activate spare
31319 */
31320 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31321-static atomic_t md_event_count;
31322+static atomic_unchecked_t md_event_count;
31323 void md_new_event(mddev_t *mddev)
31324 {
31325- atomic_inc(&md_event_count);
31326+ atomic_inc_unchecked(&md_event_count);
31327 wake_up(&md_event_waiters);
31328 }
31329 EXPORT_SYMBOL_GPL(md_new_event);
31330@@ -293,7 +293,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31331 */
31332 static void md_new_event_inintr(mddev_t *mddev)
31333 {
31334- atomic_inc(&md_event_count);
31335+ atomic_inc_unchecked(&md_event_count);
31336 wake_up(&md_event_waiters);
31337 }
31338
31339@@ -1531,7 +1531,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
31340
31341 rdev->preferred_minor = 0xffff;
31342 rdev->data_offset = le64_to_cpu(sb->data_offset);
31343- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31344+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31345
31346 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31347 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
31348@@ -1748,7 +1748,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
31349 else
31350 sb->resync_offset = cpu_to_le64(0);
31351
31352- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31353+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31354
31355 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31356 sb->size = cpu_to_le64(mddev->dev_sectors);
31357@@ -2643,7 +2643,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
31358 static ssize_t
31359 errors_show(mdk_rdev_t *rdev, char *page)
31360 {
31361- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31362+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31363 }
31364
31365 static ssize_t
31366@@ -2652,7 +2652,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
31367 char *e;
31368 unsigned long n = simple_strtoul(buf, &e, 10);
31369 if (*buf && (*e == 0 || *e == '\n')) {
31370- atomic_set(&rdev->corrected_errors, n);
31371+ atomic_set_unchecked(&rdev->corrected_errors, n);
31372 return len;
31373 }
31374 return -EINVAL;
31375@@ -3042,8 +3042,8 @@ int md_rdev_init(mdk_rdev_t *rdev)
31376 rdev->sb_loaded = 0;
31377 rdev->bb_page = NULL;
31378 atomic_set(&rdev->nr_pending, 0);
31379- atomic_set(&rdev->read_errors, 0);
31380- atomic_set(&rdev->corrected_errors, 0);
31381+ atomic_set_unchecked(&rdev->read_errors, 0);
31382+ atomic_set_unchecked(&rdev->corrected_errors, 0);
31383
31384 INIT_LIST_HEAD(&rdev->same_set);
31385 init_waitqueue_head(&rdev->blocked_wait);
31386@@ -6667,7 +6667,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31387
31388 spin_unlock(&pers_lock);
31389 seq_printf(seq, "\n");
31390- seq->poll_event = atomic_read(&md_event_count);
31391+ seq->poll_event = atomic_read_unchecked(&md_event_count);
31392 return 0;
31393 }
31394 if (v == (void*)2) {
31395@@ -6756,7 +6756,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31396 chunk_kb ? "KB" : "B");
31397 if (bitmap->file) {
31398 seq_printf(seq, ", file: ");
31399- seq_path(seq, &bitmap->file->f_path, " \t\n");
31400+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31401 }
31402
31403 seq_printf(seq, "\n");
31404@@ -6787,7 +6787,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
31405 return error;
31406
31407 seq = file->private_data;
31408- seq->poll_event = atomic_read(&md_event_count);
31409+ seq->poll_event = atomic_read_unchecked(&md_event_count);
31410 return error;
31411 }
31412
31413@@ -6801,7 +6801,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
31414 /* always allow read */
31415 mask = POLLIN | POLLRDNORM;
31416
31417- if (seq->poll_event != atomic_read(&md_event_count))
31418+ if (seq->poll_event != atomic_read_unchecked(&md_event_count))
31419 mask |= POLLERR | POLLPRI;
31420 return mask;
31421 }
31422@@ -6845,7 +6845,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
31423 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
31424 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
31425 (int)part_stat_read(&disk->part0, sectors[1]) -
31426- atomic_read(&disk->sync_io);
31427+ atomic_read_unchecked(&disk->sync_io);
31428 /* sync IO will cause sync_io to increase before the disk_stats
31429 * as sync_io is counted when a request starts, and
31430 * disk_stats is counted when it completes.
31431diff --git a/drivers/md/md.h b/drivers/md/md.h
31432index 0a309dc..7e01d7f 100644
31433--- a/drivers/md/md.h
31434+++ b/drivers/md/md.h
31435@@ -124,13 +124,13 @@ struct mdk_rdev_s
31436 * only maintained for arrays that
31437 * support hot removal
31438 */
31439- atomic_t read_errors; /* number of consecutive read errors that
31440+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
31441 * we have tried to ignore.
31442 */
31443 struct timespec last_read_error; /* monotonic time since our
31444 * last read error
31445 */
31446- atomic_t corrected_errors; /* number of corrected read errors,
31447+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
31448 * for reporting to userspace and storing
31449 * in superblock.
31450 */
31451@@ -415,7 +415,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
31452
31453 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
31454 {
31455- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31456+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31457 }
31458
31459 struct mdk_personality
31460diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
31461index d9587df..83a0dc3 100644
31462--- a/drivers/md/raid1.c
31463+++ b/drivers/md/raid1.c
31464@@ -1541,7 +1541,7 @@ static int fix_sync_read_error(r1bio_t *r1_bio)
31465 if (r1_sync_page_io(rdev, sect, s,
31466 bio->bi_io_vec[idx].bv_page,
31467 READ) != 0)
31468- atomic_add(s, &rdev->corrected_errors);
31469+ atomic_add_unchecked(s, &rdev->corrected_errors);
31470 }
31471 sectors -= s;
31472 sect += s;
31473@@ -1754,7 +1754,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
31474 test_bit(In_sync, &rdev->flags)) {
31475 if (r1_sync_page_io(rdev, sect, s,
31476 conf->tmppage, READ)) {
31477- atomic_add(s, &rdev->corrected_errors);
31478+ atomic_add_unchecked(s, &rdev->corrected_errors);
31479 printk(KERN_INFO
31480 "md/raid1:%s: read error corrected "
31481 "(%d sectors at %llu on %s)\n",
31482diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
31483index 1d44228..98db57d 100644
31484--- a/drivers/md/raid10.c
31485+++ b/drivers/md/raid10.c
31486@@ -1423,7 +1423,7 @@ static void end_sync_read(struct bio *bio, int error)
31487 /* The write handler will notice the lack of
31488 * R10BIO_Uptodate and record any errors etc
31489 */
31490- atomic_add(r10_bio->sectors,
31491+ atomic_add_unchecked(r10_bio->sectors,
31492 &conf->mirrors[d].rdev->corrected_errors);
31493
31494 /* for reconstruct, we always reschedule after a read.
31495@@ -1723,7 +1723,7 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31496 {
31497 struct timespec cur_time_mon;
31498 unsigned long hours_since_last;
31499- unsigned int read_errors = atomic_read(&rdev->read_errors);
31500+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
31501
31502 ktime_get_ts(&cur_time_mon);
31503
31504@@ -1745,9 +1745,9 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31505 * overflowing the shift of read_errors by hours_since_last.
31506 */
31507 if (hours_since_last >= 8 * sizeof(read_errors))
31508- atomic_set(&rdev->read_errors, 0);
31509+ atomic_set_unchecked(&rdev->read_errors, 0);
31510 else
31511- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
31512+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
31513 }
31514
31515 static int r10_sync_page_io(mdk_rdev_t *rdev, sector_t sector,
31516@@ -1797,8 +1797,8 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31517 return;
31518
31519 check_decay_read_errors(mddev, rdev);
31520- atomic_inc(&rdev->read_errors);
31521- if (atomic_read(&rdev->read_errors) > max_read_errors) {
31522+ atomic_inc_unchecked(&rdev->read_errors);
31523+ if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
31524 char b[BDEVNAME_SIZE];
31525 bdevname(rdev->bdev, b);
31526
31527@@ -1806,7 +1806,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31528 "md/raid10:%s: %s: Raid device exceeded "
31529 "read_error threshold [cur %d:max %d]\n",
31530 mdname(mddev), b,
31531- atomic_read(&rdev->read_errors), max_read_errors);
31532+ atomic_read_unchecked(&rdev->read_errors), max_read_errors);
31533 printk(KERN_NOTICE
31534 "md/raid10:%s: %s: Failing raid device\n",
31535 mdname(mddev), b);
31536@@ -1951,7 +1951,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31537 (unsigned long long)(
31538 sect + rdev->data_offset),
31539 bdevname(rdev->bdev, b));
31540- atomic_add(s, &rdev->corrected_errors);
31541+ atomic_add_unchecked(s, &rdev->corrected_errors);
31542 }
31543
31544 rdev_dec_pending(rdev, mddev);
31545diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
31546index b6200c3..02e8702 100644
31547--- a/drivers/md/raid5.c
31548+++ b/drivers/md/raid5.c
31549@@ -1616,19 +1616,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
31550 (unsigned long long)(sh->sector
31551 + rdev->data_offset),
31552 bdevname(rdev->bdev, b));
31553- atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
31554+ atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
31555 clear_bit(R5_ReadError, &sh->dev[i].flags);
31556 clear_bit(R5_ReWrite, &sh->dev[i].flags);
31557 }
31558- if (atomic_read(&conf->disks[i].rdev->read_errors))
31559- atomic_set(&conf->disks[i].rdev->read_errors, 0);
31560+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
31561+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
31562 } else {
31563 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
31564 int retry = 0;
31565 rdev = conf->disks[i].rdev;
31566
31567 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
31568- atomic_inc(&rdev->read_errors);
31569+ atomic_inc_unchecked(&rdev->read_errors);
31570 if (conf->mddev->degraded >= conf->max_degraded)
31571 printk_ratelimited(
31572 KERN_WARNING
31573@@ -1648,7 +1648,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
31574 (unsigned long long)(sh->sector
31575 + rdev->data_offset),
31576 bdn);
31577- else if (atomic_read(&rdev->read_errors)
31578+ else if (atomic_read_unchecked(&rdev->read_errors)
31579 > conf->max_nr_stripes)
31580 printk(KERN_WARNING
31581 "md/raid:%s: Too many read errors, failing device %s.\n",
31582@@ -1978,6 +1978,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
31583 sector_t r_sector;
31584 struct stripe_head sh2;
31585
31586+ pax_track_stack();
31587
31588 chunk_offset = sector_div(new_sector, sectors_per_chunk);
31589 stripe = new_sector;
31590diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
31591index 1d1d8d2..6c6837a 100644
31592--- a/drivers/media/common/saa7146_hlp.c
31593+++ b/drivers/media/common/saa7146_hlp.c
31594@@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
31595
31596 int x[32], y[32], w[32], h[32];
31597
31598+ pax_track_stack();
31599+
31600 /* clear out memory */
31601 memset(&line_list[0], 0x00, sizeof(u32)*32);
31602 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
31603diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c
31604index 573d540..16f78f3 100644
31605--- a/drivers/media/dvb/ddbridge/ddbridge-core.c
31606+++ b/drivers/media/dvb/ddbridge/ddbridge-core.c
31607@@ -1675,7 +1675,7 @@ static struct ddb_info ddb_v6 = {
31608 .subvendor = _subvend, .subdevice = _subdev, \
31609 .driver_data = (unsigned long)&_driverdata }
31610
31611-static const struct pci_device_id ddb_id_tbl[] __devinitdata = {
31612+static const struct pci_device_id ddb_id_tbl[] __devinitconst = {
31613 DDB_ID(DDVID, 0x0002, DDVID, 0x0001, ddb_octopus),
31614 DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus),
31615 DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le),
31616diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31617index 7ea517b..252fe54 100644
31618--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31619+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31620@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
31621 u8 buf[HOST_LINK_BUF_SIZE];
31622 int i;
31623
31624+ pax_track_stack();
31625+
31626 dprintk("%s\n", __func__);
31627
31628 /* check if we have space for a link buf in the rx_buffer */
31629@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
31630 unsigned long timeout;
31631 int written;
31632
31633+ pax_track_stack();
31634+
31635 dprintk("%s\n", __func__);
31636
31637 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
31638diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
31639index a7d876f..8c21b61 100644
31640--- a/drivers/media/dvb/dvb-core/dvb_demux.h
31641+++ b/drivers/media/dvb/dvb-core/dvb_demux.h
31642@@ -73,7 +73,7 @@ struct dvb_demux_feed {
31643 union {
31644 dmx_ts_cb ts;
31645 dmx_section_cb sec;
31646- } cb;
31647+ } __no_const cb;
31648
31649 struct dvb_demux *demux;
31650 void *priv;
31651diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
31652index f732877..d38c35a 100644
31653--- a/drivers/media/dvb/dvb-core/dvbdev.c
31654+++ b/drivers/media/dvb/dvb-core/dvbdev.c
31655@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
31656 const struct dvb_device *template, void *priv, int type)
31657 {
31658 struct dvb_device *dvbdev;
31659- struct file_operations *dvbdevfops;
31660+ file_operations_no_const *dvbdevfops;
31661 struct device *clsdev;
31662 int minor;
31663 int id;
31664diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
31665index acb5fb2..2413f1d 100644
31666--- a/drivers/media/dvb/dvb-usb/cxusb.c
31667+++ b/drivers/media/dvb/dvb-usb/cxusb.c
31668@@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
31669 struct dib0700_adapter_state {
31670 int (*set_param_save) (struct dvb_frontend *,
31671 struct dvb_frontend_parameters *);
31672-};
31673+} __no_const;
31674
31675 static int dib7070_set_param_override(struct dvb_frontend *fe,
31676 struct dvb_frontend_parameters *fep)
31677diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
31678index a224e94..503b76a 100644
31679--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
31680+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
31681@@ -478,6 +478,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
31682 if (!buf)
31683 return -ENOMEM;
31684
31685+ pax_track_stack();
31686+
31687 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
31688 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
31689 hx.addr, hx.len, hx.chk);
31690diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
31691index 058b231..183d2b3 100644
31692--- a/drivers/media/dvb/dvb-usb/dw2102.c
31693+++ b/drivers/media/dvb/dvb-usb/dw2102.c
31694@@ -95,7 +95,7 @@ struct su3000_state {
31695
31696 struct s6x0_state {
31697 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
31698-};
31699+} __no_const;
31700
31701 /* debug */
31702 static int dvb_usb_dw2102_debug;
31703diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c
31704index 37b1469..28a6f6f 100644
31705--- a/drivers/media/dvb/dvb-usb/lmedm04.c
31706+++ b/drivers/media/dvb/dvb-usb/lmedm04.c
31707@@ -742,6 +742,7 @@ static int lme2510_download_firmware(struct usb_device *dev,
31708 usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
31709 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000);
31710
31711+ pax_track_stack();
31712
31713 data[0] = 0x8a;
31714 len_in = 1;
31715@@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_device *dev)
31716 int ret = 0, len_in;
31717 u8 data[512] = {0};
31718
31719+ pax_track_stack();
31720+
31721 data[0] = 0x0a;
31722 len_in = 1;
31723 info("FRM Firmware Cold Reset");
31724diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
31725index ba91735..4261d84 100644
31726--- a/drivers/media/dvb/frontends/dib3000.h
31727+++ b/drivers/media/dvb/frontends/dib3000.h
31728@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
31729 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
31730 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
31731 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
31732-};
31733+} __no_const;
31734
31735 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
31736 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
31737diff --git a/drivers/media/dvb/frontends/mb86a16.c b/drivers/media/dvb/frontends/mb86a16.c
31738index c283112..7f367a7 100644
31739--- a/drivers/media/dvb/frontends/mb86a16.c
31740+++ b/drivers/media/dvb/frontends/mb86a16.c
31741@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16_state *state)
31742 int ret = -1;
31743 int sync;
31744
31745+ pax_track_stack();
31746+
31747 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
31748
31749 fcp = 3000;
31750diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
31751index c709ce6..b3fe620 100644
31752--- a/drivers/media/dvb/frontends/or51211.c
31753+++ b/drivers/media/dvb/frontends/or51211.c
31754@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
31755 u8 tudata[585];
31756 int i;
31757
31758+ pax_track_stack();
31759+
31760 dprintk("Firmware is %zd bytes\n",fw->size);
31761
31762 /* Get eprom data */
31763diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
31764index 0564192..75b16f5 100644
31765--- a/drivers/media/dvb/ngene/ngene-cards.c
31766+++ b/drivers/media/dvb/ngene/ngene-cards.c
31767@@ -477,7 +477,7 @@ static struct ngene_info ngene_info_m780 = {
31768
31769 /****************************************************************************/
31770
31771-static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
31772+static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
31773 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
31774 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
31775 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
31776diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
31777index 16a089f..ab1667d 100644
31778--- a/drivers/media/radio/radio-cadet.c
31779+++ b/drivers/media/radio/radio-cadet.c
31780@@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
31781 unsigned char readbuf[RDS_BUFFER];
31782 int i = 0;
31783
31784+ if (count > RDS_BUFFER)
31785+ return -EFAULT;
31786 mutex_lock(&dev->lock);
31787 if (dev->rdsstat == 0) {
31788 dev->rdsstat = 1;
31789diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
31790index 9cde353..8c6a1c3 100644
31791--- a/drivers/media/video/au0828/au0828.h
31792+++ b/drivers/media/video/au0828/au0828.h
31793@@ -191,7 +191,7 @@ struct au0828_dev {
31794
31795 /* I2C */
31796 struct i2c_adapter i2c_adap;
31797- struct i2c_algorithm i2c_algo;
31798+ i2c_algorithm_no_const i2c_algo;
31799 struct i2c_client i2c_client;
31800 u32 i2c_rc;
31801
31802diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
31803index 9e2f870..22e3a08 100644
31804--- a/drivers/media/video/cx18/cx18-driver.c
31805+++ b/drivers/media/video/cx18/cx18-driver.c
31806@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
31807 struct i2c_client c;
31808 u8 eedata[256];
31809
31810+ pax_track_stack();
31811+
31812 memset(&c, 0, sizeof(c));
31813 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
31814 c.adapter = &cx->i2c_adap[0];
31815diff --git a/drivers/media/video/cx23885/cx23885-input.c b/drivers/media/video/cx23885/cx23885-input.c
31816index ce765e3..f9e1b04 100644
31817--- a/drivers/media/video/cx23885/cx23885-input.c
31818+++ b/drivers/media/video/cx23885/cx23885-input.c
31819@@ -53,6 +53,8 @@ static void cx23885_input_process_measurements(struct cx23885_dev *dev,
31820 bool handle = false;
31821 struct ir_raw_event ir_core_event[64];
31822
31823+ pax_track_stack();
31824+
31825 do {
31826 num = 0;
31827 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
31828diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
31829index 68d1240..46b32eb 100644
31830--- a/drivers/media/video/cx88/cx88-alsa.c
31831+++ b/drivers/media/video/cx88/cx88-alsa.c
31832@@ -766,7 +766,7 @@ static struct snd_kcontrol_new snd_cx88_alc_switch = {
31833 * Only boards with eeprom and byte 1 at eeprom=1 have it
31834 */
31835
31836-static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
31837+static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
31838 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
31839 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
31840 {0, }
31841diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31842index 9515f3a..c9ecb85 100644
31843--- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31844+++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31845@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
31846 u8 *eeprom;
31847 struct tveeprom tvdata;
31848
31849+ pax_track_stack();
31850+
31851 memset(&tvdata,0,sizeof(tvdata));
31852
31853 eeprom = pvr2_eeprom_fetch(hdw);
31854diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31855index 305e6aa..0143317 100644
31856--- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31857+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31858@@ -196,7 +196,7 @@ struct pvr2_hdw {
31859
31860 /* I2C stuff */
31861 struct i2c_adapter i2c_adap;
31862- struct i2c_algorithm i2c_algo;
31863+ i2c_algorithm_no_const i2c_algo;
31864 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
31865 int i2c_cx25840_hack_state;
31866 int i2c_linked;
31867diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
31868index f9f29cc..5a2e330 100644
31869--- a/drivers/media/video/saa7134/saa6752hs.c
31870+++ b/drivers/media/video/saa7134/saa6752hs.c
31871@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
31872 unsigned char localPAT[256];
31873 unsigned char localPMT[256];
31874
31875+ pax_track_stack();
31876+
31877 /* Set video format - must be done first as it resets other settings */
31878 set_reg8(client, 0x41, h->video_format);
31879
31880diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
31881index 62fac7f..f29e0b9 100644
31882--- a/drivers/media/video/saa7164/saa7164-cmd.c
31883+++ b/drivers/media/video/saa7164/saa7164-cmd.c
31884@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
31885 u8 tmp[512];
31886 dprintk(DBGLVL_CMD, "%s()\n", __func__);
31887
31888+ pax_track_stack();
31889+
31890 /* While any outstand message on the bus exists... */
31891 do {
31892
31893@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
31894 u8 tmp[512];
31895 dprintk(DBGLVL_CMD, "%s()\n", __func__);
31896
31897+ pax_track_stack();
31898+
31899 while (loop) {
31900
31901 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
31902diff --git a/drivers/media/video/timblogiw.c b/drivers/media/video/timblogiw.c
31903index 84cd1b6..f741e07 100644
31904--- a/drivers/media/video/timblogiw.c
31905+++ b/drivers/media/video/timblogiw.c
31906@@ -744,7 +744,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
31907
31908 /* Platform device functions */
31909
31910-static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
31911+static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
31912 .vidioc_querycap = timblogiw_querycap,
31913 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
31914 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
31915@@ -766,7 +766,7 @@ static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
31916 .vidioc_enum_framesizes = timblogiw_enum_framesizes,
31917 };
31918
31919-static __devinitconst struct v4l2_file_operations timblogiw_fops = {
31920+static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
31921 .owner = THIS_MODULE,
31922 .open = timblogiw_open,
31923 .release = timblogiw_close,
31924diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
31925index f344411..6ae9974 100644
31926--- a/drivers/media/video/usbvision/usbvision-core.c
31927+++ b/drivers/media/video/usbvision/usbvision-core.c
31928@@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_compress(struct usb_usbvision *usbvision
31929 unsigned char rv, gv, bv;
31930 static unsigned char *Y, *U, *V;
31931
31932+ pax_track_stack();
31933+
31934 frame = usbvision->cur_frame;
31935 image_size = frame->frmwidth * frame->frmheight;
31936 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
31937diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
31938index f300dea..04834ba 100644
31939--- a/drivers/media/video/videobuf-dma-sg.c
31940+++ b/drivers/media/video/videobuf-dma-sg.c
31941@@ -607,6 +607,8 @@ void *videobuf_sg_alloc(size_t size)
31942 {
31943 struct videobuf_queue q;
31944
31945+ pax_track_stack();
31946+
31947 /* Required to make generic handler to call __videobuf_alloc */
31948 q.int_ops = &sg_ops;
31949
31950diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
31951index 7956a10..f39232f 100644
31952--- a/drivers/message/fusion/mptbase.c
31953+++ b/drivers/message/fusion/mptbase.c
31954@@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
31955 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
31956 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
31957
31958+#ifdef CONFIG_GRKERNSEC_HIDESYM
31959+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
31960+#else
31961 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
31962 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
31963+#endif
31964+
31965 /*
31966 * Rounding UP to nearest 4-kB boundary here...
31967 */
31968diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
31969index 7596aec..f7ae9aa 100644
31970--- a/drivers/message/fusion/mptsas.c
31971+++ b/drivers/message/fusion/mptsas.c
31972@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
31973 return 0;
31974 }
31975
31976+static inline void
31977+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
31978+{
31979+ if (phy_info->port_details) {
31980+ phy_info->port_details->rphy = rphy;
31981+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
31982+ ioc->name, rphy));
31983+ }
31984+
31985+ if (rphy) {
31986+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
31987+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
31988+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
31989+ ioc->name, rphy, rphy->dev.release));
31990+ }
31991+}
31992+
31993 /* no mutex */
31994 static void
31995 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
31996@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
31997 return NULL;
31998 }
31999
32000-static inline void
32001-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32002-{
32003- if (phy_info->port_details) {
32004- phy_info->port_details->rphy = rphy;
32005- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32006- ioc->name, rphy));
32007- }
32008-
32009- if (rphy) {
32010- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32011- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32012- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32013- ioc->name, rphy, rphy->dev.release));
32014- }
32015-}
32016-
32017 static inline struct sas_port *
32018 mptsas_get_port(struct mptsas_phyinfo *phy_info)
32019 {
32020diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
32021index ce61a57..3da8862 100644
32022--- a/drivers/message/fusion/mptscsih.c
32023+++ b/drivers/message/fusion/mptscsih.c
32024@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
32025
32026 h = shost_priv(SChost);
32027
32028- if (h) {
32029- if (h->info_kbuf == NULL)
32030- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32031- return h->info_kbuf;
32032- h->info_kbuf[0] = '\0';
32033+ if (!h)
32034+ return NULL;
32035
32036- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32037- h->info_kbuf[size-1] = '\0';
32038- }
32039+ if (h->info_kbuf == NULL)
32040+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32041+ return h->info_kbuf;
32042+ h->info_kbuf[0] = '\0';
32043+
32044+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32045+ h->info_kbuf[size-1] = '\0';
32046
32047 return h->info_kbuf;
32048 }
32049diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
32050index 098de2b..fbb922c 100644
32051--- a/drivers/message/i2o/i2o_config.c
32052+++ b/drivers/message/i2o/i2o_config.c
32053@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned long arg)
32054 struct i2o_message *msg;
32055 unsigned int iop;
32056
32057+ pax_track_stack();
32058+
32059 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
32060 return -EFAULT;
32061
32062diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
32063index 07dbeaf..5533142 100644
32064--- a/drivers/message/i2o/i2o_proc.c
32065+++ b/drivers/message/i2o/i2o_proc.c
32066@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
32067 "Array Controller Device"
32068 };
32069
32070-static char *chtostr(u8 * chars, int n)
32071-{
32072- char tmp[256];
32073- tmp[0] = 0;
32074- return strncat(tmp, (char *)chars, n);
32075-}
32076-
32077 static int i2o_report_query_status(struct seq_file *seq, int block_status,
32078 char *group)
32079 {
32080@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
32081
32082 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
32083 seq_printf(seq, "%-#8x", ddm_table.module_id);
32084- seq_printf(seq, "%-29s",
32085- chtostr(ddm_table.module_name_version, 28));
32086+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
32087 seq_printf(seq, "%9d ", ddm_table.data_size);
32088 seq_printf(seq, "%8d", ddm_table.code_size);
32089
32090@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
32091
32092 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
32093 seq_printf(seq, "%-#8x", dst->module_id);
32094- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
32095- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
32096+ seq_printf(seq, "%-.28s", dst->module_name_version);
32097+ seq_printf(seq, "%-.8s", dst->date);
32098 seq_printf(seq, "%8d ", dst->module_size);
32099 seq_printf(seq, "%8d ", dst->mpb_size);
32100 seq_printf(seq, "0x%04x", dst->module_flags);
32101@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
32102 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
32103 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
32104 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
32105- seq_printf(seq, "Vendor info : %s\n",
32106- chtostr((u8 *) (work32 + 2), 16));
32107- seq_printf(seq, "Product info : %s\n",
32108- chtostr((u8 *) (work32 + 6), 16));
32109- seq_printf(seq, "Description : %s\n",
32110- chtostr((u8 *) (work32 + 10), 16));
32111- seq_printf(seq, "Product rev. : %s\n",
32112- chtostr((u8 *) (work32 + 14), 8));
32113+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
32114+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
32115+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
32116+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
32117
32118 seq_printf(seq, "Serial number : ");
32119 print_serial_number(seq, (u8 *) (work32 + 16),
32120@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
32121 }
32122
32123 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
32124- seq_printf(seq, "Module name : %s\n",
32125- chtostr(result.module_name, 24));
32126- seq_printf(seq, "Module revision : %s\n",
32127- chtostr(result.module_rev, 8));
32128+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
32129+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
32130
32131 seq_printf(seq, "Serial number : ");
32132 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
32133@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
32134 return 0;
32135 }
32136
32137- seq_printf(seq, "Device name : %s\n",
32138- chtostr(result.device_name, 64));
32139- seq_printf(seq, "Service name : %s\n",
32140- chtostr(result.service_name, 64));
32141- seq_printf(seq, "Physical name : %s\n",
32142- chtostr(result.physical_location, 64));
32143- seq_printf(seq, "Instance number : %s\n",
32144- chtostr(result.instance_number, 4));
32145+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
32146+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
32147+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
32148+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
32149
32150 return 0;
32151 }
32152diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
32153index a8c08f3..155fe3d 100644
32154--- a/drivers/message/i2o/iop.c
32155+++ b/drivers/message/i2o/iop.c
32156@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
32157
32158 spin_lock_irqsave(&c->context_list_lock, flags);
32159
32160- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
32161- atomic_inc(&c->context_list_counter);
32162+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
32163+ atomic_inc_unchecked(&c->context_list_counter);
32164
32165- entry->context = atomic_read(&c->context_list_counter);
32166+ entry->context = atomic_read_unchecked(&c->context_list_counter);
32167
32168 list_add(&entry->list, &c->context_list);
32169
32170@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(void)
32171
32172 #if BITS_PER_LONG == 64
32173 spin_lock_init(&c->context_list_lock);
32174- atomic_set(&c->context_list_counter, 0);
32175+ atomic_set_unchecked(&c->context_list_counter, 0);
32176 INIT_LIST_HEAD(&c->context_list);
32177 #endif
32178
32179diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
32180index a20e1c4..4f57255 100644
32181--- a/drivers/mfd/ab3100-core.c
32182+++ b/drivers/mfd/ab3100-core.c
32183@@ -809,7 +809,7 @@ struct ab_family_id {
32184 char *name;
32185 };
32186
32187-static const struct ab_family_id ids[] __devinitdata = {
32188+static const struct ab_family_id ids[] __devinitconst = {
32189 /* AB3100 */
32190 {
32191 .id = 0xc0,
32192diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
32193index f12720d..3c251fd 100644
32194--- a/drivers/mfd/abx500-core.c
32195+++ b/drivers/mfd/abx500-core.c
32196@@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list);
32197
32198 struct abx500_device_entry {
32199 struct list_head list;
32200- struct abx500_ops ops;
32201+ abx500_ops_no_const ops;
32202 struct device *dev;
32203 };
32204
32205diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
32206index 5c2a06a..8fa077c 100644
32207--- a/drivers/mfd/janz-cmodio.c
32208+++ b/drivers/mfd/janz-cmodio.c
32209@@ -13,6 +13,7 @@
32210
32211 #include <linux/kernel.h>
32212 #include <linux/module.h>
32213+#include <linux/slab.h>
32214 #include <linux/init.h>
32215 #include <linux/pci.h>
32216 #include <linux/interrupt.h>
32217diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
32218index 5fe5de1..af64f53 100644
32219--- a/drivers/mfd/wm8350-i2c.c
32220+++ b/drivers/mfd/wm8350-i2c.c
32221@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
32222 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
32223 int ret;
32224
32225+ pax_track_stack();
32226+
32227 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
32228 return -EINVAL;
32229
32230diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
32231index 8b51cd6..f628f8d 100644
32232--- a/drivers/misc/lis3lv02d/lis3lv02d.c
32233+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
32234@@ -437,7 +437,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
32235 * the lid is closed. This leads to interrupts as soon as a little move
32236 * is done.
32237 */
32238- atomic_inc(&lis3_dev.count);
32239+ atomic_inc_unchecked(&lis3_dev.count);
32240
32241 wake_up_interruptible(&lis3_dev.misc_wait);
32242 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
32243@@ -520,7 +520,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
32244 if (lis3_dev.pm_dev)
32245 pm_runtime_get_sync(lis3_dev.pm_dev);
32246
32247- atomic_set(&lis3_dev.count, 0);
32248+ atomic_set_unchecked(&lis3_dev.count, 0);
32249 return 0;
32250 }
32251
32252@@ -547,7 +547,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
32253 add_wait_queue(&lis3_dev.misc_wait, &wait);
32254 while (true) {
32255 set_current_state(TASK_INTERRUPTIBLE);
32256- data = atomic_xchg(&lis3_dev.count, 0);
32257+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
32258 if (data)
32259 break;
32260
32261@@ -585,7 +585,7 @@ out:
32262 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
32263 {
32264 poll_wait(file, &lis3_dev.misc_wait, wait);
32265- if (atomic_read(&lis3_dev.count))
32266+ if (atomic_read_unchecked(&lis3_dev.count))
32267 return POLLIN | POLLRDNORM;
32268 return 0;
32269 }
32270diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
32271index a193958..4d7ecd2 100644
32272--- a/drivers/misc/lis3lv02d/lis3lv02d.h
32273+++ b/drivers/misc/lis3lv02d/lis3lv02d.h
32274@@ -265,7 +265,7 @@ struct lis3lv02d {
32275 struct input_polled_dev *idev; /* input device */
32276 struct platform_device *pdev; /* platform device */
32277 struct regulator_bulk_data regulators[2];
32278- atomic_t count; /* interrupt count after last read */
32279+ atomic_unchecked_t count; /* interrupt count after last read */
32280 union axis_conversion ac; /* hw -> logical axis */
32281 int mapped_btns[3];
32282
32283diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
32284index 2f30bad..c4c13d0 100644
32285--- a/drivers/misc/sgi-gru/gruhandles.c
32286+++ b/drivers/misc/sgi-gru/gruhandles.c
32287@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
32288 unsigned long nsec;
32289
32290 nsec = CLKS2NSEC(clks);
32291- atomic_long_inc(&mcs_op_statistics[op].count);
32292- atomic_long_add(nsec, &mcs_op_statistics[op].total);
32293+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
32294+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
32295 if (mcs_op_statistics[op].max < nsec)
32296 mcs_op_statistics[op].max = nsec;
32297 }
32298diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
32299index 7768b87..f8aac38 100644
32300--- a/drivers/misc/sgi-gru/gruprocfs.c
32301+++ b/drivers/misc/sgi-gru/gruprocfs.c
32302@@ -32,9 +32,9 @@
32303
32304 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
32305
32306-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
32307+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
32308 {
32309- unsigned long val = atomic_long_read(v);
32310+ unsigned long val = atomic_long_read_unchecked(v);
32311
32312 seq_printf(s, "%16lu %s\n", val, id);
32313 }
32314@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
32315
32316 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
32317 for (op = 0; op < mcsop_last; op++) {
32318- count = atomic_long_read(&mcs_op_statistics[op].count);
32319- total = atomic_long_read(&mcs_op_statistics[op].total);
32320+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
32321+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
32322 max = mcs_op_statistics[op].max;
32323 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
32324 count ? total / count : 0, max);
32325diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
32326index 5c3ce24..4915ccb 100644
32327--- a/drivers/misc/sgi-gru/grutables.h
32328+++ b/drivers/misc/sgi-gru/grutables.h
32329@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
32330 * GRU statistics.
32331 */
32332 struct gru_stats_s {
32333- atomic_long_t vdata_alloc;
32334- atomic_long_t vdata_free;
32335- atomic_long_t gts_alloc;
32336- atomic_long_t gts_free;
32337- atomic_long_t gms_alloc;
32338- atomic_long_t gms_free;
32339- atomic_long_t gts_double_allocate;
32340- atomic_long_t assign_context;
32341- atomic_long_t assign_context_failed;
32342- atomic_long_t free_context;
32343- atomic_long_t load_user_context;
32344- atomic_long_t load_kernel_context;
32345- atomic_long_t lock_kernel_context;
32346- atomic_long_t unlock_kernel_context;
32347- atomic_long_t steal_user_context;
32348- atomic_long_t steal_kernel_context;
32349- atomic_long_t steal_context_failed;
32350- atomic_long_t nopfn;
32351- atomic_long_t asid_new;
32352- atomic_long_t asid_next;
32353- atomic_long_t asid_wrap;
32354- atomic_long_t asid_reuse;
32355- atomic_long_t intr;
32356- atomic_long_t intr_cbr;
32357- atomic_long_t intr_tfh;
32358- atomic_long_t intr_spurious;
32359- atomic_long_t intr_mm_lock_failed;
32360- atomic_long_t call_os;
32361- atomic_long_t call_os_wait_queue;
32362- atomic_long_t user_flush_tlb;
32363- atomic_long_t user_unload_context;
32364- atomic_long_t user_exception;
32365- atomic_long_t set_context_option;
32366- atomic_long_t check_context_retarget_intr;
32367- atomic_long_t check_context_unload;
32368- atomic_long_t tlb_dropin;
32369- atomic_long_t tlb_preload_page;
32370- atomic_long_t tlb_dropin_fail_no_asid;
32371- atomic_long_t tlb_dropin_fail_upm;
32372- atomic_long_t tlb_dropin_fail_invalid;
32373- atomic_long_t tlb_dropin_fail_range_active;
32374- atomic_long_t tlb_dropin_fail_idle;
32375- atomic_long_t tlb_dropin_fail_fmm;
32376- atomic_long_t tlb_dropin_fail_no_exception;
32377- atomic_long_t tfh_stale_on_fault;
32378- atomic_long_t mmu_invalidate_range;
32379- atomic_long_t mmu_invalidate_page;
32380- atomic_long_t flush_tlb;
32381- atomic_long_t flush_tlb_gru;
32382- atomic_long_t flush_tlb_gru_tgh;
32383- atomic_long_t flush_tlb_gru_zero_asid;
32384+ atomic_long_unchecked_t vdata_alloc;
32385+ atomic_long_unchecked_t vdata_free;
32386+ atomic_long_unchecked_t gts_alloc;
32387+ atomic_long_unchecked_t gts_free;
32388+ atomic_long_unchecked_t gms_alloc;
32389+ atomic_long_unchecked_t gms_free;
32390+ atomic_long_unchecked_t gts_double_allocate;
32391+ atomic_long_unchecked_t assign_context;
32392+ atomic_long_unchecked_t assign_context_failed;
32393+ atomic_long_unchecked_t free_context;
32394+ atomic_long_unchecked_t load_user_context;
32395+ atomic_long_unchecked_t load_kernel_context;
32396+ atomic_long_unchecked_t lock_kernel_context;
32397+ atomic_long_unchecked_t unlock_kernel_context;
32398+ atomic_long_unchecked_t steal_user_context;
32399+ atomic_long_unchecked_t steal_kernel_context;
32400+ atomic_long_unchecked_t steal_context_failed;
32401+ atomic_long_unchecked_t nopfn;
32402+ atomic_long_unchecked_t asid_new;
32403+ atomic_long_unchecked_t asid_next;
32404+ atomic_long_unchecked_t asid_wrap;
32405+ atomic_long_unchecked_t asid_reuse;
32406+ atomic_long_unchecked_t intr;
32407+ atomic_long_unchecked_t intr_cbr;
32408+ atomic_long_unchecked_t intr_tfh;
32409+ atomic_long_unchecked_t intr_spurious;
32410+ atomic_long_unchecked_t intr_mm_lock_failed;
32411+ atomic_long_unchecked_t call_os;
32412+ atomic_long_unchecked_t call_os_wait_queue;
32413+ atomic_long_unchecked_t user_flush_tlb;
32414+ atomic_long_unchecked_t user_unload_context;
32415+ atomic_long_unchecked_t user_exception;
32416+ atomic_long_unchecked_t set_context_option;
32417+ atomic_long_unchecked_t check_context_retarget_intr;
32418+ atomic_long_unchecked_t check_context_unload;
32419+ atomic_long_unchecked_t tlb_dropin;
32420+ atomic_long_unchecked_t tlb_preload_page;
32421+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
32422+ atomic_long_unchecked_t tlb_dropin_fail_upm;
32423+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
32424+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
32425+ atomic_long_unchecked_t tlb_dropin_fail_idle;
32426+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
32427+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
32428+ atomic_long_unchecked_t tfh_stale_on_fault;
32429+ atomic_long_unchecked_t mmu_invalidate_range;
32430+ atomic_long_unchecked_t mmu_invalidate_page;
32431+ atomic_long_unchecked_t flush_tlb;
32432+ atomic_long_unchecked_t flush_tlb_gru;
32433+ atomic_long_unchecked_t flush_tlb_gru_tgh;
32434+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
32435
32436- atomic_long_t copy_gpa;
32437- atomic_long_t read_gpa;
32438+ atomic_long_unchecked_t copy_gpa;
32439+ atomic_long_unchecked_t read_gpa;
32440
32441- atomic_long_t mesq_receive;
32442- atomic_long_t mesq_receive_none;
32443- atomic_long_t mesq_send;
32444- atomic_long_t mesq_send_failed;
32445- atomic_long_t mesq_noop;
32446- atomic_long_t mesq_send_unexpected_error;
32447- atomic_long_t mesq_send_lb_overflow;
32448- atomic_long_t mesq_send_qlimit_reached;
32449- atomic_long_t mesq_send_amo_nacked;
32450- atomic_long_t mesq_send_put_nacked;
32451- atomic_long_t mesq_page_overflow;
32452- atomic_long_t mesq_qf_locked;
32453- atomic_long_t mesq_qf_noop_not_full;
32454- atomic_long_t mesq_qf_switch_head_failed;
32455- atomic_long_t mesq_qf_unexpected_error;
32456- atomic_long_t mesq_noop_unexpected_error;
32457- atomic_long_t mesq_noop_lb_overflow;
32458- atomic_long_t mesq_noop_qlimit_reached;
32459- atomic_long_t mesq_noop_amo_nacked;
32460- atomic_long_t mesq_noop_put_nacked;
32461- atomic_long_t mesq_noop_page_overflow;
32462+ atomic_long_unchecked_t mesq_receive;
32463+ atomic_long_unchecked_t mesq_receive_none;
32464+ atomic_long_unchecked_t mesq_send;
32465+ atomic_long_unchecked_t mesq_send_failed;
32466+ atomic_long_unchecked_t mesq_noop;
32467+ atomic_long_unchecked_t mesq_send_unexpected_error;
32468+ atomic_long_unchecked_t mesq_send_lb_overflow;
32469+ atomic_long_unchecked_t mesq_send_qlimit_reached;
32470+ atomic_long_unchecked_t mesq_send_amo_nacked;
32471+ atomic_long_unchecked_t mesq_send_put_nacked;
32472+ atomic_long_unchecked_t mesq_page_overflow;
32473+ atomic_long_unchecked_t mesq_qf_locked;
32474+ atomic_long_unchecked_t mesq_qf_noop_not_full;
32475+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
32476+ atomic_long_unchecked_t mesq_qf_unexpected_error;
32477+ atomic_long_unchecked_t mesq_noop_unexpected_error;
32478+ atomic_long_unchecked_t mesq_noop_lb_overflow;
32479+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
32480+ atomic_long_unchecked_t mesq_noop_amo_nacked;
32481+ atomic_long_unchecked_t mesq_noop_put_nacked;
32482+ atomic_long_unchecked_t mesq_noop_page_overflow;
32483
32484 };
32485
32486@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
32487 tghop_invalidate, mcsop_last};
32488
32489 struct mcs_op_statistic {
32490- atomic_long_t count;
32491- atomic_long_t total;
32492+ atomic_long_unchecked_t count;
32493+ atomic_long_unchecked_t total;
32494 unsigned long max;
32495 };
32496
32497@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
32498
32499 #define STAT(id) do { \
32500 if (gru_options & OPT_STATS) \
32501- atomic_long_inc(&gru_stats.id); \
32502+ atomic_long_inc_unchecked(&gru_stats.id); \
32503 } while (0)
32504
32505 #ifdef CONFIG_SGI_GRU_DEBUG
32506diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
32507index 851b2f2..a4ec097 100644
32508--- a/drivers/misc/sgi-xp/xp.h
32509+++ b/drivers/misc/sgi-xp/xp.h
32510@@ -289,7 +289,7 @@ struct xpc_interface {
32511 xpc_notify_func, void *);
32512 void (*received) (short, int, void *);
32513 enum xp_retval (*partid_to_nasids) (short, void *);
32514-};
32515+} __no_const;
32516
32517 extern struct xpc_interface xpc_interface;
32518
32519diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
32520index b94d5f7..7f494c5 100644
32521--- a/drivers/misc/sgi-xp/xpc.h
32522+++ b/drivers/misc/sgi-xp/xpc.h
32523@@ -835,6 +835,7 @@ struct xpc_arch_operations {
32524 void (*received_payload) (struct xpc_channel *, void *);
32525 void (*notify_senders_of_disconnect) (struct xpc_channel *);
32526 };
32527+typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
32528
32529 /* struct xpc_partition act_state values (for XPC HB) */
32530
32531@@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
32532 /* found in xpc_main.c */
32533 extern struct device *xpc_part;
32534 extern struct device *xpc_chan;
32535-extern struct xpc_arch_operations xpc_arch_ops;
32536+extern xpc_arch_operations_no_const xpc_arch_ops;
32537 extern int xpc_disengage_timelimit;
32538 extern int xpc_disengage_timedout;
32539 extern int xpc_activate_IRQ_rcvd;
32540diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
32541index 8d082b4..aa749ae 100644
32542--- a/drivers/misc/sgi-xp/xpc_main.c
32543+++ b/drivers/misc/sgi-xp/xpc_main.c
32544@@ -162,7 +162,7 @@ static struct notifier_block xpc_die_notifier = {
32545 .notifier_call = xpc_system_die,
32546 };
32547
32548-struct xpc_arch_operations xpc_arch_ops;
32549+xpc_arch_operations_no_const xpc_arch_ops;
32550
32551 /*
32552 * Timer function to enforce the timelimit on the partition disengage.
32553diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
32554index 26c5286..292d261 100644
32555--- a/drivers/mmc/host/sdhci-pci.c
32556+++ b/drivers/mmc/host/sdhci-pci.c
32557@@ -542,7 +542,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
32558 .probe = via_probe,
32559 };
32560
32561-static const struct pci_device_id pci_ids[] __devinitdata = {
32562+static const struct pci_device_id pci_ids[] __devinitconst = {
32563 {
32564 .vendor = PCI_VENDOR_ID_RICOH,
32565 .device = PCI_DEVICE_ID_RICOH_R5C822,
32566diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
32567index e1e122f..d99a6ea 100644
32568--- a/drivers/mtd/chips/cfi_cmdset_0001.c
32569+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
32570@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
32571 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
32572 unsigned long timeo = jiffies + HZ;
32573
32574+ pax_track_stack();
32575+
32576 /* Prevent setting state FL_SYNCING for chip in suspended state. */
32577 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
32578 goto sleep;
32579@@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
32580 unsigned long initial_adr;
32581 int initial_len = len;
32582
32583+ pax_track_stack();
32584+
32585 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
32586 adr += chip->start;
32587 initial_adr = adr;
32588@@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
32589 int retries = 3;
32590 int ret;
32591
32592+ pax_track_stack();
32593+
32594 adr += chip->start;
32595
32596 retry:
32597diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
32598index 179814a..abe9d60 100644
32599--- a/drivers/mtd/chips/cfi_cmdset_0020.c
32600+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
32601@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
32602 unsigned long cmd_addr;
32603 struct cfi_private *cfi = map->fldrv_priv;
32604
32605+ pax_track_stack();
32606+
32607 adr += chip->start;
32608
32609 /* Ensure cmd read/writes are aligned. */
32610@@ -429,6 +431,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
32611 DECLARE_WAITQUEUE(wait, current);
32612 int wbufsize, z;
32613
32614+ pax_track_stack();
32615+
32616 /* M58LW064A requires bus alignment for buffer wriets -- saw */
32617 if (adr & (map_bankwidth(map)-1))
32618 return -EINVAL;
32619@@ -743,6 +747,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
32620 DECLARE_WAITQUEUE(wait, current);
32621 int ret = 0;
32622
32623+ pax_track_stack();
32624+
32625 adr += chip->start;
32626
32627 /* Let's determine this according to the interleave only once */
32628@@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
32629 unsigned long timeo = jiffies + HZ;
32630 DECLARE_WAITQUEUE(wait, current);
32631
32632+ pax_track_stack();
32633+
32634 adr += chip->start;
32635
32636 /* Let's determine this according to the interleave only once */
32637@@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
32638 unsigned long timeo = jiffies + HZ;
32639 DECLARE_WAITQUEUE(wait, current);
32640
32641+ pax_track_stack();
32642+
32643 adr += chip->start;
32644
32645 /* Let's determine this according to the interleave only once */
32646diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
32647index f7fbf60..9866457 100644
32648--- a/drivers/mtd/devices/doc2000.c
32649+++ b/drivers/mtd/devices/doc2000.c
32650@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
32651
32652 /* The ECC will not be calculated correctly if less than 512 is written */
32653 /* DBB-
32654- if (len != 0x200 && eccbuf)
32655+ if (len != 0x200)
32656 printk(KERN_WARNING
32657 "ECC needs a full sector write (adr: %lx size %lx)\n",
32658 (long) to, (long) len);
32659diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
32660index 241192f..d0c35a3 100644
32661--- a/drivers/mtd/devices/doc2001.c
32662+++ b/drivers/mtd/devices/doc2001.c
32663@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
32664 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
32665
32666 /* Don't allow read past end of device */
32667- if (from >= this->totlen)
32668+ if (from >= this->totlen || !len)
32669 return -EINVAL;
32670
32671 /* Don't allow a single read to cross a 512-byte block boundary */
32672diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
32673index 037b399..225a71d 100644
32674--- a/drivers/mtd/ftl.c
32675+++ b/drivers/mtd/ftl.c
32676@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
32677 loff_t offset;
32678 uint16_t srcunitswap = cpu_to_le16(srcunit);
32679
32680+ pax_track_stack();
32681+
32682 eun = &part->EUNInfo[srcunit];
32683 xfer = &part->XferInfo[xferunit];
32684 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
32685diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
32686index d7592e6..31c505c 100644
32687--- a/drivers/mtd/inftlcore.c
32688+++ b/drivers/mtd/inftlcore.c
32689@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
32690 struct inftl_oob oob;
32691 size_t retlen;
32692
32693+ pax_track_stack();
32694+
32695 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
32696 "pending=%d)\n", inftl, thisVUC, pendingblock);
32697
32698diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
32699index 104052e..6232be5 100644
32700--- a/drivers/mtd/inftlmount.c
32701+++ b/drivers/mtd/inftlmount.c
32702@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
32703 struct INFTLPartition *ip;
32704 size_t retlen;
32705
32706+ pax_track_stack();
32707+
32708 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
32709
32710 /*
32711diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
32712index dbfe17b..c7b0918 100644
32713--- a/drivers/mtd/lpddr/qinfo_probe.c
32714+++ b/drivers/mtd/lpddr/qinfo_probe.c
32715@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
32716 {
32717 map_word pfow_val[4];
32718
32719+ pax_track_stack();
32720+
32721 /* Check identification string */
32722 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
32723 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
32724diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
32725index 49e20a4..60fbfa5 100644
32726--- a/drivers/mtd/mtdchar.c
32727+++ b/drivers/mtd/mtdchar.c
32728@@ -554,6 +554,8 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
32729 u_long size;
32730 struct mtd_info_user info;
32731
32732+ pax_track_stack();
32733+
32734 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
32735
32736 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
32737diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
32738index d527621..2491fab 100644
32739--- a/drivers/mtd/nand/denali.c
32740+++ b/drivers/mtd/nand/denali.c
32741@@ -26,6 +26,7 @@
32742 #include <linux/pci.h>
32743 #include <linux/mtd/mtd.h>
32744 #include <linux/module.h>
32745+#include <linux/slab.h>
32746
32747 #include "denali.h"
32748
32749diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
32750index b155666..611b801 100644
32751--- a/drivers/mtd/nftlcore.c
32752+++ b/drivers/mtd/nftlcore.c
32753@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
32754 int inplace = 1;
32755 size_t retlen;
32756
32757+ pax_track_stack();
32758+
32759 memset(BlockMap, 0xff, sizeof(BlockMap));
32760 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
32761
32762diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
32763index e3cd1ff..0ea79a3 100644
32764--- a/drivers/mtd/nftlmount.c
32765+++ b/drivers/mtd/nftlmount.c
32766@@ -24,6 +24,7 @@
32767 #include <asm/errno.h>
32768 #include <linux/delay.h>
32769 #include <linux/slab.h>
32770+#include <linux/sched.h>
32771 #include <linux/mtd/mtd.h>
32772 #include <linux/mtd/nand.h>
32773 #include <linux/mtd/nftl.h>
32774@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
32775 struct mtd_info *mtd = nftl->mbd.mtd;
32776 unsigned int i;
32777
32778+ pax_track_stack();
32779+
32780 /* Assume logical EraseSize == physical erasesize for starting the scan.
32781 We'll sort it out later if we find a MediaHeader which says otherwise */
32782 /* Actually, we won't. The new DiskOnChip driver has already scanned
32783diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
32784index 6c3fb5a..c542a81 100644
32785--- a/drivers/mtd/ubi/build.c
32786+++ b/drivers/mtd/ubi/build.c
32787@@ -1311,7 +1311,7 @@ module_exit(ubi_exit);
32788 static int __init bytes_str_to_int(const char *str)
32789 {
32790 char *endp;
32791- unsigned long result;
32792+ unsigned long result, scale = 1;
32793
32794 result = simple_strtoul(str, &endp, 0);
32795 if (str == endp || result >= INT_MAX) {
32796@@ -1322,11 +1322,11 @@ static int __init bytes_str_to_int(const char *str)
32797
32798 switch (*endp) {
32799 case 'G':
32800- result *= 1024;
32801+ scale *= 1024;
32802 case 'M':
32803- result *= 1024;
32804+ scale *= 1024;
32805 case 'K':
32806- result *= 1024;
32807+ scale *= 1024;
32808 if (endp[1] == 'i' && endp[2] == 'B')
32809 endp += 2;
32810 case '\0':
32811@@ -1337,7 +1337,13 @@ static int __init bytes_str_to_int(const char *str)
32812 return -EINVAL;
32813 }
32814
32815- return result;
32816+ if ((intoverflow_t)result*scale >= INT_MAX) {
32817+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
32818+ str);
32819+ return -EINVAL;
32820+ }
32821+
32822+ return result*scale;
32823 }
32824
32825 /**
32826diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
32827index d4f7dda..d627d46 100644
32828--- a/drivers/net/atlx/atl2.c
32829+++ b/drivers/net/atlx/atl2.c
32830@@ -2857,7 +2857,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
32831 */
32832
32833 #define ATL2_PARAM(X, desc) \
32834- static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
32835+ static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
32836 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
32837 MODULE_PARM_DESC(X, desc);
32838 #else
32839diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
32840index 87aecdf..ec23470 100644
32841--- a/drivers/net/bna/bfa_ioc_ct.c
32842+++ b/drivers/net/bna/bfa_ioc_ct.c
32843@@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct bfa_ioc *ioc);
32844 static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc);
32845 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
32846
32847-static struct bfa_ioc_hwif nw_hwif_ct;
32848+static struct bfa_ioc_hwif nw_hwif_ct = {
32849+ .ioc_pll_init = bfa_ioc_ct_pll_init,
32850+ .ioc_firmware_lock = bfa_ioc_ct_firmware_lock,
32851+ .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock,
32852+ .ioc_reg_init = bfa_ioc_ct_reg_init,
32853+ .ioc_map_port = bfa_ioc_ct_map_port,
32854+ .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set,
32855+ .ioc_notify_fail = bfa_ioc_ct_notify_fail,
32856+ .ioc_ownership_reset = bfa_ioc_ct_ownership_reset,
32857+ .ioc_sync_start = bfa_ioc_ct_sync_start,
32858+ .ioc_sync_join = bfa_ioc_ct_sync_join,
32859+ .ioc_sync_leave = bfa_ioc_ct_sync_leave,
32860+ .ioc_sync_ack = bfa_ioc_ct_sync_ack,
32861+ .ioc_sync_complete = bfa_ioc_ct_sync_complete
32862+};
32863
32864 /**
32865 * Called from bfa_ioc_attach() to map asic specific calls.
32866@@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct;
32867 void
32868 bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
32869 {
32870- nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
32871- nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
32872- nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
32873- nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
32874- nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
32875- nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
32876- nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
32877- nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
32878- nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
32879- nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
32880- nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
32881- nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
32882- nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete;
32883-
32884 ioc->ioc_hwif = &nw_hwif_ct;
32885 }
32886
32887diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
32888index 8e35b25..c39f205 100644
32889--- a/drivers/net/bna/bnad.c
32890+++ b/drivers/net/bna/bnad.c
32891@@ -1673,7 +1673,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
32892 struct bna_intr_info *intr_info =
32893 &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
32894 struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
32895- struct bna_tx_event_cbfn tx_cbfn;
32896+ static struct bna_tx_event_cbfn tx_cbfn = {
32897+ /* Initialize the tx event handlers */
32898+ .tcb_setup_cbfn = bnad_cb_tcb_setup,
32899+ .tcb_destroy_cbfn = bnad_cb_tcb_destroy,
32900+ .tx_stall_cbfn = bnad_cb_tx_stall,
32901+ .tx_resume_cbfn = bnad_cb_tx_resume,
32902+ .tx_cleanup_cbfn = bnad_cb_tx_cleanup
32903+ };
32904 struct bna_tx *tx;
32905 unsigned long flags;
32906
32907@@ -1682,13 +1689,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
32908 tx_config->txq_depth = bnad->txq_depth;
32909 tx_config->tx_type = BNA_TX_T_REGULAR;
32910
32911- /* Initialize the tx event handlers */
32912- tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
32913- tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
32914- tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
32915- tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
32916- tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
32917-
32918 /* Get BNA's resource requirement for one tx object */
32919 spin_lock_irqsave(&bnad->bna_lock, flags);
32920 bna_tx_res_req(bnad->num_txq_per_tx,
32921@@ -1819,21 +1819,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx_id)
32922 struct bna_intr_info *intr_info =
32923 &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
32924 struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
32925- struct bna_rx_event_cbfn rx_cbfn;
32926+ static struct bna_rx_event_cbfn rx_cbfn = {
32927+ /* Initialize the Rx event handlers */
32928+ .rcb_setup_cbfn = bnad_cb_rcb_setup,
32929+ .rcb_destroy_cbfn = bnad_cb_rcb_destroy,
32930+ .ccb_setup_cbfn = bnad_cb_ccb_setup,
32931+ .ccb_destroy_cbfn = bnad_cb_ccb_destroy,
32932+ .rx_cleanup_cbfn = bnad_cb_rx_cleanup,
32933+ .rx_post_cbfn = bnad_cb_rx_post
32934+ };
32935 struct bna_rx *rx;
32936 unsigned long flags;
32937
32938 /* Initialize the Rx object configuration */
32939 bnad_init_rx_config(bnad, rx_config);
32940
32941- /* Initialize the Rx event handlers */
32942- rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
32943- rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
32944- rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
32945- rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
32946- rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
32947- rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
32948-
32949 /* Get BNA's resource requirement for one Rx object */
32950 spin_lock_irqsave(&bnad->bna_lock, flags);
32951 bna_rx_res_req(rx_config, res_info);
32952diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
32953index 4b2b570..31033f4 100644
32954--- a/drivers/net/bnx2.c
32955+++ b/drivers/net/bnx2.c
32956@@ -5877,6 +5877,8 @@ bnx2_test_nvram(struct bnx2 *bp)
32957 int rc = 0;
32958 u32 magic, csum;
32959
32960+ pax_track_stack();
32961+
32962 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
32963 goto test_nvram_done;
32964
32965diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
32966index cf3e479..5dc0ecc 100644
32967--- a/drivers/net/bnx2x/bnx2x_ethtool.c
32968+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
32969@@ -1943,6 +1943,8 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
32970 int i, rc;
32971 u32 magic, crc;
32972
32973+ pax_track_stack();
32974+
32975 if (BP_NOMCP(bp))
32976 return 0;
32977
32978diff --git a/drivers/net/bnx2x/bnx2x_sp.h b/drivers/net/bnx2x/bnx2x_sp.h
32979index 9a517c2..a50cfcb 100644
32980--- a/drivers/net/bnx2x/bnx2x_sp.h
32981+++ b/drivers/net/bnx2x/bnx2x_sp.h
32982@@ -449,7 +449,7 @@ struct bnx2x_rx_mode_obj {
32983
32984 int (*wait_comp)(struct bnx2x *bp,
32985 struct bnx2x_rx_mode_ramrod_params *p);
32986-};
32987+} __no_const;
32988
32989 /********************** Set multicast group ***********************************/
32990
32991diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
32992index c5f5479..2e8c260 100644
32993--- a/drivers/net/cxgb3/l2t.h
32994+++ b/drivers/net/cxgb3/l2t.h
32995@@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
32996 */
32997 struct l2t_skb_cb {
32998 arp_failure_handler_func arp_failure_handler;
32999-};
33000+} __no_const;
33001
33002 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
33003
33004diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
33005index b4efa29..c5f2703 100644
33006--- a/drivers/net/cxgb4/cxgb4_main.c
33007+++ b/drivers/net/cxgb4/cxgb4_main.c
33008@@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct adapter *adap)
33009 unsigned int nchan = adap->params.nports;
33010 struct msix_entry entries[MAX_INGQ + 1];
33011
33012+ pax_track_stack();
33013+
33014 for (i = 0; i < ARRAY_SIZE(entries); ++i)
33015 entries[i].entry = i;
33016
33017diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
33018index d1ec111..12735bc 100644
33019--- a/drivers/net/cxgb4/t4_hw.c
33020+++ b/drivers/net/cxgb4/t4_hw.c
33021@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
33022 u8 vpd[VPD_LEN], csum;
33023 unsigned int vpdr_len, kw_offset, id_len;
33024
33025+ pax_track_stack();
33026+
33027 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
33028 if (ret < 0)
33029 return ret;
33030diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
33031index 536b3a5..e6f8dcc 100644
33032--- a/drivers/net/e1000e/82571.c
33033+++ b/drivers/net/e1000e/82571.c
33034@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
33035 {
33036 struct e1000_hw *hw = &adapter->hw;
33037 struct e1000_mac_info *mac = &hw->mac;
33038- struct e1000_mac_operations *func = &mac->ops;
33039+ e1000_mac_operations_no_const *func = &mac->ops;
33040 u32 swsm = 0;
33041 u32 swsm2 = 0;
33042 bool force_clear_smbi = false;
33043diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
33044index e4f4225..24da2ea 100644
33045--- a/drivers/net/e1000e/es2lan.c
33046+++ b/drivers/net/e1000e/es2lan.c
33047@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
33048 {
33049 struct e1000_hw *hw = &adapter->hw;
33050 struct e1000_mac_info *mac = &hw->mac;
33051- struct e1000_mac_operations *func = &mac->ops;
33052+ e1000_mac_operations_no_const *func = &mac->ops;
33053
33054 /* Set media type */
33055 switch (adapter->pdev->device) {
33056diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
33057index 2967039..ca8c40c 100644
33058--- a/drivers/net/e1000e/hw.h
33059+++ b/drivers/net/e1000e/hw.h
33060@@ -778,6 +778,7 @@ struct e1000_mac_operations {
33061 void (*write_vfta)(struct e1000_hw *, u32, u32);
33062 s32 (*read_mac_addr)(struct e1000_hw *);
33063 };
33064+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33065
33066 /*
33067 * When to use various PHY register access functions:
33068@@ -818,6 +819,7 @@ struct e1000_phy_operations {
33069 void (*power_up)(struct e1000_hw *);
33070 void (*power_down)(struct e1000_hw *);
33071 };
33072+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33073
33074 /* Function pointers for the NVM. */
33075 struct e1000_nvm_operations {
33076@@ -829,9 +831,10 @@ struct e1000_nvm_operations {
33077 s32 (*validate)(struct e1000_hw *);
33078 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
33079 };
33080+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33081
33082 struct e1000_mac_info {
33083- struct e1000_mac_operations ops;
33084+ e1000_mac_operations_no_const ops;
33085 u8 addr[ETH_ALEN];
33086 u8 perm_addr[ETH_ALEN];
33087
33088@@ -872,7 +875,7 @@ struct e1000_mac_info {
33089 };
33090
33091 struct e1000_phy_info {
33092- struct e1000_phy_operations ops;
33093+ e1000_phy_operations_no_const ops;
33094
33095 enum e1000_phy_type type;
33096
33097@@ -906,7 +909,7 @@ struct e1000_phy_info {
33098 };
33099
33100 struct e1000_nvm_info {
33101- struct e1000_nvm_operations ops;
33102+ e1000_nvm_operations_no_const ops;
33103
33104 enum e1000_nvm_type type;
33105 enum e1000_nvm_override override;
33106diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
33107index fa8677c..196356f 100644
33108--- a/drivers/net/fealnx.c
33109+++ b/drivers/net/fealnx.c
33110@@ -150,7 +150,7 @@ struct chip_info {
33111 int flags;
33112 };
33113
33114-static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
33115+static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
33116 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33117 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
33118 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33119diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
33120index 2a5a34d..be871cc 100644
33121--- a/drivers/net/hamradio/6pack.c
33122+++ b/drivers/net/hamradio/6pack.c
33123@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
33124 unsigned char buf[512];
33125 int count1;
33126
33127+ pax_track_stack();
33128+
33129 if (!count)
33130 return;
33131
33132diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
33133index 4519a13..f97fcd0 100644
33134--- a/drivers/net/igb/e1000_hw.h
33135+++ b/drivers/net/igb/e1000_hw.h
33136@@ -314,6 +314,7 @@ struct e1000_mac_operations {
33137 s32 (*read_mac_addr)(struct e1000_hw *);
33138 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
33139 };
33140+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33141
33142 struct e1000_phy_operations {
33143 s32 (*acquire)(struct e1000_hw *);
33144@@ -330,6 +331,7 @@ struct e1000_phy_operations {
33145 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
33146 s32 (*write_reg)(struct e1000_hw *, u32, u16);
33147 };
33148+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33149
33150 struct e1000_nvm_operations {
33151 s32 (*acquire)(struct e1000_hw *);
33152@@ -339,6 +341,7 @@ struct e1000_nvm_operations {
33153 s32 (*update)(struct e1000_hw *);
33154 s32 (*validate)(struct e1000_hw *);
33155 };
33156+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33157
33158 struct e1000_info {
33159 s32 (*get_invariants)(struct e1000_hw *);
33160@@ -350,7 +353,7 @@ struct e1000_info {
33161 extern const struct e1000_info e1000_82575_info;
33162
33163 struct e1000_mac_info {
33164- struct e1000_mac_operations ops;
33165+ e1000_mac_operations_no_const ops;
33166
33167 u8 addr[6];
33168 u8 perm_addr[6];
33169@@ -388,7 +391,7 @@ struct e1000_mac_info {
33170 };
33171
33172 struct e1000_phy_info {
33173- struct e1000_phy_operations ops;
33174+ e1000_phy_operations_no_const ops;
33175
33176 enum e1000_phy_type type;
33177
33178@@ -423,7 +426,7 @@ struct e1000_phy_info {
33179 };
33180
33181 struct e1000_nvm_info {
33182- struct e1000_nvm_operations ops;
33183+ e1000_nvm_operations_no_const ops;
33184 enum e1000_nvm_type type;
33185 enum e1000_nvm_override override;
33186
33187@@ -468,6 +471,7 @@ struct e1000_mbx_operations {
33188 s32 (*check_for_ack)(struct e1000_hw *, u16);
33189 s32 (*check_for_rst)(struct e1000_hw *, u16);
33190 };
33191+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33192
33193 struct e1000_mbx_stats {
33194 u32 msgs_tx;
33195@@ -479,7 +483,7 @@ struct e1000_mbx_stats {
33196 };
33197
33198 struct e1000_mbx_info {
33199- struct e1000_mbx_operations ops;
33200+ e1000_mbx_operations_no_const ops;
33201 struct e1000_mbx_stats stats;
33202 u32 timeout;
33203 u32 usec_delay;
33204diff --git a/drivers/net/igbvf/vf.h b/drivers/net/igbvf/vf.h
33205index d7ed58f..64cde36 100644
33206--- a/drivers/net/igbvf/vf.h
33207+++ b/drivers/net/igbvf/vf.h
33208@@ -189,9 +189,10 @@ struct e1000_mac_operations {
33209 s32 (*read_mac_addr)(struct e1000_hw *);
33210 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
33211 };
33212+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33213
33214 struct e1000_mac_info {
33215- struct e1000_mac_operations ops;
33216+ e1000_mac_operations_no_const ops;
33217 u8 addr[6];
33218 u8 perm_addr[6];
33219
33220@@ -213,6 +214,7 @@ struct e1000_mbx_operations {
33221 s32 (*check_for_ack)(struct e1000_hw *);
33222 s32 (*check_for_rst)(struct e1000_hw *);
33223 };
33224+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33225
33226 struct e1000_mbx_stats {
33227 u32 msgs_tx;
33228@@ -224,7 +226,7 @@ struct e1000_mbx_stats {
33229 };
33230
33231 struct e1000_mbx_info {
33232- struct e1000_mbx_operations ops;
33233+ e1000_mbx_operations_no_const ops;
33234 struct e1000_mbx_stats stats;
33235 u32 timeout;
33236 u32 usec_delay;
33237diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
33238index 6a130eb..1aeb9e4 100644
33239--- a/drivers/net/ixgb/ixgb_main.c
33240+++ b/drivers/net/ixgb/ixgb_main.c
33241@@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev)
33242 u32 rctl;
33243 int i;
33244
33245+ pax_track_stack();
33246+
33247 /* Check for Promiscuous and All Multicast modes */
33248
33249 rctl = IXGB_READ_REG(hw, RCTL);
33250diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
33251index dd7fbeb..44b9bbf 100644
33252--- a/drivers/net/ixgb/ixgb_param.c
33253+++ b/drivers/net/ixgb/ixgb_param.c
33254@@ -261,6 +261,9 @@ void __devinit
33255 ixgb_check_options(struct ixgb_adapter *adapter)
33256 {
33257 int bd = adapter->bd_number;
33258+
33259+ pax_track_stack();
33260+
33261 if (bd >= IXGB_MAX_NIC) {
33262 pr_notice("Warning: no configuration for board #%i\n", bd);
33263 pr_notice("Using defaults for all values\n");
33264diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
33265index e0d970e..1cfdea5 100644
33266--- a/drivers/net/ixgbe/ixgbe_type.h
33267+++ b/drivers/net/ixgbe/ixgbe_type.h
33268@@ -2642,6 +2642,7 @@ struct ixgbe_eeprom_operations {
33269 s32 (*update_checksum)(struct ixgbe_hw *);
33270 u16 (*calc_checksum)(struct ixgbe_hw *);
33271 };
33272+typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
33273
33274 struct ixgbe_mac_operations {
33275 s32 (*init_hw)(struct ixgbe_hw *);
33276@@ -2703,6 +2704,7 @@ struct ixgbe_mac_operations {
33277 /* Manageability interface */
33278 s32 (*set_fw_drv_ver)(struct ixgbe_hw *, u8, u8, u8, u8);
33279 };
33280+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33281
33282 struct ixgbe_phy_operations {
33283 s32 (*identify)(struct ixgbe_hw *);
33284@@ -2722,9 +2724,10 @@ struct ixgbe_phy_operations {
33285 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
33286 s32 (*check_overtemp)(struct ixgbe_hw *);
33287 };
33288+typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
33289
33290 struct ixgbe_eeprom_info {
33291- struct ixgbe_eeprom_operations ops;
33292+ ixgbe_eeprom_operations_no_const ops;
33293 enum ixgbe_eeprom_type type;
33294 u32 semaphore_delay;
33295 u16 word_size;
33296@@ -2734,7 +2737,7 @@ struct ixgbe_eeprom_info {
33297
33298 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
33299 struct ixgbe_mac_info {
33300- struct ixgbe_mac_operations ops;
33301+ ixgbe_mac_operations_no_const ops;
33302 enum ixgbe_mac_type type;
33303 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33304 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33305@@ -2762,7 +2765,7 @@ struct ixgbe_mac_info {
33306 };
33307
33308 struct ixgbe_phy_info {
33309- struct ixgbe_phy_operations ops;
33310+ ixgbe_phy_operations_no_const ops;
33311 struct mdio_if_info mdio;
33312 enum ixgbe_phy_type type;
33313 u32 id;
33314@@ -2790,6 +2793,7 @@ struct ixgbe_mbx_operations {
33315 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
33316 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
33317 };
33318+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33319
33320 struct ixgbe_mbx_stats {
33321 u32 msgs_tx;
33322@@ -2801,7 +2805,7 @@ struct ixgbe_mbx_stats {
33323 };
33324
33325 struct ixgbe_mbx_info {
33326- struct ixgbe_mbx_operations ops;
33327+ ixgbe_mbx_operations_no_const ops;
33328 struct ixgbe_mbx_stats stats;
33329 u32 timeout;
33330 u32 usec_delay;
33331diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
33332index 10306b4..28df758 100644
33333--- a/drivers/net/ixgbevf/vf.h
33334+++ b/drivers/net/ixgbevf/vf.h
33335@@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
33336 s32 (*clear_vfta)(struct ixgbe_hw *);
33337 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
33338 };
33339+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33340
33341 enum ixgbe_mac_type {
33342 ixgbe_mac_unknown = 0,
33343@@ -79,7 +80,7 @@ enum ixgbe_mac_type {
33344 };
33345
33346 struct ixgbe_mac_info {
33347- struct ixgbe_mac_operations ops;
33348+ ixgbe_mac_operations_no_const ops;
33349 u8 addr[6];
33350 u8 perm_addr[6];
33351
33352@@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
33353 s32 (*check_for_ack)(struct ixgbe_hw *);
33354 s32 (*check_for_rst)(struct ixgbe_hw *);
33355 };
33356+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33357
33358 struct ixgbe_mbx_stats {
33359 u32 msgs_tx;
33360@@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
33361 };
33362
33363 struct ixgbe_mbx_info {
33364- struct ixgbe_mbx_operations ops;
33365+ ixgbe_mbx_operations_no_const ops;
33366 struct ixgbe_mbx_stats stats;
33367 u32 timeout;
33368 u32 udelay;
33369diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
33370index 27418d3..adf15bb 100644
33371--- a/drivers/net/ksz884x.c
33372+++ b/drivers/net/ksz884x.c
33373@@ -6533,6 +6533,8 @@ static void netdev_get_ethtool_stats(struct net_device *dev,
33374 int rc;
33375 u64 counter[TOTAL_PORT_COUNTER_NUM];
33376
33377+ pax_track_stack();
33378+
33379 mutex_lock(&hw_priv->lock);
33380 n = SWITCH_PORT_NUM;
33381 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
33382diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
33383index f0ee35d..3831c8a 100644
33384--- a/drivers/net/mlx4/main.c
33385+++ b/drivers/net/mlx4/main.c
33386@@ -40,6 +40,7 @@
33387 #include <linux/dma-mapping.h>
33388 #include <linux/slab.h>
33389 #include <linux/io-mapping.h>
33390+#include <linux/sched.h>
33391
33392 #include <linux/mlx4/device.h>
33393 #include <linux/mlx4/doorbell.h>
33394@@ -762,6 +763,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
33395 u64 icm_size;
33396 int err;
33397
33398+ pax_track_stack();
33399+
33400 err = mlx4_QUERY_FW(dev);
33401 if (err) {
33402 if (err == -EACCES)
33403diff --git a/drivers/net/niu.c b/drivers/net/niu.c
33404index ed47585..5e5be8f 100644
33405--- a/drivers/net/niu.c
33406+++ b/drivers/net/niu.c
33407@@ -9061,6 +9061,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
33408 int i, num_irqs, err;
33409 u8 first_ldg;
33410
33411+ pax_track_stack();
33412+
33413 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
33414 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
33415 ldg_num_map[i] = first_ldg + i;
33416diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
33417index 80b6f36..5cd8938 100644
33418--- a/drivers/net/pcnet32.c
33419+++ b/drivers/net/pcnet32.c
33420@@ -270,7 +270,7 @@ struct pcnet32_private {
33421 struct sk_buff **rx_skbuff;
33422 dma_addr_t *tx_dma_addr;
33423 dma_addr_t *rx_dma_addr;
33424- struct pcnet32_access a;
33425+ struct pcnet32_access *a;
33426 spinlock_t lock; /* Guard lock */
33427 unsigned int cur_rx, cur_tx; /* The next free ring entry */
33428 unsigned int rx_ring_size; /* current rx ring size */
33429@@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct net_device *dev)
33430 u16 val;
33431
33432 netif_wake_queue(dev);
33433- val = lp->a.read_csr(ioaddr, CSR3);
33434+ val = lp->a->read_csr(ioaddr, CSR3);
33435 val &= 0x00ff;
33436- lp->a.write_csr(ioaddr, CSR3, val);
33437+ lp->a->write_csr(ioaddr, CSR3, val);
33438 napi_enable(&lp->napi);
33439 }
33440
33441@@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
33442 r = mii_link_ok(&lp->mii_if);
33443 } else if (lp->chip_version >= PCNET32_79C970A) {
33444 ulong ioaddr = dev->base_addr; /* card base I/O address */
33445- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
33446+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
33447 } else { /* can not detect link on really old chips */
33448 r = 1;
33449 }
33450@@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
33451 pcnet32_netif_stop(dev);
33452
33453 spin_lock_irqsave(&lp->lock, flags);
33454- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33455+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33456
33457 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
33458
33459@@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
33460 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33461 {
33462 struct pcnet32_private *lp = netdev_priv(dev);
33463- struct pcnet32_access *a = &lp->a; /* access to registers */
33464+ struct pcnet32_access *a = lp->a; /* access to registers */
33465 ulong ioaddr = dev->base_addr; /* card base I/O address */
33466 struct sk_buff *skb; /* sk buff */
33467 int x, i; /* counters */
33468@@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33469 pcnet32_netif_stop(dev);
33470
33471 spin_lock_irqsave(&lp->lock, flags);
33472- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33473+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33474
33475 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
33476
33477 /* Reset the PCNET32 */
33478- lp->a.reset(ioaddr);
33479- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33480+ lp->a->reset(ioaddr);
33481+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33482
33483 /* switch pcnet32 to 32bit mode */
33484- lp->a.write_bcr(ioaddr, 20, 2);
33485+ lp->a->write_bcr(ioaddr, 20, 2);
33486
33487 /* purge & init rings but don't actually restart */
33488 pcnet32_restart(dev, 0x0000);
33489
33490- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33491+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33492
33493 /* Initialize Transmit buffers. */
33494 size = data_len + 15;
33495@@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33496
33497 /* set int loopback in CSR15 */
33498 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
33499- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
33500+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
33501
33502 teststatus = cpu_to_le16(0x8000);
33503- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33504+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33505
33506 /* Check status of descriptors */
33507 for (x = 0; x < numbuffs; x++) {
33508@@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33509 }
33510 }
33511
33512- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33513+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33514 wmb();
33515 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
33516 netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n");
33517@@ -1015,7 +1015,7 @@ clean_up:
33518 pcnet32_restart(dev, CSR0_NORMAL);
33519 } else {
33520 pcnet32_purge_rx_ring(dev);
33521- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33522+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33523 }
33524 spin_unlock_irqrestore(&lp->lock, flags);
33525
33526@@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct net_device *dev,
33527 enum ethtool_phys_id_state state)
33528 {
33529 struct pcnet32_private *lp = netdev_priv(dev);
33530- struct pcnet32_access *a = &lp->a;
33531+ struct pcnet32_access *a = lp->a;
33532 ulong ioaddr = dev->base_addr;
33533 unsigned long flags;
33534 int i;
33535@@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
33536 {
33537 int csr5;
33538 struct pcnet32_private *lp = netdev_priv(dev);
33539- struct pcnet32_access *a = &lp->a;
33540+ struct pcnet32_access *a = lp->a;
33541 ulong ioaddr = dev->base_addr;
33542 int ticks;
33543
33544@@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33545 spin_lock_irqsave(&lp->lock, flags);
33546 if (pcnet32_tx(dev)) {
33547 /* reset the chip to clear the error condition, then restart */
33548- lp->a.reset(ioaddr);
33549- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33550+ lp->a->reset(ioaddr);
33551+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33552 pcnet32_restart(dev, CSR0_START);
33553 netif_wake_queue(dev);
33554 }
33555@@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33556 __napi_complete(napi);
33557
33558 /* clear interrupt masks */
33559- val = lp->a.read_csr(ioaddr, CSR3);
33560+ val = lp->a->read_csr(ioaddr, CSR3);
33561 val &= 0x00ff;
33562- lp->a.write_csr(ioaddr, CSR3, val);
33563+ lp->a->write_csr(ioaddr, CSR3, val);
33564
33565 /* Set interrupt enable. */
33566- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
33567+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
33568
33569 spin_unlock_irqrestore(&lp->lock, flags);
33570 }
33571@@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33572 int i, csr0;
33573 u16 *buff = ptr;
33574 struct pcnet32_private *lp = netdev_priv(dev);
33575- struct pcnet32_access *a = &lp->a;
33576+ struct pcnet32_access *a = lp->a;
33577 ulong ioaddr = dev->base_addr;
33578 unsigned long flags;
33579
33580@@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33581 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
33582 if (lp->phymask & (1 << j)) {
33583 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
33584- lp->a.write_bcr(ioaddr, 33,
33585+ lp->a->write_bcr(ioaddr, 33,
33586 (j << 5) | i);
33587- *buff++ = lp->a.read_bcr(ioaddr, 34);
33588+ *buff++ = lp->a->read_bcr(ioaddr, 34);
33589 }
33590 }
33591 }
33592@@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33593 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
33594 lp->options |= PCNET32_PORT_FD;
33595
33596- lp->a = *a;
33597+ lp->a = a;
33598
33599 /* prior to register_netdev, dev->name is not yet correct */
33600 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
33601@@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33602 if (lp->mii) {
33603 /* lp->phycount and lp->phymask are set to 0 by memset above */
33604
33605- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33606+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33607 /* scan for PHYs */
33608 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33609 unsigned short id1, id2;
33610@@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33611 pr_info("Found PHY %04x:%04x at address %d\n",
33612 id1, id2, i);
33613 }
33614- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33615+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33616 if (lp->phycount > 1)
33617 lp->options |= PCNET32_PORT_MII;
33618 }
33619@@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_device *dev)
33620 }
33621
33622 /* Reset the PCNET32 */
33623- lp->a.reset(ioaddr);
33624+ lp->a->reset(ioaddr);
33625
33626 /* switch pcnet32 to 32bit mode */
33627- lp->a.write_bcr(ioaddr, 20, 2);
33628+ lp->a->write_bcr(ioaddr, 20, 2);
33629
33630 netif_printk(lp, ifup, KERN_DEBUG, dev,
33631 "%s() irq %d tx/rx rings %#x/%#x init %#x\n",
33632@@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_device *dev)
33633 (u32) (lp->init_dma_addr));
33634
33635 /* set/reset autoselect bit */
33636- val = lp->a.read_bcr(ioaddr, 2) & ~2;
33637+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
33638 if (lp->options & PCNET32_PORT_ASEL)
33639 val |= 2;
33640- lp->a.write_bcr(ioaddr, 2, val);
33641+ lp->a->write_bcr(ioaddr, 2, val);
33642
33643 /* handle full duplex setting */
33644 if (lp->mii_if.full_duplex) {
33645- val = lp->a.read_bcr(ioaddr, 9) & ~3;
33646+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
33647 if (lp->options & PCNET32_PORT_FD) {
33648 val |= 1;
33649 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
33650@@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_device *dev)
33651 if (lp->chip_version == 0x2627)
33652 val |= 3;
33653 }
33654- lp->a.write_bcr(ioaddr, 9, val);
33655+ lp->a->write_bcr(ioaddr, 9, val);
33656 }
33657
33658 /* set/reset GPSI bit in test register */
33659- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
33660+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
33661 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
33662 val |= 0x10;
33663- lp->a.write_csr(ioaddr, 124, val);
33664+ lp->a->write_csr(ioaddr, 124, val);
33665
33666 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
33667 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
33668@@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_device *dev)
33669 * duplex, and/or enable auto negotiation, and clear DANAS
33670 */
33671 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
33672- lp->a.write_bcr(ioaddr, 32,
33673- lp->a.read_bcr(ioaddr, 32) | 0x0080);
33674+ lp->a->write_bcr(ioaddr, 32,
33675+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
33676 /* disable Auto Negotiation, set 10Mpbs, HD */
33677- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
33678+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
33679 if (lp->options & PCNET32_PORT_FD)
33680 val |= 0x10;
33681 if (lp->options & PCNET32_PORT_100)
33682 val |= 0x08;
33683- lp->a.write_bcr(ioaddr, 32, val);
33684+ lp->a->write_bcr(ioaddr, 32, val);
33685 } else {
33686 if (lp->options & PCNET32_PORT_ASEL) {
33687- lp->a.write_bcr(ioaddr, 32,
33688- lp->a.read_bcr(ioaddr,
33689+ lp->a->write_bcr(ioaddr, 32,
33690+ lp->a->read_bcr(ioaddr,
33691 32) | 0x0080);
33692 /* enable auto negotiate, setup, disable fd */
33693- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
33694+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
33695 val |= 0x20;
33696- lp->a.write_bcr(ioaddr, 32, val);
33697+ lp->a->write_bcr(ioaddr, 32, val);
33698 }
33699 }
33700 } else {
33701@@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_device *dev)
33702 * There is really no good other way to handle multiple PHYs
33703 * other than turning off all automatics
33704 */
33705- val = lp->a.read_bcr(ioaddr, 2);
33706- lp->a.write_bcr(ioaddr, 2, val & ~2);
33707- val = lp->a.read_bcr(ioaddr, 32);
33708- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
33709+ val = lp->a->read_bcr(ioaddr, 2);
33710+ lp->a->write_bcr(ioaddr, 2, val & ~2);
33711+ val = lp->a->read_bcr(ioaddr, 32);
33712+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
33713
33714 if (!(lp->options & PCNET32_PORT_ASEL)) {
33715 /* setup ecmd */
33716@@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_device *dev)
33717 ethtool_cmd_speed_set(&ecmd,
33718 (lp->options & PCNET32_PORT_100) ?
33719 SPEED_100 : SPEED_10);
33720- bcr9 = lp->a.read_bcr(ioaddr, 9);
33721+ bcr9 = lp->a->read_bcr(ioaddr, 9);
33722
33723 if (lp->options & PCNET32_PORT_FD) {
33724 ecmd.duplex = DUPLEX_FULL;
33725@@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_device *dev)
33726 ecmd.duplex = DUPLEX_HALF;
33727 bcr9 |= ~(1 << 0);
33728 }
33729- lp->a.write_bcr(ioaddr, 9, bcr9);
33730+ lp->a->write_bcr(ioaddr, 9, bcr9);
33731 }
33732
33733 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33734@@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_device *dev)
33735
33736 #ifdef DO_DXSUFLO
33737 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
33738- val = lp->a.read_csr(ioaddr, CSR3);
33739+ val = lp->a->read_csr(ioaddr, CSR3);
33740 val |= 0x40;
33741- lp->a.write_csr(ioaddr, CSR3, val);
33742+ lp->a->write_csr(ioaddr, CSR3, val);
33743 }
33744 #endif
33745
33746@@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_device *dev)
33747 napi_enable(&lp->napi);
33748
33749 /* Re-initialize the PCNET32, and start it when done. */
33750- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
33751- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
33752+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
33753+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
33754
33755- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33756- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
33757+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33758+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
33759
33760 netif_start_queue(dev);
33761
33762@@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_device *dev)
33763
33764 i = 0;
33765 while (i++ < 100)
33766- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
33767+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
33768 break;
33769 /*
33770 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
33771 * reports that doing so triggers a bug in the '974.
33772 */
33773- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
33774+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
33775
33776 netif_printk(lp, ifup, KERN_DEBUG, dev,
33777 "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n",
33778 i,
33779 (u32) (lp->init_dma_addr),
33780- lp->a.read_csr(ioaddr, CSR0));
33781+ lp->a->read_csr(ioaddr, CSR0));
33782
33783 spin_unlock_irqrestore(&lp->lock, flags);
33784
33785@@ -2218,7 +2218,7 @@ err_free_ring:
33786 * Switch back to 16bit mode to avoid problems with dumb
33787 * DOS packet driver after a warm reboot
33788 */
33789- lp->a.write_bcr(ioaddr, 20, 4);
33790+ lp->a->write_bcr(ioaddr, 20, 4);
33791
33792 err_free_irq:
33793 spin_unlock_irqrestore(&lp->lock, flags);
33794@@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
33795
33796 /* wait for stop */
33797 for (i = 0; i < 100; i++)
33798- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
33799+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
33800 break;
33801
33802 if (i >= 100)
33803@@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
33804 return;
33805
33806 /* ReInit Ring */
33807- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
33808+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
33809 i = 0;
33810 while (i++ < 1000)
33811- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
33812+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
33813 break;
33814
33815- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
33816+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
33817 }
33818
33819 static void pcnet32_tx_timeout(struct net_device *dev)
33820@@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
33821 /* Transmitter timeout, serious problems. */
33822 if (pcnet32_debug & NETIF_MSG_DRV)
33823 pr_err("%s: transmit timed out, status %4.4x, resetting\n",
33824- dev->name, lp->a.read_csr(ioaddr, CSR0));
33825- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33826+ dev->name, lp->a->read_csr(ioaddr, CSR0));
33827+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33828 dev->stats.tx_errors++;
33829 if (netif_msg_tx_err(lp)) {
33830 int i;
33831@@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
33832
33833 netif_printk(lp, tx_queued, KERN_DEBUG, dev,
33834 "%s() called, csr0 %4.4x\n",
33835- __func__, lp->a.read_csr(ioaddr, CSR0));
33836+ __func__, lp->a->read_csr(ioaddr, CSR0));
33837
33838 /* Default status -- will not enable Successful-TxDone
33839 * interrupt when that option is available to us.
33840@@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
33841 dev->stats.tx_bytes += skb->len;
33842
33843 /* Trigger an immediate send poll. */
33844- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
33845+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
33846
33847 if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) {
33848 lp->tx_full = 1;
33849@@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id)
33850
33851 spin_lock(&lp->lock);
33852
33853- csr0 = lp->a.read_csr(ioaddr, CSR0);
33854+ csr0 = lp->a->read_csr(ioaddr, CSR0);
33855 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
33856 if (csr0 == 0xffff)
33857 break; /* PCMCIA remove happened */
33858 /* Acknowledge all of the current interrupt sources ASAP. */
33859- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
33860+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
33861
33862 netif_printk(lp, intr, KERN_DEBUG, dev,
33863 "interrupt csr0=%#2.2x new csr=%#2.2x\n",
33864- csr0, lp->a.read_csr(ioaddr, CSR0));
33865+ csr0, lp->a->read_csr(ioaddr, CSR0));
33866
33867 /* Log misc errors. */
33868 if (csr0 & 0x4000)
33869@@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id)
33870 if (napi_schedule_prep(&lp->napi)) {
33871 u16 val;
33872 /* set interrupt masks */
33873- val = lp->a.read_csr(ioaddr, CSR3);
33874+ val = lp->a->read_csr(ioaddr, CSR3);
33875 val |= 0x5f00;
33876- lp->a.write_csr(ioaddr, CSR3, val);
33877+ lp->a->write_csr(ioaddr, CSR3, val);
33878
33879 __napi_schedule(&lp->napi);
33880 break;
33881 }
33882- csr0 = lp->a.read_csr(ioaddr, CSR0);
33883+ csr0 = lp->a->read_csr(ioaddr, CSR0);
33884 }
33885
33886 netif_printk(lp, intr, KERN_DEBUG, dev,
33887 "exiting interrupt, csr0=%#4.4x\n",
33888- lp->a.read_csr(ioaddr, CSR0));
33889+ lp->a->read_csr(ioaddr, CSR0));
33890
33891 spin_unlock(&lp->lock);
33892
33893@@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_device *dev)
33894
33895 spin_lock_irqsave(&lp->lock, flags);
33896
33897- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
33898+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
33899
33900 netif_printk(lp, ifdown, KERN_DEBUG, dev,
33901 "Shutting down ethercard, status was %2.2x\n",
33902- lp->a.read_csr(ioaddr, CSR0));
33903+ lp->a->read_csr(ioaddr, CSR0));
33904
33905 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
33906- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33907+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33908
33909 /*
33910 * Switch back to 16bit mode to avoid problems with dumb
33911 * DOS packet driver after a warm reboot
33912 */
33913- lp->a.write_bcr(ioaddr, 20, 4);
33914+ lp->a->write_bcr(ioaddr, 20, 4);
33915
33916 spin_unlock_irqrestore(&lp->lock, flags);
33917
33918@@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
33919 unsigned long flags;
33920
33921 spin_lock_irqsave(&lp->lock, flags);
33922- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
33923+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
33924 spin_unlock_irqrestore(&lp->lock, flags);
33925
33926 return &dev->stats;
33927@@ -2577,10 +2577,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
33928 if (dev->flags & IFF_ALLMULTI) {
33929 ib->filter[0] = cpu_to_le32(~0U);
33930 ib->filter[1] = cpu_to_le32(~0U);
33931- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
33932- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
33933- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
33934- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
33935+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
33936+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
33937+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
33938+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
33939 return;
33940 }
33941 /* clear the multicast filter */
33942@@ -2594,7 +2594,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
33943 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
33944 }
33945 for (i = 0; i < 4; i++)
33946- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
33947+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
33948 le16_to_cpu(mcast_table[i]));
33949 }
33950
33951@@ -2609,28 +2609,28 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
33952
33953 spin_lock_irqsave(&lp->lock, flags);
33954 suspended = pcnet32_suspend(dev, &flags, 0);
33955- csr15 = lp->a.read_csr(ioaddr, CSR15);
33956+ csr15 = lp->a->read_csr(ioaddr, CSR15);
33957 if (dev->flags & IFF_PROMISC) {
33958 /* Log any net taps. */
33959 netif_info(lp, hw, dev, "Promiscuous mode enabled\n");
33960 lp->init_block->mode =
33961 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
33962 7);
33963- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
33964+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
33965 } else {
33966 lp->init_block->mode =
33967 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
33968- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
33969+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
33970 pcnet32_load_multicast(dev);
33971 }
33972
33973 if (suspended) {
33974 int csr5;
33975 /* clear SUSPEND (SPND) - CSR5 bit 0 */
33976- csr5 = lp->a.read_csr(ioaddr, CSR5);
33977- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
33978+ csr5 = lp->a->read_csr(ioaddr, CSR5);
33979+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
33980 } else {
33981- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33982+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33983 pcnet32_restart(dev, CSR0_NORMAL);
33984 netif_wake_queue(dev);
33985 }
33986@@ -2648,8 +2648,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
33987 if (!lp->mii)
33988 return 0;
33989
33990- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
33991- val_out = lp->a.read_bcr(ioaddr, 34);
33992+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
33993+ val_out = lp->a->read_bcr(ioaddr, 34);
33994
33995 return val_out;
33996 }
33997@@ -2663,8 +2663,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
33998 if (!lp->mii)
33999 return;
34000
34001- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34002- lp->a.write_bcr(ioaddr, 34, val);
34003+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34004+ lp->a->write_bcr(ioaddr, 34, val);
34005 }
34006
34007 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34008@@ -2741,7 +2741,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34009 curr_link = mii_link_ok(&lp->mii_if);
34010 } else {
34011 ulong ioaddr = dev->base_addr; /* card base I/O address */
34012- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
34013+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
34014 }
34015 if (!curr_link) {
34016 if (prev_link || verbose) {
34017@@ -2764,13 +2764,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34018 (ecmd.duplex == DUPLEX_FULL)
34019 ? "full" : "half");
34020 }
34021- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
34022+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
34023 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
34024 if (lp->mii_if.full_duplex)
34025 bcr9 |= (1 << 0);
34026 else
34027 bcr9 &= ~(1 << 0);
34028- lp->a.write_bcr(dev->base_addr, 9, bcr9);
34029+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
34030 }
34031 } else {
34032 netif_info(lp, link, dev, "link up\n");
34033diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
34034index edfa15d..002bfa9 100644
34035--- a/drivers/net/ppp_generic.c
34036+++ b/drivers/net/ppp_generic.c
34037@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34038 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
34039 struct ppp_stats stats;
34040 struct ppp_comp_stats cstats;
34041- char *vers;
34042
34043 switch (cmd) {
34044 case SIOCGPPPSTATS:
34045@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34046 break;
34047
34048 case SIOCGPPPVER:
34049- vers = PPP_VERSION;
34050- if (copy_to_user(addr, vers, strlen(vers) + 1))
34051+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
34052 break;
34053 err = 0;
34054 break;
34055diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
34056index 6d657ca..d1be94b 100644
34057--- a/drivers/net/r8169.c
34058+++ b/drivers/net/r8169.c
34059@@ -663,12 +663,12 @@ struct rtl8169_private {
34060 struct mdio_ops {
34061 void (*write)(void __iomem *, int, int);
34062 int (*read)(void __iomem *, int);
34063- } mdio_ops;
34064+ } __no_const mdio_ops;
34065
34066 struct pll_power_ops {
34067 void (*down)(struct rtl8169_private *);
34068 void (*up)(struct rtl8169_private *);
34069- } pll_power_ops;
34070+ } __no_const pll_power_ops;
34071
34072 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
34073 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
34074diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
34075index 3c0f131..17f8b02 100644
34076--- a/drivers/net/sis190.c
34077+++ b/drivers/net/sis190.c
34078@@ -1624,7 +1624,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
34079 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
34080 struct net_device *dev)
34081 {
34082- static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
34083+ static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
34084 struct sis190_private *tp = netdev_priv(dev);
34085 struct pci_dev *isa_bridge;
34086 u8 reg, tmp8;
34087diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
34088index 4793df8..44c9849 100644
34089--- a/drivers/net/sundance.c
34090+++ b/drivers/net/sundance.c
34091@@ -218,7 +218,7 @@ enum {
34092 struct pci_id_info {
34093 const char *name;
34094 };
34095-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34096+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34097 {"D-Link DFE-550TX FAST Ethernet Adapter"},
34098 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
34099 {"D-Link DFE-580TX 4 port Server Adapter"},
34100diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
34101index 2ea456d..3ad9523 100644
34102--- a/drivers/net/tg3.h
34103+++ b/drivers/net/tg3.h
34104@@ -134,6 +134,7 @@
34105 #define CHIPREV_ID_5750_A0 0x4000
34106 #define CHIPREV_ID_5750_A1 0x4001
34107 #define CHIPREV_ID_5750_A3 0x4003
34108+#define CHIPREV_ID_5750_C1 0x4201
34109 #define CHIPREV_ID_5750_C2 0x4202
34110 #define CHIPREV_ID_5752_A0_HW 0x5000
34111 #define CHIPREV_ID_5752_A0 0x6000
34112diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
34113index 515f122..41dd273 100644
34114--- a/drivers/net/tokenring/abyss.c
34115+++ b/drivers/net/tokenring/abyss.c
34116@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
34117
34118 static int __init abyss_init (void)
34119 {
34120- abyss_netdev_ops = tms380tr_netdev_ops;
34121+ pax_open_kernel();
34122+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34123
34124- abyss_netdev_ops.ndo_open = abyss_open;
34125- abyss_netdev_ops.ndo_stop = abyss_close;
34126+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
34127+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
34128+ pax_close_kernel();
34129
34130 return pci_register_driver(&abyss_driver);
34131 }
34132diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
34133index 6153cfd..cf69c1c 100644
34134--- a/drivers/net/tokenring/madgemc.c
34135+++ b/drivers/net/tokenring/madgemc.c
34136@@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver = {
34137
34138 static int __init madgemc_init (void)
34139 {
34140- madgemc_netdev_ops = tms380tr_netdev_ops;
34141- madgemc_netdev_ops.ndo_open = madgemc_open;
34142- madgemc_netdev_ops.ndo_stop = madgemc_close;
34143+ pax_open_kernel();
34144+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34145+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
34146+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
34147+ pax_close_kernel();
34148
34149 return mca_register_driver (&madgemc_driver);
34150 }
34151diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
34152index 8d362e6..f91cc52 100644
34153--- a/drivers/net/tokenring/proteon.c
34154+++ b/drivers/net/tokenring/proteon.c
34155@@ -353,9 +353,11 @@ static int __init proteon_init(void)
34156 struct platform_device *pdev;
34157 int i, num = 0, err = 0;
34158
34159- proteon_netdev_ops = tms380tr_netdev_ops;
34160- proteon_netdev_ops.ndo_open = proteon_open;
34161- proteon_netdev_ops.ndo_stop = tms380tr_close;
34162+ pax_open_kernel();
34163+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34164+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
34165+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
34166+ pax_close_kernel();
34167
34168 err = platform_driver_register(&proteon_driver);
34169 if (err)
34170diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
34171index 46db5c5..37c1536 100644
34172--- a/drivers/net/tokenring/skisa.c
34173+++ b/drivers/net/tokenring/skisa.c
34174@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
34175 struct platform_device *pdev;
34176 int i, num = 0, err = 0;
34177
34178- sk_isa_netdev_ops = tms380tr_netdev_ops;
34179- sk_isa_netdev_ops.ndo_open = sk_isa_open;
34180- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34181+ pax_open_kernel();
34182+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34183+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
34184+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34185+ pax_close_kernel();
34186
34187 err = platform_driver_register(&sk_isa_driver);
34188 if (err)
34189diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
34190index ce90efc..2676f89 100644
34191--- a/drivers/net/tulip/de2104x.c
34192+++ b/drivers/net/tulip/de2104x.c
34193@@ -1795,6 +1795,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
34194 struct de_srom_info_leaf *il;
34195 void *bufp;
34196
34197+ pax_track_stack();
34198+
34199 /* download entire eeprom */
34200 for (i = 0; i < DE_EEPROM_WORDS; i++)
34201 ((__le16 *)ee_data)[i] =
34202diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
34203index 959b410..c97fac2 100644
34204--- a/drivers/net/tulip/de4x5.c
34205+++ b/drivers/net/tulip/de4x5.c
34206@@ -5397,7 +5397,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34207 for (i=0; i<ETH_ALEN; i++) {
34208 tmp.addr[i] = dev->dev_addr[i];
34209 }
34210- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34211+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34212 break;
34213
34214 case DE4X5_SET_HWADDR: /* Set the hardware address */
34215@@ -5437,7 +5437,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34216 spin_lock_irqsave(&lp->lock, flags);
34217 memcpy(&statbuf, &lp->pktStats, ioc->len);
34218 spin_unlock_irqrestore(&lp->lock, flags);
34219- if (copy_to_user(ioc->data, &statbuf, ioc->len))
34220+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
34221 return -EFAULT;
34222 break;
34223 }
34224diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
34225index fa5eee9..e074432 100644
34226--- a/drivers/net/tulip/eeprom.c
34227+++ b/drivers/net/tulip/eeprom.c
34228@@ -81,7 +81,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
34229 {NULL}};
34230
34231
34232-static const char *block_name[] __devinitdata = {
34233+static const char *block_name[] __devinitconst = {
34234 "21140 non-MII",
34235 "21140 MII PHY",
34236 "21142 Serial PHY",
34237diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
34238index 862eadf..3eee1e6 100644
34239--- a/drivers/net/tulip/winbond-840.c
34240+++ b/drivers/net/tulip/winbond-840.c
34241@@ -236,7 +236,7 @@ struct pci_id_info {
34242 int drv_flags; /* Driver use, intended as capability flags. */
34243 };
34244
34245-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34246+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34247 { /* Sometime a Level-One switch card. */
34248 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
34249 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
34250diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
34251index 304fe78..db112fa 100644
34252--- a/drivers/net/usb/hso.c
34253+++ b/drivers/net/usb/hso.c
34254@@ -71,7 +71,7 @@
34255 #include <asm/byteorder.h>
34256 #include <linux/serial_core.h>
34257 #include <linux/serial.h>
34258-
34259+#include <asm/local.h>
34260
34261 #define MOD_AUTHOR "Option Wireless"
34262 #define MOD_DESCRIPTION "USB High Speed Option driver"
34263@@ -257,7 +257,7 @@ struct hso_serial {
34264
34265 /* from usb_serial_port */
34266 struct tty_struct *tty;
34267- int open_count;
34268+ local_t open_count;
34269 spinlock_t serial_lock;
34270
34271 int (*write_data) (struct hso_serial *serial);
34272@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
34273 struct urb *urb;
34274
34275 urb = serial->rx_urb[0];
34276- if (serial->open_count > 0) {
34277+ if (local_read(&serial->open_count) > 0) {
34278 count = put_rxbuf_data(urb, serial);
34279 if (count == -1)
34280 return;
34281@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
34282 DUMP1(urb->transfer_buffer, urb->actual_length);
34283
34284 /* Anyone listening? */
34285- if (serial->open_count == 0)
34286+ if (local_read(&serial->open_count) == 0)
34287 return;
34288
34289 if (status == 0) {
34290@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34291 spin_unlock_irq(&serial->serial_lock);
34292
34293 /* check for port already opened, if not set the termios */
34294- serial->open_count++;
34295- if (serial->open_count == 1) {
34296+ if (local_inc_return(&serial->open_count) == 1) {
34297 serial->rx_state = RX_IDLE;
34298 /* Force default termio settings */
34299 _hso_serial_set_termios(tty, NULL);
34300@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34301 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
34302 if (result) {
34303 hso_stop_serial_device(serial->parent);
34304- serial->open_count--;
34305+ local_dec(&serial->open_count);
34306 kref_put(&serial->parent->ref, hso_serial_ref_free);
34307 }
34308 } else {
34309@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
34310
34311 /* reset the rts and dtr */
34312 /* do the actual close */
34313- serial->open_count--;
34314+ local_dec(&serial->open_count);
34315
34316- if (serial->open_count <= 0) {
34317- serial->open_count = 0;
34318+ if (local_read(&serial->open_count) <= 0) {
34319+ local_set(&serial->open_count, 0);
34320 spin_lock_irq(&serial->serial_lock);
34321 if (serial->tty == tty) {
34322 serial->tty->driver_data = NULL;
34323@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
34324
34325 /* the actual setup */
34326 spin_lock_irqsave(&serial->serial_lock, flags);
34327- if (serial->open_count)
34328+ if (local_read(&serial->open_count))
34329 _hso_serial_set_termios(tty, old);
34330 else
34331 tty->termios = old;
34332@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *urb)
34333 D1("Pending read interrupt on port %d\n", i);
34334 spin_lock(&serial->serial_lock);
34335 if (serial->rx_state == RX_IDLE &&
34336- serial->open_count > 0) {
34337+ local_read(&serial->open_count) > 0) {
34338 /* Setup and send a ctrl req read on
34339 * port i */
34340 if (!serial->rx_urb_filled[0]) {
34341@@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interface *iface)
34342 /* Start all serial ports */
34343 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
34344 if (serial_table[i] && (serial_table[i]->interface == iface)) {
34345- if (dev2ser(serial_table[i])->open_count) {
34346+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
34347 result =
34348 hso_start_serial_device(serial_table[i], GFP_NOIO);
34349 hso_kick_transmit(dev2ser(serial_table[i]));
34350diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34351index 27400ed..c796e05 100644
34352--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
34353+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34354@@ -601,8 +601,7 @@ vmxnet3_set_rss_indir(struct net_device *netdev,
34355 * Return with error code if any of the queue indices
34356 * is out of range
34357 */
34358- if (p->ring_index[i] < 0 ||
34359- p->ring_index[i] >= adapter->num_rx_queues)
34360+ if (p->ring_index[i] >= adapter->num_rx_queues)
34361 return -EINVAL;
34362 }
34363
34364diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
34365index dd36258..e47fd31 100644
34366--- a/drivers/net/vxge/vxge-config.h
34367+++ b/drivers/net/vxge/vxge-config.h
34368@@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
34369 void (*link_down)(struct __vxge_hw_device *devh);
34370 void (*crit_err)(struct __vxge_hw_device *devh,
34371 enum vxge_hw_event type, u64 ext_data);
34372-};
34373+} __no_const;
34374
34375 /*
34376 * struct __vxge_hw_blockpool_entry - Block private data structure
34377diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
34378index 178348a2..18bb433 100644
34379--- a/drivers/net/vxge/vxge-main.c
34380+++ b/drivers/net/vxge/vxge-main.c
34381@@ -100,6 +100,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
34382 struct sk_buff *completed[NR_SKB_COMPLETED];
34383 int more;
34384
34385+ pax_track_stack();
34386+
34387 do {
34388 more = 0;
34389 skb_ptr = completed;
34390@@ -1915,6 +1917,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
34391 u8 mtable[256] = {0}; /* CPU to vpath mapping */
34392 int index;
34393
34394+ pax_track_stack();
34395+
34396 /*
34397 * Filling
34398 * - itable with bucket numbers
34399diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
34400index 4a518a3..936b334 100644
34401--- a/drivers/net/vxge/vxge-traffic.h
34402+++ b/drivers/net/vxge/vxge-traffic.h
34403@@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
34404 struct vxge_hw_mempool_dma *dma_object,
34405 u32 index,
34406 u32 is_last);
34407-};
34408+} __no_const;
34409
34410 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
34411 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
34412diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
34413index 56aeb01..547f71f 100644
34414--- a/drivers/net/wan/hdlc_x25.c
34415+++ b/drivers/net/wan/hdlc_x25.c
34416@@ -134,16 +134,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
34417
34418 static int x25_open(struct net_device *dev)
34419 {
34420- struct lapb_register_struct cb;
34421+ static struct lapb_register_struct cb = {
34422+ .connect_confirmation = x25_connected,
34423+ .connect_indication = x25_connected,
34424+ .disconnect_confirmation = x25_disconnected,
34425+ .disconnect_indication = x25_disconnected,
34426+ .data_indication = x25_data_indication,
34427+ .data_transmit = x25_data_transmit
34428+ };
34429 int result;
34430
34431- cb.connect_confirmation = x25_connected;
34432- cb.connect_indication = x25_connected;
34433- cb.disconnect_confirmation = x25_disconnected;
34434- cb.disconnect_indication = x25_disconnected;
34435- cb.data_indication = x25_data_indication;
34436- cb.data_transmit = x25_data_transmit;
34437-
34438 result = lapb_register(dev, &cb);
34439 if (result != LAPB_OK)
34440 return result;
34441diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
34442index 1fda46c..f2858f2 100644
34443--- a/drivers/net/wimax/i2400m/usb-fw.c
34444+++ b/drivers/net/wimax/i2400m/usb-fw.c
34445@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
34446 int do_autopm = 1;
34447 DECLARE_COMPLETION_ONSTACK(notif_completion);
34448
34449+ pax_track_stack();
34450+
34451 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
34452 i2400m, ack, ack_size);
34453 BUG_ON(_ack == i2400m->bm_ack_buf);
34454diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
34455index e1b3e3c..e413f18 100644
34456--- a/drivers/net/wireless/airo.c
34457+++ b/drivers/net/wireless/airo.c
34458@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
34459 BSSListElement * loop_net;
34460 BSSListElement * tmp_net;
34461
34462+ pax_track_stack();
34463+
34464 /* Blow away current list of scan results */
34465 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
34466 list_move_tail (&loop_net->list, &ai->network_free_list);
34467@@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
34468 WepKeyRid wkr;
34469 int rc;
34470
34471+ pax_track_stack();
34472+
34473 memset( &mySsid, 0, sizeof( mySsid ) );
34474 kfree (ai->flash);
34475 ai->flash = NULL;
34476@@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct inode *inode,
34477 __le32 *vals = stats.vals;
34478 int len;
34479
34480+ pax_track_stack();
34481+
34482 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34483 return -ENOMEM;
34484 data = file->private_data;
34485@@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
34486 /* If doLoseSync is not 1, we won't do a Lose Sync */
34487 int doLoseSync = -1;
34488
34489+ pax_track_stack();
34490+
34491 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34492 return -ENOMEM;
34493 data = file->private_data;
34494@@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_device *dev,
34495 int i;
34496 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
34497
34498+ pax_track_stack();
34499+
34500 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
34501 if (!qual)
34502 return -ENOMEM;
34503@@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
34504 CapabilityRid cap_rid;
34505 __le32 *vals = stats_rid.vals;
34506
34507+ pax_track_stack();
34508+
34509 /* Get stats out of the card */
34510 clear_bit(JOB_WSTATS, &local->jobs);
34511 if (local->power.event) {
34512diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
34513index 17c4b56..00d836f 100644
34514--- a/drivers/net/wireless/ath/ath.h
34515+++ b/drivers/net/wireless/ath/ath.h
34516@@ -121,6 +121,7 @@ struct ath_ops {
34517 void (*write_flush) (void *);
34518 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
34519 };
34520+typedef struct ath_ops __no_const ath_ops_no_const;
34521
34522 struct ath_common;
34523 struct ath_bus_ops;
34524diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
34525index ccca724..7afbadc 100644
34526--- a/drivers/net/wireless/ath/ath5k/debug.c
34527+++ b/drivers/net/wireless/ath/ath5k/debug.c
34528@@ -203,6 +203,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
34529 unsigned int v;
34530 u64 tsf;
34531
34532+ pax_track_stack();
34533+
34534 v = ath5k_hw_reg_read(ah, AR5K_BEACON);
34535 len += snprintf(buf + len, sizeof(buf) - len,
34536 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
34537@@ -321,6 +323,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
34538 unsigned int len = 0;
34539 unsigned int i;
34540
34541+ pax_track_stack();
34542+
34543 len += snprintf(buf + len, sizeof(buf) - len,
34544 "DEBUG LEVEL: 0x%08x\n\n", ah->debug.level);
34545
34546@@ -492,6 +496,8 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
34547 unsigned int len = 0;
34548 u32 filt = ath5k_hw_get_rx_filter(ah);
34549
34550+ pax_track_stack();
34551+
34552 len += snprintf(buf + len, sizeof(buf) - len, "bssid-mask: %pM\n",
34553 ah->bssidmask);
34554 len += snprintf(buf + len, sizeof(buf) - len, "filter-flags: 0x%x ",
34555@@ -548,6 +554,8 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
34556 unsigned int len = 0;
34557 int i;
34558
34559+ pax_track_stack();
34560+
34561 len += snprintf(buf + len, sizeof(buf) - len,
34562 "RX\n---------------------\n");
34563 len += snprintf(buf + len, sizeof(buf) - len, "CRC\t%u\t(%u%%)\n",
34564@@ -665,6 +673,8 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
34565 char buf[700];
34566 unsigned int len = 0;
34567
34568+ pax_track_stack();
34569+
34570 len += snprintf(buf + len, sizeof(buf) - len,
34571 "HW has PHY error counters:\t%s\n",
34572 ah->ah_capabilities.cap_has_phyerr_counters ?
34573@@ -829,6 +839,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34574 struct ath5k_buf *bf, *bf0;
34575 int i, n;
34576
34577+ pax_track_stack();
34578+
34579 len += snprintf(buf + len, sizeof(buf) - len,
34580 "available txbuffers: %d\n", ah->txbuf_len);
34581
34582diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34583index 7c2aaad..ad14dee 100644
34584--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34585+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34586@@ -758,6 +758,8 @@ static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah)
34587 int i, im, j;
34588 int nmeasurement;
34589
34590+ pax_track_stack();
34591+
34592 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
34593 if (ah->txchainmask & (1 << i))
34594 num_chains++;
34595diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34596index f80d1d6..08b773d 100644
34597--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34598+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34599@@ -406,6 +406,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
34600 int theta_low_bin = 0;
34601 int i;
34602
34603+ pax_track_stack();
34604+
34605 /* disregard any bin that contains <= 16 samples */
34606 thresh_accum_cnt = 16;
34607 scale_factor = 5;
34608diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
34609index d1eb896..8b67cd4 100644
34610--- a/drivers/net/wireless/ath/ath9k/debug.c
34611+++ b/drivers/net/wireless/ath/ath9k/debug.c
34612@@ -387,6 +387,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
34613 char buf[512];
34614 unsigned int len = 0;
34615
34616+ pax_track_stack();
34617+
34618 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
34619 len += snprintf(buf + len, sizeof(buf) - len,
34620 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
34621@@ -477,6 +479,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
34622 u8 addr[ETH_ALEN];
34623 u32 tmp;
34624
34625+ pax_track_stack();
34626+
34627 len += snprintf(buf + len, sizeof(buf) - len,
34628 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
34629 wiphy_name(sc->hw->wiphy),
34630diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34631index d3ff33c..309398e 100644
34632--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34633+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34634@@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
34635 unsigned int len = 0;
34636 int ret = 0;
34637
34638+ pax_track_stack();
34639+
34640 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34641
34642 ath9k_htc_ps_wakeup(priv);
34643@@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
34644 unsigned int len = 0;
34645 int ret = 0;
34646
34647+ pax_track_stack();
34648+
34649 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34650
34651 ath9k_htc_ps_wakeup(priv);
34652@@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
34653 unsigned int len = 0;
34654 int ret = 0;
34655
34656+ pax_track_stack();
34657+
34658 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34659
34660 ath9k_htc_ps_wakeup(priv);
34661@@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
34662 char buf[512];
34663 unsigned int len = 0;
34664
34665+ pax_track_stack();
34666+
34667 len += snprintf(buf + len, sizeof(buf) - len,
34668 "%20s : %10u\n", "Buffers queued",
34669 priv->debug.tx_stats.buf_queued);
34670@@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct file *file, char __user *user_buf,
34671 char buf[512];
34672 unsigned int len = 0;
34673
34674+ pax_track_stack();
34675+
34676 spin_lock_bh(&priv->tx.tx_lock);
34677
34678 len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
34679@@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34680 char buf[512];
34681 unsigned int len = 0;
34682
34683+ pax_track_stack();
34684+
34685 len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
34686 "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
34687
34688diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
34689index c798890..c19a8fb 100644
34690--- a/drivers/net/wireless/ath/ath9k/hw.h
34691+++ b/drivers/net/wireless/ath/ath9k/hw.h
34692@@ -588,7 +588,7 @@ struct ath_hw_private_ops {
34693
34694 /* ANI */
34695 void (*ani_cache_ini_regs)(struct ath_hw *ah);
34696-};
34697+} __no_const;
34698
34699 /**
34700 * struct ath_hw_ops - callbacks used by hardware code and driver code
34701@@ -639,7 +639,7 @@ struct ath_hw_ops {
34702 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
34703 struct ath_hw_antcomb_conf *antconf);
34704
34705-};
34706+} __no_const;
34707
34708 struct ath_nf_limits {
34709 s16 max;
34710@@ -652,7 +652,7 @@ struct ath_nf_limits {
34711 #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */
34712
34713 struct ath_hw {
34714- struct ath_ops reg_ops;
34715+ ath_ops_no_const reg_ops;
34716
34717 struct ieee80211_hw *hw;
34718 struct ath_common common;
34719diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
34720index ef9ad79..f5f8d80 100644
34721--- a/drivers/net/wireless/ipw2x00/ipw2100.c
34722+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
34723@@ -2102,6 +2102,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
34724 int err;
34725 DECLARE_SSID_BUF(ssid);
34726
34727+ pax_track_stack();
34728+
34729 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
34730
34731 if (ssid_len)
34732@@ -5451,6 +5453,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
34733 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
34734 int err;
34735
34736+ pax_track_stack();
34737+
34738 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
34739 idx, keylen, len);
34740
34741diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
34742index 32a9966..de69787 100644
34743--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
34744+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
34745@@ -1565,6 +1565,8 @@ static void libipw_process_probe_response(struct libipw_device
34746 unsigned long flags;
34747 DECLARE_SSID_BUF(ssid);
34748
34749+ pax_track_stack();
34750+
34751 LIBIPW_DEBUG_SCAN("'%s' (%pM"
34752 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
34753 print_ssid(ssid, info_element->data, info_element->len),
34754diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
34755index 66ee1562..b90412b 100644
34756--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
34757+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
34758@@ -3687,7 +3687,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
34759 */
34760 if (iwl3945_mod_params.disable_hw_scan) {
34761 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
34762- iwl3945_hw_ops.hw_scan = NULL;
34763+ pax_open_kernel();
34764+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
34765+ pax_close_kernel();
34766 }
34767
34768 IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
34769diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34770index 3789ff4..22ab151 100644
34771--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34772+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34773@@ -920,6 +920,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
34774 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
34775 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
34776
34777+ pax_track_stack();
34778+
34779 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
34780
34781 /* Treat uninitialized rate scaling data same as non-existing. */
34782@@ -2931,6 +2933,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
34783 container_of(lq_sta, struct iwl_station_priv, lq_sta);
34784 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
34785
34786+ pax_track_stack();
34787+
34788 /* Override starting rate (index 0) if needed for debug purposes */
34789 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
34790
34791diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
34792index f9a407e..a6f2bb7 100644
34793--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
34794+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
34795@@ -68,8 +68,8 @@ do { \
34796 } while (0)
34797
34798 #else
34799-#define IWL_DEBUG(__priv, level, fmt, args...)
34800-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
34801+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
34802+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
34803 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
34804 const void *p, u32 len)
34805 {}
34806diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34807index ec1485b..900c3bd 100644
34808--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34809+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34810@@ -561,6 +561,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
34811 int pos = 0;
34812 const size_t bufsz = sizeof(buf);
34813
34814+ pax_track_stack();
34815+
34816 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
34817 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
34818 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
34819@@ -693,6 +695,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
34820 char buf[256 * NUM_IWL_RXON_CTX];
34821 const size_t bufsz = sizeof(buf);
34822
34823+ pax_track_stack();
34824+
34825 for_each_context(priv, ctx) {
34826 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
34827 ctx->ctxid);
34828diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
34829index 0a0cc96..fd49ad8 100644
34830--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
34831+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
34832@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
34833 int buf_len = 512;
34834 size_t len = 0;
34835
34836+ pax_track_stack();
34837+
34838 if (*ppos != 0)
34839 return 0;
34840 if (count < sizeof(buf))
34841diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
34842index 031cd89..bdc8435 100644
34843--- a/drivers/net/wireless/mac80211_hwsim.c
34844+++ b/drivers/net/wireless/mac80211_hwsim.c
34845@@ -1670,9 +1670,11 @@ static int __init init_mac80211_hwsim(void)
34846 return -EINVAL;
34847
34848 if (fake_hw_scan) {
34849- mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
34850- mac80211_hwsim_ops.sw_scan_start = NULL;
34851- mac80211_hwsim_ops.sw_scan_complete = NULL;
34852+ pax_open_kernel();
34853+ *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
34854+ *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
34855+ *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
34856+ pax_close_kernel();
34857 }
34858
34859 spin_lock_init(&hwsim_radio_lock);
34860diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
34861index 2215c3c..64e6a47 100644
34862--- a/drivers/net/wireless/mwifiex/main.h
34863+++ b/drivers/net/wireless/mwifiex/main.h
34864@@ -560,7 +560,7 @@ struct mwifiex_if_ops {
34865
34866 void (*update_mp_end_port) (struct mwifiex_adapter *, u16);
34867 void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
34868-};
34869+} __no_const;
34870
34871 struct mwifiex_adapter {
34872 struct mwifiex_private *priv[MWIFIEX_MAX_BSS_NUM];
34873diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
34874index 29f9389..f6d2ce0 100644
34875--- a/drivers/net/wireless/rndis_wlan.c
34876+++ b/drivers/net/wireless/rndis_wlan.c
34877@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
34878
34879 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
34880
34881- if (rts_threshold < 0 || rts_threshold > 2347)
34882+ if (rts_threshold > 2347)
34883 rts_threshold = 2347;
34884
34885 tmp = cpu_to_le32(rts_threshold);
34886diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34887index 3b11642..d6bb049 100644
34888--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34889+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34890@@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
34891 u8 rfpath;
34892 u8 num_total_rfpath = rtlphy->num_total_rfpath;
34893
34894+ pax_track_stack();
34895+
34896 precommoncmdcnt = 0;
34897 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
34898 MAX_PRECMD_CNT,
34899diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
34900index a77f1bb..c608b2b 100644
34901--- a/drivers/net/wireless/wl1251/wl1251.h
34902+++ b/drivers/net/wireless/wl1251/wl1251.h
34903@@ -266,7 +266,7 @@ struct wl1251_if_operations {
34904 void (*reset)(struct wl1251 *wl);
34905 void (*enable_irq)(struct wl1251 *wl);
34906 void (*disable_irq)(struct wl1251 *wl);
34907-};
34908+} __no_const;
34909
34910 struct wl1251 {
34911 struct ieee80211_hw *hw;
34912diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
34913index e0b3736..4b466e6 100644
34914--- a/drivers/net/wireless/wl12xx/spi.c
34915+++ b/drivers/net/wireless/wl12xx/spi.c
34916@@ -281,6 +281,8 @@ static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
34917 u32 chunk_len;
34918 int i;
34919
34920+ pax_track_stack();
34921+
34922 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
34923
34924 spi_message_init(&m);
34925diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
34926index f34b5b2..b5abb9f 100644
34927--- a/drivers/oprofile/buffer_sync.c
34928+++ b/drivers/oprofile/buffer_sync.c
34929@@ -343,7 +343,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
34930 if (cookie == NO_COOKIE)
34931 offset = pc;
34932 if (cookie == INVALID_COOKIE) {
34933- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
34934+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
34935 offset = pc;
34936 }
34937 if (cookie != last_cookie) {
34938@@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
34939 /* add userspace sample */
34940
34941 if (!mm) {
34942- atomic_inc(&oprofile_stats.sample_lost_no_mm);
34943+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
34944 return 0;
34945 }
34946
34947 cookie = lookup_dcookie(mm, s->eip, &offset);
34948
34949 if (cookie == INVALID_COOKIE) {
34950- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
34951+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
34952 return 0;
34953 }
34954
34955@@ -563,7 +563,7 @@ void sync_buffer(int cpu)
34956 /* ignore backtraces if failed to add a sample */
34957 if (state == sb_bt_start) {
34958 state = sb_bt_ignore;
34959- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
34960+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
34961 }
34962 }
34963 release_mm(mm);
34964diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
34965index dd87e86..bc0148c 100644
34966--- a/drivers/oprofile/event_buffer.c
34967+++ b/drivers/oprofile/event_buffer.c
34968@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
34969 }
34970
34971 if (buffer_pos == buffer_size) {
34972- atomic_inc(&oprofile_stats.event_lost_overflow);
34973+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
34974 return;
34975 }
34976
34977diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
34978index f8c752e..28bf4fc 100644
34979--- a/drivers/oprofile/oprof.c
34980+++ b/drivers/oprofile/oprof.c
34981@@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
34982 if (oprofile_ops.switch_events())
34983 return;
34984
34985- atomic_inc(&oprofile_stats.multiplex_counter);
34986+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
34987 start_switch_worker();
34988 }
34989
34990diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
34991index 917d28e..d62d981 100644
34992--- a/drivers/oprofile/oprofile_stats.c
34993+++ b/drivers/oprofile/oprofile_stats.c
34994@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
34995 cpu_buf->sample_invalid_eip = 0;
34996 }
34997
34998- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
34999- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
35000- atomic_set(&oprofile_stats.event_lost_overflow, 0);
35001- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
35002- atomic_set(&oprofile_stats.multiplex_counter, 0);
35003+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
35004+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
35005+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
35006+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
35007+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
35008 }
35009
35010
35011diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
35012index 38b6fc0..b5cbfce 100644
35013--- a/drivers/oprofile/oprofile_stats.h
35014+++ b/drivers/oprofile/oprofile_stats.h
35015@@ -13,11 +13,11 @@
35016 #include <linux/atomic.h>
35017
35018 struct oprofile_stat_struct {
35019- atomic_t sample_lost_no_mm;
35020- atomic_t sample_lost_no_mapping;
35021- atomic_t bt_lost_no_mapping;
35022- atomic_t event_lost_overflow;
35023- atomic_t multiplex_counter;
35024+ atomic_unchecked_t sample_lost_no_mm;
35025+ atomic_unchecked_t sample_lost_no_mapping;
35026+ atomic_unchecked_t bt_lost_no_mapping;
35027+ atomic_unchecked_t event_lost_overflow;
35028+ atomic_unchecked_t multiplex_counter;
35029 };
35030
35031 extern struct oprofile_stat_struct oprofile_stats;
35032diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
35033index e9ff6f7..28e259a 100644
35034--- a/drivers/oprofile/oprofilefs.c
35035+++ b/drivers/oprofile/oprofilefs.c
35036@@ -186,7 +186,7 @@ static const struct file_operations atomic_ro_fops = {
35037
35038
35039 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
35040- char const *name, atomic_t *val)
35041+ char const *name, atomic_unchecked_t *val)
35042 {
35043 return __oprofilefs_create_file(sb, root, name,
35044 &atomic_ro_fops, 0444, val);
35045diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
35046index 3f56bc0..707d642 100644
35047--- a/drivers/parport/procfs.c
35048+++ b/drivers/parport/procfs.c
35049@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
35050
35051 *ppos += len;
35052
35053- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
35054+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
35055 }
35056
35057 #ifdef CONFIG_PARPORT_1284
35058@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
35059
35060 *ppos += len;
35061
35062- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
35063+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
35064 }
35065 #endif /* IEEE1284.3 support. */
35066
35067diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
35068index 9fff878..ad0ad53 100644
35069--- a/drivers/pci/hotplug/cpci_hotplug.h
35070+++ b/drivers/pci/hotplug/cpci_hotplug.h
35071@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
35072 int (*hardware_test) (struct slot* slot, u32 value);
35073 u8 (*get_power) (struct slot* slot);
35074 int (*set_power) (struct slot* slot, int value);
35075-};
35076+} __no_const;
35077
35078 struct cpci_hp_controller {
35079 unsigned int irq;
35080diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
35081index 76ba8a1..20ca857 100644
35082--- a/drivers/pci/hotplug/cpqphp_nvram.c
35083+++ b/drivers/pci/hotplug/cpqphp_nvram.c
35084@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
35085
35086 void compaq_nvram_init (void __iomem *rom_start)
35087 {
35088+
35089+#ifndef CONFIG_PAX_KERNEXEC
35090 if (rom_start) {
35091 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
35092 }
35093+#endif
35094+
35095 dbg("int15 entry = %p\n", compaq_int15_entry_point);
35096
35097 /* initialize our int15 lock */
35098diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
35099index cbfbab1..6a9fced 100644
35100--- a/drivers/pci/pcie/aspm.c
35101+++ b/drivers/pci/pcie/aspm.c
35102@@ -27,9 +27,9 @@
35103 #define MODULE_PARAM_PREFIX "pcie_aspm."
35104
35105 /* Note: those are not register definitions */
35106-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
35107-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
35108-#define ASPM_STATE_L1 (4) /* L1 state */
35109+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
35110+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
35111+#define ASPM_STATE_L1 (4U) /* L1 state */
35112 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
35113 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
35114
35115diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
35116index 6ab6bd3..72bdc69 100644
35117--- a/drivers/pci/probe.c
35118+++ b/drivers/pci/probe.c
35119@@ -136,7 +136,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
35120 u32 l, sz, mask;
35121 u16 orig_cmd;
35122
35123- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
35124+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
35125
35126 if (!dev->mmio_always_on) {
35127 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
35128diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
35129index 27911b5..5b6db88 100644
35130--- a/drivers/pci/proc.c
35131+++ b/drivers/pci/proc.c
35132@@ -476,7 +476,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
35133 static int __init pci_proc_init(void)
35134 {
35135 struct pci_dev *dev = NULL;
35136+
35137+#ifdef CONFIG_GRKERNSEC_PROC_ADD
35138+#ifdef CONFIG_GRKERNSEC_PROC_USER
35139+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
35140+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35141+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
35142+#endif
35143+#else
35144 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
35145+#endif
35146 proc_create("devices", 0, proc_bus_pci_dir,
35147 &proc_bus_pci_dev_operations);
35148 proc_initialized = 1;
35149diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
35150index 90832a9..419089a 100644
35151--- a/drivers/pci/xen-pcifront.c
35152+++ b/drivers/pci/xen-pcifront.c
35153@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_bus *bus, unsigned int devfn,
35154 struct pcifront_sd *sd = bus->sysdata;
35155 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35156
35157+ pax_track_stack();
35158+
35159 if (verbose_request)
35160 dev_info(&pdev->xdev->dev,
35161 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
35162@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci_bus *bus, unsigned int devfn,
35163 struct pcifront_sd *sd = bus->sysdata;
35164 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35165
35166+ pax_track_stack();
35167+
35168 if (verbose_request)
35169 dev_info(&pdev->xdev->dev,
35170 "write dev=%04x:%02x:%02x.%01x - "
35171@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(struct pci_dev *dev,
35172 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35173 struct msi_desc *entry;
35174
35175+ pax_track_stack();
35176+
35177 if (nvec > SH_INFO_MAX_VEC) {
35178 dev_err(&dev->dev, "too much vector for pci frontend: %x."
35179 " Increase SH_INFO_MAX_VEC.\n", nvec);
35180@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(struct pci_dev *dev)
35181 struct pcifront_sd *sd = dev->bus->sysdata;
35182 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35183
35184+ pax_track_stack();
35185+
35186 err = do_pci_op(pdev, &op);
35187
35188 /* What should do for error ? */
35189@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struct pci_dev *dev, int vector[])
35190 struct pcifront_sd *sd = dev->bus->sysdata;
35191 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35192
35193+ pax_track_stack();
35194+
35195 err = do_pci_op(pdev, &op);
35196 if (likely(!err)) {
35197 vector[0] = op.value;
35198diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
35199index 7bd829f..a3237ad 100644
35200--- a/drivers/platform/x86/thinkpad_acpi.c
35201+++ b/drivers/platform/x86/thinkpad_acpi.c
35202@@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
35203 return 0;
35204 }
35205
35206-void static hotkey_mask_warn_incomplete_mask(void)
35207+static void hotkey_mask_warn_incomplete_mask(void)
35208 {
35209 /* log only what the user can fix... */
35210 const u32 wantedmask = hotkey_driver_mask &
35211@@ -2325,11 +2325,6 @@ static void hotkey_read_nvram(struct tp_nvram_state *n, const u32 m)
35212 }
35213 }
35214
35215-static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35216- struct tp_nvram_state *newn,
35217- const u32 event_mask)
35218-{
35219-
35220 #define TPACPI_COMPARE_KEY(__scancode, __member) \
35221 do { \
35222 if ((event_mask & (1 << __scancode)) && \
35223@@ -2343,36 +2338,42 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35224 tpacpi_hotkey_send_key(__scancode); \
35225 } while (0)
35226
35227- void issue_volchange(const unsigned int oldvol,
35228- const unsigned int newvol)
35229- {
35230- unsigned int i = oldvol;
35231+static void issue_volchange(const unsigned int oldvol,
35232+ const unsigned int newvol,
35233+ const u32 event_mask)
35234+{
35235+ unsigned int i = oldvol;
35236
35237- while (i > newvol) {
35238- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35239- i--;
35240- }
35241- while (i < newvol) {
35242- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35243- i++;
35244- }
35245+ while (i > newvol) {
35246+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35247+ i--;
35248 }
35249+ while (i < newvol) {
35250+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35251+ i++;
35252+ }
35253+}
35254
35255- void issue_brightnesschange(const unsigned int oldbrt,
35256- const unsigned int newbrt)
35257- {
35258- unsigned int i = oldbrt;
35259+static void issue_brightnesschange(const unsigned int oldbrt,
35260+ const unsigned int newbrt,
35261+ const u32 event_mask)
35262+{
35263+ unsigned int i = oldbrt;
35264
35265- while (i > newbrt) {
35266- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35267- i--;
35268- }
35269- while (i < newbrt) {
35270- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35271- i++;
35272- }
35273+ while (i > newbrt) {
35274+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35275+ i--;
35276+ }
35277+ while (i < newbrt) {
35278+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35279+ i++;
35280 }
35281+}
35282
35283+static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35284+ struct tp_nvram_state *newn,
35285+ const u32 event_mask)
35286+{
35287 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_THINKPAD, thinkpad_toggle);
35288 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNSPACE, zoom_toggle);
35289 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNF7, display_toggle);
35290@@ -2406,7 +2407,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35291 oldn->volume_level != newn->volume_level) {
35292 /* recently muted, or repeated mute keypress, or
35293 * multiple presses ending in mute */
35294- issue_volchange(oldn->volume_level, newn->volume_level);
35295+ issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35296 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_MUTE);
35297 }
35298 } else {
35299@@ -2416,7 +2417,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35300 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35301 }
35302 if (oldn->volume_level != newn->volume_level) {
35303- issue_volchange(oldn->volume_level, newn->volume_level);
35304+ issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35305 } else if (oldn->volume_toggle != newn->volume_toggle) {
35306 /* repeated vol up/down keypress at end of scale ? */
35307 if (newn->volume_level == 0)
35308@@ -2429,7 +2430,8 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35309 /* handle brightness */
35310 if (oldn->brightness_level != newn->brightness_level) {
35311 issue_brightnesschange(oldn->brightness_level,
35312- newn->brightness_level);
35313+ newn->brightness_level,
35314+ event_mask);
35315 } else if (oldn->brightness_toggle != newn->brightness_toggle) {
35316 /* repeated key presses that didn't change state */
35317 if (newn->brightness_level == 0)
35318@@ -2438,10 +2440,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35319 && !tp_features.bright_unkfw)
35320 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35321 }
35322+}
35323
35324 #undef TPACPI_COMPARE_KEY
35325 #undef TPACPI_MAY_SEND_KEY
35326-}
35327
35328 /*
35329 * Polling driver
35330diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
35331index b859d16..5cc6b1a 100644
35332--- a/drivers/pnp/pnpbios/bioscalls.c
35333+++ b/drivers/pnp/pnpbios/bioscalls.c
35334@@ -59,7 +59,7 @@ do { \
35335 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
35336 } while(0)
35337
35338-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
35339+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
35340 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
35341
35342 /*
35343@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35344
35345 cpu = get_cpu();
35346 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
35347+
35348+ pax_open_kernel();
35349 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
35350+ pax_close_kernel();
35351
35352 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
35353 spin_lock_irqsave(&pnp_bios_lock, flags);
35354@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35355 :"memory");
35356 spin_unlock_irqrestore(&pnp_bios_lock, flags);
35357
35358+ pax_open_kernel();
35359 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
35360+ pax_close_kernel();
35361+
35362 put_cpu();
35363
35364 /* If we get here and this is set then the PnP BIOS faulted on us. */
35365@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
35366 return status;
35367 }
35368
35369-void pnpbios_calls_init(union pnp_bios_install_struct *header)
35370+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
35371 {
35372 int i;
35373
35374@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35375 pnp_bios_callpoint.offset = header->fields.pm16offset;
35376 pnp_bios_callpoint.segment = PNP_CS16;
35377
35378+ pax_open_kernel();
35379+
35380 for_each_possible_cpu(i) {
35381 struct desc_struct *gdt = get_cpu_gdt_table(i);
35382 if (!gdt)
35383@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35384 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
35385 (unsigned long)__va(header->fields.pm16dseg));
35386 }
35387+
35388+ pax_close_kernel();
35389 }
35390diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
35391index b0ecacb..7c9da2e 100644
35392--- a/drivers/pnp/resource.c
35393+++ b/drivers/pnp/resource.c
35394@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
35395 return 1;
35396
35397 /* check if the resource is valid */
35398- if (*irq < 0 || *irq > 15)
35399+ if (*irq > 15)
35400 return 0;
35401
35402 /* check if the resource is reserved */
35403@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
35404 return 1;
35405
35406 /* check if the resource is valid */
35407- if (*dma < 0 || *dma == 4 || *dma > 7)
35408+ if (*dma == 4 || *dma > 7)
35409 return 0;
35410
35411 /* check if the resource is reserved */
35412diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
35413index bb16f5b..c751eef 100644
35414--- a/drivers/power/bq27x00_battery.c
35415+++ b/drivers/power/bq27x00_battery.c
35416@@ -67,7 +67,7 @@
35417 struct bq27x00_device_info;
35418 struct bq27x00_access_methods {
35419 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
35420-};
35421+} __no_const;
35422
35423 enum bq27x00_chip { BQ27000, BQ27500 };
35424
35425diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
35426index 33f5d9a..d957d3f 100644
35427--- a/drivers/regulator/max8660.c
35428+++ b/drivers/regulator/max8660.c
35429@@ -383,8 +383,10 @@ static int __devinit max8660_probe(struct i2c_client *client,
35430 max8660->shadow_regs[MAX8660_OVER1] = 5;
35431 } else {
35432 /* Otherwise devices can be toggled via software */
35433- max8660_dcdc_ops.enable = max8660_dcdc_enable;
35434- max8660_dcdc_ops.disable = max8660_dcdc_disable;
35435+ pax_open_kernel();
35436+ *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
35437+ *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
35438+ pax_close_kernel();
35439 }
35440
35441 /*
35442diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
35443index 3285d41..ab7c22a 100644
35444--- a/drivers/regulator/mc13892-regulator.c
35445+++ b/drivers/regulator/mc13892-regulator.c
35446@@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev)
35447 }
35448 mc13xxx_unlock(mc13892);
35449
35450- mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35451+ pax_open_kernel();
35452+ *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35453 = mc13892_vcam_set_mode;
35454- mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35455+ *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35456 = mc13892_vcam_get_mode;
35457+ pax_close_kernel();
35458 for (i = 0; i < pdata->num_regulators; i++) {
35459 init_data = &pdata->regulators[i];
35460 priv->regulators[i] = regulator_register(
35461diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
35462index cace6d3..f623fda 100644
35463--- a/drivers/rtc/rtc-dev.c
35464+++ b/drivers/rtc/rtc-dev.c
35465@@ -14,6 +14,7 @@
35466 #include <linux/module.h>
35467 #include <linux/rtc.h>
35468 #include <linux/sched.h>
35469+#include <linux/grsecurity.h>
35470 #include "rtc-core.h"
35471
35472 static dev_t rtc_devt;
35473@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *file,
35474 if (copy_from_user(&tm, uarg, sizeof(tm)))
35475 return -EFAULT;
35476
35477+ gr_log_timechange();
35478+
35479 return rtc_set_time(rtc, &tm);
35480
35481 case RTC_PIE_ON:
35482diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
35483index f66c33b..7ae5823 100644
35484--- a/drivers/scsi/BusLogic.c
35485+++ b/drivers/scsi/BusLogic.c
35486@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
35487 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
35488 *PrototypeHostAdapter)
35489 {
35490+ pax_track_stack();
35491+
35492 /*
35493 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
35494 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
35495diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
35496index ffb5878..e6d785c 100644
35497--- a/drivers/scsi/aacraid/aacraid.h
35498+++ b/drivers/scsi/aacraid/aacraid.h
35499@@ -492,7 +492,7 @@ struct adapter_ops
35500 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
35501 /* Administrative operations */
35502 int (*adapter_comm)(struct aac_dev * dev, int comm);
35503-};
35504+} __no_const;
35505
35506 /*
35507 * Define which interrupt handler needs to be installed
35508diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
35509index 8a0b330..b4286de 100644
35510--- a/drivers/scsi/aacraid/commctrl.c
35511+++ b/drivers/scsi/aacraid/commctrl.c
35512@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
35513 u32 actual_fibsize64, actual_fibsize = 0;
35514 int i;
35515
35516+ pax_track_stack();
35517
35518 if (dev->in_reset) {
35519 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
35520diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
35521index c7b6fed..4db0569 100644
35522--- a/drivers/scsi/aacraid/linit.c
35523+++ b/drivers/scsi/aacraid/linit.c
35524@@ -93,7 +93,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
35525 #elif defined(__devinitconst)
35526 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35527 #else
35528-static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
35529+static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35530 #endif
35531 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
35532 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
35533diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
35534index d5ff142..49c0ebb 100644
35535--- a/drivers/scsi/aic94xx/aic94xx_init.c
35536+++ b/drivers/scsi/aic94xx/aic94xx_init.c
35537@@ -1012,7 +1012,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
35538 .lldd_control_phy = asd_control_phy,
35539 };
35540
35541-static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
35542+static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
35543 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
35544 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
35545 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
35546diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
35547index a796de9..1ef20e1 100644
35548--- a/drivers/scsi/bfa/bfa.h
35549+++ b/drivers/scsi/bfa/bfa.h
35550@@ -196,7 +196,7 @@ struct bfa_hwif_s {
35551 u32 *end);
35552 int cpe_vec_q0;
35553 int rme_vec_q0;
35554-};
35555+} __no_const;
35556 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
35557
35558 struct bfa_faa_cbfn_s {
35559diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
35560index e07bd47..dbd260a 100644
35561--- a/drivers/scsi/bfa/bfa_fcpim.c
35562+++ b/drivers/scsi/bfa/bfa_fcpim.c
35563@@ -4179,7 +4179,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35564 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
35565 {
35566 struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
35567- struct bfa_itn_s *itn;
35568+ bfa_itn_s_no_const *itn;
35569
35570 itn = BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
35571 itn->isr = isr;
35572diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
35573index 1080bcb..a3b39e3 100644
35574--- a/drivers/scsi/bfa/bfa_fcpim.h
35575+++ b/drivers/scsi/bfa/bfa_fcpim.h
35576@@ -37,6 +37,7 @@ struct bfa_iotag_s {
35577 struct bfa_itn_s {
35578 bfa_isr_func_t isr;
35579 };
35580+typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
35581
35582 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35583 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
35584@@ -149,7 +150,7 @@ struct bfa_fcp_mod_s {
35585 struct list_head iotag_tio_free_q; /* free IO resources */
35586 struct list_head iotag_unused_q; /* unused IO resources*/
35587 struct bfa_iotag_s *iotag_arr;
35588- struct bfa_itn_s *itn_arr;
35589+ bfa_itn_s_no_const *itn_arr;
35590 int num_ioim_reqs;
35591 int num_fwtio_reqs;
35592 int num_itns;
35593diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
35594index d4f951f..197c350 100644
35595--- a/drivers/scsi/bfa/bfa_fcs_lport.c
35596+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
35597@@ -1700,6 +1700,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
35598 u16 len, count;
35599 u16 templen;
35600
35601+ pax_track_stack();
35602+
35603 /*
35604 * get hba attributes
35605 */
35606@@ -1977,6 +1979,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
35607 u8 count = 0;
35608 u16 templen;
35609
35610+ pax_track_stack();
35611+
35612 /*
35613 * get port attributes
35614 */
35615diff --git a/drivers/scsi/bfa/bfa_fcs_rport.c b/drivers/scsi/bfa/bfa_fcs_rport.c
35616index 52628d5..f89d033 100644
35617--- a/drivers/scsi/bfa/bfa_fcs_rport.c
35618+++ b/drivers/scsi/bfa/bfa_fcs_rport.c
35619@@ -1871,6 +1871,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fcs_rport_s *rport,
35620 struct fc_rpsc_speed_info_s speeds;
35621 struct bfa_port_attr_s pport_attr;
35622
35623+ pax_track_stack();
35624+
35625 bfa_trc(port->fcs, rx_fchs->s_id);
35626 bfa_trc(port->fcs, rx_fchs->d_id);
35627
35628diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
35629index 546d46b..642fa5b 100644
35630--- a/drivers/scsi/bfa/bfa_ioc.h
35631+++ b/drivers/scsi/bfa/bfa_ioc.h
35632@@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
35633 bfa_ioc_disable_cbfn_t disable_cbfn;
35634 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
35635 bfa_ioc_reset_cbfn_t reset_cbfn;
35636-};
35637+} __no_const;
35638
35639 /*
35640 * IOC event notification mechanism.
35641@@ -346,7 +346,7 @@ struct bfa_ioc_hwif_s {
35642 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
35643 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
35644 bfa_boolean_t (*ioc_lpu_read_stat) (struct bfa_ioc_s *ioc);
35645-};
35646+} __no_const;
35647
35648 /*
35649 * Queue element to wait for room in request queue. FIFO order is
35650diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
35651index 66fb725..0fe05ab 100644
35652--- a/drivers/scsi/bfa/bfad.c
35653+++ b/drivers/scsi/bfa/bfad.c
35654@@ -1019,6 +1019,8 @@ bfad_start_ops(struct bfad_s *bfad) {
35655 struct bfad_vport_s *vport, *vport_new;
35656 struct bfa_fcs_driver_info_s driver_info;
35657
35658+ pax_track_stack();
35659+
35660 /* Limit min/max. xfer size to [64k-32MB] */
35661 if (max_xfer_size < BFAD_MIN_SECTORS >> 1)
35662 max_xfer_size = BFAD_MIN_SECTORS >> 1;
35663diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
35664index b4f6c9a..0eb1938 100644
35665--- a/drivers/scsi/dpt_i2o.c
35666+++ b/drivers/scsi/dpt_i2o.c
35667@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
35668 dma_addr_t addr;
35669 ulong flags = 0;
35670
35671+ pax_track_stack();
35672+
35673 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
35674 // get user msg size in u32s
35675 if(get_user(size, &user_msg[0])){
35676@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
35677 s32 rcode;
35678 dma_addr_t addr;
35679
35680+ pax_track_stack();
35681+
35682 memset(msg, 0 , sizeof(msg));
35683 len = scsi_bufflen(cmd);
35684 direction = 0x00000000;
35685diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
35686index 94de889..ca4f0cf 100644
35687--- a/drivers/scsi/eata.c
35688+++ b/drivers/scsi/eata.c
35689@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
35690 struct hostdata *ha;
35691 char name[16];
35692
35693+ pax_track_stack();
35694+
35695 sprintf(name, "%s%d", driver_name, j);
35696
35697 if (!request_region(port_base, REGION_SIZE, driver_name)) {
35698diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
35699index c74c4b8..c41ca3f 100644
35700--- a/drivers/scsi/fcoe/fcoe_ctlr.c
35701+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
35702@@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
35703 } buf;
35704 int rc;
35705
35706+ pax_track_stack();
35707+
35708 fiph = (struct fip_header *)skb->data;
35709 sub = fiph->fip_subcode;
35710
35711diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
35712index 3242bca..45a83e7 100644
35713--- a/drivers/scsi/gdth.c
35714+++ b/drivers/scsi/gdth.c
35715@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
35716 unsigned long flags;
35717 gdth_ha_str *ha;
35718
35719+ pax_track_stack();
35720+
35721 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
35722 return -EFAULT;
35723 ha = gdth_find_ha(ldrv.ionode);
35724@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
35725 gdth_ha_str *ha;
35726 int rval;
35727
35728+ pax_track_stack();
35729+
35730 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
35731 res.number >= MAX_HDRIVES)
35732 return -EFAULT;
35733@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg, char *cmnd)
35734 gdth_ha_str *ha;
35735 int rval;
35736
35737+ pax_track_stack();
35738+
35739 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
35740 return -EFAULT;
35741 ha = gdth_find_ha(gen.ionode);
35742@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
35743 int i;
35744 gdth_cmd_str gdtcmd;
35745 char cmnd[MAX_COMMAND_SIZE];
35746+
35747+ pax_track_stack();
35748+
35749 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
35750
35751 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
35752diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
35753index 6527543..81e4fe2 100644
35754--- a/drivers/scsi/gdth_proc.c
35755+++ b/drivers/scsi/gdth_proc.c
35756@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
35757 u64 paddr;
35758
35759 char cmnd[MAX_COMMAND_SIZE];
35760+
35761+ pax_track_stack();
35762+
35763 memset(cmnd, 0xff, 12);
35764 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
35765
35766@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
35767 gdth_hget_str *phg;
35768 char cmnd[MAX_COMMAND_SIZE];
35769
35770+ pax_track_stack();
35771+
35772 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
35773 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
35774 if (!gdtcmd || !estr)
35775diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
35776index 351dc0b..951dc32 100644
35777--- a/drivers/scsi/hosts.c
35778+++ b/drivers/scsi/hosts.c
35779@@ -42,7 +42,7 @@
35780 #include "scsi_logging.h"
35781
35782
35783-static atomic_t scsi_host_next_hn; /* host_no for next new host */
35784+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
35785
35786
35787 static void scsi_host_cls_release(struct device *dev)
35788@@ -357,7 +357,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
35789 * subtract one because we increment first then return, but we need to
35790 * know what the next host number was before increment
35791 */
35792- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
35793+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
35794 shost->dma_channel = 0xff;
35795
35796 /* These three are default values which can be overridden */
35797diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
35798index 418ce83..7ee1225 100644
35799--- a/drivers/scsi/hpsa.c
35800+++ b/drivers/scsi/hpsa.c
35801@@ -499,7 +499,7 @@ static inline u32 next_command(struct ctlr_info *h)
35802 u32 a;
35803
35804 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
35805- return h->access.command_completed(h);
35806+ return h->access->command_completed(h);
35807
35808 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
35809 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
35810@@ -2956,7 +2956,7 @@ static void start_io(struct ctlr_info *h)
35811 while (!list_empty(&h->reqQ)) {
35812 c = list_entry(h->reqQ.next, struct CommandList, list);
35813 /* can't do anything if fifo is full */
35814- if ((h->access.fifo_full(h))) {
35815+ if ((h->access->fifo_full(h))) {
35816 dev_warn(&h->pdev->dev, "fifo full\n");
35817 break;
35818 }
35819@@ -2966,7 +2966,7 @@ static void start_io(struct ctlr_info *h)
35820 h->Qdepth--;
35821
35822 /* Tell the controller execute command */
35823- h->access.submit_command(h, c);
35824+ h->access->submit_command(h, c);
35825
35826 /* Put job onto the completed Q */
35827 addQ(&h->cmpQ, c);
35828@@ -2975,17 +2975,17 @@ static void start_io(struct ctlr_info *h)
35829
35830 static inline unsigned long get_next_completion(struct ctlr_info *h)
35831 {
35832- return h->access.command_completed(h);
35833+ return h->access->command_completed(h);
35834 }
35835
35836 static inline bool interrupt_pending(struct ctlr_info *h)
35837 {
35838- return h->access.intr_pending(h);
35839+ return h->access->intr_pending(h);
35840 }
35841
35842 static inline long interrupt_not_for_us(struct ctlr_info *h)
35843 {
35844- return (h->access.intr_pending(h) == 0) ||
35845+ return (h->access->intr_pending(h) == 0) ||
35846 (h->interrupts_enabled == 0);
35847 }
35848
35849@@ -3882,7 +3882,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
35850 if (prod_index < 0)
35851 return -ENODEV;
35852 h->product_name = products[prod_index].product_name;
35853- h->access = *(products[prod_index].access);
35854+ h->access = products[prod_index].access;
35855
35856 if (hpsa_board_disabled(h->pdev)) {
35857 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
35858@@ -4163,7 +4163,7 @@ reinit_after_soft_reset:
35859 }
35860
35861 /* make sure the board interrupts are off */
35862- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35863+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35864
35865 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
35866 goto clean2;
35867@@ -4197,7 +4197,7 @@ reinit_after_soft_reset:
35868 * fake ones to scoop up any residual completions.
35869 */
35870 spin_lock_irqsave(&h->lock, flags);
35871- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35872+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35873 spin_unlock_irqrestore(&h->lock, flags);
35874 free_irq(h->intr[h->intr_mode], h);
35875 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
35876@@ -4216,9 +4216,9 @@ reinit_after_soft_reset:
35877 dev_info(&h->pdev->dev, "Board READY.\n");
35878 dev_info(&h->pdev->dev,
35879 "Waiting for stale completions to drain.\n");
35880- h->access.set_intr_mask(h, HPSA_INTR_ON);
35881+ h->access->set_intr_mask(h, HPSA_INTR_ON);
35882 msleep(10000);
35883- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35884+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35885
35886 rc = controller_reset_failed(h->cfgtable);
35887 if (rc)
35888@@ -4239,7 +4239,7 @@ reinit_after_soft_reset:
35889 }
35890
35891 /* Turn the interrupts on so we can service requests */
35892- h->access.set_intr_mask(h, HPSA_INTR_ON);
35893+ h->access->set_intr_mask(h, HPSA_INTR_ON);
35894
35895 hpsa_hba_inquiry(h);
35896 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
35897@@ -4292,7 +4292,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
35898 * To write all data in the battery backed cache to disks
35899 */
35900 hpsa_flush_cache(h);
35901- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35902+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35903 free_irq(h->intr[h->intr_mode], h);
35904 #ifdef CONFIG_PCI_MSI
35905 if (h->msix_vector)
35906@@ -4455,7 +4455,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
35907 return;
35908 }
35909 /* Change the access methods to the performant access methods */
35910- h->access = SA5_performant_access;
35911+ h->access = &SA5_performant_access;
35912 h->transMethod = CFGTBL_Trans_Performant;
35913 }
35914
35915diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
35916index 7f53cea..a8c7188 100644
35917--- a/drivers/scsi/hpsa.h
35918+++ b/drivers/scsi/hpsa.h
35919@@ -73,7 +73,7 @@ struct ctlr_info {
35920 unsigned int msix_vector;
35921 unsigned int msi_vector;
35922 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
35923- struct access_method access;
35924+ struct access_method *access;
35925
35926 /* queue and queue Info */
35927 struct list_head reqQ;
35928diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
35929index f2df059..a3a9930 100644
35930--- a/drivers/scsi/ips.h
35931+++ b/drivers/scsi/ips.h
35932@@ -1027,7 +1027,7 @@ typedef struct {
35933 int (*intr)(struct ips_ha *);
35934 void (*enableint)(struct ips_ha *);
35935 uint32_t (*statupd)(struct ips_ha *);
35936-} ips_hw_func_t;
35937+} __no_const ips_hw_func_t;
35938
35939 typedef struct ips_ha {
35940 uint8_t ha_id[IPS_MAX_CHANNELS+1];
35941diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
35942index d261e98..1e00f35 100644
35943--- a/drivers/scsi/libfc/fc_exch.c
35944+++ b/drivers/scsi/libfc/fc_exch.c
35945@@ -105,12 +105,12 @@ struct fc_exch_mgr {
35946 * all together if not used XXX
35947 */
35948 struct {
35949- atomic_t no_free_exch;
35950- atomic_t no_free_exch_xid;
35951- atomic_t xid_not_found;
35952- atomic_t xid_busy;
35953- atomic_t seq_not_found;
35954- atomic_t non_bls_resp;
35955+ atomic_unchecked_t no_free_exch;
35956+ atomic_unchecked_t no_free_exch_xid;
35957+ atomic_unchecked_t xid_not_found;
35958+ atomic_unchecked_t xid_busy;
35959+ atomic_unchecked_t seq_not_found;
35960+ atomic_unchecked_t non_bls_resp;
35961 } stats;
35962 };
35963
35964@@ -718,7 +718,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
35965 /* allocate memory for exchange */
35966 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
35967 if (!ep) {
35968- atomic_inc(&mp->stats.no_free_exch);
35969+ atomic_inc_unchecked(&mp->stats.no_free_exch);
35970 goto out;
35971 }
35972 memset(ep, 0, sizeof(*ep));
35973@@ -779,7 +779,7 @@ out:
35974 return ep;
35975 err:
35976 spin_unlock_bh(&pool->lock);
35977- atomic_inc(&mp->stats.no_free_exch_xid);
35978+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
35979 mempool_free(ep, mp->ep_pool);
35980 return NULL;
35981 }
35982@@ -922,7 +922,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
35983 xid = ntohs(fh->fh_ox_id); /* we originated exch */
35984 ep = fc_exch_find(mp, xid);
35985 if (!ep) {
35986- atomic_inc(&mp->stats.xid_not_found);
35987+ atomic_inc_unchecked(&mp->stats.xid_not_found);
35988 reject = FC_RJT_OX_ID;
35989 goto out;
35990 }
35991@@ -952,7 +952,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
35992 ep = fc_exch_find(mp, xid);
35993 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
35994 if (ep) {
35995- atomic_inc(&mp->stats.xid_busy);
35996+ atomic_inc_unchecked(&mp->stats.xid_busy);
35997 reject = FC_RJT_RX_ID;
35998 goto rel;
35999 }
36000@@ -963,7 +963,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36001 }
36002 xid = ep->xid; /* get our XID */
36003 } else if (!ep) {
36004- atomic_inc(&mp->stats.xid_not_found);
36005+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36006 reject = FC_RJT_RX_ID; /* XID not found */
36007 goto out;
36008 }
36009@@ -980,7 +980,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36010 } else {
36011 sp = &ep->seq;
36012 if (sp->id != fh->fh_seq_id) {
36013- atomic_inc(&mp->stats.seq_not_found);
36014+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36015 if (f_ctl & FC_FC_END_SEQ) {
36016 /*
36017 * Update sequence_id based on incoming last
36018@@ -1430,22 +1430,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36019
36020 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
36021 if (!ep) {
36022- atomic_inc(&mp->stats.xid_not_found);
36023+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36024 goto out;
36025 }
36026 if (ep->esb_stat & ESB_ST_COMPLETE) {
36027- atomic_inc(&mp->stats.xid_not_found);
36028+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36029 goto rel;
36030 }
36031 if (ep->rxid == FC_XID_UNKNOWN)
36032 ep->rxid = ntohs(fh->fh_rx_id);
36033 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
36034- atomic_inc(&mp->stats.xid_not_found);
36035+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36036 goto rel;
36037 }
36038 if (ep->did != ntoh24(fh->fh_s_id) &&
36039 ep->did != FC_FID_FLOGI) {
36040- atomic_inc(&mp->stats.xid_not_found);
36041+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36042 goto rel;
36043 }
36044 sof = fr_sof(fp);
36045@@ -1454,7 +1454,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36046 sp->ssb_stat |= SSB_ST_RESP;
36047 sp->id = fh->fh_seq_id;
36048 } else if (sp->id != fh->fh_seq_id) {
36049- atomic_inc(&mp->stats.seq_not_found);
36050+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36051 goto rel;
36052 }
36053
36054@@ -1518,9 +1518,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36055 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
36056
36057 if (!sp)
36058- atomic_inc(&mp->stats.xid_not_found);
36059+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36060 else
36061- atomic_inc(&mp->stats.non_bls_resp);
36062+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
36063
36064 fc_frame_free(fp);
36065 }
36066diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
36067index db9238f..4378ed2 100644
36068--- a/drivers/scsi/libsas/sas_ata.c
36069+++ b/drivers/scsi/libsas/sas_ata.c
36070@@ -368,7 +368,7 @@ static struct ata_port_operations sas_sata_ops = {
36071 .postreset = ata_std_postreset,
36072 .error_handler = ata_std_error_handler,
36073 .post_internal_cmd = sas_ata_post_internal,
36074- .qc_defer = ata_std_qc_defer,
36075+ .qc_defer = ata_std_qc_defer,
36076 .qc_prep = ata_noop_qc_prep,
36077 .qc_issue = sas_ata_qc_issue,
36078 .qc_fill_rtf = sas_ata_qc_fill_rtf,
36079diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
36080index c088a36..01c73b0 100644
36081--- a/drivers/scsi/lpfc/lpfc.h
36082+++ b/drivers/scsi/lpfc/lpfc.h
36083@@ -425,7 +425,7 @@ struct lpfc_vport {
36084 struct dentry *debug_nodelist;
36085 struct dentry *vport_debugfs_root;
36086 struct lpfc_debugfs_trc *disc_trc;
36087- atomic_t disc_trc_cnt;
36088+ atomic_unchecked_t disc_trc_cnt;
36089 #endif
36090 uint8_t stat_data_enabled;
36091 uint8_t stat_data_blocked;
36092@@ -835,8 +835,8 @@ struct lpfc_hba {
36093 struct timer_list fabric_block_timer;
36094 unsigned long bit_flags;
36095 #define FABRIC_COMANDS_BLOCKED 0
36096- atomic_t num_rsrc_err;
36097- atomic_t num_cmd_success;
36098+ atomic_unchecked_t num_rsrc_err;
36099+ atomic_unchecked_t num_cmd_success;
36100 unsigned long last_rsrc_error_time;
36101 unsigned long last_ramp_down_time;
36102 unsigned long last_ramp_up_time;
36103@@ -850,7 +850,7 @@ struct lpfc_hba {
36104 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
36105 struct dentry *debug_slow_ring_trc;
36106 struct lpfc_debugfs_trc *slow_ring_trc;
36107- atomic_t slow_ring_trc_cnt;
36108+ atomic_unchecked_t slow_ring_trc_cnt;
36109 /* iDiag debugfs sub-directory */
36110 struct dentry *idiag_root;
36111 struct dentry *idiag_pci_cfg;
36112diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
36113index a0424dd..2499b6b 100644
36114--- a/drivers/scsi/lpfc/lpfc_debugfs.c
36115+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
36116@@ -105,7 +105,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
36117
36118 #include <linux/debugfs.h>
36119
36120-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36121+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36122 static unsigned long lpfc_debugfs_start_time = 0L;
36123
36124 /* iDiag */
36125@@ -146,7 +146,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
36126 lpfc_debugfs_enable = 0;
36127
36128 len = 0;
36129- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
36130+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
36131 (lpfc_debugfs_max_disc_trc - 1);
36132 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
36133 dtp = vport->disc_trc + i;
36134@@ -212,7 +212,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
36135 lpfc_debugfs_enable = 0;
36136
36137 len = 0;
36138- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
36139+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
36140 (lpfc_debugfs_max_slow_ring_trc - 1);
36141 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
36142 dtp = phba->slow_ring_trc + i;
36143@@ -635,14 +635,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
36144 !vport || !vport->disc_trc)
36145 return;
36146
36147- index = atomic_inc_return(&vport->disc_trc_cnt) &
36148+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
36149 (lpfc_debugfs_max_disc_trc - 1);
36150 dtp = vport->disc_trc + index;
36151 dtp->fmt = fmt;
36152 dtp->data1 = data1;
36153 dtp->data2 = data2;
36154 dtp->data3 = data3;
36155- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36156+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36157 dtp->jif = jiffies;
36158 #endif
36159 return;
36160@@ -673,14 +673,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
36161 !phba || !phba->slow_ring_trc)
36162 return;
36163
36164- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
36165+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
36166 (lpfc_debugfs_max_slow_ring_trc - 1);
36167 dtp = phba->slow_ring_trc + index;
36168 dtp->fmt = fmt;
36169 dtp->data1 = data1;
36170 dtp->data2 = data2;
36171 dtp->data3 = data3;
36172- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36173+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36174 dtp->jif = jiffies;
36175 #endif
36176 return;
36177@@ -3828,7 +3828,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36178 "slow_ring buffer\n");
36179 goto debug_failed;
36180 }
36181- atomic_set(&phba->slow_ring_trc_cnt, 0);
36182+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
36183 memset(phba->slow_ring_trc, 0,
36184 (sizeof(struct lpfc_debugfs_trc) *
36185 lpfc_debugfs_max_slow_ring_trc));
36186@@ -3874,7 +3874,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36187 "buffer\n");
36188 goto debug_failed;
36189 }
36190- atomic_set(&vport->disc_trc_cnt, 0);
36191+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
36192
36193 snprintf(name, sizeof(name), "discovery_trace");
36194 vport->debug_disc_trc =
36195diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
36196index a3c8200..31e562e 100644
36197--- a/drivers/scsi/lpfc/lpfc_init.c
36198+++ b/drivers/scsi/lpfc/lpfc_init.c
36199@@ -9969,8 +9969,10 @@ lpfc_init(void)
36200 printk(LPFC_COPYRIGHT "\n");
36201
36202 if (lpfc_enable_npiv) {
36203- lpfc_transport_functions.vport_create = lpfc_vport_create;
36204- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36205+ pax_open_kernel();
36206+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
36207+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36208+ pax_close_kernel();
36209 }
36210 lpfc_transport_template =
36211 fc_attach_transport(&lpfc_transport_functions);
36212diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
36213index eadd241..26c8e0f 100644
36214--- a/drivers/scsi/lpfc/lpfc_scsi.c
36215+++ b/drivers/scsi/lpfc/lpfc_scsi.c
36216@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
36217 uint32_t evt_posted;
36218
36219 spin_lock_irqsave(&phba->hbalock, flags);
36220- atomic_inc(&phba->num_rsrc_err);
36221+ atomic_inc_unchecked(&phba->num_rsrc_err);
36222 phba->last_rsrc_error_time = jiffies;
36223
36224 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
36225@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
36226 unsigned long flags;
36227 struct lpfc_hba *phba = vport->phba;
36228 uint32_t evt_posted;
36229- atomic_inc(&phba->num_cmd_success);
36230+ atomic_inc_unchecked(&phba->num_cmd_success);
36231
36232 if (vport->cfg_lun_queue_depth <= queue_depth)
36233 return;
36234@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36235 unsigned long num_rsrc_err, num_cmd_success;
36236 int i;
36237
36238- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
36239- num_cmd_success = atomic_read(&phba->num_cmd_success);
36240+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
36241+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
36242
36243 vports = lpfc_create_vport_work_array(phba);
36244 if (vports != NULL)
36245@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36246 }
36247 }
36248 lpfc_destroy_vport_work_array(phba, vports);
36249- atomic_set(&phba->num_rsrc_err, 0);
36250- atomic_set(&phba->num_cmd_success, 0);
36251+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36252+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36253 }
36254
36255 /**
36256@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
36257 }
36258 }
36259 lpfc_destroy_vport_work_array(phba, vports);
36260- atomic_set(&phba->num_rsrc_err, 0);
36261- atomic_set(&phba->num_cmd_success, 0);
36262+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36263+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36264 }
36265
36266 /**
36267diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
36268index 2e6619e..fa64494 100644
36269--- a/drivers/scsi/megaraid/megaraid_mbox.c
36270+++ b/drivers/scsi/megaraid/megaraid_mbox.c
36271@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
36272 int rval;
36273 int i;
36274
36275+ pax_track_stack();
36276+
36277 // Allocate memory for the base list of scb for management module.
36278 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
36279
36280diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
36281index 86afb13f..c912398 100644
36282--- a/drivers/scsi/osd/osd_initiator.c
36283+++ b/drivers/scsi/osd/osd_initiator.c
36284@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(struct osd_dev *od,
36285 int nelem = ARRAY_SIZE(get_attrs), a = 0;
36286 int ret;
36287
36288+ pax_track_stack();
36289+
36290 or = osd_start_request(od, GFP_KERNEL);
36291 if (!or)
36292 return -ENOMEM;
36293diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
36294index d079f9a..d26072c 100644
36295--- a/drivers/scsi/pmcraid.c
36296+++ b/drivers/scsi/pmcraid.c
36297@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
36298 res->scsi_dev = scsi_dev;
36299 scsi_dev->hostdata = res;
36300 res->change_detected = 0;
36301- atomic_set(&res->read_failures, 0);
36302- atomic_set(&res->write_failures, 0);
36303+ atomic_set_unchecked(&res->read_failures, 0);
36304+ atomic_set_unchecked(&res->write_failures, 0);
36305 rc = 0;
36306 }
36307 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
36308@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
36309
36310 /* If this was a SCSI read/write command keep count of errors */
36311 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
36312- atomic_inc(&res->read_failures);
36313+ atomic_inc_unchecked(&res->read_failures);
36314 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
36315- atomic_inc(&res->write_failures);
36316+ atomic_inc_unchecked(&res->write_failures);
36317
36318 if (!RES_IS_GSCSI(res->cfg_entry) &&
36319 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
36320@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
36321 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36322 * hrrq_id assigned here in queuecommand
36323 */
36324- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36325+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36326 pinstance->num_hrrq;
36327 cmd->cmd_done = pmcraid_io_done;
36328
36329@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
36330 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36331 * hrrq_id assigned here in queuecommand
36332 */
36333- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36334+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36335 pinstance->num_hrrq;
36336
36337 if (request_size) {
36338@@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
36339
36340 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
36341 /* add resources only after host is added into system */
36342- if (!atomic_read(&pinstance->expose_resources))
36343+ if (!atomic_read_unchecked(&pinstance->expose_resources))
36344 return;
36345
36346 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
36347@@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instance(
36348 init_waitqueue_head(&pinstance->reset_wait_q);
36349
36350 atomic_set(&pinstance->outstanding_cmds, 0);
36351- atomic_set(&pinstance->last_message_id, 0);
36352- atomic_set(&pinstance->expose_resources, 0);
36353+ atomic_set_unchecked(&pinstance->last_message_id, 0);
36354+ atomic_set_unchecked(&pinstance->expose_resources, 0);
36355
36356 INIT_LIST_HEAD(&pinstance->free_res_q);
36357 INIT_LIST_HEAD(&pinstance->used_res_q);
36358@@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe(
36359 /* Schedule worker thread to handle CCN and take care of adding and
36360 * removing devices to OS
36361 */
36362- atomic_set(&pinstance->expose_resources, 1);
36363+ atomic_set_unchecked(&pinstance->expose_resources, 1);
36364 schedule_work(&pinstance->worker_q);
36365 return rc;
36366
36367diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
36368index f920baf..4417389 100644
36369--- a/drivers/scsi/pmcraid.h
36370+++ b/drivers/scsi/pmcraid.h
36371@@ -749,7 +749,7 @@ struct pmcraid_instance {
36372 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
36373
36374 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
36375- atomic_t last_message_id;
36376+ atomic_unchecked_t last_message_id;
36377
36378 /* configuration table */
36379 struct pmcraid_config_table *cfg_table;
36380@@ -778,7 +778,7 @@ struct pmcraid_instance {
36381 atomic_t outstanding_cmds;
36382
36383 /* should add/delete resources to mid-layer now ?*/
36384- atomic_t expose_resources;
36385+ atomic_unchecked_t expose_resources;
36386
36387
36388
36389@@ -814,8 +814,8 @@ struct pmcraid_resource_entry {
36390 struct pmcraid_config_table_entry_ext cfg_entry_ext;
36391 };
36392 struct scsi_device *scsi_dev; /* Link scsi_device structure */
36393- atomic_t read_failures; /* count of failed READ commands */
36394- atomic_t write_failures; /* count of failed WRITE commands */
36395+ atomic_unchecked_t read_failures; /* count of failed READ commands */
36396+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
36397
36398 /* To indicate add/delete/modify during CCN */
36399 u8 change_detected;
36400diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
36401index a03eaf4..a6b3fd9 100644
36402--- a/drivers/scsi/qla2xxx/qla_def.h
36403+++ b/drivers/scsi/qla2xxx/qla_def.h
36404@@ -2244,7 +2244,7 @@ struct isp_operations {
36405 int (*get_flash_version) (struct scsi_qla_host *, void *);
36406 int (*start_scsi) (srb_t *);
36407 int (*abort_isp) (struct scsi_qla_host *);
36408-};
36409+} __no_const;
36410
36411 /* MSI-X Support *************************************************************/
36412
36413diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
36414index 473c5c8..4e2f24a 100644
36415--- a/drivers/scsi/qla4xxx/ql4_def.h
36416+++ b/drivers/scsi/qla4xxx/ql4_def.h
36417@@ -256,7 +256,7 @@ struct ddb_entry {
36418 atomic_t retry_relogin_timer; /* Min Time between relogins
36419 * (4000 only) */
36420 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
36421- atomic_t relogin_retry_count; /* Num of times relogin has been
36422+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
36423 * retried */
36424
36425 uint16_t port;
36426diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
36427index 42ed5db..0262f9e 100644
36428--- a/drivers/scsi/qla4xxx/ql4_init.c
36429+++ b/drivers/scsi/qla4xxx/ql4_init.c
36430@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
36431 ddb_entry->fw_ddb_index = fw_ddb_index;
36432 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
36433 atomic_set(&ddb_entry->relogin_timer, 0);
36434- atomic_set(&ddb_entry->relogin_retry_count, 0);
36435+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36436 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36437 list_add_tail(&ddb_entry->list, &ha->ddb_list);
36438 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
36439@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
36440 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
36441 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
36442 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36443- atomic_set(&ddb_entry->relogin_retry_count, 0);
36444+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36445 atomic_set(&ddb_entry->relogin_timer, 0);
36446 clear_bit(DF_RELOGIN, &ddb_entry->flags);
36447 iscsi_unblock_session(ddb_entry->sess);
36448diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
36449index f2364ec..44c42b1 100644
36450--- a/drivers/scsi/qla4xxx/ql4_os.c
36451+++ b/drivers/scsi/qla4xxx/ql4_os.c
36452@@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
36453 ddb_entry->fw_ddb_device_state ==
36454 DDB_DS_SESSION_FAILED) {
36455 /* Reset retry relogin timer */
36456- atomic_inc(&ddb_entry->relogin_retry_count);
36457+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
36458 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
36459 " timed out-retrying"
36460 " relogin (%d)\n",
36461 ha->host_no,
36462 ddb_entry->fw_ddb_index,
36463- atomic_read(&ddb_entry->
36464+ atomic_read_unchecked(&ddb_entry->
36465 relogin_retry_count))
36466 );
36467 start_dpc++;
36468diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
36469index 2aeb2e9..46e3925 100644
36470--- a/drivers/scsi/scsi.c
36471+++ b/drivers/scsi/scsi.c
36472@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
36473 unsigned long timeout;
36474 int rtn = 0;
36475
36476- atomic_inc(&cmd->device->iorequest_cnt);
36477+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36478
36479 /* check if the device is still usable */
36480 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
36481diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
36482index 6888b2c..45befa1 100644
36483--- a/drivers/scsi/scsi_debug.c
36484+++ b/drivers/scsi/scsi_debug.c
36485@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
36486 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
36487 unsigned char *cmd = (unsigned char *)scp->cmnd;
36488
36489+ pax_track_stack();
36490+
36491 if ((errsts = check_readiness(scp, 1, devip)))
36492 return errsts;
36493 memset(arr, 0, sizeof(arr));
36494@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
36495 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
36496 unsigned char *cmd = (unsigned char *)scp->cmnd;
36497
36498+ pax_track_stack();
36499+
36500 if ((errsts = check_readiness(scp, 1, devip)))
36501 return errsts;
36502 memset(arr, 0, sizeof(arr));
36503diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
36504index 6d219e4..eb3ded3 100644
36505--- a/drivers/scsi/scsi_lib.c
36506+++ b/drivers/scsi/scsi_lib.c
36507@@ -1415,7 +1415,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
36508 shost = sdev->host;
36509 scsi_init_cmd_errh(cmd);
36510 cmd->result = DID_NO_CONNECT << 16;
36511- atomic_inc(&cmd->device->iorequest_cnt);
36512+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36513
36514 /*
36515 * SCSI request completion path will do scsi_device_unbusy(),
36516@@ -1441,9 +1441,9 @@ static void scsi_softirq_done(struct request *rq)
36517
36518 INIT_LIST_HEAD(&cmd->eh_entry);
36519
36520- atomic_inc(&cmd->device->iodone_cnt);
36521+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
36522 if (cmd->result)
36523- atomic_inc(&cmd->device->ioerr_cnt);
36524+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
36525
36526 disposition = scsi_decide_disposition(cmd);
36527 if (disposition != SUCCESS &&
36528diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
36529index e0bd3f7..816b8a6 100644
36530--- a/drivers/scsi/scsi_sysfs.c
36531+++ b/drivers/scsi/scsi_sysfs.c
36532@@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
36533 char *buf) \
36534 { \
36535 struct scsi_device *sdev = to_scsi_device(dev); \
36536- unsigned long long count = atomic_read(&sdev->field); \
36537+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
36538 return snprintf(buf, 20, "0x%llx\n", count); \
36539 } \
36540 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
36541diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
36542index 84a1fdf..693b0d6 100644
36543--- a/drivers/scsi/scsi_tgt_lib.c
36544+++ b/drivers/scsi/scsi_tgt_lib.c
36545@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
36546 int err;
36547
36548 dprintk("%lx %u\n", uaddr, len);
36549- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
36550+ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
36551 if (err) {
36552 /*
36553 * TODO: need to fixup sg_tablesize, max_segment_size,
36554diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
36555index 1b21491..1b7f60e 100644
36556--- a/drivers/scsi/scsi_transport_fc.c
36557+++ b/drivers/scsi/scsi_transport_fc.c
36558@@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
36559 * Netlink Infrastructure
36560 */
36561
36562-static atomic_t fc_event_seq;
36563+static atomic_unchecked_t fc_event_seq;
36564
36565 /**
36566 * fc_get_event_number - Obtain the next sequential FC event number
36567@@ -497,7 +497,7 @@ static atomic_t fc_event_seq;
36568 u32
36569 fc_get_event_number(void)
36570 {
36571- return atomic_add_return(1, &fc_event_seq);
36572+ return atomic_add_return_unchecked(1, &fc_event_seq);
36573 }
36574 EXPORT_SYMBOL(fc_get_event_number);
36575
36576@@ -645,7 +645,7 @@ static __init int fc_transport_init(void)
36577 {
36578 int error;
36579
36580- atomic_set(&fc_event_seq, 0);
36581+ atomic_set_unchecked(&fc_event_seq, 0);
36582
36583 error = transport_class_register(&fc_host_class);
36584 if (error)
36585@@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
36586 char *cp;
36587
36588 *val = simple_strtoul(buf, &cp, 0);
36589- if ((*cp && (*cp != '\n')) || (*val < 0))
36590+ if (*cp && (*cp != '\n'))
36591 return -EINVAL;
36592 /*
36593 * Check for overflow; dev_loss_tmo is u32
36594diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
36595index 3fd16d7..ba0871f 100644
36596--- a/drivers/scsi/scsi_transport_iscsi.c
36597+++ b/drivers/scsi/scsi_transport_iscsi.c
36598@@ -83,7 +83,7 @@ struct iscsi_internal {
36599 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
36600 };
36601
36602-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
36603+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
36604 static struct workqueue_struct *iscsi_eh_timer_workq;
36605
36606 /*
36607@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
36608 int err;
36609
36610 ihost = shost->shost_data;
36611- session->sid = atomic_add_return(1, &iscsi_session_nr);
36612+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
36613
36614 if (id == ISCSI_MAX_TARGET) {
36615 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
36616@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(void)
36617 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
36618 ISCSI_TRANSPORT_VERSION);
36619
36620- atomic_set(&iscsi_session_nr, 0);
36621+ atomic_set_unchecked(&iscsi_session_nr, 0);
36622
36623 err = class_register(&iscsi_transport_class);
36624 if (err)
36625diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
36626index 21a045e..ec89e03 100644
36627--- a/drivers/scsi/scsi_transport_srp.c
36628+++ b/drivers/scsi/scsi_transport_srp.c
36629@@ -33,7 +33,7 @@
36630 #include "scsi_transport_srp_internal.h"
36631
36632 struct srp_host_attrs {
36633- atomic_t next_port_id;
36634+ atomic_unchecked_t next_port_id;
36635 };
36636 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
36637
36638@@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
36639 struct Scsi_Host *shost = dev_to_shost(dev);
36640 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
36641
36642- atomic_set(&srp_host->next_port_id, 0);
36643+ atomic_set_unchecked(&srp_host->next_port_id, 0);
36644 return 0;
36645 }
36646
36647@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
36648 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
36649 rport->roles = ids->roles;
36650
36651- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
36652+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
36653 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
36654
36655 transport_setup_device(&rport->dev);
36656diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
36657index 909ed9e..1ae290a 100644
36658--- a/drivers/scsi/sg.c
36659+++ b/drivers/scsi/sg.c
36660@@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
36661 sdp->disk->disk_name,
36662 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
36663 NULL,
36664- (char *)arg);
36665+ (char __user *)arg);
36666 case BLKTRACESTART:
36667 return blk_trace_startstop(sdp->device->request_queue, 1);
36668 case BLKTRACESTOP:
36669@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
36670 const struct file_operations * fops;
36671 };
36672
36673-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
36674+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
36675 {"allow_dio", &adio_fops},
36676 {"debug", &debug_fops},
36677 {"def_reserved_size", &dressz_fops},
36678@@ -2325,7 +2325,7 @@ sg_proc_init(void)
36679 {
36680 int k, mask;
36681 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
36682- struct sg_proc_leaf * leaf;
36683+ const struct sg_proc_leaf * leaf;
36684
36685 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
36686 if (!sg_proc_sgp)
36687diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
36688index b4543f5..e1b34b8 100644
36689--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
36690+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
36691@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
36692 int do_iounmap = 0;
36693 int do_disable_device = 1;
36694
36695+ pax_track_stack();
36696+
36697 memset(&sym_dev, 0, sizeof(sym_dev));
36698 memset(&nvram, 0, sizeof(nvram));
36699 sym_dev.pdev = pdev;
36700diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
36701index a18996d..fe993cb 100644
36702--- a/drivers/scsi/vmw_pvscsi.c
36703+++ b/drivers/scsi/vmw_pvscsi.c
36704@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
36705 dma_addr_t base;
36706 unsigned i;
36707
36708+ pax_track_stack();
36709+
36710 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
36711 cmd.reqRingNumPages = adapter->req_pages;
36712 cmd.cmpRingNumPages = adapter->cmp_pages;
36713diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
36714index c5f37f0..898d202 100644
36715--- a/drivers/spi/spi-dw-pci.c
36716+++ b/drivers/spi/spi-dw-pci.c
36717@@ -148,7 +148,7 @@ static int spi_resume(struct pci_dev *pdev)
36718 #define spi_resume NULL
36719 #endif
36720
36721-static const struct pci_device_id pci_ids[] __devinitdata = {
36722+static const struct pci_device_id pci_ids[] __devinitconst = {
36723 /* Intel MID platform SPI controller 0 */
36724 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
36725 {},
36726diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
36727index 4d1b9f5..8408fe3 100644
36728--- a/drivers/spi/spi.c
36729+++ b/drivers/spi/spi.c
36730@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *master)
36731 EXPORT_SYMBOL_GPL(spi_bus_unlock);
36732
36733 /* portable code must never pass more than 32 bytes */
36734-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
36735+#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
36736
36737 static u8 *buf;
36738
36739diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36740index 32ee39a..3004c3d 100644
36741--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36742+++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36743@@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
36744 (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
36745
36746
36747-static struct net_device_ops ar6000_netdev_ops = {
36748+static net_device_ops_no_const ar6000_netdev_ops = {
36749 .ndo_init = NULL,
36750 .ndo_open = ar6000_open,
36751 .ndo_stop = ar6000_close,
36752diff --git a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36753index 39e0873..0925710 100644
36754--- a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36755+++ b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36756@@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void *pHciPalInfo, void *skb);
36757 typedef struct ar6k_pal_config_s
36758 {
36759 ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
36760-}ar6k_pal_config_t;
36761+} __no_const ar6k_pal_config_t;
36762
36763 void register_pal_cb(ar6k_pal_config_t *palConfig_p);
36764 #endif /* _AR6K_PAL_H_ */
36765diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36766index 05dada9..96171c6 100644
36767--- a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36768+++ b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36769@@ -451,14 +451,14 @@ static void brcmf_op_if(struct brcmf_if *ifp)
36770 free_netdev(ifp->net);
36771 }
36772 /* Allocate etherdev, including space for private structure */
36773- ifp->net = alloc_etherdev(sizeof(drvr_priv));
36774+ ifp->net = alloc_etherdev(sizeof(*drvr_priv));
36775 if (!ifp->net) {
36776 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
36777 ret = -ENOMEM;
36778 }
36779 if (ret == 0) {
36780 strcpy(ifp->net->name, ifp->name);
36781- memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(drvr_priv));
36782+ memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(*drvr_priv));
36783 err = brcmf_net_attach(&drvr_priv->pub, ifp->idx);
36784 if (err != 0) {
36785 BRCMF_ERROR(("%s: brcmf_net_attach failed, "
36786@@ -1279,7 +1279,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36787 BRCMF_TRACE(("%s: Enter\n", __func__));
36788
36789 /* Allocate etherdev, including space for private structure */
36790- net = alloc_etherdev(sizeof(drvr_priv));
36791+ net = alloc_etherdev(sizeof(*drvr_priv));
36792 if (!net) {
36793 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
36794 goto fail;
36795@@ -1295,7 +1295,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36796 /*
36797 * Save the brcmf_info into the priv
36798 */
36799- memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
36800+ memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
36801
36802 /* Set network interface name if it was provided as module parameter */
36803 if (iface_name[0]) {
36804@@ -1352,7 +1352,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36805 /*
36806 * Save the brcmf_info into the priv
36807 */
36808- memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
36809+ memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
36810
36811 #if defined(CONFIG_PM_SLEEP)
36812 atomic_set(&brcmf_mmc_suspend, false);
36813diff --git a/drivers/staging/brcm80211/brcmfmac/sdio_host.h b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36814index d345472..cedb19e 100644
36815--- a/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36816+++ b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36817@@ -263,7 +263,7 @@ struct brcmf_sdioh_driver {
36818 u16 func, uint bustype, u32 regsva, void *param);
36819 /* detach from device */
36820 void (*detach) (void *ch);
36821-};
36822+} __no_const;
36823
36824 struct sdioh_info;
36825
36826diff --git a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36827index a01b01c..b3f721c 100644
36828--- a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36829+++ b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36830@@ -591,7 +591,7 @@ struct phy_func_ptr {
36831 initfn_t carrsuppr;
36832 rxsigpwrfn_t rxsigpwr;
36833 detachfn_t detach;
36834-};
36835+} __no_const;
36836
36837 struct brcms_phy {
36838 struct brcms_phy_pub pubpi_ro;
36839diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
36840index 8fb3051..a8b6c67 100644
36841--- a/drivers/staging/et131x/et1310_tx.c
36842+++ b/drivers/staging/et131x/et1310_tx.c
36843@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
36844 struct net_device_stats *stats = &etdev->net_stats;
36845
36846 if (tcb->flags & fMP_DEST_BROAD)
36847- atomic_inc(&etdev->stats.brdcstxmt);
36848+ atomic_inc_unchecked(&etdev->stats.brdcstxmt);
36849 else if (tcb->flags & fMP_DEST_MULTI)
36850- atomic_inc(&etdev->stats.multixmt);
36851+ atomic_inc_unchecked(&etdev->stats.multixmt);
36852 else
36853- atomic_inc(&etdev->stats.unixmt);
36854+ atomic_inc_unchecked(&etdev->stats.unixmt);
36855
36856 if (tcb->skb) {
36857 stats->tx_bytes += tcb->skb->len;
36858diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
36859index 408c50b..fd65e9f 100644
36860--- a/drivers/staging/et131x/et131x_adapter.h
36861+++ b/drivers/staging/et131x/et131x_adapter.h
36862@@ -106,11 +106,11 @@ struct ce_stats {
36863 * operations
36864 */
36865 u32 unircv; /* # multicast packets received */
36866- atomic_t unixmt; /* # multicast packets for Tx */
36867+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
36868 u32 multircv; /* # multicast packets received */
36869- atomic_t multixmt; /* # multicast packets for Tx */
36870+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
36871 u32 brdcstrcv; /* # broadcast packets received */
36872- atomic_t brdcstxmt; /* # broadcast packets for Tx */
36873+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
36874 u32 norcvbuf; /* # Rx packets discarded */
36875 u32 noxmtbuf; /* # Tx packets discarded */
36876
36877diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
36878index 455f47a..86205ff 100644
36879--- a/drivers/staging/hv/channel.c
36880+++ b/drivers/staging/hv/channel.c
36881@@ -447,8 +447,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
36882 int ret = 0;
36883 int t;
36884
36885- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
36886- atomic_inc(&vmbus_connection.next_gpadl_handle);
36887+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
36888+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
36889
36890 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
36891 if (ret)
36892diff --git a/drivers/staging/hv/hv.c b/drivers/staging/hv/hv.c
36893index 824f816..a800af7 100644
36894--- a/drivers/staging/hv/hv.c
36895+++ b/drivers/staging/hv/hv.c
36896@@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
36897 u64 output_address = (output) ? virt_to_phys(output) : 0;
36898 u32 output_address_hi = output_address >> 32;
36899 u32 output_address_lo = output_address & 0xFFFFFFFF;
36900- volatile void *hypercall_page = hv_context.hypercall_page;
36901+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
36902
36903 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
36904 "=a"(hv_status_lo) : "d" (control_hi),
36905diff --git a/drivers/staging/hv/hv_mouse.c b/drivers/staging/hv/hv_mouse.c
36906index d957fc2..43cedd9 100644
36907--- a/drivers/staging/hv/hv_mouse.c
36908+++ b/drivers/staging/hv/hv_mouse.c
36909@@ -878,8 +878,10 @@ static void reportdesc_callback(struct hv_device *dev, void *packet, u32 len)
36910 if (hid_dev) {
36911 DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
36912
36913- hid_dev->ll_driver->open = mousevsc_hid_open;
36914- hid_dev->ll_driver->close = mousevsc_hid_close;
36915+ pax_open_kernel();
36916+ *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open;
36917+ *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
36918+ pax_close_kernel();
36919
36920 hid_dev->bus = BUS_VIRTUAL;
36921 hid_dev->vendor = input_device_ctx->device_info.vendor;
36922diff --git a/drivers/staging/hv/hyperv_vmbus.h b/drivers/staging/hv/hyperv_vmbus.h
36923index 349ad80..3f75719 100644
36924--- a/drivers/staging/hv/hyperv_vmbus.h
36925+++ b/drivers/staging/hv/hyperv_vmbus.h
36926@@ -559,7 +559,7 @@ enum vmbus_connect_state {
36927 struct vmbus_connection {
36928 enum vmbus_connect_state conn_state;
36929
36930- atomic_t next_gpadl_handle;
36931+ atomic_unchecked_t next_gpadl_handle;
36932
36933 /*
36934 * Represents channel interrupts. Each bit position represents a
36935diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c
36936index dbb5201..d6047c6 100644
36937--- a/drivers/staging/hv/rndis_filter.c
36938+++ b/drivers/staging/hv/rndis_filter.c
36939@@ -43,7 +43,7 @@ struct rndis_device {
36940
36941 enum rndis_device_state state;
36942 u32 link_stat;
36943- atomic_t new_req_id;
36944+ atomic_unchecked_t new_req_id;
36945
36946 spinlock_t request_lock;
36947 struct list_head req_list;
36948@@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
36949 * template
36950 */
36951 set = &rndis_msg->msg.set_req;
36952- set->req_id = atomic_inc_return(&dev->new_req_id);
36953+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
36954
36955 /* Add to the request list */
36956 spin_lock_irqsave(&dev->request_lock, flags);
36957@@ -622,7 +622,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
36958
36959 /* Setup the rndis set */
36960 halt = &request->request_msg.msg.halt_req;
36961- halt->req_id = atomic_inc_return(&dev->new_req_id);
36962+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
36963
36964 /* Ignore return since this msg is optional. */
36965 rndis_filter_send_request(dev, request);
36966diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
36967index 1c949f5..7a8b104 100644
36968--- a/drivers/staging/hv/vmbus_drv.c
36969+++ b/drivers/staging/hv/vmbus_drv.c
36970@@ -660,11 +660,11 @@ int vmbus_child_device_register(struct hv_device *child_device_obj)
36971 {
36972 int ret = 0;
36973
36974- static atomic_t device_num = ATOMIC_INIT(0);
36975+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
36976
36977 /* Set the device name. Otherwise, device_register() will fail. */
36978 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
36979- atomic_inc_return(&device_num));
36980+ atomic_inc_return_unchecked(&device_num));
36981
36982 /* The new device belongs to this bus */
36983 child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */
36984diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
36985index 3f26f71..fb5c787 100644
36986--- a/drivers/staging/iio/ring_generic.h
36987+++ b/drivers/staging/iio/ring_generic.h
36988@@ -62,7 +62,7 @@ struct iio_ring_access_funcs {
36989
36990 int (*is_enabled)(struct iio_ring_buffer *ring);
36991 int (*enable)(struct iio_ring_buffer *ring);
36992-};
36993+} __no_const;
36994
36995 struct iio_ring_setup_ops {
36996 int (*preenable)(struct iio_dev *);
36997diff --git a/drivers/staging/mei/interface.c b/drivers/staging/mei/interface.c
36998index cfec92d..a65dacf 100644
36999--- a/drivers/staging/mei/interface.c
37000+++ b/drivers/staging/mei/interface.c
37001@@ -332,7 +332,7 @@ int mei_send_flow_control(struct mei_device *dev, struct mei_cl *cl)
37002 mei_hdr->reserved = 0;
37003
37004 mei_flow_control = (struct hbm_flow_control *) &dev->wr_msg_buf[1];
37005- memset(mei_flow_control, 0, sizeof(mei_flow_control));
37006+ memset(mei_flow_control, 0, sizeof(*mei_flow_control));
37007 mei_flow_control->host_addr = cl->host_client_id;
37008 mei_flow_control->me_addr = cl->me_client_id;
37009 mei_flow_control->cmd.cmd = MEI_FLOW_CONTROL_CMD;
37010@@ -396,7 +396,7 @@ int mei_disconnect(struct mei_device *dev, struct mei_cl *cl)
37011
37012 mei_cli_disconnect =
37013 (struct hbm_client_disconnect_request *) &dev->wr_msg_buf[1];
37014- memset(mei_cli_disconnect, 0, sizeof(mei_cli_disconnect));
37015+ memset(mei_cli_disconnect, 0, sizeof(*mei_cli_disconnect));
37016 mei_cli_disconnect->host_addr = cl->host_client_id;
37017 mei_cli_disconnect->me_addr = cl->me_client_id;
37018 mei_cli_disconnect->cmd.cmd = CLIENT_DISCONNECT_REQ_CMD;
37019diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
37020index 8b307b4..a97ac91 100644
37021--- a/drivers/staging/octeon/ethernet-rx.c
37022+++ b/drivers/staging/octeon/ethernet-rx.c
37023@@ -420,11 +420,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37024 /* Increment RX stats for virtual ports */
37025 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
37026 #ifdef CONFIG_64BIT
37027- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
37028- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
37029+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
37030+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
37031 #else
37032- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
37033- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
37034+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
37035+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
37036 #endif
37037 }
37038 netif_receive_skb(skb);
37039@@ -436,9 +436,9 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37040 dev->name);
37041 */
37042 #ifdef CONFIG_64BIT
37043- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
37044+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37045 #else
37046- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
37047+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
37048 #endif
37049 dev_kfree_skb_irq(skb);
37050 }
37051diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
37052index a8f780e..aef1098 100644
37053--- a/drivers/staging/octeon/ethernet.c
37054+++ b/drivers/staging/octeon/ethernet.c
37055@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
37056 * since the RX tasklet also increments it.
37057 */
37058 #ifdef CONFIG_64BIT
37059- atomic64_add(rx_status.dropped_packets,
37060- (atomic64_t *)&priv->stats.rx_dropped);
37061+ atomic64_add_unchecked(rx_status.dropped_packets,
37062+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37063 #else
37064- atomic_add(rx_status.dropped_packets,
37065- (atomic_t *)&priv->stats.rx_dropped);
37066+ atomic_add_unchecked(rx_status.dropped_packets,
37067+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
37068 #endif
37069 }
37070
37071diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
37072index f3c6060..56bf826 100644
37073--- a/drivers/staging/pohmelfs/inode.c
37074+++ b/drivers/staging/pohmelfs/inode.c
37075@@ -1861,7 +1861,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37076 mutex_init(&psb->mcache_lock);
37077 psb->mcache_root = RB_ROOT;
37078 psb->mcache_timeout = msecs_to_jiffies(5000);
37079- atomic_long_set(&psb->mcache_gen, 0);
37080+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
37081
37082 psb->trans_max_pages = 100;
37083
37084@@ -1876,7 +1876,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37085 INIT_LIST_HEAD(&psb->crypto_ready_list);
37086 INIT_LIST_HEAD(&psb->crypto_active_list);
37087
37088- atomic_set(&psb->trans_gen, 1);
37089+ atomic_set_unchecked(&psb->trans_gen, 1);
37090 atomic_long_set(&psb->total_inodes, 0);
37091
37092 mutex_init(&psb->state_lock);
37093diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
37094index e22665c..a2a9390 100644
37095--- a/drivers/staging/pohmelfs/mcache.c
37096+++ b/drivers/staging/pohmelfs/mcache.c
37097@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
37098 m->data = data;
37099 m->start = start;
37100 m->size = size;
37101- m->gen = atomic_long_inc_return(&psb->mcache_gen);
37102+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
37103
37104 mutex_lock(&psb->mcache_lock);
37105 err = pohmelfs_mcache_insert(psb, m);
37106diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
37107index 985b6b7..7699e05 100644
37108--- a/drivers/staging/pohmelfs/netfs.h
37109+++ b/drivers/staging/pohmelfs/netfs.h
37110@@ -571,14 +571,14 @@ struct pohmelfs_config;
37111 struct pohmelfs_sb {
37112 struct rb_root mcache_root;
37113 struct mutex mcache_lock;
37114- atomic_long_t mcache_gen;
37115+ atomic_long_unchecked_t mcache_gen;
37116 unsigned long mcache_timeout;
37117
37118 unsigned int idx;
37119
37120 unsigned int trans_retries;
37121
37122- atomic_t trans_gen;
37123+ atomic_unchecked_t trans_gen;
37124
37125 unsigned int crypto_attached_size;
37126 unsigned int crypto_align_size;
37127diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
37128index 36a2535..0591bf4 100644
37129--- a/drivers/staging/pohmelfs/trans.c
37130+++ b/drivers/staging/pohmelfs/trans.c
37131@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
37132 int err;
37133 struct netfs_cmd *cmd = t->iovec.iov_base;
37134
37135- t->gen = atomic_inc_return(&psb->trans_gen);
37136+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
37137
37138 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
37139 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
37140diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
37141index b70cb2b..4db41a7 100644
37142--- a/drivers/staging/rtl8712/rtl871x_io.h
37143+++ b/drivers/staging/rtl8712/rtl871x_io.h
37144@@ -83,7 +83,7 @@ struct _io_ops {
37145 u8 *pmem);
37146 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
37147 u8 *pmem);
37148-};
37149+} __no_const;
37150
37151 struct io_req {
37152 struct list_head list;
37153diff --git a/drivers/staging/sbe-2t3e3/netdev.c b/drivers/staging/sbe-2t3e3/netdev.c
37154index c7b5e8b..783d6cb 100644
37155--- a/drivers/staging/sbe-2t3e3/netdev.c
37156+++ b/drivers/staging/sbe-2t3e3/netdev.c
37157@@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
37158 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
37159
37160 if (rlen)
37161- if (copy_to_user(data, &resp, rlen))
37162+ if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
37163 return -EFAULT;
37164
37165 return 0;
37166diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
37167index be21617..0954e45 100644
37168--- a/drivers/staging/usbip/usbip_common.h
37169+++ b/drivers/staging/usbip/usbip_common.h
37170@@ -289,7 +289,7 @@ struct usbip_device {
37171 void (*shutdown)(struct usbip_device *);
37172 void (*reset)(struct usbip_device *);
37173 void (*unusable)(struct usbip_device *);
37174- } eh_ops;
37175+ } __no_const eh_ops;
37176 };
37177
37178 #if 0
37179diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
37180index 71a586e..4d8a91a 100644
37181--- a/drivers/staging/usbip/vhci.h
37182+++ b/drivers/staging/usbip/vhci.h
37183@@ -85,7 +85,7 @@ struct vhci_hcd {
37184 unsigned resuming:1;
37185 unsigned long re_timeout;
37186
37187- atomic_t seqnum;
37188+ atomic_unchecked_t seqnum;
37189
37190 /*
37191 * NOTE:
37192diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
37193index 2ee97e2..0420b86 100644
37194--- a/drivers/staging/usbip/vhci_hcd.c
37195+++ b/drivers/staging/usbip/vhci_hcd.c
37196@@ -527,7 +527,7 @@ static void vhci_tx_urb(struct urb *urb)
37197 return;
37198 }
37199
37200- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
37201+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37202 if (priv->seqnum == 0xffff)
37203 dev_info(&urb->dev->dev, "seqnum max\n");
37204
37205@@ -779,7 +779,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
37206 return -ENOMEM;
37207 }
37208
37209- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
37210+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37211 if (unlink->seqnum == 0xffff)
37212 pr_info("seqnum max\n");
37213
37214@@ -969,7 +969,7 @@ static int vhci_start(struct usb_hcd *hcd)
37215 vdev->rhport = rhport;
37216 }
37217
37218- atomic_set(&vhci->seqnum, 0);
37219+ atomic_set_unchecked(&vhci->seqnum, 0);
37220 spin_lock_init(&vhci->lock);
37221
37222 hcd->power_budget = 0; /* no limit */
37223diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
37224index 3872b8c..fe6d2f4 100644
37225--- a/drivers/staging/usbip/vhci_rx.c
37226+++ b/drivers/staging/usbip/vhci_rx.c
37227@@ -77,7 +77,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
37228 if (!urb) {
37229 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
37230 pr_info("max seqnum %d\n",
37231- atomic_read(&the_controller->seqnum));
37232+ atomic_read_unchecked(&the_controller->seqnum));
37233 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
37234 return;
37235 }
37236diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
37237index 7735027..30eed13 100644
37238--- a/drivers/staging/vt6655/hostap.c
37239+++ b/drivers/staging/vt6655/hostap.c
37240@@ -79,14 +79,13 @@ static int msglevel =MSG_LEVEL_INFO;
37241 *
37242 */
37243
37244+static net_device_ops_no_const apdev_netdev_ops;
37245+
37246 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37247 {
37248 PSDevice apdev_priv;
37249 struct net_device *dev = pDevice->dev;
37250 int ret;
37251- const struct net_device_ops apdev_netdev_ops = {
37252- .ndo_start_xmit = pDevice->tx_80211,
37253- };
37254
37255 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37256
37257@@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37258 *apdev_priv = *pDevice;
37259 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37260
37261+ /* only half broken now */
37262+ apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37263 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37264
37265 pDevice->apdev->type = ARPHRD_IEEE80211;
37266diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
37267index 51b5adf..098e320 100644
37268--- a/drivers/staging/vt6656/hostap.c
37269+++ b/drivers/staging/vt6656/hostap.c
37270@@ -80,14 +80,13 @@ static int msglevel =MSG_LEVEL_INFO;
37271 *
37272 */
37273
37274+static net_device_ops_no_const apdev_netdev_ops;
37275+
37276 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37277 {
37278 PSDevice apdev_priv;
37279 struct net_device *dev = pDevice->dev;
37280 int ret;
37281- const struct net_device_ops apdev_netdev_ops = {
37282- .ndo_start_xmit = pDevice->tx_80211,
37283- };
37284
37285 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37286
37287@@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37288 *apdev_priv = *pDevice;
37289 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37290
37291+ /* only half broken now */
37292+ apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37293 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37294
37295 pDevice->apdev->type = ARPHRD_IEEE80211;
37296diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
37297index 7843dfd..3db105f 100644
37298--- a/drivers/staging/wlan-ng/hfa384x_usb.c
37299+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
37300@@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
37301
37302 struct usbctlx_completor {
37303 int (*complete) (struct usbctlx_completor *);
37304-};
37305+} __no_const;
37306
37307 static int
37308 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
37309diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
37310index 1ca66ea..76f1343 100644
37311--- a/drivers/staging/zcache/tmem.c
37312+++ b/drivers/staging/zcache/tmem.c
37313@@ -39,7 +39,7 @@
37314 * A tmem host implementation must use this function to register callbacks
37315 * for memory allocation.
37316 */
37317-static struct tmem_hostops tmem_hostops;
37318+static tmem_hostops_no_const tmem_hostops;
37319
37320 static void tmem_objnode_tree_init(void);
37321
37322@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_hostops *m)
37323 * A tmem host implementation must use this function to register
37324 * callbacks for a page-accessible memory (PAM) implementation
37325 */
37326-static struct tmem_pamops tmem_pamops;
37327+static tmem_pamops_no_const tmem_pamops;
37328
37329 void tmem_register_pamops(struct tmem_pamops *m)
37330 {
37331diff --git a/drivers/staging/zcache/tmem.h b/drivers/staging/zcache/tmem.h
37332index ed147c4..94fc3c6 100644
37333--- a/drivers/staging/zcache/tmem.h
37334+++ b/drivers/staging/zcache/tmem.h
37335@@ -180,6 +180,7 @@ struct tmem_pamops {
37336 void (*new_obj)(struct tmem_obj *);
37337 int (*replace_in_obj)(void *, struct tmem_obj *);
37338 };
37339+typedef struct tmem_pamops __no_const tmem_pamops_no_const;
37340 extern void tmem_register_pamops(struct tmem_pamops *m);
37341
37342 /* memory allocation methods provided by the host implementation */
37343@@ -189,6 +190,7 @@ struct tmem_hostops {
37344 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
37345 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
37346 };
37347+typedef struct tmem_hostops __no_const tmem_hostops_no_const;
37348 extern void tmem_register_hostops(struct tmem_hostops *m);
37349
37350 /* core tmem accessor functions */
37351diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
37352index c4ac6f6..4f90f53 100644
37353--- a/drivers/target/iscsi/iscsi_target.c
37354+++ b/drivers/target/iscsi/iscsi_target.c
37355@@ -1370,7 +1370,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
37356 * outstanding_r2ts reaches zero, go ahead and send the delayed
37357 * TASK_ABORTED status.
37358 */
37359- if (atomic_read(&se_cmd->t_transport_aborted) != 0) {
37360+ if (atomic_read_unchecked(&se_cmd->t_transport_aborted) != 0) {
37361 if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
37362 if (--cmd->outstanding_r2ts < 1) {
37363 iscsit_stop_dataout_timer(cmd);
37364diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
37365index 8badcb4..94c9ac6 100644
37366--- a/drivers/target/target_core_alua.c
37367+++ b/drivers/target/target_core_alua.c
37368@@ -723,6 +723,8 @@ static int core_alua_update_tpg_primary_metadata(
37369 char path[ALUA_METADATA_PATH_LEN];
37370 int len;
37371
37372+ pax_track_stack();
37373+
37374 memset(path, 0, ALUA_METADATA_PATH_LEN);
37375
37376 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
37377@@ -986,6 +988,8 @@ static int core_alua_update_tpg_secondary_metadata(
37378 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
37379 int len;
37380
37381+ pax_track_stack();
37382+
37383 memset(path, 0, ALUA_METADATA_PATH_LEN);
37384 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
37385
37386diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
37387index 5f91397..dcc2d25 100644
37388--- a/drivers/target/target_core_cdb.c
37389+++ b/drivers/target/target_core_cdb.c
37390@@ -933,6 +933,8 @@ target_emulate_modesense(struct se_cmd *cmd, int ten)
37391 int length = 0;
37392 unsigned char buf[SE_MODE_PAGE_BUF];
37393
37394+ pax_track_stack();
37395+
37396 memset(buf, 0, SE_MODE_PAGE_BUF);
37397
37398 switch (cdb[2] & 0x3f) {
37399diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
37400index b2575d8..b6b28fd 100644
37401--- a/drivers/target/target_core_configfs.c
37402+++ b/drivers/target/target_core_configfs.c
37403@@ -1267,6 +1267,8 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
37404 ssize_t len = 0;
37405 int reg_count = 0, prf_isid;
37406
37407+ pax_track_stack();
37408+
37409 if (!su_dev->se_dev_ptr)
37410 return -ENODEV;
37411
37412diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
37413index 7fd3a16..bc2fb3e 100644
37414--- a/drivers/target/target_core_pr.c
37415+++ b/drivers/target/target_core_pr.c
37416@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_registration(
37417 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
37418 u16 tpgt;
37419
37420+ pax_track_stack();
37421+
37422 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
37423 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
37424 /*
37425@@ -1867,6 +1869,8 @@ static int __core_scsi3_update_aptpl_buf(
37426 ssize_t len = 0;
37427 int reg_count = 0;
37428
37429+ pax_track_stack();
37430+
37431 memset(buf, 0, pr_aptpl_buf_len);
37432 /*
37433 * Called to clear metadata once APTPL has been deactivated.
37434@@ -1989,6 +1993,8 @@ static int __core_scsi3_write_aptpl_to_file(
37435 char path[512];
37436 int ret;
37437
37438+ pax_track_stack();
37439+
37440 memset(iov, 0, sizeof(struct iovec));
37441 memset(path, 0, 512);
37442
37443diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
37444index 5c1b8c5..0cb7d0e 100644
37445--- a/drivers/target/target_core_tmr.c
37446+++ b/drivers/target/target_core_tmr.c
37447@@ -255,7 +255,7 @@ static void core_tmr_drain_task_list(
37448 cmd->se_tfo->get_task_tag(cmd), cmd->pr_res_key,
37449 cmd->t_task_list_num,
37450 atomic_read(&cmd->t_task_cdbs_left),
37451- atomic_read(&cmd->t_task_cdbs_sent),
37452+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37453 atomic_read(&cmd->t_transport_active),
37454 atomic_read(&cmd->t_transport_stop),
37455 atomic_read(&cmd->t_transport_sent));
37456@@ -291,7 +291,7 @@ static void core_tmr_drain_task_list(
37457 pr_debug("LUN_RESET: got t_transport_active = 1 for"
37458 " task: %p, t_fe_count: %d dev: %p\n", task,
37459 fe_count, dev);
37460- atomic_set(&cmd->t_transport_aborted, 1);
37461+ atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37462 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37463
37464 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37465@@ -299,7 +299,7 @@ static void core_tmr_drain_task_list(
37466 }
37467 pr_debug("LUN_RESET: Got t_transport_active = 0 for task: %p,"
37468 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
37469- atomic_set(&cmd->t_transport_aborted, 1);
37470+ atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37471 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37472
37473 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37474diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
37475index e2added..ccb5251 100644
37476--- a/drivers/target/target_core_transport.c
37477+++ b/drivers/target/target_core_transport.c
37478@@ -1445,7 +1445,7 @@ struct se_device *transport_add_device_to_core_hba(
37479
37480 dev->queue_depth = dev_limits->queue_depth;
37481 atomic_set(&dev->depth_left, dev->queue_depth);
37482- atomic_set(&dev->dev_ordered_id, 0);
37483+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
37484
37485 se_dev_set_default_attribs(dev, dev_limits);
37486
37487@@ -1633,7 +1633,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
37488 * Used to determine when ORDERED commands should go from
37489 * Dormant to Active status.
37490 */
37491- cmd->se_ordered_id = atomic_inc_return(&cmd->se_dev->dev_ordered_id);
37492+ cmd->se_ordered_id = atomic_inc_return_unchecked(&cmd->se_dev->dev_ordered_id);
37493 smp_mb__after_atomic_inc();
37494 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
37495 cmd->se_ordered_id, cmd->sam_task_attr,
37496@@ -1960,7 +1960,7 @@ static void transport_generic_request_failure(
37497 " t_transport_active: %d t_transport_stop: %d"
37498 " t_transport_sent: %d\n", cmd->t_task_list_num,
37499 atomic_read(&cmd->t_task_cdbs_left),
37500- atomic_read(&cmd->t_task_cdbs_sent),
37501+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37502 atomic_read(&cmd->t_task_cdbs_ex_left),
37503 atomic_read(&cmd->t_transport_active),
37504 atomic_read(&cmd->t_transport_stop),
37505@@ -2460,9 +2460,9 @@ check_depth:
37506 spin_lock_irqsave(&cmd->t_state_lock, flags);
37507 atomic_set(&task->task_active, 1);
37508 atomic_set(&task->task_sent, 1);
37509- atomic_inc(&cmd->t_task_cdbs_sent);
37510+ atomic_inc_unchecked(&cmd->t_task_cdbs_sent);
37511
37512- if (atomic_read(&cmd->t_task_cdbs_sent) ==
37513+ if (atomic_read_unchecked(&cmd->t_task_cdbs_sent) ==
37514 cmd->t_task_list_num)
37515 atomic_set(&cmd->transport_sent, 1);
37516
37517@@ -4682,7 +4682,7 @@ static void transport_generic_wait_for_tasks(
37518 atomic_set(&cmd->transport_lun_stop, 0);
37519 }
37520 if (!atomic_read(&cmd->t_transport_active) ||
37521- atomic_read(&cmd->t_transport_aborted))
37522+ atomic_read_unchecked(&cmd->t_transport_aborted))
37523 goto remove;
37524
37525 atomic_set(&cmd->t_transport_stop, 1);
37526@@ -4917,7 +4917,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
37527 {
37528 int ret = 0;
37529
37530- if (atomic_read(&cmd->t_transport_aborted) != 0) {
37531+ if (atomic_read_unchecked(&cmd->t_transport_aborted) != 0) {
37532 if (!send_status ||
37533 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
37534 return 1;
37535@@ -4954,7 +4954,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
37536 */
37537 if (cmd->data_direction == DMA_TO_DEVICE) {
37538 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
37539- atomic_inc(&cmd->t_transport_aborted);
37540+ atomic_inc_unchecked(&cmd->t_transport_aborted);
37541 smp_mb__after_atomic_inc();
37542 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
37543 transport_new_cmd_failure(cmd);
37544@@ -5068,7 +5068,7 @@ static void transport_processing_shutdown(struct se_device *dev)
37545 cmd->se_tfo->get_task_tag(cmd),
37546 cmd->t_task_list_num,
37547 atomic_read(&cmd->t_task_cdbs_left),
37548- atomic_read(&cmd->t_task_cdbs_sent),
37549+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37550 atomic_read(&cmd->t_transport_active),
37551 atomic_read(&cmd->t_transport_stop),
37552 atomic_read(&cmd->t_transport_sent));
37553diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
37554index d5f923b..9c78228 100644
37555--- a/drivers/telephony/ixj.c
37556+++ b/drivers/telephony/ixj.c
37557@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
37558 bool mContinue;
37559 char *pIn, *pOut;
37560
37561+ pax_track_stack();
37562+
37563 if (!SCI_Prepare(j))
37564 return 0;
37565
37566diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
37567index 4c8b665..1d931eb 100644
37568--- a/drivers/tty/hvc/hvcs.c
37569+++ b/drivers/tty/hvc/hvcs.c
37570@@ -83,6 +83,7 @@
37571 #include <asm/hvcserver.h>
37572 #include <asm/uaccess.h>
37573 #include <asm/vio.h>
37574+#include <asm/local.h>
37575
37576 /*
37577 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
37578@@ -270,7 +271,7 @@ struct hvcs_struct {
37579 unsigned int index;
37580
37581 struct tty_struct *tty;
37582- int open_count;
37583+ local_t open_count;
37584
37585 /*
37586 * Used to tell the driver kernel_thread what operations need to take
37587@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
37588
37589 spin_lock_irqsave(&hvcsd->lock, flags);
37590
37591- if (hvcsd->open_count > 0) {
37592+ if (local_read(&hvcsd->open_count) > 0) {
37593 spin_unlock_irqrestore(&hvcsd->lock, flags);
37594 printk(KERN_INFO "HVCS: vterm state unchanged. "
37595 "The hvcs device node is still in use.\n");
37596@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
37597 if ((retval = hvcs_partner_connect(hvcsd)))
37598 goto error_release;
37599
37600- hvcsd->open_count = 1;
37601+ local_set(&hvcsd->open_count, 1);
37602 hvcsd->tty = tty;
37603 tty->driver_data = hvcsd;
37604
37605@@ -1179,7 +1180,7 @@ fast_open:
37606
37607 spin_lock_irqsave(&hvcsd->lock, flags);
37608 kref_get(&hvcsd->kref);
37609- hvcsd->open_count++;
37610+ local_inc(&hvcsd->open_count);
37611 hvcsd->todo_mask |= HVCS_SCHED_READ;
37612 spin_unlock_irqrestore(&hvcsd->lock, flags);
37613
37614@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37615 hvcsd = tty->driver_data;
37616
37617 spin_lock_irqsave(&hvcsd->lock, flags);
37618- if (--hvcsd->open_count == 0) {
37619+ if (local_dec_and_test(&hvcsd->open_count)) {
37620
37621 vio_disable_interrupts(hvcsd->vdev);
37622
37623@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37624 free_irq(irq, hvcsd);
37625 kref_put(&hvcsd->kref, destroy_hvcs_struct);
37626 return;
37627- } else if (hvcsd->open_count < 0) {
37628+ } else if (local_read(&hvcsd->open_count) < 0) {
37629 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
37630 " is missmanaged.\n",
37631- hvcsd->vdev->unit_address, hvcsd->open_count);
37632+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
37633 }
37634
37635 spin_unlock_irqrestore(&hvcsd->lock, flags);
37636@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37637
37638 spin_lock_irqsave(&hvcsd->lock, flags);
37639 /* Preserve this so that we know how many kref refs to put */
37640- temp_open_count = hvcsd->open_count;
37641+ temp_open_count = local_read(&hvcsd->open_count);
37642
37643 /*
37644 * Don't kref put inside the spinlock because the destruction
37645@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37646 hvcsd->tty->driver_data = NULL;
37647 hvcsd->tty = NULL;
37648
37649- hvcsd->open_count = 0;
37650+ local_set(&hvcsd->open_count, 0);
37651
37652 /* This will drop any buffered data on the floor which is OK in a hangup
37653 * scenario. */
37654@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct *tty,
37655 * the middle of a write operation? This is a crummy place to do this
37656 * but we want to keep it all in the spinlock.
37657 */
37658- if (hvcsd->open_count <= 0) {
37659+ if (local_read(&hvcsd->open_count) <= 0) {
37660 spin_unlock_irqrestore(&hvcsd->lock, flags);
37661 return -ENODEV;
37662 }
37663@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_struct *tty)
37664 {
37665 struct hvcs_struct *hvcsd = tty->driver_data;
37666
37667- if (!hvcsd || hvcsd->open_count <= 0)
37668+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
37669 return 0;
37670
37671 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
37672diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
37673index ef92869..f4ebd88 100644
37674--- a/drivers/tty/ipwireless/tty.c
37675+++ b/drivers/tty/ipwireless/tty.c
37676@@ -29,6 +29,7 @@
37677 #include <linux/tty_driver.h>
37678 #include <linux/tty_flip.h>
37679 #include <linux/uaccess.h>
37680+#include <asm/local.h>
37681
37682 #include "tty.h"
37683 #include "network.h"
37684@@ -51,7 +52,7 @@ struct ipw_tty {
37685 int tty_type;
37686 struct ipw_network *network;
37687 struct tty_struct *linux_tty;
37688- int open_count;
37689+ local_t open_count;
37690 unsigned int control_lines;
37691 struct mutex ipw_tty_mutex;
37692 int tx_bytes_queued;
37693@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37694 mutex_unlock(&tty->ipw_tty_mutex);
37695 return -ENODEV;
37696 }
37697- if (tty->open_count == 0)
37698+ if (local_read(&tty->open_count) == 0)
37699 tty->tx_bytes_queued = 0;
37700
37701- tty->open_count++;
37702+ local_inc(&tty->open_count);
37703
37704 tty->linux_tty = linux_tty;
37705 linux_tty->driver_data = tty;
37706@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37707
37708 static void do_ipw_close(struct ipw_tty *tty)
37709 {
37710- tty->open_count--;
37711-
37712- if (tty->open_count == 0) {
37713+ if (local_dec_return(&tty->open_count) == 0) {
37714 struct tty_struct *linux_tty = tty->linux_tty;
37715
37716 if (linux_tty != NULL) {
37717@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
37718 return;
37719
37720 mutex_lock(&tty->ipw_tty_mutex);
37721- if (tty->open_count == 0) {
37722+ if (local_read(&tty->open_count) == 0) {
37723 mutex_unlock(&tty->ipw_tty_mutex);
37724 return;
37725 }
37726@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
37727 return;
37728 }
37729
37730- if (!tty->open_count) {
37731+ if (!local_read(&tty->open_count)) {
37732 mutex_unlock(&tty->ipw_tty_mutex);
37733 return;
37734 }
37735@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *linux_tty,
37736 return -ENODEV;
37737
37738 mutex_lock(&tty->ipw_tty_mutex);
37739- if (!tty->open_count) {
37740+ if (!local_read(&tty->open_count)) {
37741 mutex_unlock(&tty->ipw_tty_mutex);
37742 return -EINVAL;
37743 }
37744@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
37745 if (!tty)
37746 return -ENODEV;
37747
37748- if (!tty->open_count)
37749+ if (!local_read(&tty->open_count))
37750 return -EINVAL;
37751
37752 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
37753@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
37754 if (!tty)
37755 return 0;
37756
37757- if (!tty->open_count)
37758+ if (!local_read(&tty->open_count))
37759 return 0;
37760
37761 return tty->tx_bytes_queued;
37762@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
37763 if (!tty)
37764 return -ENODEV;
37765
37766- if (!tty->open_count)
37767+ if (!local_read(&tty->open_count))
37768 return -EINVAL;
37769
37770 return get_control_lines(tty);
37771@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
37772 if (!tty)
37773 return -ENODEV;
37774
37775- if (!tty->open_count)
37776+ if (!local_read(&tty->open_count))
37777 return -EINVAL;
37778
37779 return set_control_lines(tty, set, clear);
37780@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
37781 if (!tty)
37782 return -ENODEV;
37783
37784- if (!tty->open_count)
37785+ if (!local_read(&tty->open_count))
37786 return -EINVAL;
37787
37788 /* FIXME: Exactly how is the tty object locked here .. */
37789@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
37790 against a parallel ioctl etc */
37791 mutex_lock(&ttyj->ipw_tty_mutex);
37792 }
37793- while (ttyj->open_count)
37794+ while (local_read(&ttyj->open_count))
37795 do_ipw_close(ttyj);
37796 ipwireless_disassociate_network_ttys(network,
37797 ttyj->channel_idx);
37798diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
37799index 8a50e4e..7d9ca3d 100644
37800--- a/drivers/tty/n_gsm.c
37801+++ b/drivers/tty/n_gsm.c
37802@@ -1625,7 +1625,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
37803 kref_init(&dlci->ref);
37804 mutex_init(&dlci->mutex);
37805 dlci->fifo = &dlci->_fifo;
37806- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
37807+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
37808 kfree(dlci);
37809 return NULL;
37810 }
37811diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
37812index 39d6ab6..eb97f41 100644
37813--- a/drivers/tty/n_tty.c
37814+++ b/drivers/tty/n_tty.c
37815@@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
37816 {
37817 *ops = tty_ldisc_N_TTY;
37818 ops->owner = NULL;
37819- ops->refcount = ops->flags = 0;
37820+ atomic_set(&ops->refcount, 0);
37821+ ops->flags = 0;
37822 }
37823 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
37824diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
37825index e18604b..a7d5a11 100644
37826--- a/drivers/tty/pty.c
37827+++ b/drivers/tty/pty.c
37828@@ -773,8 +773,10 @@ static void __init unix98_pty_init(void)
37829 register_sysctl_table(pty_root_table);
37830
37831 /* Now create the /dev/ptmx special device */
37832+ pax_open_kernel();
37833 tty_default_fops(&ptmx_fops);
37834- ptmx_fops.open = ptmx_open;
37835+ *(void **)&ptmx_fops.open = ptmx_open;
37836+ pax_close_kernel();
37837
37838 cdev_init(&ptmx_cdev, &ptmx_fops);
37839 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
37840diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
37841index 6a1241c..d04ab0d 100644
37842--- a/drivers/tty/rocket.c
37843+++ b/drivers/tty/rocket.c
37844@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
37845 struct rocket_ports tmp;
37846 int board;
37847
37848+ pax_track_stack();
37849+
37850 if (!retports)
37851 return -EFAULT;
37852 memset(&tmp, 0, sizeof (tmp));
37853diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
37854index 87e7e6c..89744e0 100644
37855--- a/drivers/tty/serial/kgdboc.c
37856+++ b/drivers/tty/serial/kgdboc.c
37857@@ -23,8 +23,9 @@
37858 #define MAX_CONFIG_LEN 40
37859
37860 static struct kgdb_io kgdboc_io_ops;
37861+static struct kgdb_io kgdboc_io_ops_console;
37862
37863-/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
37864+/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
37865 static int configured = -1;
37866
37867 static char config[MAX_CONFIG_LEN];
37868@@ -147,6 +148,8 @@ static void cleanup_kgdboc(void)
37869 kgdboc_unregister_kbd();
37870 if (configured == 1)
37871 kgdb_unregister_io_module(&kgdboc_io_ops);
37872+ else if (configured == 2)
37873+ kgdb_unregister_io_module(&kgdboc_io_ops_console);
37874 }
37875
37876 static int configure_kgdboc(void)
37877@@ -156,13 +159,13 @@ static int configure_kgdboc(void)
37878 int err;
37879 char *cptr = config;
37880 struct console *cons;
37881+ int is_console = 0;
37882
37883 err = kgdboc_option_setup(config);
37884 if (err || !strlen(config) || isspace(config[0]))
37885 goto noconfig;
37886
37887 err = -ENODEV;
37888- kgdboc_io_ops.is_console = 0;
37889 kgdb_tty_driver = NULL;
37890
37891 kgdboc_use_kms = 0;
37892@@ -183,7 +186,7 @@ static int configure_kgdboc(void)
37893 int idx;
37894 if (cons->device && cons->device(cons, &idx) == p &&
37895 idx == tty_line) {
37896- kgdboc_io_ops.is_console = 1;
37897+ is_console = 1;
37898 break;
37899 }
37900 cons = cons->next;
37901@@ -193,12 +196,16 @@ static int configure_kgdboc(void)
37902 kgdb_tty_line = tty_line;
37903
37904 do_register:
37905- err = kgdb_register_io_module(&kgdboc_io_ops);
37906+ if (is_console) {
37907+ err = kgdb_register_io_module(&kgdboc_io_ops_console);
37908+ configured = 2;
37909+ } else {
37910+ err = kgdb_register_io_module(&kgdboc_io_ops);
37911+ configured = 1;
37912+ }
37913 if (err)
37914 goto noconfig;
37915
37916- configured = 1;
37917-
37918 return 0;
37919
37920 noconfig:
37921@@ -212,7 +219,7 @@ noconfig:
37922 static int __init init_kgdboc(void)
37923 {
37924 /* Already configured? */
37925- if (configured == 1)
37926+ if (configured >= 1)
37927 return 0;
37928
37929 return configure_kgdboc();
37930@@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
37931 if (config[len - 1] == '\n')
37932 config[len - 1] = '\0';
37933
37934- if (configured == 1)
37935+ if (configured >= 1)
37936 cleanup_kgdboc();
37937
37938 /* Go and configure with the new params. */
37939@@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = {
37940 .post_exception = kgdboc_post_exp_handler,
37941 };
37942
37943+static struct kgdb_io kgdboc_io_ops_console = {
37944+ .name = "kgdboc",
37945+ .read_char = kgdboc_get_char,
37946+ .write_char = kgdboc_put_char,
37947+ .pre_exception = kgdboc_pre_exp_handler,
37948+ .post_exception = kgdboc_post_exp_handler,
37949+ .is_console = 1
37950+};
37951+
37952 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
37953 /* This is only available if kgdboc is a built in for early debugging */
37954 static int __init kgdboc_early_init(char *opt)
37955diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
37956index cab52f4..29fc6aa 100644
37957--- a/drivers/tty/serial/mfd.c
37958+++ b/drivers/tty/serial/mfd.c
37959@@ -1423,7 +1423,7 @@ static void serial_hsu_remove(struct pci_dev *pdev)
37960 }
37961
37962 /* First 3 are UART ports, and the 4th is the DMA */
37963-static const struct pci_device_id pci_ids[] __devinitdata = {
37964+static const struct pci_device_id pci_ids[] __devinitconst = {
37965 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
37966 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
37967 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
37968diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
37969index 23bc743..d425c07 100644
37970--- a/drivers/tty/serial/mrst_max3110.c
37971+++ b/drivers/tty/serial/mrst_max3110.c
37972@@ -393,6 +393,8 @@ static void max3110_con_receive(struct uart_max3110 *max)
37973 int loop = 1, num, total = 0;
37974 u8 recv_buf[512], *pbuf;
37975
37976+ pax_track_stack();
37977+
37978 pbuf = recv_buf;
37979 do {
37980 num = max3110_read_multi(max, pbuf);
37981diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
37982index 1a890e2..1d8139c 100644
37983--- a/drivers/tty/tty_io.c
37984+++ b/drivers/tty/tty_io.c
37985@@ -3238,7 +3238,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
37986
37987 void tty_default_fops(struct file_operations *fops)
37988 {
37989- *fops = tty_fops;
37990+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
37991 }
37992
37993 /*
37994diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
37995index a76c808..ecbc743 100644
37996--- a/drivers/tty/tty_ldisc.c
37997+++ b/drivers/tty/tty_ldisc.c
37998@@ -75,7 +75,7 @@ static void put_ldisc(struct tty_ldisc *ld)
37999 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
38000 struct tty_ldisc_ops *ldo = ld->ops;
38001
38002- ldo->refcount--;
38003+ atomic_dec(&ldo->refcount);
38004 module_put(ldo->owner);
38005 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38006
38007@@ -110,7 +110,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
38008 spin_lock_irqsave(&tty_ldisc_lock, flags);
38009 tty_ldiscs[disc] = new_ldisc;
38010 new_ldisc->num = disc;
38011- new_ldisc->refcount = 0;
38012+ atomic_set(&new_ldisc->refcount, 0);
38013 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38014
38015 return ret;
38016@@ -138,7 +138,7 @@ int tty_unregister_ldisc(int disc)
38017 return -EINVAL;
38018
38019 spin_lock_irqsave(&tty_ldisc_lock, flags);
38020- if (tty_ldiscs[disc]->refcount)
38021+ if (atomic_read(&tty_ldiscs[disc]->refcount))
38022 ret = -EBUSY;
38023 else
38024 tty_ldiscs[disc] = NULL;
38025@@ -159,7 +159,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
38026 if (ldops) {
38027 ret = ERR_PTR(-EAGAIN);
38028 if (try_module_get(ldops->owner)) {
38029- ldops->refcount++;
38030+ atomic_inc(&ldops->refcount);
38031 ret = ldops;
38032 }
38033 }
38034@@ -172,7 +172,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
38035 unsigned long flags;
38036
38037 spin_lock_irqsave(&tty_ldisc_lock, flags);
38038- ldops->refcount--;
38039+ atomic_dec(&ldops->refcount);
38040 module_put(ldops->owner);
38041 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38042 }
38043diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
38044index 3761ccf..2c613b3 100644
38045--- a/drivers/tty/vt/keyboard.c
38046+++ b/drivers/tty/vt/keyboard.c
38047@@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
38048 kbd->kbdmode == VC_OFF) &&
38049 value != KVAL(K_SAK))
38050 return; /* SAK is allowed even in raw mode */
38051+
38052+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
38053+ {
38054+ void *func = fn_handler[value];
38055+ if (func == fn_show_state || func == fn_show_ptregs ||
38056+ func == fn_show_mem)
38057+ return;
38058+ }
38059+#endif
38060+
38061 fn_handler[value](vc);
38062 }
38063
38064diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
38065index b3915b7..e716839 100644
38066--- a/drivers/tty/vt/vt.c
38067+++ b/drivers/tty/vt/vt.c
38068@@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
38069
38070 static void notify_write(struct vc_data *vc, unsigned int unicode)
38071 {
38072- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
38073+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
38074 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
38075 }
38076
38077diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
38078index 5e096f4..0da1363 100644
38079--- a/drivers/tty/vt/vt_ioctl.c
38080+++ b/drivers/tty/vt/vt_ioctl.c
38081@@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38082 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
38083 return -EFAULT;
38084
38085- if (!capable(CAP_SYS_TTY_CONFIG))
38086- perm = 0;
38087-
38088 switch (cmd) {
38089 case KDGKBENT:
38090 key_map = key_maps[s];
38091@@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38092 val = (i ? K_HOLE : K_NOSUCHMAP);
38093 return put_user(val, &user_kbe->kb_value);
38094 case KDSKBENT:
38095+ if (!capable(CAP_SYS_TTY_CONFIG))
38096+ perm = 0;
38097+
38098 if (!perm)
38099 return -EPERM;
38100 if (!i && v == K_NOSUCHMAP) {
38101@@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38102 int i, j, k;
38103 int ret;
38104
38105- if (!capable(CAP_SYS_TTY_CONFIG))
38106- perm = 0;
38107-
38108 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
38109 if (!kbs) {
38110 ret = -ENOMEM;
38111@@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38112 kfree(kbs);
38113 return ((p && *p) ? -EOVERFLOW : 0);
38114 case KDSKBSENT:
38115+ if (!capable(CAP_SYS_TTY_CONFIG))
38116+ perm = 0;
38117+
38118 if (!perm) {
38119 ret = -EPERM;
38120 goto reterr;
38121diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
38122index d2efe82..9440ab6 100644
38123--- a/drivers/uio/uio.c
38124+++ b/drivers/uio/uio.c
38125@@ -25,6 +25,7 @@
38126 #include <linux/kobject.h>
38127 #include <linux/cdev.h>
38128 #include <linux/uio_driver.h>
38129+#include <asm/local.h>
38130
38131 #define UIO_MAX_DEVICES (1U << MINORBITS)
38132
38133@@ -32,10 +33,10 @@ struct uio_device {
38134 struct module *owner;
38135 struct device *dev;
38136 int minor;
38137- atomic_t event;
38138+ atomic_unchecked_t event;
38139 struct fasync_struct *async_queue;
38140 wait_queue_head_t wait;
38141- int vma_count;
38142+ local_t vma_count;
38143 struct uio_info *info;
38144 struct kobject *map_dir;
38145 struct kobject *portio_dir;
38146@@ -242,7 +243,7 @@ static ssize_t show_event(struct device *dev,
38147 struct device_attribute *attr, char *buf)
38148 {
38149 struct uio_device *idev = dev_get_drvdata(dev);
38150- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
38151+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
38152 }
38153
38154 static struct device_attribute uio_class_attributes[] = {
38155@@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *info)
38156 {
38157 struct uio_device *idev = info->uio_dev;
38158
38159- atomic_inc(&idev->event);
38160+ atomic_inc_unchecked(&idev->event);
38161 wake_up_interruptible(&idev->wait);
38162 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
38163 }
38164@@ -461,7 +462,7 @@ static int uio_open(struct inode *inode, struct file *filep)
38165 }
38166
38167 listener->dev = idev;
38168- listener->event_count = atomic_read(&idev->event);
38169+ listener->event_count = atomic_read_unchecked(&idev->event);
38170 filep->private_data = listener;
38171
38172 if (idev->info->open) {
38173@@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
38174 return -EIO;
38175
38176 poll_wait(filep, &idev->wait, wait);
38177- if (listener->event_count != atomic_read(&idev->event))
38178+ if (listener->event_count != atomic_read_unchecked(&idev->event))
38179 return POLLIN | POLLRDNORM;
38180 return 0;
38181 }
38182@@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
38183 do {
38184 set_current_state(TASK_INTERRUPTIBLE);
38185
38186- event_count = atomic_read(&idev->event);
38187+ event_count = atomic_read_unchecked(&idev->event);
38188 if (event_count != listener->event_count) {
38189 if (copy_to_user(buf, &event_count, count))
38190 retval = -EFAULT;
38191@@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
38192 static void uio_vma_open(struct vm_area_struct *vma)
38193 {
38194 struct uio_device *idev = vma->vm_private_data;
38195- idev->vma_count++;
38196+ local_inc(&idev->vma_count);
38197 }
38198
38199 static void uio_vma_close(struct vm_area_struct *vma)
38200 {
38201 struct uio_device *idev = vma->vm_private_data;
38202- idev->vma_count--;
38203+ local_dec(&idev->vma_count);
38204 }
38205
38206 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
38207@@ -823,7 +824,7 @@ int __uio_register_device(struct module *owner,
38208 idev->owner = owner;
38209 idev->info = info;
38210 init_waitqueue_head(&idev->wait);
38211- atomic_set(&idev->event, 0);
38212+ atomic_set_unchecked(&idev->event, 0);
38213
38214 ret = uio_get_minor(idev);
38215 if (ret)
38216diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
38217index a845f8b..4f54072 100644
38218--- a/drivers/usb/atm/cxacru.c
38219+++ b/drivers/usb/atm/cxacru.c
38220@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
38221 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
38222 if (ret < 2)
38223 return -EINVAL;
38224- if (index < 0 || index > 0x7f)
38225+ if (index > 0x7f)
38226 return -EINVAL;
38227 pos += tmp;
38228
38229diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
38230index d3448ca..d2864ca 100644
38231--- a/drivers/usb/atm/usbatm.c
38232+++ b/drivers/usb/atm/usbatm.c
38233@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38234 if (printk_ratelimit())
38235 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
38236 __func__, vpi, vci);
38237- atomic_inc(&vcc->stats->rx_err);
38238+ atomic_inc_unchecked(&vcc->stats->rx_err);
38239 return;
38240 }
38241
38242@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38243 if (length > ATM_MAX_AAL5_PDU) {
38244 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
38245 __func__, length, vcc);
38246- atomic_inc(&vcc->stats->rx_err);
38247+ atomic_inc_unchecked(&vcc->stats->rx_err);
38248 goto out;
38249 }
38250
38251@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38252 if (sarb->len < pdu_length) {
38253 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
38254 __func__, pdu_length, sarb->len, vcc);
38255- atomic_inc(&vcc->stats->rx_err);
38256+ atomic_inc_unchecked(&vcc->stats->rx_err);
38257 goto out;
38258 }
38259
38260 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
38261 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
38262 __func__, vcc);
38263- atomic_inc(&vcc->stats->rx_err);
38264+ atomic_inc_unchecked(&vcc->stats->rx_err);
38265 goto out;
38266 }
38267
38268@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38269 if (printk_ratelimit())
38270 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
38271 __func__, length);
38272- atomic_inc(&vcc->stats->rx_drop);
38273+ atomic_inc_unchecked(&vcc->stats->rx_drop);
38274 goto out;
38275 }
38276
38277@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38278
38279 vcc->push(vcc, skb);
38280
38281- atomic_inc(&vcc->stats->rx);
38282+ atomic_inc_unchecked(&vcc->stats->rx);
38283 out:
38284 skb_trim(sarb, 0);
38285 }
38286@@ -615,7 +615,7 @@ static void usbatm_tx_process(unsigned long data)
38287 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
38288
38289 usbatm_pop(vcc, skb);
38290- atomic_inc(&vcc->stats->tx);
38291+ atomic_inc_unchecked(&vcc->stats->tx);
38292
38293 skb = skb_dequeue(&instance->sndqueue);
38294 }
38295@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
38296 if (!left--)
38297 return sprintf(page,
38298 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
38299- atomic_read(&atm_dev->stats.aal5.tx),
38300- atomic_read(&atm_dev->stats.aal5.tx_err),
38301- atomic_read(&atm_dev->stats.aal5.rx),
38302- atomic_read(&atm_dev->stats.aal5.rx_err),
38303- atomic_read(&atm_dev->stats.aal5.rx_drop));
38304+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
38305+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
38306+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
38307+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
38308+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
38309
38310 if (!left--) {
38311 if (instance->disconnected)
38312diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
38313index 0149c09..f108812 100644
38314--- a/drivers/usb/core/devices.c
38315+++ b/drivers/usb/core/devices.c
38316@@ -126,7 +126,7 @@ static const char format_endpt[] =
38317 * time it gets called.
38318 */
38319 static struct device_connect_event {
38320- atomic_t count;
38321+ atomic_unchecked_t count;
38322 wait_queue_head_t wait;
38323 } device_event = {
38324 .count = ATOMIC_INIT(1),
38325@@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
38326
38327 void usbfs_conn_disc_event(void)
38328 {
38329- atomic_add(2, &device_event.count);
38330+ atomic_add_unchecked(2, &device_event.count);
38331 wake_up(&device_event.wait);
38332 }
38333
38334@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(struct file *file,
38335
38336 poll_wait(file, &device_event.wait, wait);
38337
38338- event_count = atomic_read(&device_event.count);
38339+ event_count = atomic_read_unchecked(&device_event.count);
38340 if (file->f_version != event_count) {
38341 file->f_version = event_count;
38342 return POLLIN | POLLRDNORM;
38343diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
38344index 0b5ec23..0da3d76 100644
38345--- a/drivers/usb/core/message.c
38346+++ b/drivers/usb/core/message.c
38347@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device *udev, int index)
38348 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
38349 if (buf) {
38350 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
38351- if (len > 0) {
38352- smallbuf = kmalloc(++len, GFP_NOIO);
38353+ if (len++ > 0) {
38354+ smallbuf = kmalloc(len, GFP_NOIO);
38355 if (!smallbuf)
38356 return buf;
38357 memcpy(smallbuf, buf, len);
38358diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
38359index 1fc8f12..20647c1 100644
38360--- a/drivers/usb/early/ehci-dbgp.c
38361+++ b/drivers/usb/early/ehci-dbgp.c
38362@@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
38363
38364 #ifdef CONFIG_KGDB
38365 static struct kgdb_io kgdbdbgp_io_ops;
38366-#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
38367+static struct kgdb_io kgdbdbgp_io_ops_console;
38368+#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
38369 #else
38370 #define dbgp_kgdb_mode (0)
38371 #endif
38372@@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
38373 .write_char = kgdbdbgp_write_char,
38374 };
38375
38376+static struct kgdb_io kgdbdbgp_io_ops_console = {
38377+ .name = "kgdbdbgp",
38378+ .read_char = kgdbdbgp_read_char,
38379+ .write_char = kgdbdbgp_write_char,
38380+ .is_console = 1
38381+};
38382+
38383 static int kgdbdbgp_wait_time;
38384
38385 static int __init kgdbdbgp_parse_config(char *str)
38386@@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(char *str)
38387 ptr++;
38388 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
38389 }
38390- kgdb_register_io_module(&kgdbdbgp_io_ops);
38391- kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
38392+ if (early_dbgp_console.index != -1)
38393+ kgdb_register_io_module(&kgdbdbgp_io_ops_console);
38394+ else
38395+ kgdb_register_io_module(&kgdbdbgp_io_ops);
38396
38397 return 0;
38398 }
38399diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
38400index d718033..6075579 100644
38401--- a/drivers/usb/host/xhci-mem.c
38402+++ b/drivers/usb/host/xhci-mem.c
38403@@ -1685,6 +1685,8 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
38404 unsigned int num_tests;
38405 int i, ret;
38406
38407+ pax_track_stack();
38408+
38409 num_tests = ARRAY_SIZE(simple_test_vector);
38410 for (i = 0; i < num_tests; i++) {
38411 ret = xhci_test_trb_in_td(xhci,
38412diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
38413index d6bea3e..60b250e 100644
38414--- a/drivers/usb/wusbcore/wa-hc.h
38415+++ b/drivers/usb/wusbcore/wa-hc.h
38416@@ -192,7 +192,7 @@ struct wahc {
38417 struct list_head xfer_delayed_list;
38418 spinlock_t xfer_list_lock;
38419 struct work_struct xfer_work;
38420- atomic_t xfer_id_count;
38421+ atomic_unchecked_t xfer_id_count;
38422 };
38423
38424
38425@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
38426 INIT_LIST_HEAD(&wa->xfer_delayed_list);
38427 spin_lock_init(&wa->xfer_list_lock);
38428 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
38429- atomic_set(&wa->xfer_id_count, 1);
38430+ atomic_set_unchecked(&wa->xfer_id_count, 1);
38431 }
38432
38433 /**
38434diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
38435index 4193345..49ae93d 100644
38436--- a/drivers/usb/wusbcore/wa-xfer.c
38437+++ b/drivers/usb/wusbcore/wa-xfer.c
38438@@ -295,7 +295,7 @@ out:
38439 */
38440 static void wa_xfer_id_init(struct wa_xfer *xfer)
38441 {
38442- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
38443+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
38444 }
38445
38446 /*
38447diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
38448index c14c42b..f955cc2 100644
38449--- a/drivers/vhost/vhost.c
38450+++ b/drivers/vhost/vhost.c
38451@@ -629,7 +629,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
38452 return 0;
38453 }
38454
38455-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
38456+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
38457 {
38458 struct file *eventfp, *filep = NULL,
38459 *pollstart = NULL, *pollstop = NULL;
38460diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
38461index b0b2ac3..89a4399 100644
38462--- a/drivers/video/aty/aty128fb.c
38463+++ b/drivers/video/aty/aty128fb.c
38464@@ -148,7 +148,7 @@ enum {
38465 };
38466
38467 /* Must match above enum */
38468-static const char *r128_family[] __devinitdata = {
38469+static const char *r128_family[] __devinitconst = {
38470 "AGP",
38471 "PCI",
38472 "PRO AGP",
38473diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
38474index 5c3960d..15cf8fc 100644
38475--- a/drivers/video/fbcmap.c
38476+++ b/drivers/video/fbcmap.c
38477@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
38478 rc = -ENODEV;
38479 goto out;
38480 }
38481- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
38482- !info->fbops->fb_setcmap)) {
38483+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
38484 rc = -EINVAL;
38485 goto out1;
38486 }
38487diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
38488index ad93629..ca6a218 100644
38489--- a/drivers/video/fbmem.c
38490+++ b/drivers/video/fbmem.c
38491@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38492 image->dx += image->width + 8;
38493 }
38494 } else if (rotate == FB_ROTATE_UD) {
38495- for (x = 0; x < num && image->dx >= 0; x++) {
38496+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
38497 info->fbops->fb_imageblit(info, image);
38498 image->dx -= image->width + 8;
38499 }
38500@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38501 image->dy += image->height + 8;
38502 }
38503 } else if (rotate == FB_ROTATE_CCW) {
38504- for (x = 0; x < num && image->dy >= 0; x++) {
38505+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
38506 info->fbops->fb_imageblit(info, image);
38507 image->dy -= image->height + 8;
38508 }
38509@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
38510 int flags = info->flags;
38511 int ret = 0;
38512
38513+ pax_track_stack();
38514+
38515 if (var->activate & FB_ACTIVATE_INV_MODE) {
38516 struct fb_videomode mode1, mode2;
38517
38518@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38519 void __user *argp = (void __user *)arg;
38520 long ret = 0;
38521
38522+ pax_track_stack();
38523+
38524 switch (cmd) {
38525 case FBIOGET_VSCREENINFO:
38526 if (!lock_fb_info(info))
38527@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38528 return -EFAULT;
38529 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
38530 return -EINVAL;
38531- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
38532+ if (con2fb.framebuffer >= FB_MAX)
38533 return -EINVAL;
38534 if (!registered_fb[con2fb.framebuffer])
38535 request_module("fb%d", con2fb.framebuffer);
38536diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
38537index 5a5d092..265c5ed 100644
38538--- a/drivers/video/geode/gx1fb_core.c
38539+++ b/drivers/video/geode/gx1fb_core.c
38540@@ -29,7 +29,7 @@ static int crt_option = 1;
38541 static char panel_option[32] = "";
38542
38543 /* Modes relevant to the GX1 (taken from modedb.c) */
38544-static const struct fb_videomode __devinitdata gx1_modedb[] = {
38545+static const struct fb_videomode __devinitconst gx1_modedb[] = {
38546 /* 640x480-60 VESA */
38547 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
38548 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
38549diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
38550index 896e53d..4d87d0b 100644
38551--- a/drivers/video/gxt4500.c
38552+++ b/drivers/video/gxt4500.c
38553@@ -156,7 +156,7 @@ struct gxt4500_par {
38554 static char *mode_option;
38555
38556 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
38557-static const struct fb_videomode defaultmode __devinitdata = {
38558+static const struct fb_videomode defaultmode __devinitconst = {
38559 .refresh = 60,
38560 .xres = 1280,
38561 .yres = 1024,
38562@@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
38563 return 0;
38564 }
38565
38566-static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
38567+static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
38568 .id = "IBM GXT4500P",
38569 .type = FB_TYPE_PACKED_PIXELS,
38570 .visual = FB_VISUAL_PSEUDOCOLOR,
38571diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
38572index 7672d2e..b56437f 100644
38573--- a/drivers/video/i810/i810_accel.c
38574+++ b/drivers/video/i810/i810_accel.c
38575@@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
38576 }
38577 }
38578 printk("ringbuffer lockup!!!\n");
38579+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
38580 i810_report_error(mmio);
38581 par->dev_flags |= LOCKUP;
38582 info->pixmap.scan_align = 1;
38583diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
38584index 318f6fb..9a389c1 100644
38585--- a/drivers/video/i810/i810_main.c
38586+++ b/drivers/video/i810/i810_main.c
38587@@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
38588 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
38589
38590 /* PCI */
38591-static const char *i810_pci_list[] __devinitdata = {
38592+static const char *i810_pci_list[] __devinitconst = {
38593 "Intel(R) 810 Framebuffer Device" ,
38594 "Intel(R) 810-DC100 Framebuffer Device" ,
38595 "Intel(R) 810E Framebuffer Device" ,
38596diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
38597index de36693..3c63fc2 100644
38598--- a/drivers/video/jz4740_fb.c
38599+++ b/drivers/video/jz4740_fb.c
38600@@ -136,7 +136,7 @@ struct jzfb {
38601 uint32_t pseudo_palette[16];
38602 };
38603
38604-static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
38605+static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
38606 .id = "JZ4740 FB",
38607 .type = FB_TYPE_PACKED_PIXELS,
38608 .visual = FB_VISUAL_TRUECOLOR,
38609diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
38610index 3c14e43..eafa544 100644
38611--- a/drivers/video/logo/logo_linux_clut224.ppm
38612+++ b/drivers/video/logo/logo_linux_clut224.ppm
38613@@ -1,1604 +1,1123 @@
38614 P3
38615-# Standard 224-color Linux logo
38616 80 80
38617 255
38618- 0 0 0 0 0 0 0 0 0 0 0 0
38619- 0 0 0 0 0 0 0 0 0 0 0 0
38620- 0 0 0 0 0 0 0 0 0 0 0 0
38621- 0 0 0 0 0 0 0 0 0 0 0 0
38622- 0 0 0 0 0 0 0 0 0 0 0 0
38623- 0 0 0 0 0 0 0 0 0 0 0 0
38624- 0 0 0 0 0 0 0 0 0 0 0 0
38625- 0 0 0 0 0 0 0 0 0 0 0 0
38626- 0 0 0 0 0 0 0 0 0 0 0 0
38627- 6 6 6 6 6 6 10 10 10 10 10 10
38628- 10 10 10 6 6 6 6 6 6 6 6 6
38629- 0 0 0 0 0 0 0 0 0 0 0 0
38630- 0 0 0 0 0 0 0 0 0 0 0 0
38631- 0 0 0 0 0 0 0 0 0 0 0 0
38632- 0 0 0 0 0 0 0 0 0 0 0 0
38633- 0 0 0 0 0 0 0 0 0 0 0 0
38634- 0 0 0 0 0 0 0 0 0 0 0 0
38635- 0 0 0 0 0 0 0 0 0 0 0 0
38636- 0 0 0 0 0 0 0 0 0 0 0 0
38637- 0 0 0 0 0 0 0 0 0 0 0 0
38638- 0 0 0 0 0 0 0 0 0 0 0 0
38639- 0 0 0 0 0 0 0 0 0 0 0 0
38640- 0 0 0 0 0 0 0 0 0 0 0 0
38641- 0 0 0 0 0 0 0 0 0 0 0 0
38642- 0 0 0 0 0 0 0 0 0 0 0 0
38643- 0 0 0 0 0 0 0 0 0 0 0 0
38644- 0 0 0 0 0 0 0 0 0 0 0 0
38645- 0 0 0 0 0 0 0 0 0 0 0 0
38646- 0 0 0 6 6 6 10 10 10 14 14 14
38647- 22 22 22 26 26 26 30 30 30 34 34 34
38648- 30 30 30 30 30 30 26 26 26 18 18 18
38649- 14 14 14 10 10 10 6 6 6 0 0 0
38650- 0 0 0 0 0 0 0 0 0 0 0 0
38651- 0 0 0 0 0 0 0 0 0 0 0 0
38652- 0 0 0 0 0 0 0 0 0 0 0 0
38653- 0 0 0 0 0 0 0 0 0 0 0 0
38654- 0 0 0 0 0 0 0 0 0 0 0 0
38655- 0 0 0 0 0 0 0 0 0 0 0 0
38656- 0 0 0 0 0 0 0 0 0 0 0 0
38657- 0 0 0 0 0 0 0 0 0 0 0 0
38658- 0 0 0 0 0 0 0 0 0 0 0 0
38659- 0 0 0 0 0 1 0 0 1 0 0 0
38660- 0 0 0 0 0 0 0 0 0 0 0 0
38661- 0 0 0 0 0 0 0 0 0 0 0 0
38662- 0 0 0 0 0 0 0 0 0 0 0 0
38663- 0 0 0 0 0 0 0 0 0 0 0 0
38664- 0 0 0 0 0 0 0 0 0 0 0 0
38665- 0 0 0 0 0 0 0 0 0 0 0 0
38666- 6 6 6 14 14 14 26 26 26 42 42 42
38667- 54 54 54 66 66 66 78 78 78 78 78 78
38668- 78 78 78 74 74 74 66 66 66 54 54 54
38669- 42 42 42 26 26 26 18 18 18 10 10 10
38670- 6 6 6 0 0 0 0 0 0 0 0 0
38671- 0 0 0 0 0 0 0 0 0 0 0 0
38672- 0 0 0 0 0 0 0 0 0 0 0 0
38673- 0 0 0 0 0 0 0 0 0 0 0 0
38674- 0 0 0 0 0 0 0 0 0 0 0 0
38675- 0 0 0 0 0 0 0 0 0 0 0 0
38676- 0 0 0 0 0 0 0 0 0 0 0 0
38677- 0 0 0 0 0 0 0 0 0 0 0 0
38678- 0 0 0 0 0 0 0 0 0 0 0 0
38679- 0 0 1 0 0 0 0 0 0 0 0 0
38680- 0 0 0 0 0 0 0 0 0 0 0 0
38681- 0 0 0 0 0 0 0 0 0 0 0 0
38682- 0 0 0 0 0 0 0 0 0 0 0 0
38683- 0 0 0 0 0 0 0 0 0 0 0 0
38684- 0 0 0 0 0 0 0 0 0 0 0 0
38685- 0 0 0 0 0 0 0 0 0 10 10 10
38686- 22 22 22 42 42 42 66 66 66 86 86 86
38687- 66 66 66 38 38 38 38 38 38 22 22 22
38688- 26 26 26 34 34 34 54 54 54 66 66 66
38689- 86 86 86 70 70 70 46 46 46 26 26 26
38690- 14 14 14 6 6 6 0 0 0 0 0 0
38691- 0 0 0 0 0 0 0 0 0 0 0 0
38692- 0 0 0 0 0 0 0 0 0 0 0 0
38693- 0 0 0 0 0 0 0 0 0 0 0 0
38694- 0 0 0 0 0 0 0 0 0 0 0 0
38695- 0 0 0 0 0 0 0 0 0 0 0 0
38696- 0 0 0 0 0 0 0 0 0 0 0 0
38697- 0 0 0 0 0 0 0 0 0 0 0 0
38698- 0 0 0 0 0 0 0 0 0 0 0 0
38699- 0 0 1 0 0 1 0 0 1 0 0 0
38700- 0 0 0 0 0 0 0 0 0 0 0 0
38701- 0 0 0 0 0 0 0 0 0 0 0 0
38702- 0 0 0 0 0 0 0 0 0 0 0 0
38703- 0 0 0 0 0 0 0 0 0 0 0 0
38704- 0 0 0 0 0 0 0 0 0 0 0 0
38705- 0 0 0 0 0 0 10 10 10 26 26 26
38706- 50 50 50 82 82 82 58 58 58 6 6 6
38707- 2 2 6 2 2 6 2 2 6 2 2 6
38708- 2 2 6 2 2 6 2 2 6 2 2 6
38709- 6 6 6 54 54 54 86 86 86 66 66 66
38710- 38 38 38 18 18 18 6 6 6 0 0 0
38711- 0 0 0 0 0 0 0 0 0 0 0 0
38712- 0 0 0 0 0 0 0 0 0 0 0 0
38713- 0 0 0 0 0 0 0 0 0 0 0 0
38714- 0 0 0 0 0 0 0 0 0 0 0 0
38715- 0 0 0 0 0 0 0 0 0 0 0 0
38716- 0 0 0 0 0 0 0 0 0 0 0 0
38717- 0 0 0 0 0 0 0 0 0 0 0 0
38718- 0 0 0 0 0 0 0 0 0 0 0 0
38719- 0 0 0 0 0 0 0 0 0 0 0 0
38720- 0 0 0 0 0 0 0 0 0 0 0 0
38721- 0 0 0 0 0 0 0 0 0 0 0 0
38722- 0 0 0 0 0 0 0 0 0 0 0 0
38723- 0 0 0 0 0 0 0 0 0 0 0 0
38724- 0 0 0 0 0 0 0 0 0 0 0 0
38725- 0 0 0 6 6 6 22 22 22 50 50 50
38726- 78 78 78 34 34 34 2 2 6 2 2 6
38727- 2 2 6 2 2 6 2 2 6 2 2 6
38728- 2 2 6 2 2 6 2 2 6 2 2 6
38729- 2 2 6 2 2 6 6 6 6 70 70 70
38730- 78 78 78 46 46 46 22 22 22 6 6 6
38731- 0 0 0 0 0 0 0 0 0 0 0 0
38732- 0 0 0 0 0 0 0 0 0 0 0 0
38733- 0 0 0 0 0 0 0 0 0 0 0 0
38734- 0 0 0 0 0 0 0 0 0 0 0 0
38735- 0 0 0 0 0 0 0 0 0 0 0 0
38736- 0 0 0 0 0 0 0 0 0 0 0 0
38737- 0 0 0 0 0 0 0 0 0 0 0 0
38738- 0 0 0 0 0 0 0 0 0 0 0 0
38739- 0 0 1 0 0 1 0 0 1 0 0 0
38740- 0 0 0 0 0 0 0 0 0 0 0 0
38741- 0 0 0 0 0 0 0 0 0 0 0 0
38742- 0 0 0 0 0 0 0 0 0 0 0 0
38743- 0 0 0 0 0 0 0 0 0 0 0 0
38744- 0 0 0 0 0 0 0 0 0 0 0 0
38745- 6 6 6 18 18 18 42 42 42 82 82 82
38746- 26 26 26 2 2 6 2 2 6 2 2 6
38747- 2 2 6 2 2 6 2 2 6 2 2 6
38748- 2 2 6 2 2 6 2 2 6 14 14 14
38749- 46 46 46 34 34 34 6 6 6 2 2 6
38750- 42 42 42 78 78 78 42 42 42 18 18 18
38751- 6 6 6 0 0 0 0 0 0 0 0 0
38752- 0 0 0 0 0 0 0 0 0 0 0 0
38753- 0 0 0 0 0 0 0 0 0 0 0 0
38754- 0 0 0 0 0 0 0 0 0 0 0 0
38755- 0 0 0 0 0 0 0 0 0 0 0 0
38756- 0 0 0 0 0 0 0 0 0 0 0 0
38757- 0 0 0 0 0 0 0 0 0 0 0 0
38758- 0 0 0 0 0 0 0 0 0 0 0 0
38759- 0 0 1 0 0 0 0 0 1 0 0 0
38760- 0 0 0 0 0 0 0 0 0 0 0 0
38761- 0 0 0 0 0 0 0 0 0 0 0 0
38762- 0 0 0 0 0 0 0 0 0 0 0 0
38763- 0 0 0 0 0 0 0 0 0 0 0 0
38764- 0 0 0 0 0 0 0 0 0 0 0 0
38765- 10 10 10 30 30 30 66 66 66 58 58 58
38766- 2 2 6 2 2 6 2 2 6 2 2 6
38767- 2 2 6 2 2 6 2 2 6 2 2 6
38768- 2 2 6 2 2 6 2 2 6 26 26 26
38769- 86 86 86 101 101 101 46 46 46 10 10 10
38770- 2 2 6 58 58 58 70 70 70 34 34 34
38771- 10 10 10 0 0 0 0 0 0 0 0 0
38772- 0 0 0 0 0 0 0 0 0 0 0 0
38773- 0 0 0 0 0 0 0 0 0 0 0 0
38774- 0 0 0 0 0 0 0 0 0 0 0 0
38775- 0 0 0 0 0 0 0 0 0 0 0 0
38776- 0 0 0 0 0 0 0 0 0 0 0 0
38777- 0 0 0 0 0 0 0 0 0 0 0 0
38778- 0 0 0 0 0 0 0 0 0 0 0 0
38779- 0 0 1 0 0 1 0 0 1 0 0 0
38780- 0 0 0 0 0 0 0 0 0 0 0 0
38781- 0 0 0 0 0 0 0 0 0 0 0 0
38782- 0 0 0 0 0 0 0 0 0 0 0 0
38783- 0 0 0 0 0 0 0 0 0 0 0 0
38784- 0 0 0 0 0 0 0 0 0 0 0 0
38785- 14 14 14 42 42 42 86 86 86 10 10 10
38786- 2 2 6 2 2 6 2 2 6 2 2 6
38787- 2 2 6 2 2 6 2 2 6 2 2 6
38788- 2 2 6 2 2 6 2 2 6 30 30 30
38789- 94 94 94 94 94 94 58 58 58 26 26 26
38790- 2 2 6 6 6 6 78 78 78 54 54 54
38791- 22 22 22 6 6 6 0 0 0 0 0 0
38792- 0 0 0 0 0 0 0 0 0 0 0 0
38793- 0 0 0 0 0 0 0 0 0 0 0 0
38794- 0 0 0 0 0 0 0 0 0 0 0 0
38795- 0 0 0 0 0 0 0 0 0 0 0 0
38796- 0 0 0 0 0 0 0 0 0 0 0 0
38797- 0 0 0 0 0 0 0 0 0 0 0 0
38798- 0 0 0 0 0 0 0 0 0 0 0 0
38799- 0 0 0 0 0 0 0 0 0 0 0 0
38800- 0 0 0 0 0 0 0 0 0 0 0 0
38801- 0 0 0 0 0 0 0 0 0 0 0 0
38802- 0 0 0 0 0 0 0 0 0 0 0 0
38803- 0 0 0 0 0 0 0 0 0 0 0 0
38804- 0 0 0 0 0 0 0 0 0 6 6 6
38805- 22 22 22 62 62 62 62 62 62 2 2 6
38806- 2 2 6 2 2 6 2 2 6 2 2 6
38807- 2 2 6 2 2 6 2 2 6 2 2 6
38808- 2 2 6 2 2 6 2 2 6 26 26 26
38809- 54 54 54 38 38 38 18 18 18 10 10 10
38810- 2 2 6 2 2 6 34 34 34 82 82 82
38811- 38 38 38 14 14 14 0 0 0 0 0 0
38812- 0 0 0 0 0 0 0 0 0 0 0 0
38813- 0 0 0 0 0 0 0 0 0 0 0 0
38814- 0 0 0 0 0 0 0 0 0 0 0 0
38815- 0 0 0 0 0 0 0 0 0 0 0 0
38816- 0 0 0 0 0 0 0 0 0 0 0 0
38817- 0 0 0 0 0 0 0 0 0 0 0 0
38818- 0 0 0 0 0 0 0 0 0 0 0 0
38819- 0 0 0 0 0 1 0 0 1 0 0 0
38820- 0 0 0 0 0 0 0 0 0 0 0 0
38821- 0 0 0 0 0 0 0 0 0 0 0 0
38822- 0 0 0 0 0 0 0 0 0 0 0 0
38823- 0 0 0 0 0 0 0 0 0 0 0 0
38824- 0 0 0 0 0 0 0 0 0 6 6 6
38825- 30 30 30 78 78 78 30 30 30 2 2 6
38826- 2 2 6 2 2 6 2 2 6 2 2 6
38827- 2 2 6 2 2 6 2 2 6 2 2 6
38828- 2 2 6 2 2 6 2 2 6 10 10 10
38829- 10 10 10 2 2 6 2 2 6 2 2 6
38830- 2 2 6 2 2 6 2 2 6 78 78 78
38831- 50 50 50 18 18 18 6 6 6 0 0 0
38832- 0 0 0 0 0 0 0 0 0 0 0 0
38833- 0 0 0 0 0 0 0 0 0 0 0 0
38834- 0 0 0 0 0 0 0 0 0 0 0 0
38835- 0 0 0 0 0 0 0 0 0 0 0 0
38836- 0 0 0 0 0 0 0 0 0 0 0 0
38837- 0 0 0 0 0 0 0 0 0 0 0 0
38838- 0 0 0 0 0 0 0 0 0 0 0 0
38839- 0 0 1 0 0 0 0 0 0 0 0 0
38840- 0 0 0 0 0 0 0 0 0 0 0 0
38841- 0 0 0 0 0 0 0 0 0 0 0 0
38842- 0 0 0 0 0 0 0 0 0 0 0 0
38843- 0 0 0 0 0 0 0 0 0 0 0 0
38844- 0 0 0 0 0 0 0 0 0 10 10 10
38845- 38 38 38 86 86 86 14 14 14 2 2 6
38846- 2 2 6 2 2 6 2 2 6 2 2 6
38847- 2 2 6 2 2 6 2 2 6 2 2 6
38848- 2 2 6 2 2 6 2 2 6 2 2 6
38849- 2 2 6 2 2 6 2 2 6 2 2 6
38850- 2 2 6 2 2 6 2 2 6 54 54 54
38851- 66 66 66 26 26 26 6 6 6 0 0 0
38852- 0 0 0 0 0 0 0 0 0 0 0 0
38853- 0 0 0 0 0 0 0 0 0 0 0 0
38854- 0 0 0 0 0 0 0 0 0 0 0 0
38855- 0 0 0 0 0 0 0 0 0 0 0 0
38856- 0 0 0 0 0 0 0 0 0 0 0 0
38857- 0 0 0 0 0 0 0 0 0 0 0 0
38858- 0 0 0 0 0 0 0 0 0 0 0 0
38859- 0 0 0 0 0 1 0 0 1 0 0 0
38860- 0 0 0 0 0 0 0 0 0 0 0 0
38861- 0 0 0 0 0 0 0 0 0 0 0 0
38862- 0 0 0 0 0 0 0 0 0 0 0 0
38863- 0 0 0 0 0 0 0 0 0 0 0 0
38864- 0 0 0 0 0 0 0 0 0 14 14 14
38865- 42 42 42 82 82 82 2 2 6 2 2 6
38866- 2 2 6 6 6 6 10 10 10 2 2 6
38867- 2 2 6 2 2 6 2 2 6 2 2 6
38868- 2 2 6 2 2 6 2 2 6 6 6 6
38869- 14 14 14 10 10 10 2 2 6 2 2 6
38870- 2 2 6 2 2 6 2 2 6 18 18 18
38871- 82 82 82 34 34 34 10 10 10 0 0 0
38872- 0 0 0 0 0 0 0 0 0 0 0 0
38873- 0 0 0 0 0 0 0 0 0 0 0 0
38874- 0 0 0 0 0 0 0 0 0 0 0 0
38875- 0 0 0 0 0 0 0 0 0 0 0 0
38876- 0 0 0 0 0 0 0 0 0 0 0 0
38877- 0 0 0 0 0 0 0 0 0 0 0 0
38878- 0 0 0 0 0 0 0 0 0 0 0 0
38879- 0 0 1 0 0 0 0 0 0 0 0 0
38880- 0 0 0 0 0 0 0 0 0 0 0 0
38881- 0 0 0 0 0 0 0 0 0 0 0 0
38882- 0 0 0 0 0 0 0 0 0 0 0 0
38883- 0 0 0 0 0 0 0 0 0 0 0 0
38884- 0 0 0 0 0 0 0 0 0 14 14 14
38885- 46 46 46 86 86 86 2 2 6 2 2 6
38886- 6 6 6 6 6 6 22 22 22 34 34 34
38887- 6 6 6 2 2 6 2 2 6 2 2 6
38888- 2 2 6 2 2 6 18 18 18 34 34 34
38889- 10 10 10 50 50 50 22 22 22 2 2 6
38890- 2 2 6 2 2 6 2 2 6 10 10 10
38891- 86 86 86 42 42 42 14 14 14 0 0 0
38892- 0 0 0 0 0 0 0 0 0 0 0 0
38893- 0 0 0 0 0 0 0 0 0 0 0 0
38894- 0 0 0 0 0 0 0 0 0 0 0 0
38895- 0 0 0 0 0 0 0 0 0 0 0 0
38896- 0 0 0 0 0 0 0 0 0 0 0 0
38897- 0 0 0 0 0 0 0 0 0 0 0 0
38898- 0 0 0 0 0 0 0 0 0 0 0 0
38899- 0 0 1 0 0 1 0 0 1 0 0 0
38900- 0 0 0 0 0 0 0 0 0 0 0 0
38901- 0 0 0 0 0 0 0 0 0 0 0 0
38902- 0 0 0 0 0 0 0 0 0 0 0 0
38903- 0 0 0 0 0 0 0 0 0 0 0 0
38904- 0 0 0 0 0 0 0 0 0 14 14 14
38905- 46 46 46 86 86 86 2 2 6 2 2 6
38906- 38 38 38 116 116 116 94 94 94 22 22 22
38907- 22 22 22 2 2 6 2 2 6 2 2 6
38908- 14 14 14 86 86 86 138 138 138 162 162 162
38909-154 154 154 38 38 38 26 26 26 6 6 6
38910- 2 2 6 2 2 6 2 2 6 2 2 6
38911- 86 86 86 46 46 46 14 14 14 0 0 0
38912- 0 0 0 0 0 0 0 0 0 0 0 0
38913- 0 0 0 0 0 0 0 0 0 0 0 0
38914- 0 0 0 0 0 0 0 0 0 0 0 0
38915- 0 0 0 0 0 0 0 0 0 0 0 0
38916- 0 0 0 0 0 0 0 0 0 0 0 0
38917- 0 0 0 0 0 0 0 0 0 0 0 0
38918- 0 0 0 0 0 0 0 0 0 0 0 0
38919- 0 0 0 0 0 0 0 0 0 0 0 0
38920- 0 0 0 0 0 0 0 0 0 0 0 0
38921- 0 0 0 0 0 0 0 0 0 0 0 0
38922- 0 0 0 0 0 0 0 0 0 0 0 0
38923- 0 0 0 0 0 0 0 0 0 0 0 0
38924- 0 0 0 0 0 0 0 0 0 14 14 14
38925- 46 46 46 86 86 86 2 2 6 14 14 14
38926-134 134 134 198 198 198 195 195 195 116 116 116
38927- 10 10 10 2 2 6 2 2 6 6 6 6
38928-101 98 89 187 187 187 210 210 210 218 218 218
38929-214 214 214 134 134 134 14 14 14 6 6 6
38930- 2 2 6 2 2 6 2 2 6 2 2 6
38931- 86 86 86 50 50 50 18 18 18 6 6 6
38932- 0 0 0 0 0 0 0 0 0 0 0 0
38933- 0 0 0 0 0 0 0 0 0 0 0 0
38934- 0 0 0 0 0 0 0 0 0 0 0 0
38935- 0 0 0 0 0 0 0 0 0 0 0 0
38936- 0 0 0 0 0 0 0 0 0 0 0 0
38937- 0 0 0 0 0 0 0 0 0 0 0 0
38938- 0 0 0 0 0 0 0 0 1 0 0 0
38939- 0 0 1 0 0 1 0 0 1 0 0 0
38940- 0 0 0 0 0 0 0 0 0 0 0 0
38941- 0 0 0 0 0 0 0 0 0 0 0 0
38942- 0 0 0 0 0 0 0 0 0 0 0 0
38943- 0 0 0 0 0 0 0 0 0 0 0 0
38944- 0 0 0 0 0 0 0 0 0 14 14 14
38945- 46 46 46 86 86 86 2 2 6 54 54 54
38946-218 218 218 195 195 195 226 226 226 246 246 246
38947- 58 58 58 2 2 6 2 2 6 30 30 30
38948-210 210 210 253 253 253 174 174 174 123 123 123
38949-221 221 221 234 234 234 74 74 74 2 2 6
38950- 2 2 6 2 2 6 2 2 6 2 2 6
38951- 70 70 70 58 58 58 22 22 22 6 6 6
38952- 0 0 0 0 0 0 0 0 0 0 0 0
38953- 0 0 0 0 0 0 0 0 0 0 0 0
38954- 0 0 0 0 0 0 0 0 0 0 0 0
38955- 0 0 0 0 0 0 0 0 0 0 0 0
38956- 0 0 0 0 0 0 0 0 0 0 0 0
38957- 0 0 0 0 0 0 0 0 0 0 0 0
38958- 0 0 0 0 0 0 0 0 0 0 0 0
38959- 0 0 0 0 0 0 0 0 0 0 0 0
38960- 0 0 0 0 0 0 0 0 0 0 0 0
38961- 0 0 0 0 0 0 0 0 0 0 0 0
38962- 0 0 0 0 0 0 0 0 0 0 0 0
38963- 0 0 0 0 0 0 0 0 0 0 0 0
38964- 0 0 0 0 0 0 0 0 0 14 14 14
38965- 46 46 46 82 82 82 2 2 6 106 106 106
38966-170 170 170 26 26 26 86 86 86 226 226 226
38967-123 123 123 10 10 10 14 14 14 46 46 46
38968-231 231 231 190 190 190 6 6 6 70 70 70
38969- 90 90 90 238 238 238 158 158 158 2 2 6
38970- 2 2 6 2 2 6 2 2 6 2 2 6
38971- 70 70 70 58 58 58 22 22 22 6 6 6
38972- 0 0 0 0 0 0 0 0 0 0 0 0
38973- 0 0 0 0 0 0 0 0 0 0 0 0
38974- 0 0 0 0 0 0 0 0 0 0 0 0
38975- 0 0 0 0 0 0 0 0 0 0 0 0
38976- 0 0 0 0 0 0 0 0 0 0 0 0
38977- 0 0 0 0 0 0 0 0 0 0 0 0
38978- 0 0 0 0 0 0 0 0 1 0 0 0
38979- 0 0 1 0 0 1 0 0 1 0 0 0
38980- 0 0 0 0 0 0 0 0 0 0 0 0
38981- 0 0 0 0 0 0 0 0 0 0 0 0
38982- 0 0 0 0 0 0 0 0 0 0 0 0
38983- 0 0 0 0 0 0 0 0 0 0 0 0
38984- 0 0 0 0 0 0 0 0 0 14 14 14
38985- 42 42 42 86 86 86 6 6 6 116 116 116
38986-106 106 106 6 6 6 70 70 70 149 149 149
38987-128 128 128 18 18 18 38 38 38 54 54 54
38988-221 221 221 106 106 106 2 2 6 14 14 14
38989- 46 46 46 190 190 190 198 198 198 2 2 6
38990- 2 2 6 2 2 6 2 2 6 2 2 6
38991- 74 74 74 62 62 62 22 22 22 6 6 6
38992- 0 0 0 0 0 0 0 0 0 0 0 0
38993- 0 0 0 0 0 0 0 0 0 0 0 0
38994- 0 0 0 0 0 0 0 0 0 0 0 0
38995- 0 0 0 0 0 0 0 0 0 0 0 0
38996- 0 0 0 0 0 0 0 0 0 0 0 0
38997- 0 0 0 0 0 0 0 0 0 0 0 0
38998- 0 0 0 0 0 0 0 0 1 0 0 0
38999- 0 0 1 0 0 0 0 0 1 0 0 0
39000- 0 0 0 0 0 0 0 0 0 0 0 0
39001- 0 0 0 0 0 0 0 0 0 0 0 0
39002- 0 0 0 0 0 0 0 0 0 0 0 0
39003- 0 0 0 0 0 0 0 0 0 0 0 0
39004- 0 0 0 0 0 0 0 0 0 14 14 14
39005- 42 42 42 94 94 94 14 14 14 101 101 101
39006-128 128 128 2 2 6 18 18 18 116 116 116
39007-118 98 46 121 92 8 121 92 8 98 78 10
39008-162 162 162 106 106 106 2 2 6 2 2 6
39009- 2 2 6 195 195 195 195 195 195 6 6 6
39010- 2 2 6 2 2 6 2 2 6 2 2 6
39011- 74 74 74 62 62 62 22 22 22 6 6 6
39012- 0 0 0 0 0 0 0 0 0 0 0 0
39013- 0 0 0 0 0 0 0 0 0 0 0 0
39014- 0 0 0 0 0 0 0 0 0 0 0 0
39015- 0 0 0 0 0 0 0 0 0 0 0 0
39016- 0 0 0 0 0 0 0 0 0 0 0 0
39017- 0 0 0 0 0 0 0 0 0 0 0 0
39018- 0 0 0 0 0 0 0 0 1 0 0 1
39019- 0 0 1 0 0 0 0 0 1 0 0 0
39020- 0 0 0 0 0 0 0 0 0 0 0 0
39021- 0 0 0 0 0 0 0 0 0 0 0 0
39022- 0 0 0 0 0 0 0 0 0 0 0 0
39023- 0 0 0 0 0 0 0 0 0 0 0 0
39024- 0 0 0 0 0 0 0 0 0 10 10 10
39025- 38 38 38 90 90 90 14 14 14 58 58 58
39026-210 210 210 26 26 26 54 38 6 154 114 10
39027-226 170 11 236 186 11 225 175 15 184 144 12
39028-215 174 15 175 146 61 37 26 9 2 2 6
39029- 70 70 70 246 246 246 138 138 138 2 2 6
39030- 2 2 6 2 2 6 2 2 6 2 2 6
39031- 70 70 70 66 66 66 26 26 26 6 6 6
39032- 0 0 0 0 0 0 0 0 0 0 0 0
39033- 0 0 0 0 0 0 0 0 0 0 0 0
39034- 0 0 0 0 0 0 0 0 0 0 0 0
39035- 0 0 0 0 0 0 0 0 0 0 0 0
39036- 0 0 0 0 0 0 0 0 0 0 0 0
39037- 0 0 0 0 0 0 0 0 0 0 0 0
39038- 0 0 0 0 0 0 0 0 0 0 0 0
39039- 0 0 0 0 0 0 0 0 0 0 0 0
39040- 0 0 0 0 0 0 0 0 0 0 0 0
39041- 0 0 0 0 0 0 0 0 0 0 0 0
39042- 0 0 0 0 0 0 0 0 0 0 0 0
39043- 0 0 0 0 0 0 0 0 0 0 0 0
39044- 0 0 0 0 0 0 0 0 0 10 10 10
39045- 38 38 38 86 86 86 14 14 14 10 10 10
39046-195 195 195 188 164 115 192 133 9 225 175 15
39047-239 182 13 234 190 10 232 195 16 232 200 30
39048-245 207 45 241 208 19 232 195 16 184 144 12
39049-218 194 134 211 206 186 42 42 42 2 2 6
39050- 2 2 6 2 2 6 2 2 6 2 2 6
39051- 50 50 50 74 74 74 30 30 30 6 6 6
39052- 0 0 0 0 0 0 0 0 0 0 0 0
39053- 0 0 0 0 0 0 0 0 0 0 0 0
39054- 0 0 0 0 0 0 0 0 0 0 0 0
39055- 0 0 0 0 0 0 0 0 0 0 0 0
39056- 0 0 0 0 0 0 0 0 0 0 0 0
39057- 0 0 0 0 0 0 0 0 0 0 0 0
39058- 0 0 0 0 0 0 0 0 0 0 0 0
39059- 0 0 0 0 0 0 0 0 0 0 0 0
39060- 0 0 0 0 0 0 0 0 0 0 0 0
39061- 0 0 0 0 0 0 0 0 0 0 0 0
39062- 0 0 0 0 0 0 0 0 0 0 0 0
39063- 0 0 0 0 0 0 0 0 0 0 0 0
39064- 0 0 0 0 0 0 0 0 0 10 10 10
39065- 34 34 34 86 86 86 14 14 14 2 2 6
39066-121 87 25 192 133 9 219 162 10 239 182 13
39067-236 186 11 232 195 16 241 208 19 244 214 54
39068-246 218 60 246 218 38 246 215 20 241 208 19
39069-241 208 19 226 184 13 121 87 25 2 2 6
39070- 2 2 6 2 2 6 2 2 6 2 2 6
39071- 50 50 50 82 82 82 34 34 34 10 10 10
39072- 0 0 0 0 0 0 0 0 0 0 0 0
39073- 0 0 0 0 0 0 0 0 0 0 0 0
39074- 0 0 0 0 0 0 0 0 0 0 0 0
39075- 0 0 0 0 0 0 0 0 0 0 0 0
39076- 0 0 0 0 0 0 0 0 0 0 0 0
39077- 0 0 0 0 0 0 0 0 0 0 0 0
39078- 0 0 0 0 0 0 0 0 0 0 0 0
39079- 0 0 0 0 0 0 0 0 0 0 0 0
39080- 0 0 0 0 0 0 0 0 0 0 0 0
39081- 0 0 0 0 0 0 0 0 0 0 0 0
39082- 0 0 0 0 0 0 0 0 0 0 0 0
39083- 0 0 0 0 0 0 0 0 0 0 0 0
39084- 0 0 0 0 0 0 0 0 0 10 10 10
39085- 34 34 34 82 82 82 30 30 30 61 42 6
39086-180 123 7 206 145 10 230 174 11 239 182 13
39087-234 190 10 238 202 15 241 208 19 246 218 74
39088-246 218 38 246 215 20 246 215 20 246 215 20
39089-226 184 13 215 174 15 184 144 12 6 6 6
39090- 2 2 6 2 2 6 2 2 6 2 2 6
39091- 26 26 26 94 94 94 42 42 42 14 14 14
39092- 0 0 0 0 0 0 0 0 0 0 0 0
39093- 0 0 0 0 0 0 0 0 0 0 0 0
39094- 0 0 0 0 0 0 0 0 0 0 0 0
39095- 0 0 0 0 0 0 0 0 0 0 0 0
39096- 0 0 0 0 0 0 0 0 0 0 0 0
39097- 0 0 0 0 0 0 0 0 0 0 0 0
39098- 0 0 0 0 0 0 0 0 0 0 0 0
39099- 0 0 0 0 0 0 0 0 0 0 0 0
39100- 0 0 0 0 0 0 0 0 0 0 0 0
39101- 0 0 0 0 0 0 0 0 0 0 0 0
39102- 0 0 0 0 0 0 0 0 0 0 0 0
39103- 0 0 0 0 0 0 0 0 0 0 0 0
39104- 0 0 0 0 0 0 0 0 0 10 10 10
39105- 30 30 30 78 78 78 50 50 50 104 69 6
39106-192 133 9 216 158 10 236 178 12 236 186 11
39107-232 195 16 241 208 19 244 214 54 245 215 43
39108-246 215 20 246 215 20 241 208 19 198 155 10
39109-200 144 11 216 158 10 156 118 10 2 2 6
39110- 2 2 6 2 2 6 2 2 6 2 2 6
39111- 6 6 6 90 90 90 54 54 54 18 18 18
39112- 6 6 6 0 0 0 0 0 0 0 0 0
39113- 0 0 0 0 0 0 0 0 0 0 0 0
39114- 0 0 0 0 0 0 0 0 0 0 0 0
39115- 0 0 0 0 0 0 0 0 0 0 0 0
39116- 0 0 0 0 0 0 0 0 0 0 0 0
39117- 0 0 0 0 0 0 0 0 0 0 0 0
39118- 0 0 0 0 0 0 0 0 0 0 0 0
39119- 0 0 0 0 0 0 0 0 0 0 0 0
39120- 0 0 0 0 0 0 0 0 0 0 0 0
39121- 0 0 0 0 0 0 0 0 0 0 0 0
39122- 0 0 0 0 0 0 0 0 0 0 0 0
39123- 0 0 0 0 0 0 0 0 0 0 0 0
39124- 0 0 0 0 0 0 0 0 0 10 10 10
39125- 30 30 30 78 78 78 46 46 46 22 22 22
39126-137 92 6 210 162 10 239 182 13 238 190 10
39127-238 202 15 241 208 19 246 215 20 246 215 20
39128-241 208 19 203 166 17 185 133 11 210 150 10
39129-216 158 10 210 150 10 102 78 10 2 2 6
39130- 6 6 6 54 54 54 14 14 14 2 2 6
39131- 2 2 6 62 62 62 74 74 74 30 30 30
39132- 10 10 10 0 0 0 0 0 0 0 0 0
39133- 0 0 0 0 0 0 0 0 0 0 0 0
39134- 0 0 0 0 0 0 0 0 0 0 0 0
39135- 0 0 0 0 0 0 0 0 0 0 0 0
39136- 0 0 0 0 0 0 0 0 0 0 0 0
39137- 0 0 0 0 0 0 0 0 0 0 0 0
39138- 0 0 0 0 0 0 0 0 0 0 0 0
39139- 0 0 0 0 0 0 0 0 0 0 0 0
39140- 0 0 0 0 0 0 0 0 0 0 0 0
39141- 0 0 0 0 0 0 0 0 0 0 0 0
39142- 0 0 0 0 0 0 0 0 0 0 0 0
39143- 0 0 0 0 0 0 0 0 0 0 0 0
39144- 0 0 0 0 0 0 0 0 0 10 10 10
39145- 34 34 34 78 78 78 50 50 50 6 6 6
39146- 94 70 30 139 102 15 190 146 13 226 184 13
39147-232 200 30 232 195 16 215 174 15 190 146 13
39148-168 122 10 192 133 9 210 150 10 213 154 11
39149-202 150 34 182 157 106 101 98 89 2 2 6
39150- 2 2 6 78 78 78 116 116 116 58 58 58
39151- 2 2 6 22 22 22 90 90 90 46 46 46
39152- 18 18 18 6 6 6 0 0 0 0 0 0
39153- 0 0 0 0 0 0 0 0 0 0 0 0
39154- 0 0 0 0 0 0 0 0 0 0 0 0
39155- 0 0 0 0 0 0 0 0 0 0 0 0
39156- 0 0 0 0 0 0 0 0 0 0 0 0
39157- 0 0 0 0 0 0 0 0 0 0 0 0
39158- 0 0 0 0 0 0 0 0 0 0 0 0
39159- 0 0 0 0 0 0 0 0 0 0 0 0
39160- 0 0 0 0 0 0 0 0 0 0 0 0
39161- 0 0 0 0 0 0 0 0 0 0 0 0
39162- 0 0 0 0 0 0 0 0 0 0 0 0
39163- 0 0 0 0 0 0 0 0 0 0 0 0
39164- 0 0 0 0 0 0 0 0 0 10 10 10
39165- 38 38 38 86 86 86 50 50 50 6 6 6
39166-128 128 128 174 154 114 156 107 11 168 122 10
39167-198 155 10 184 144 12 197 138 11 200 144 11
39168-206 145 10 206 145 10 197 138 11 188 164 115
39169-195 195 195 198 198 198 174 174 174 14 14 14
39170- 2 2 6 22 22 22 116 116 116 116 116 116
39171- 22 22 22 2 2 6 74 74 74 70 70 70
39172- 30 30 30 10 10 10 0 0 0 0 0 0
39173- 0 0 0 0 0 0 0 0 0 0 0 0
39174- 0 0 0 0 0 0 0 0 0 0 0 0
39175- 0 0 0 0 0 0 0 0 0 0 0 0
39176- 0 0 0 0 0 0 0 0 0 0 0 0
39177- 0 0 0 0 0 0 0 0 0 0 0 0
39178- 0 0 0 0 0 0 0 0 0 0 0 0
39179- 0 0 0 0 0 0 0 0 0 0 0 0
39180- 0 0 0 0 0 0 0 0 0 0 0 0
39181- 0 0 0 0 0 0 0 0 0 0 0 0
39182- 0 0 0 0 0 0 0 0 0 0 0 0
39183- 0 0 0 0 0 0 0 0 0 0 0 0
39184- 0 0 0 0 0 0 6 6 6 18 18 18
39185- 50 50 50 101 101 101 26 26 26 10 10 10
39186-138 138 138 190 190 190 174 154 114 156 107 11
39187-197 138 11 200 144 11 197 138 11 192 133 9
39188-180 123 7 190 142 34 190 178 144 187 187 187
39189-202 202 202 221 221 221 214 214 214 66 66 66
39190- 2 2 6 2 2 6 50 50 50 62 62 62
39191- 6 6 6 2 2 6 10 10 10 90 90 90
39192- 50 50 50 18 18 18 6 6 6 0 0 0
39193- 0 0 0 0 0 0 0 0 0 0 0 0
39194- 0 0 0 0 0 0 0 0 0 0 0 0
39195- 0 0 0 0 0 0 0 0 0 0 0 0
39196- 0 0 0 0 0 0 0 0 0 0 0 0
39197- 0 0 0 0 0 0 0 0 0 0 0 0
39198- 0 0 0 0 0 0 0 0 0 0 0 0
39199- 0 0 0 0 0 0 0 0 0 0 0 0
39200- 0 0 0 0 0 0 0 0 0 0 0 0
39201- 0 0 0 0 0 0 0 0 0 0 0 0
39202- 0 0 0 0 0 0 0 0 0 0 0 0
39203- 0 0 0 0 0 0 0 0 0 0 0 0
39204- 0 0 0 0 0 0 10 10 10 34 34 34
39205- 74 74 74 74 74 74 2 2 6 6 6 6
39206-144 144 144 198 198 198 190 190 190 178 166 146
39207-154 121 60 156 107 11 156 107 11 168 124 44
39208-174 154 114 187 187 187 190 190 190 210 210 210
39209-246 246 246 253 253 253 253 253 253 182 182 182
39210- 6 6 6 2 2 6 2 2 6 2 2 6
39211- 2 2 6 2 2 6 2 2 6 62 62 62
39212- 74 74 74 34 34 34 14 14 14 0 0 0
39213- 0 0 0 0 0 0 0 0 0 0 0 0
39214- 0 0 0 0 0 0 0 0 0 0 0 0
39215- 0 0 0 0 0 0 0 0 0 0 0 0
39216- 0 0 0 0 0 0 0 0 0 0 0 0
39217- 0 0 0 0 0 0 0 0 0 0 0 0
39218- 0 0 0 0 0 0 0 0 0 0 0 0
39219- 0 0 0 0 0 0 0 0 0 0 0 0
39220- 0 0 0 0 0 0 0 0 0 0 0 0
39221- 0 0 0 0 0 0 0 0 0 0 0 0
39222- 0 0 0 0 0 0 0 0 0 0 0 0
39223- 0 0 0 0 0 0 0 0 0 0 0 0
39224- 0 0 0 10 10 10 22 22 22 54 54 54
39225- 94 94 94 18 18 18 2 2 6 46 46 46
39226-234 234 234 221 221 221 190 190 190 190 190 190
39227-190 190 190 187 187 187 187 187 187 190 190 190
39228-190 190 190 195 195 195 214 214 214 242 242 242
39229-253 253 253 253 253 253 253 253 253 253 253 253
39230- 82 82 82 2 2 6 2 2 6 2 2 6
39231- 2 2 6 2 2 6 2 2 6 14 14 14
39232- 86 86 86 54 54 54 22 22 22 6 6 6
39233- 0 0 0 0 0 0 0 0 0 0 0 0
39234- 0 0 0 0 0 0 0 0 0 0 0 0
39235- 0 0 0 0 0 0 0 0 0 0 0 0
39236- 0 0 0 0 0 0 0 0 0 0 0 0
39237- 0 0 0 0 0 0 0 0 0 0 0 0
39238- 0 0 0 0 0 0 0 0 0 0 0 0
39239- 0 0 0 0 0 0 0 0 0 0 0 0
39240- 0 0 0 0 0 0 0 0 0 0 0 0
39241- 0 0 0 0 0 0 0 0 0 0 0 0
39242- 0 0 0 0 0 0 0 0 0 0 0 0
39243- 0 0 0 0 0 0 0 0 0 0 0 0
39244- 6 6 6 18 18 18 46 46 46 90 90 90
39245- 46 46 46 18 18 18 6 6 6 182 182 182
39246-253 253 253 246 246 246 206 206 206 190 190 190
39247-190 190 190 190 190 190 190 190 190 190 190 190
39248-206 206 206 231 231 231 250 250 250 253 253 253
39249-253 253 253 253 253 253 253 253 253 253 253 253
39250-202 202 202 14 14 14 2 2 6 2 2 6
39251- 2 2 6 2 2 6 2 2 6 2 2 6
39252- 42 42 42 86 86 86 42 42 42 18 18 18
39253- 6 6 6 0 0 0 0 0 0 0 0 0
39254- 0 0 0 0 0 0 0 0 0 0 0 0
39255- 0 0 0 0 0 0 0 0 0 0 0 0
39256- 0 0 0 0 0 0 0 0 0 0 0 0
39257- 0 0 0 0 0 0 0 0 0 0 0 0
39258- 0 0 0 0 0 0 0 0 0 0 0 0
39259- 0 0 0 0 0 0 0 0 0 0 0 0
39260- 0 0 0 0 0 0 0 0 0 0 0 0
39261- 0 0 0 0 0 0 0 0 0 0 0 0
39262- 0 0 0 0 0 0 0 0 0 0 0 0
39263- 0 0 0 0 0 0 0 0 0 6 6 6
39264- 14 14 14 38 38 38 74 74 74 66 66 66
39265- 2 2 6 6 6 6 90 90 90 250 250 250
39266-253 253 253 253 253 253 238 238 238 198 198 198
39267-190 190 190 190 190 190 195 195 195 221 221 221
39268-246 246 246 253 253 253 253 253 253 253 253 253
39269-253 253 253 253 253 253 253 253 253 253 253 253
39270-253 253 253 82 82 82 2 2 6 2 2 6
39271- 2 2 6 2 2 6 2 2 6 2 2 6
39272- 2 2 6 78 78 78 70 70 70 34 34 34
39273- 14 14 14 6 6 6 0 0 0 0 0 0
39274- 0 0 0 0 0 0 0 0 0 0 0 0
39275- 0 0 0 0 0 0 0 0 0 0 0 0
39276- 0 0 0 0 0 0 0 0 0 0 0 0
39277- 0 0 0 0 0 0 0 0 0 0 0 0
39278- 0 0 0 0 0 0 0 0 0 0 0 0
39279- 0 0 0 0 0 0 0 0 0 0 0 0
39280- 0 0 0 0 0 0 0 0 0 0 0 0
39281- 0 0 0 0 0 0 0 0 0 0 0 0
39282- 0 0 0 0 0 0 0 0 0 0 0 0
39283- 0 0 0 0 0 0 0 0 0 14 14 14
39284- 34 34 34 66 66 66 78 78 78 6 6 6
39285- 2 2 6 18 18 18 218 218 218 253 253 253
39286-253 253 253 253 253 253 253 253 253 246 246 246
39287-226 226 226 231 231 231 246 246 246 253 253 253
39288-253 253 253 253 253 253 253 253 253 253 253 253
39289-253 253 253 253 253 253 253 253 253 253 253 253
39290-253 253 253 178 178 178 2 2 6 2 2 6
39291- 2 2 6 2 2 6 2 2 6 2 2 6
39292- 2 2 6 18 18 18 90 90 90 62 62 62
39293- 30 30 30 10 10 10 0 0 0 0 0 0
39294- 0 0 0 0 0 0 0 0 0 0 0 0
39295- 0 0 0 0 0 0 0 0 0 0 0 0
39296- 0 0 0 0 0 0 0 0 0 0 0 0
39297- 0 0 0 0 0 0 0 0 0 0 0 0
39298- 0 0 0 0 0 0 0 0 0 0 0 0
39299- 0 0 0 0 0 0 0 0 0 0 0 0
39300- 0 0 0 0 0 0 0 0 0 0 0 0
39301- 0 0 0 0 0 0 0 0 0 0 0 0
39302- 0 0 0 0 0 0 0 0 0 0 0 0
39303- 0 0 0 0 0 0 10 10 10 26 26 26
39304- 58 58 58 90 90 90 18 18 18 2 2 6
39305- 2 2 6 110 110 110 253 253 253 253 253 253
39306-253 253 253 253 253 253 253 253 253 253 253 253
39307-250 250 250 253 253 253 253 253 253 253 253 253
39308-253 253 253 253 253 253 253 253 253 253 253 253
39309-253 253 253 253 253 253 253 253 253 253 253 253
39310-253 253 253 231 231 231 18 18 18 2 2 6
39311- 2 2 6 2 2 6 2 2 6 2 2 6
39312- 2 2 6 2 2 6 18 18 18 94 94 94
39313- 54 54 54 26 26 26 10 10 10 0 0 0
39314- 0 0 0 0 0 0 0 0 0 0 0 0
39315- 0 0 0 0 0 0 0 0 0 0 0 0
39316- 0 0 0 0 0 0 0 0 0 0 0 0
39317- 0 0 0 0 0 0 0 0 0 0 0 0
39318- 0 0 0 0 0 0 0 0 0 0 0 0
39319- 0 0 0 0 0 0 0 0 0 0 0 0
39320- 0 0 0 0 0 0 0 0 0 0 0 0
39321- 0 0 0 0 0 0 0 0 0 0 0 0
39322- 0 0 0 0 0 0 0 0 0 0 0 0
39323- 0 0 0 6 6 6 22 22 22 50 50 50
39324- 90 90 90 26 26 26 2 2 6 2 2 6
39325- 14 14 14 195 195 195 250 250 250 253 253 253
39326-253 253 253 253 253 253 253 253 253 253 253 253
39327-253 253 253 253 253 253 253 253 253 253 253 253
39328-253 253 253 253 253 253 253 253 253 253 253 253
39329-253 253 253 253 253 253 253 253 253 253 253 253
39330-250 250 250 242 242 242 54 54 54 2 2 6
39331- 2 2 6 2 2 6 2 2 6 2 2 6
39332- 2 2 6 2 2 6 2 2 6 38 38 38
39333- 86 86 86 50 50 50 22 22 22 6 6 6
39334- 0 0 0 0 0 0 0 0 0 0 0 0
39335- 0 0 0 0 0 0 0 0 0 0 0 0
39336- 0 0 0 0 0 0 0 0 0 0 0 0
39337- 0 0 0 0 0 0 0 0 0 0 0 0
39338- 0 0 0 0 0 0 0 0 0 0 0 0
39339- 0 0 0 0 0 0 0 0 0 0 0 0
39340- 0 0 0 0 0 0 0 0 0 0 0 0
39341- 0 0 0 0 0 0 0 0 0 0 0 0
39342- 0 0 0 0 0 0 0 0 0 0 0 0
39343- 6 6 6 14 14 14 38 38 38 82 82 82
39344- 34 34 34 2 2 6 2 2 6 2 2 6
39345- 42 42 42 195 195 195 246 246 246 253 253 253
39346-253 253 253 253 253 253 253 253 253 250 250 250
39347-242 242 242 242 242 242 250 250 250 253 253 253
39348-253 253 253 253 253 253 253 253 253 253 253 253
39349-253 253 253 250 250 250 246 246 246 238 238 238
39350-226 226 226 231 231 231 101 101 101 6 6 6
39351- 2 2 6 2 2 6 2 2 6 2 2 6
39352- 2 2 6 2 2 6 2 2 6 2 2 6
39353- 38 38 38 82 82 82 42 42 42 14 14 14
39354- 6 6 6 0 0 0 0 0 0 0 0 0
39355- 0 0 0 0 0 0 0 0 0 0 0 0
39356- 0 0 0 0 0 0 0 0 0 0 0 0
39357- 0 0 0 0 0 0 0 0 0 0 0 0
39358- 0 0 0 0 0 0 0 0 0 0 0 0
39359- 0 0 0 0 0 0 0 0 0 0 0 0
39360- 0 0 0 0 0 0 0 0 0 0 0 0
39361- 0 0 0 0 0 0 0 0 0 0 0 0
39362- 0 0 0 0 0 0 0 0 0 0 0 0
39363- 10 10 10 26 26 26 62 62 62 66 66 66
39364- 2 2 6 2 2 6 2 2 6 6 6 6
39365- 70 70 70 170 170 170 206 206 206 234 234 234
39366-246 246 246 250 250 250 250 250 250 238 238 238
39367-226 226 226 231 231 231 238 238 238 250 250 250
39368-250 250 250 250 250 250 246 246 246 231 231 231
39369-214 214 214 206 206 206 202 202 202 202 202 202
39370-198 198 198 202 202 202 182 182 182 18 18 18
39371- 2 2 6 2 2 6 2 2 6 2 2 6
39372- 2 2 6 2 2 6 2 2 6 2 2 6
39373- 2 2 6 62 62 62 66 66 66 30 30 30
39374- 10 10 10 0 0 0 0 0 0 0 0 0
39375- 0 0 0 0 0 0 0 0 0 0 0 0
39376- 0 0 0 0 0 0 0 0 0 0 0 0
39377- 0 0 0 0 0 0 0 0 0 0 0 0
39378- 0 0 0 0 0 0 0 0 0 0 0 0
39379- 0 0 0 0 0 0 0 0 0 0 0 0
39380- 0 0 0 0 0 0 0 0 0 0 0 0
39381- 0 0 0 0 0 0 0 0 0 0 0 0
39382- 0 0 0 0 0 0 0 0 0 0 0 0
39383- 14 14 14 42 42 42 82 82 82 18 18 18
39384- 2 2 6 2 2 6 2 2 6 10 10 10
39385- 94 94 94 182 182 182 218 218 218 242 242 242
39386-250 250 250 253 253 253 253 253 253 250 250 250
39387-234 234 234 253 253 253 253 253 253 253 253 253
39388-253 253 253 253 253 253 253 253 253 246 246 246
39389-238 238 238 226 226 226 210 210 210 202 202 202
39390-195 195 195 195 195 195 210 210 210 158 158 158
39391- 6 6 6 14 14 14 50 50 50 14 14 14
39392- 2 2 6 2 2 6 2 2 6 2 2 6
39393- 2 2 6 6 6 6 86 86 86 46 46 46
39394- 18 18 18 6 6 6 0 0 0 0 0 0
39395- 0 0 0 0 0 0 0 0 0 0 0 0
39396- 0 0 0 0 0 0 0 0 0 0 0 0
39397- 0 0 0 0 0 0 0 0 0 0 0 0
39398- 0 0 0 0 0 0 0 0 0 0 0 0
39399- 0 0 0 0 0 0 0 0 0 0 0 0
39400- 0 0 0 0 0 0 0 0 0 0 0 0
39401- 0 0 0 0 0 0 0 0 0 0 0 0
39402- 0 0 0 0 0 0 0 0 0 6 6 6
39403- 22 22 22 54 54 54 70 70 70 2 2 6
39404- 2 2 6 10 10 10 2 2 6 22 22 22
39405-166 166 166 231 231 231 250 250 250 253 253 253
39406-253 253 253 253 253 253 253 253 253 250 250 250
39407-242 242 242 253 253 253 253 253 253 253 253 253
39408-253 253 253 253 253 253 253 253 253 253 253 253
39409-253 253 253 253 253 253 253 253 253 246 246 246
39410-231 231 231 206 206 206 198 198 198 226 226 226
39411- 94 94 94 2 2 6 6 6 6 38 38 38
39412- 30 30 30 2 2 6 2 2 6 2 2 6
39413- 2 2 6 2 2 6 62 62 62 66 66 66
39414- 26 26 26 10 10 10 0 0 0 0 0 0
39415- 0 0 0 0 0 0 0 0 0 0 0 0
39416- 0 0 0 0 0 0 0 0 0 0 0 0
39417- 0 0 0 0 0 0 0 0 0 0 0 0
39418- 0 0 0 0 0 0 0 0 0 0 0 0
39419- 0 0 0 0 0 0 0 0 0 0 0 0
39420- 0 0 0 0 0 0 0 0 0 0 0 0
39421- 0 0 0 0 0 0 0 0 0 0 0 0
39422- 0 0 0 0 0 0 0 0 0 10 10 10
39423- 30 30 30 74 74 74 50 50 50 2 2 6
39424- 26 26 26 26 26 26 2 2 6 106 106 106
39425-238 238 238 253 253 253 253 253 253 253 253 253
39426-253 253 253 253 253 253 253 253 253 253 253 253
39427-253 253 253 253 253 253 253 253 253 253 253 253
39428-253 253 253 253 253 253 253 253 253 253 253 253
39429-253 253 253 253 253 253 253 253 253 253 253 253
39430-253 253 253 246 246 246 218 218 218 202 202 202
39431-210 210 210 14 14 14 2 2 6 2 2 6
39432- 30 30 30 22 22 22 2 2 6 2 2 6
39433- 2 2 6 2 2 6 18 18 18 86 86 86
39434- 42 42 42 14 14 14 0 0 0 0 0 0
39435- 0 0 0 0 0 0 0 0 0 0 0 0
39436- 0 0 0 0 0 0 0 0 0 0 0 0
39437- 0 0 0 0 0 0 0 0 0 0 0 0
39438- 0 0 0 0 0 0 0 0 0 0 0 0
39439- 0 0 0 0 0 0 0 0 0 0 0 0
39440- 0 0 0 0 0 0 0 0 0 0 0 0
39441- 0 0 0 0 0 0 0 0 0 0 0 0
39442- 0 0 0 0 0 0 0 0 0 14 14 14
39443- 42 42 42 90 90 90 22 22 22 2 2 6
39444- 42 42 42 2 2 6 18 18 18 218 218 218
39445-253 253 253 253 253 253 253 253 253 253 253 253
39446-253 253 253 253 253 253 253 253 253 253 253 253
39447-253 253 253 253 253 253 253 253 253 253 253 253
39448-253 253 253 253 253 253 253 253 253 253 253 253
39449-253 253 253 253 253 253 253 253 253 253 253 253
39450-253 253 253 253 253 253 250 250 250 221 221 221
39451-218 218 218 101 101 101 2 2 6 14 14 14
39452- 18 18 18 38 38 38 10 10 10 2 2 6
39453- 2 2 6 2 2 6 2 2 6 78 78 78
39454- 58 58 58 22 22 22 6 6 6 0 0 0
39455- 0 0 0 0 0 0 0 0 0 0 0 0
39456- 0 0 0 0 0 0 0 0 0 0 0 0
39457- 0 0 0 0 0 0 0 0 0 0 0 0
39458- 0 0 0 0 0 0 0 0 0 0 0 0
39459- 0 0 0 0 0 0 0 0 0 0 0 0
39460- 0 0 0 0 0 0 0 0 0 0 0 0
39461- 0 0 0 0 0 0 0 0 0 0 0 0
39462- 0 0 0 0 0 0 6 6 6 18 18 18
39463- 54 54 54 82 82 82 2 2 6 26 26 26
39464- 22 22 22 2 2 6 123 123 123 253 253 253
39465-253 253 253 253 253 253 253 253 253 253 253 253
39466-253 253 253 253 253 253 253 253 253 253 253 253
39467-253 253 253 253 253 253 253 253 253 253 253 253
39468-253 253 253 253 253 253 253 253 253 253 253 253
39469-253 253 253 253 253 253 253 253 253 253 253 253
39470-253 253 253 253 253 253 253 253 253 250 250 250
39471-238 238 238 198 198 198 6 6 6 38 38 38
39472- 58 58 58 26 26 26 38 38 38 2 2 6
39473- 2 2 6 2 2 6 2 2 6 46 46 46
39474- 78 78 78 30 30 30 10 10 10 0 0 0
39475- 0 0 0 0 0 0 0 0 0 0 0 0
39476- 0 0 0 0 0 0 0 0 0 0 0 0
39477- 0 0 0 0 0 0 0 0 0 0 0 0
39478- 0 0 0 0 0 0 0 0 0 0 0 0
39479- 0 0 0 0 0 0 0 0 0 0 0 0
39480- 0 0 0 0 0 0 0 0 0 0 0 0
39481- 0 0 0 0 0 0 0 0 0 0 0 0
39482- 0 0 0 0 0 0 10 10 10 30 30 30
39483- 74 74 74 58 58 58 2 2 6 42 42 42
39484- 2 2 6 22 22 22 231 231 231 253 253 253
39485-253 253 253 253 253 253 253 253 253 253 253 253
39486-253 253 253 253 253 253 253 253 253 250 250 250
39487-253 253 253 253 253 253 253 253 253 253 253 253
39488-253 253 253 253 253 253 253 253 253 253 253 253
39489-253 253 253 253 253 253 253 253 253 253 253 253
39490-253 253 253 253 253 253 253 253 253 253 253 253
39491-253 253 253 246 246 246 46 46 46 38 38 38
39492- 42 42 42 14 14 14 38 38 38 14 14 14
39493- 2 2 6 2 2 6 2 2 6 6 6 6
39494- 86 86 86 46 46 46 14 14 14 0 0 0
39495- 0 0 0 0 0 0 0 0 0 0 0 0
39496- 0 0 0 0 0 0 0 0 0 0 0 0
39497- 0 0 0 0 0 0 0 0 0 0 0 0
39498- 0 0 0 0 0 0 0 0 0 0 0 0
39499- 0 0 0 0 0 0 0 0 0 0 0 0
39500- 0 0 0 0 0 0 0 0 0 0 0 0
39501- 0 0 0 0 0 0 0 0 0 0 0 0
39502- 0 0 0 6 6 6 14 14 14 42 42 42
39503- 90 90 90 18 18 18 18 18 18 26 26 26
39504- 2 2 6 116 116 116 253 253 253 253 253 253
39505-253 253 253 253 253 253 253 253 253 253 253 253
39506-253 253 253 253 253 253 250 250 250 238 238 238
39507-253 253 253 253 253 253 253 253 253 253 253 253
39508-253 253 253 253 253 253 253 253 253 253 253 253
39509-253 253 253 253 253 253 253 253 253 253 253 253
39510-253 253 253 253 253 253 253 253 253 253 253 253
39511-253 253 253 253 253 253 94 94 94 6 6 6
39512- 2 2 6 2 2 6 10 10 10 34 34 34
39513- 2 2 6 2 2 6 2 2 6 2 2 6
39514- 74 74 74 58 58 58 22 22 22 6 6 6
39515- 0 0 0 0 0 0 0 0 0 0 0 0
39516- 0 0 0 0 0 0 0 0 0 0 0 0
39517- 0 0 0 0 0 0 0 0 0 0 0 0
39518- 0 0 0 0 0 0 0 0 0 0 0 0
39519- 0 0 0 0 0 0 0 0 0 0 0 0
39520- 0 0 0 0 0 0 0 0 0 0 0 0
39521- 0 0 0 0 0 0 0 0 0 0 0 0
39522- 0 0 0 10 10 10 26 26 26 66 66 66
39523- 82 82 82 2 2 6 38 38 38 6 6 6
39524- 14 14 14 210 210 210 253 253 253 253 253 253
39525-253 253 253 253 253 253 253 253 253 253 253 253
39526-253 253 253 253 253 253 246 246 246 242 242 242
39527-253 253 253 253 253 253 253 253 253 253 253 253
39528-253 253 253 253 253 253 253 253 253 253 253 253
39529-253 253 253 253 253 253 253 253 253 253 253 253
39530-253 253 253 253 253 253 253 253 253 253 253 253
39531-253 253 253 253 253 253 144 144 144 2 2 6
39532- 2 2 6 2 2 6 2 2 6 46 46 46
39533- 2 2 6 2 2 6 2 2 6 2 2 6
39534- 42 42 42 74 74 74 30 30 30 10 10 10
39535- 0 0 0 0 0 0 0 0 0 0 0 0
39536- 0 0 0 0 0 0 0 0 0 0 0 0
39537- 0 0 0 0 0 0 0 0 0 0 0 0
39538- 0 0 0 0 0 0 0 0 0 0 0 0
39539- 0 0 0 0 0 0 0 0 0 0 0 0
39540- 0 0 0 0 0 0 0 0 0 0 0 0
39541- 0 0 0 0 0 0 0 0 0 0 0 0
39542- 6 6 6 14 14 14 42 42 42 90 90 90
39543- 26 26 26 6 6 6 42 42 42 2 2 6
39544- 74 74 74 250 250 250 253 253 253 253 253 253
39545-253 253 253 253 253 253 253 253 253 253 253 253
39546-253 253 253 253 253 253 242 242 242 242 242 242
39547-253 253 253 253 253 253 253 253 253 253 253 253
39548-253 253 253 253 253 253 253 253 253 253 253 253
39549-253 253 253 253 253 253 253 253 253 253 253 253
39550-253 253 253 253 253 253 253 253 253 253 253 253
39551-253 253 253 253 253 253 182 182 182 2 2 6
39552- 2 2 6 2 2 6 2 2 6 46 46 46
39553- 2 2 6 2 2 6 2 2 6 2 2 6
39554- 10 10 10 86 86 86 38 38 38 10 10 10
39555- 0 0 0 0 0 0 0 0 0 0 0 0
39556- 0 0 0 0 0 0 0 0 0 0 0 0
39557- 0 0 0 0 0 0 0 0 0 0 0 0
39558- 0 0 0 0 0 0 0 0 0 0 0 0
39559- 0 0 0 0 0 0 0 0 0 0 0 0
39560- 0 0 0 0 0 0 0 0 0 0 0 0
39561- 0 0 0 0 0 0 0 0 0 0 0 0
39562- 10 10 10 26 26 26 66 66 66 82 82 82
39563- 2 2 6 22 22 22 18 18 18 2 2 6
39564-149 149 149 253 253 253 253 253 253 253 253 253
39565-253 253 253 253 253 253 253 253 253 253 253 253
39566-253 253 253 253 253 253 234 234 234 242 242 242
39567-253 253 253 253 253 253 253 253 253 253 253 253
39568-253 253 253 253 253 253 253 253 253 253 253 253
39569-253 253 253 253 253 253 253 253 253 253 253 253
39570-253 253 253 253 253 253 253 253 253 253 253 253
39571-253 253 253 253 253 253 206 206 206 2 2 6
39572- 2 2 6 2 2 6 2 2 6 38 38 38
39573- 2 2 6 2 2 6 2 2 6 2 2 6
39574- 6 6 6 86 86 86 46 46 46 14 14 14
39575- 0 0 0 0 0 0 0 0 0 0 0 0
39576- 0 0 0 0 0 0 0 0 0 0 0 0
39577- 0 0 0 0 0 0 0 0 0 0 0 0
39578- 0 0 0 0 0 0 0 0 0 0 0 0
39579- 0 0 0 0 0 0 0 0 0 0 0 0
39580- 0 0 0 0 0 0 0 0 0 0 0 0
39581- 0 0 0 0 0 0 0 0 0 6 6 6
39582- 18 18 18 46 46 46 86 86 86 18 18 18
39583- 2 2 6 34 34 34 10 10 10 6 6 6
39584-210 210 210 253 253 253 253 253 253 253 253 253
39585-253 253 253 253 253 253 253 253 253 253 253 253
39586-253 253 253 253 253 253 234 234 234 242 242 242
39587-253 253 253 253 253 253 253 253 253 253 253 253
39588-253 253 253 253 253 253 253 253 253 253 253 253
39589-253 253 253 253 253 253 253 253 253 253 253 253
39590-253 253 253 253 253 253 253 253 253 253 253 253
39591-253 253 253 253 253 253 221 221 221 6 6 6
39592- 2 2 6 2 2 6 6 6 6 30 30 30
39593- 2 2 6 2 2 6 2 2 6 2 2 6
39594- 2 2 6 82 82 82 54 54 54 18 18 18
39595- 6 6 6 0 0 0 0 0 0 0 0 0
39596- 0 0 0 0 0 0 0 0 0 0 0 0
39597- 0 0 0 0 0 0 0 0 0 0 0 0
39598- 0 0 0 0 0 0 0 0 0 0 0 0
39599- 0 0 0 0 0 0 0 0 0 0 0 0
39600- 0 0 0 0 0 0 0 0 0 0 0 0
39601- 0 0 0 0 0 0 0 0 0 10 10 10
39602- 26 26 26 66 66 66 62 62 62 2 2 6
39603- 2 2 6 38 38 38 10 10 10 26 26 26
39604-238 238 238 253 253 253 253 253 253 253 253 253
39605-253 253 253 253 253 253 253 253 253 253 253 253
39606-253 253 253 253 253 253 231 231 231 238 238 238
39607-253 253 253 253 253 253 253 253 253 253 253 253
39608-253 253 253 253 253 253 253 253 253 253 253 253
39609-253 253 253 253 253 253 253 253 253 253 253 253
39610-253 253 253 253 253 253 253 253 253 253 253 253
39611-253 253 253 253 253 253 231 231 231 6 6 6
39612- 2 2 6 2 2 6 10 10 10 30 30 30
39613- 2 2 6 2 2 6 2 2 6 2 2 6
39614- 2 2 6 66 66 66 58 58 58 22 22 22
39615- 6 6 6 0 0 0 0 0 0 0 0 0
39616- 0 0 0 0 0 0 0 0 0 0 0 0
39617- 0 0 0 0 0 0 0 0 0 0 0 0
39618- 0 0 0 0 0 0 0 0 0 0 0 0
39619- 0 0 0 0 0 0 0 0 0 0 0 0
39620- 0 0 0 0 0 0 0 0 0 0 0 0
39621- 0 0 0 0 0 0 0 0 0 10 10 10
39622- 38 38 38 78 78 78 6 6 6 2 2 6
39623- 2 2 6 46 46 46 14 14 14 42 42 42
39624-246 246 246 253 253 253 253 253 253 253 253 253
39625-253 253 253 253 253 253 253 253 253 253 253 253
39626-253 253 253 253 253 253 231 231 231 242 242 242
39627-253 253 253 253 253 253 253 253 253 253 253 253
39628-253 253 253 253 253 253 253 253 253 253 253 253
39629-253 253 253 253 253 253 253 253 253 253 253 253
39630-253 253 253 253 253 253 253 253 253 253 253 253
39631-253 253 253 253 253 253 234 234 234 10 10 10
39632- 2 2 6 2 2 6 22 22 22 14 14 14
39633- 2 2 6 2 2 6 2 2 6 2 2 6
39634- 2 2 6 66 66 66 62 62 62 22 22 22
39635- 6 6 6 0 0 0 0 0 0 0 0 0
39636- 0 0 0 0 0 0 0 0 0 0 0 0
39637- 0 0 0 0 0 0 0 0 0 0 0 0
39638- 0 0 0 0 0 0 0 0 0 0 0 0
39639- 0 0 0 0 0 0 0 0 0 0 0 0
39640- 0 0 0 0 0 0 0 0 0 0 0 0
39641- 0 0 0 0 0 0 6 6 6 18 18 18
39642- 50 50 50 74 74 74 2 2 6 2 2 6
39643- 14 14 14 70 70 70 34 34 34 62 62 62
39644-250 250 250 253 253 253 253 253 253 253 253 253
39645-253 253 253 253 253 253 253 253 253 253 253 253
39646-253 253 253 253 253 253 231 231 231 246 246 246
39647-253 253 253 253 253 253 253 253 253 253 253 253
39648-253 253 253 253 253 253 253 253 253 253 253 253
39649-253 253 253 253 253 253 253 253 253 253 253 253
39650-253 253 253 253 253 253 253 253 253 253 253 253
39651-253 253 253 253 253 253 234 234 234 14 14 14
39652- 2 2 6 2 2 6 30 30 30 2 2 6
39653- 2 2 6 2 2 6 2 2 6 2 2 6
39654- 2 2 6 66 66 66 62 62 62 22 22 22
39655- 6 6 6 0 0 0 0 0 0 0 0 0
39656- 0 0 0 0 0 0 0 0 0 0 0 0
39657- 0 0 0 0 0 0 0 0 0 0 0 0
39658- 0 0 0 0 0 0 0 0 0 0 0 0
39659- 0 0 0 0 0 0 0 0 0 0 0 0
39660- 0 0 0 0 0 0 0 0 0 0 0 0
39661- 0 0 0 0 0 0 6 6 6 18 18 18
39662- 54 54 54 62 62 62 2 2 6 2 2 6
39663- 2 2 6 30 30 30 46 46 46 70 70 70
39664-250 250 250 253 253 253 253 253 253 253 253 253
39665-253 253 253 253 253 253 253 253 253 253 253 253
39666-253 253 253 253 253 253 231 231 231 246 246 246
39667-253 253 253 253 253 253 253 253 253 253 253 253
39668-253 253 253 253 253 253 253 253 253 253 253 253
39669-253 253 253 253 253 253 253 253 253 253 253 253
39670-253 253 253 253 253 253 253 253 253 253 253 253
39671-253 253 253 253 253 253 226 226 226 10 10 10
39672- 2 2 6 6 6 6 30 30 30 2 2 6
39673- 2 2 6 2 2 6 2 2 6 2 2 6
39674- 2 2 6 66 66 66 58 58 58 22 22 22
39675- 6 6 6 0 0 0 0 0 0 0 0 0
39676- 0 0 0 0 0 0 0 0 0 0 0 0
39677- 0 0 0 0 0 0 0 0 0 0 0 0
39678- 0 0 0 0 0 0 0 0 0 0 0 0
39679- 0 0 0 0 0 0 0 0 0 0 0 0
39680- 0 0 0 0 0 0 0 0 0 0 0 0
39681- 0 0 0 0 0 0 6 6 6 22 22 22
39682- 58 58 58 62 62 62 2 2 6 2 2 6
39683- 2 2 6 2 2 6 30 30 30 78 78 78
39684-250 250 250 253 253 253 253 253 253 253 253 253
39685-253 253 253 253 253 253 253 253 253 253 253 253
39686-253 253 253 253 253 253 231 231 231 246 246 246
39687-253 253 253 253 253 253 253 253 253 253 253 253
39688-253 253 253 253 253 253 253 253 253 253 253 253
39689-253 253 253 253 253 253 253 253 253 253 253 253
39690-253 253 253 253 253 253 253 253 253 253 253 253
39691-253 253 253 253 253 253 206 206 206 2 2 6
39692- 22 22 22 34 34 34 18 14 6 22 22 22
39693- 26 26 26 18 18 18 6 6 6 2 2 6
39694- 2 2 6 82 82 82 54 54 54 18 18 18
39695- 6 6 6 0 0 0 0 0 0 0 0 0
39696- 0 0 0 0 0 0 0 0 0 0 0 0
39697- 0 0 0 0 0 0 0 0 0 0 0 0
39698- 0 0 0 0 0 0 0 0 0 0 0 0
39699- 0 0 0 0 0 0 0 0 0 0 0 0
39700- 0 0 0 0 0 0 0 0 0 0 0 0
39701- 0 0 0 0 0 0 6 6 6 26 26 26
39702- 62 62 62 106 106 106 74 54 14 185 133 11
39703-210 162 10 121 92 8 6 6 6 62 62 62
39704-238 238 238 253 253 253 253 253 253 253 253 253
39705-253 253 253 253 253 253 253 253 253 253 253 253
39706-253 253 253 253 253 253 231 231 231 246 246 246
39707-253 253 253 253 253 253 253 253 253 253 253 253
39708-253 253 253 253 253 253 253 253 253 253 253 253
39709-253 253 253 253 253 253 253 253 253 253 253 253
39710-253 253 253 253 253 253 253 253 253 253 253 253
39711-253 253 253 253 253 253 158 158 158 18 18 18
39712- 14 14 14 2 2 6 2 2 6 2 2 6
39713- 6 6 6 18 18 18 66 66 66 38 38 38
39714- 6 6 6 94 94 94 50 50 50 18 18 18
39715- 6 6 6 0 0 0 0 0 0 0 0 0
39716- 0 0 0 0 0 0 0 0 0 0 0 0
39717- 0 0 0 0 0 0 0 0 0 0 0 0
39718- 0 0 0 0 0 0 0 0 0 0 0 0
39719- 0 0 0 0 0 0 0 0 0 0 0 0
39720- 0 0 0 0 0 0 0 0 0 6 6 6
39721- 10 10 10 10 10 10 18 18 18 38 38 38
39722- 78 78 78 142 134 106 216 158 10 242 186 14
39723-246 190 14 246 190 14 156 118 10 10 10 10
39724- 90 90 90 238 238 238 253 253 253 253 253 253
39725-253 253 253 253 253 253 253 253 253 253 253 253
39726-253 253 253 253 253 253 231 231 231 250 250 250
39727-253 253 253 253 253 253 253 253 253 253 253 253
39728-253 253 253 253 253 253 253 253 253 253 253 253
39729-253 253 253 253 253 253 253 253 253 253 253 253
39730-253 253 253 253 253 253 253 253 253 246 230 190
39731-238 204 91 238 204 91 181 142 44 37 26 9
39732- 2 2 6 2 2 6 2 2 6 2 2 6
39733- 2 2 6 2 2 6 38 38 38 46 46 46
39734- 26 26 26 106 106 106 54 54 54 18 18 18
39735- 6 6 6 0 0 0 0 0 0 0 0 0
39736- 0 0 0 0 0 0 0 0 0 0 0 0
39737- 0 0 0 0 0 0 0 0 0 0 0 0
39738- 0 0 0 0 0 0 0 0 0 0 0 0
39739- 0 0 0 0 0 0 0 0 0 0 0 0
39740- 0 0 0 6 6 6 14 14 14 22 22 22
39741- 30 30 30 38 38 38 50 50 50 70 70 70
39742-106 106 106 190 142 34 226 170 11 242 186 14
39743-246 190 14 246 190 14 246 190 14 154 114 10
39744- 6 6 6 74 74 74 226 226 226 253 253 253
39745-253 253 253 253 253 253 253 253 253 253 253 253
39746-253 253 253 253 253 253 231 231 231 250 250 250
39747-253 253 253 253 253 253 253 253 253 253 253 253
39748-253 253 253 253 253 253 253 253 253 253 253 253
39749-253 253 253 253 253 253 253 253 253 253 253 253
39750-253 253 253 253 253 253 253 253 253 228 184 62
39751-241 196 14 241 208 19 232 195 16 38 30 10
39752- 2 2 6 2 2 6 2 2 6 2 2 6
39753- 2 2 6 6 6 6 30 30 30 26 26 26
39754-203 166 17 154 142 90 66 66 66 26 26 26
39755- 6 6 6 0 0 0 0 0 0 0 0 0
39756- 0 0 0 0 0 0 0 0 0 0 0 0
39757- 0 0 0 0 0 0 0 0 0 0 0 0
39758- 0 0 0 0 0 0 0 0 0 0 0 0
39759- 0 0 0 0 0 0 0 0 0 0 0 0
39760- 6 6 6 18 18 18 38 38 38 58 58 58
39761- 78 78 78 86 86 86 101 101 101 123 123 123
39762-175 146 61 210 150 10 234 174 13 246 186 14
39763-246 190 14 246 190 14 246 190 14 238 190 10
39764-102 78 10 2 2 6 46 46 46 198 198 198
39765-253 253 253 253 253 253 253 253 253 253 253 253
39766-253 253 253 253 253 253 234 234 234 242 242 242
39767-253 253 253 253 253 253 253 253 253 253 253 253
39768-253 253 253 253 253 253 253 253 253 253 253 253
39769-253 253 253 253 253 253 253 253 253 253 253 253
39770-253 253 253 253 253 253 253 253 253 224 178 62
39771-242 186 14 241 196 14 210 166 10 22 18 6
39772- 2 2 6 2 2 6 2 2 6 2 2 6
39773- 2 2 6 2 2 6 6 6 6 121 92 8
39774-238 202 15 232 195 16 82 82 82 34 34 34
39775- 10 10 10 0 0 0 0 0 0 0 0 0
39776- 0 0 0 0 0 0 0 0 0 0 0 0
39777- 0 0 0 0 0 0 0 0 0 0 0 0
39778- 0 0 0 0 0 0 0 0 0 0 0 0
39779- 0 0 0 0 0 0 0 0 0 0 0 0
39780- 14 14 14 38 38 38 70 70 70 154 122 46
39781-190 142 34 200 144 11 197 138 11 197 138 11
39782-213 154 11 226 170 11 242 186 14 246 190 14
39783-246 190 14 246 190 14 246 190 14 246 190 14
39784-225 175 15 46 32 6 2 2 6 22 22 22
39785-158 158 158 250 250 250 253 253 253 253 253 253
39786-253 253 253 253 253 253 253 253 253 253 253 253
39787-253 253 253 253 253 253 253 253 253 253 253 253
39788-253 253 253 253 253 253 253 253 253 253 253 253
39789-253 253 253 253 253 253 253 253 253 253 253 253
39790-253 253 253 250 250 250 242 242 242 224 178 62
39791-239 182 13 236 186 11 213 154 11 46 32 6
39792- 2 2 6 2 2 6 2 2 6 2 2 6
39793- 2 2 6 2 2 6 61 42 6 225 175 15
39794-238 190 10 236 186 11 112 100 78 42 42 42
39795- 14 14 14 0 0 0 0 0 0 0 0 0
39796- 0 0 0 0 0 0 0 0 0 0 0 0
39797- 0 0 0 0 0 0 0 0 0 0 0 0
39798- 0 0 0 0 0 0 0 0 0 0 0 0
39799- 0 0 0 0 0 0 0 0 0 6 6 6
39800- 22 22 22 54 54 54 154 122 46 213 154 11
39801-226 170 11 230 174 11 226 170 11 226 170 11
39802-236 178 12 242 186 14 246 190 14 246 190 14
39803-246 190 14 246 190 14 246 190 14 246 190 14
39804-241 196 14 184 144 12 10 10 10 2 2 6
39805- 6 6 6 116 116 116 242 242 242 253 253 253
39806-253 253 253 253 253 253 253 253 253 253 253 253
39807-253 253 253 253 253 253 253 253 253 253 253 253
39808-253 253 253 253 253 253 253 253 253 253 253 253
39809-253 253 253 253 253 253 253 253 253 253 253 253
39810-253 253 253 231 231 231 198 198 198 214 170 54
39811-236 178 12 236 178 12 210 150 10 137 92 6
39812- 18 14 6 2 2 6 2 2 6 2 2 6
39813- 6 6 6 70 47 6 200 144 11 236 178 12
39814-239 182 13 239 182 13 124 112 88 58 58 58
39815- 22 22 22 6 6 6 0 0 0 0 0 0
39816- 0 0 0 0 0 0 0 0 0 0 0 0
39817- 0 0 0 0 0 0 0 0 0 0 0 0
39818- 0 0 0 0 0 0 0 0 0 0 0 0
39819- 0 0 0 0 0 0 0 0 0 10 10 10
39820- 30 30 30 70 70 70 180 133 36 226 170 11
39821-239 182 13 242 186 14 242 186 14 246 186 14
39822-246 190 14 246 190 14 246 190 14 246 190 14
39823-246 190 14 246 190 14 246 190 14 246 190 14
39824-246 190 14 232 195 16 98 70 6 2 2 6
39825- 2 2 6 2 2 6 66 66 66 221 221 221
39826-253 253 253 253 253 253 253 253 253 253 253 253
39827-253 253 253 253 253 253 253 253 253 253 253 253
39828-253 253 253 253 253 253 253 253 253 253 253 253
39829-253 253 253 253 253 253 253 253 253 253 253 253
39830-253 253 253 206 206 206 198 198 198 214 166 58
39831-230 174 11 230 174 11 216 158 10 192 133 9
39832-163 110 8 116 81 8 102 78 10 116 81 8
39833-167 114 7 197 138 11 226 170 11 239 182 13
39834-242 186 14 242 186 14 162 146 94 78 78 78
39835- 34 34 34 14 14 14 6 6 6 0 0 0
39836- 0 0 0 0 0 0 0 0 0 0 0 0
39837- 0 0 0 0 0 0 0 0 0 0 0 0
39838- 0 0 0 0 0 0 0 0 0 0 0 0
39839- 0 0 0 0 0 0 0 0 0 6 6 6
39840- 30 30 30 78 78 78 190 142 34 226 170 11
39841-239 182 13 246 190 14 246 190 14 246 190 14
39842-246 190 14 246 190 14 246 190 14 246 190 14
39843-246 190 14 246 190 14 246 190 14 246 190 14
39844-246 190 14 241 196 14 203 166 17 22 18 6
39845- 2 2 6 2 2 6 2 2 6 38 38 38
39846-218 218 218 253 253 253 253 253 253 253 253 253
39847-253 253 253 253 253 253 253 253 253 253 253 253
39848-253 253 253 253 253 253 253 253 253 253 253 253
39849-253 253 253 253 253 253 253 253 253 253 253 253
39850-250 250 250 206 206 206 198 198 198 202 162 69
39851-226 170 11 236 178 12 224 166 10 210 150 10
39852-200 144 11 197 138 11 192 133 9 197 138 11
39853-210 150 10 226 170 11 242 186 14 246 190 14
39854-246 190 14 246 186 14 225 175 15 124 112 88
39855- 62 62 62 30 30 30 14 14 14 6 6 6
39856- 0 0 0 0 0 0 0 0 0 0 0 0
39857- 0 0 0 0 0 0 0 0 0 0 0 0
39858- 0 0 0 0 0 0 0 0 0 0 0 0
39859- 0 0 0 0 0 0 0 0 0 10 10 10
39860- 30 30 30 78 78 78 174 135 50 224 166 10
39861-239 182 13 246 190 14 246 190 14 246 190 14
39862-246 190 14 246 190 14 246 190 14 246 190 14
39863-246 190 14 246 190 14 246 190 14 246 190 14
39864-246 190 14 246 190 14 241 196 14 139 102 15
39865- 2 2 6 2 2 6 2 2 6 2 2 6
39866- 78 78 78 250 250 250 253 253 253 253 253 253
39867-253 253 253 253 253 253 253 253 253 253 253 253
39868-253 253 253 253 253 253 253 253 253 253 253 253
39869-253 253 253 253 253 253 253 253 253 253 253 253
39870-250 250 250 214 214 214 198 198 198 190 150 46
39871-219 162 10 236 178 12 234 174 13 224 166 10
39872-216 158 10 213 154 11 213 154 11 216 158 10
39873-226 170 11 239 182 13 246 190 14 246 190 14
39874-246 190 14 246 190 14 242 186 14 206 162 42
39875-101 101 101 58 58 58 30 30 30 14 14 14
39876- 6 6 6 0 0 0 0 0 0 0 0 0
39877- 0 0 0 0 0 0 0 0 0 0 0 0
39878- 0 0 0 0 0 0 0 0 0 0 0 0
39879- 0 0 0 0 0 0 0 0 0 10 10 10
39880- 30 30 30 74 74 74 174 135 50 216 158 10
39881-236 178 12 246 190 14 246 190 14 246 190 14
39882-246 190 14 246 190 14 246 190 14 246 190 14
39883-246 190 14 246 190 14 246 190 14 246 190 14
39884-246 190 14 246 190 14 241 196 14 226 184 13
39885- 61 42 6 2 2 6 2 2 6 2 2 6
39886- 22 22 22 238 238 238 253 253 253 253 253 253
39887-253 253 253 253 253 253 253 253 253 253 253 253
39888-253 253 253 253 253 253 253 253 253 253 253 253
39889-253 253 253 253 253 253 253 253 253 253 253 253
39890-253 253 253 226 226 226 187 187 187 180 133 36
39891-216 158 10 236 178 12 239 182 13 236 178 12
39892-230 174 11 226 170 11 226 170 11 230 174 11
39893-236 178 12 242 186 14 246 190 14 246 190 14
39894-246 190 14 246 190 14 246 186 14 239 182 13
39895-206 162 42 106 106 106 66 66 66 34 34 34
39896- 14 14 14 6 6 6 0 0 0 0 0 0
39897- 0 0 0 0 0 0 0 0 0 0 0 0
39898- 0 0 0 0 0 0 0 0 0 0 0 0
39899- 0 0 0 0 0 0 0 0 0 6 6 6
39900- 26 26 26 70 70 70 163 133 67 213 154 11
39901-236 178 12 246 190 14 246 190 14 246 190 14
39902-246 190 14 246 190 14 246 190 14 246 190 14
39903-246 190 14 246 190 14 246 190 14 246 190 14
39904-246 190 14 246 190 14 246 190 14 241 196 14
39905-190 146 13 18 14 6 2 2 6 2 2 6
39906- 46 46 46 246 246 246 253 253 253 253 253 253
39907-253 253 253 253 253 253 253 253 253 253 253 253
39908-253 253 253 253 253 253 253 253 253 253 253 253
39909-253 253 253 253 253 253 253 253 253 253 253 253
39910-253 253 253 221 221 221 86 86 86 156 107 11
39911-216 158 10 236 178 12 242 186 14 246 186 14
39912-242 186 14 239 182 13 239 182 13 242 186 14
39913-242 186 14 246 186 14 246 190 14 246 190 14
39914-246 190 14 246 190 14 246 190 14 246 190 14
39915-242 186 14 225 175 15 142 122 72 66 66 66
39916- 30 30 30 10 10 10 0 0 0 0 0 0
39917- 0 0 0 0 0 0 0 0 0 0 0 0
39918- 0 0 0 0 0 0 0 0 0 0 0 0
39919- 0 0 0 0 0 0 0 0 0 6 6 6
39920- 26 26 26 70 70 70 163 133 67 210 150 10
39921-236 178 12 246 190 14 246 190 14 246 190 14
39922-246 190 14 246 190 14 246 190 14 246 190 14
39923-246 190 14 246 190 14 246 190 14 246 190 14
39924-246 190 14 246 190 14 246 190 14 246 190 14
39925-232 195 16 121 92 8 34 34 34 106 106 106
39926-221 221 221 253 253 253 253 253 253 253 253 253
39927-253 253 253 253 253 253 253 253 253 253 253 253
39928-253 253 253 253 253 253 253 253 253 253 253 253
39929-253 253 253 253 253 253 253 253 253 253 253 253
39930-242 242 242 82 82 82 18 14 6 163 110 8
39931-216 158 10 236 178 12 242 186 14 246 190 14
39932-246 190 14 246 190 14 246 190 14 246 190 14
39933-246 190 14 246 190 14 246 190 14 246 190 14
39934-246 190 14 246 190 14 246 190 14 246 190 14
39935-246 190 14 246 190 14 242 186 14 163 133 67
39936- 46 46 46 18 18 18 6 6 6 0 0 0
39937- 0 0 0 0 0 0 0 0 0 0 0 0
39938- 0 0 0 0 0 0 0 0 0 0 0 0
39939- 0 0 0 0 0 0 0 0 0 10 10 10
39940- 30 30 30 78 78 78 163 133 67 210 150 10
39941-236 178 12 246 186 14 246 190 14 246 190 14
39942-246 190 14 246 190 14 246 190 14 246 190 14
39943-246 190 14 246 190 14 246 190 14 246 190 14
39944-246 190 14 246 190 14 246 190 14 246 190 14
39945-241 196 14 215 174 15 190 178 144 253 253 253
39946-253 253 253 253 253 253 253 253 253 253 253 253
39947-253 253 253 253 253 253 253 253 253 253 253 253
39948-253 253 253 253 253 253 253 253 253 253 253 253
39949-253 253 253 253 253 253 253 253 253 218 218 218
39950- 58 58 58 2 2 6 22 18 6 167 114 7
39951-216 158 10 236 178 12 246 186 14 246 190 14
39952-246 190 14 246 190 14 246 190 14 246 190 14
39953-246 190 14 246 190 14 246 190 14 246 190 14
39954-246 190 14 246 190 14 246 190 14 246 190 14
39955-246 190 14 246 186 14 242 186 14 190 150 46
39956- 54 54 54 22 22 22 6 6 6 0 0 0
39957- 0 0 0 0 0 0 0 0 0 0 0 0
39958- 0 0 0 0 0 0 0 0 0 0 0 0
39959- 0 0 0 0 0 0 0 0 0 14 14 14
39960- 38 38 38 86 86 86 180 133 36 213 154 11
39961-236 178 12 246 186 14 246 190 14 246 190 14
39962-246 190 14 246 190 14 246 190 14 246 190 14
39963-246 190 14 246 190 14 246 190 14 246 190 14
39964-246 190 14 246 190 14 246 190 14 246 190 14
39965-246 190 14 232 195 16 190 146 13 214 214 214
39966-253 253 253 253 253 253 253 253 253 253 253 253
39967-253 253 253 253 253 253 253 253 253 253 253 253
39968-253 253 253 253 253 253 253 253 253 253 253 253
39969-253 253 253 250 250 250 170 170 170 26 26 26
39970- 2 2 6 2 2 6 37 26 9 163 110 8
39971-219 162 10 239 182 13 246 186 14 246 190 14
39972-246 190 14 246 190 14 246 190 14 246 190 14
39973-246 190 14 246 190 14 246 190 14 246 190 14
39974-246 190 14 246 190 14 246 190 14 246 190 14
39975-246 186 14 236 178 12 224 166 10 142 122 72
39976- 46 46 46 18 18 18 6 6 6 0 0 0
39977- 0 0 0 0 0 0 0 0 0 0 0 0
39978- 0 0 0 0 0 0 0 0 0 0 0 0
39979- 0 0 0 0 0 0 6 6 6 18 18 18
39980- 50 50 50 109 106 95 192 133 9 224 166 10
39981-242 186 14 246 190 14 246 190 14 246 190 14
39982-246 190 14 246 190 14 246 190 14 246 190 14
39983-246 190 14 246 190 14 246 190 14 246 190 14
39984-246 190 14 246 190 14 246 190 14 246 190 14
39985-242 186 14 226 184 13 210 162 10 142 110 46
39986-226 226 226 253 253 253 253 253 253 253 253 253
39987-253 253 253 253 253 253 253 253 253 253 253 253
39988-253 253 253 253 253 253 253 253 253 253 253 253
39989-198 198 198 66 66 66 2 2 6 2 2 6
39990- 2 2 6 2 2 6 50 34 6 156 107 11
39991-219 162 10 239 182 13 246 186 14 246 190 14
39992-246 190 14 246 190 14 246 190 14 246 190 14
39993-246 190 14 246 190 14 246 190 14 246 190 14
39994-246 190 14 246 190 14 246 190 14 242 186 14
39995-234 174 13 213 154 11 154 122 46 66 66 66
39996- 30 30 30 10 10 10 0 0 0 0 0 0
39997- 0 0 0 0 0 0 0 0 0 0 0 0
39998- 0 0 0 0 0 0 0 0 0 0 0 0
39999- 0 0 0 0 0 0 6 6 6 22 22 22
40000- 58 58 58 154 121 60 206 145 10 234 174 13
40001-242 186 14 246 186 14 246 190 14 246 190 14
40002-246 190 14 246 190 14 246 190 14 246 190 14
40003-246 190 14 246 190 14 246 190 14 246 190 14
40004-246 190 14 246 190 14 246 190 14 246 190 14
40005-246 186 14 236 178 12 210 162 10 163 110 8
40006- 61 42 6 138 138 138 218 218 218 250 250 250
40007-253 253 253 253 253 253 253 253 253 250 250 250
40008-242 242 242 210 210 210 144 144 144 66 66 66
40009- 6 6 6 2 2 6 2 2 6 2 2 6
40010- 2 2 6 2 2 6 61 42 6 163 110 8
40011-216 158 10 236 178 12 246 190 14 246 190 14
40012-246 190 14 246 190 14 246 190 14 246 190 14
40013-246 190 14 246 190 14 246 190 14 246 190 14
40014-246 190 14 239 182 13 230 174 11 216 158 10
40015-190 142 34 124 112 88 70 70 70 38 38 38
40016- 18 18 18 6 6 6 0 0 0 0 0 0
40017- 0 0 0 0 0 0 0 0 0 0 0 0
40018- 0 0 0 0 0 0 0 0 0 0 0 0
40019- 0 0 0 0 0 0 6 6 6 22 22 22
40020- 62 62 62 168 124 44 206 145 10 224 166 10
40021-236 178 12 239 182 13 242 186 14 242 186 14
40022-246 186 14 246 190 14 246 190 14 246 190 14
40023-246 190 14 246 190 14 246 190 14 246 190 14
40024-246 190 14 246 190 14 246 190 14 246 190 14
40025-246 190 14 236 178 12 216 158 10 175 118 6
40026- 80 54 7 2 2 6 6 6 6 30 30 30
40027- 54 54 54 62 62 62 50 50 50 38 38 38
40028- 14 14 14 2 2 6 2 2 6 2 2 6
40029- 2 2 6 2 2 6 2 2 6 2 2 6
40030- 2 2 6 6 6 6 80 54 7 167 114 7
40031-213 154 11 236 178 12 246 190 14 246 190 14
40032-246 190 14 246 190 14 246 190 14 246 190 14
40033-246 190 14 242 186 14 239 182 13 239 182 13
40034-230 174 11 210 150 10 174 135 50 124 112 88
40035- 82 82 82 54 54 54 34 34 34 18 18 18
40036- 6 6 6 0 0 0 0 0 0 0 0 0
40037- 0 0 0 0 0 0 0 0 0 0 0 0
40038- 0 0 0 0 0 0 0 0 0 0 0 0
40039- 0 0 0 0 0 0 6 6 6 18 18 18
40040- 50 50 50 158 118 36 192 133 9 200 144 11
40041-216 158 10 219 162 10 224 166 10 226 170 11
40042-230 174 11 236 178 12 239 182 13 239 182 13
40043-242 186 14 246 186 14 246 190 14 246 190 14
40044-246 190 14 246 190 14 246 190 14 246 190 14
40045-246 186 14 230 174 11 210 150 10 163 110 8
40046-104 69 6 10 10 10 2 2 6 2 2 6
40047- 2 2 6 2 2 6 2 2 6 2 2 6
40048- 2 2 6 2 2 6 2 2 6 2 2 6
40049- 2 2 6 2 2 6 2 2 6 2 2 6
40050- 2 2 6 6 6 6 91 60 6 167 114 7
40051-206 145 10 230 174 11 242 186 14 246 190 14
40052-246 190 14 246 190 14 246 186 14 242 186 14
40053-239 182 13 230 174 11 224 166 10 213 154 11
40054-180 133 36 124 112 88 86 86 86 58 58 58
40055- 38 38 38 22 22 22 10 10 10 6 6 6
40056- 0 0 0 0 0 0 0 0 0 0 0 0
40057- 0 0 0 0 0 0 0 0 0 0 0 0
40058- 0 0 0 0 0 0 0 0 0 0 0 0
40059- 0 0 0 0 0 0 0 0 0 14 14 14
40060- 34 34 34 70 70 70 138 110 50 158 118 36
40061-167 114 7 180 123 7 192 133 9 197 138 11
40062-200 144 11 206 145 10 213 154 11 219 162 10
40063-224 166 10 230 174 11 239 182 13 242 186 14
40064-246 186 14 246 186 14 246 186 14 246 186 14
40065-239 182 13 216 158 10 185 133 11 152 99 6
40066-104 69 6 18 14 6 2 2 6 2 2 6
40067- 2 2 6 2 2 6 2 2 6 2 2 6
40068- 2 2 6 2 2 6 2 2 6 2 2 6
40069- 2 2 6 2 2 6 2 2 6 2 2 6
40070- 2 2 6 6 6 6 80 54 7 152 99 6
40071-192 133 9 219 162 10 236 178 12 239 182 13
40072-246 186 14 242 186 14 239 182 13 236 178 12
40073-224 166 10 206 145 10 192 133 9 154 121 60
40074- 94 94 94 62 62 62 42 42 42 22 22 22
40075- 14 14 14 6 6 6 0 0 0 0 0 0
40076- 0 0 0 0 0 0 0 0 0 0 0 0
40077- 0 0 0 0 0 0 0 0 0 0 0 0
40078- 0 0 0 0 0 0 0 0 0 0 0 0
40079- 0 0 0 0 0 0 0 0 0 6 6 6
40080- 18 18 18 34 34 34 58 58 58 78 78 78
40081-101 98 89 124 112 88 142 110 46 156 107 11
40082-163 110 8 167 114 7 175 118 6 180 123 7
40083-185 133 11 197 138 11 210 150 10 219 162 10
40084-226 170 11 236 178 12 236 178 12 234 174 13
40085-219 162 10 197 138 11 163 110 8 130 83 6
40086- 91 60 6 10 10 10 2 2 6 2 2 6
40087- 18 18 18 38 38 38 38 38 38 38 38 38
40088- 38 38 38 38 38 38 38 38 38 38 38 38
40089- 38 38 38 38 38 38 26 26 26 2 2 6
40090- 2 2 6 6 6 6 70 47 6 137 92 6
40091-175 118 6 200 144 11 219 162 10 230 174 11
40092-234 174 13 230 174 11 219 162 10 210 150 10
40093-192 133 9 163 110 8 124 112 88 82 82 82
40094- 50 50 50 30 30 30 14 14 14 6 6 6
40095- 0 0 0 0 0 0 0 0 0 0 0 0
40096- 0 0 0 0 0 0 0 0 0 0 0 0
40097- 0 0 0 0 0 0 0 0 0 0 0 0
40098- 0 0 0 0 0 0 0 0 0 0 0 0
40099- 0 0 0 0 0 0 0 0 0 0 0 0
40100- 6 6 6 14 14 14 22 22 22 34 34 34
40101- 42 42 42 58 58 58 74 74 74 86 86 86
40102-101 98 89 122 102 70 130 98 46 121 87 25
40103-137 92 6 152 99 6 163 110 8 180 123 7
40104-185 133 11 197 138 11 206 145 10 200 144 11
40105-180 123 7 156 107 11 130 83 6 104 69 6
40106- 50 34 6 54 54 54 110 110 110 101 98 89
40107- 86 86 86 82 82 82 78 78 78 78 78 78
40108- 78 78 78 78 78 78 78 78 78 78 78 78
40109- 78 78 78 82 82 82 86 86 86 94 94 94
40110-106 106 106 101 101 101 86 66 34 124 80 6
40111-156 107 11 180 123 7 192 133 9 200 144 11
40112-206 145 10 200 144 11 192 133 9 175 118 6
40113-139 102 15 109 106 95 70 70 70 42 42 42
40114- 22 22 22 10 10 10 0 0 0 0 0 0
40115- 0 0 0 0 0 0 0 0 0 0 0 0
40116- 0 0 0 0 0 0 0 0 0 0 0 0
40117- 0 0 0 0 0 0 0 0 0 0 0 0
40118- 0 0 0 0 0 0 0 0 0 0 0 0
40119- 0 0 0 0 0 0 0 0 0 0 0 0
40120- 0 0 0 0 0 0 6 6 6 10 10 10
40121- 14 14 14 22 22 22 30 30 30 38 38 38
40122- 50 50 50 62 62 62 74 74 74 90 90 90
40123-101 98 89 112 100 78 121 87 25 124 80 6
40124-137 92 6 152 99 6 152 99 6 152 99 6
40125-138 86 6 124 80 6 98 70 6 86 66 30
40126-101 98 89 82 82 82 58 58 58 46 46 46
40127- 38 38 38 34 34 34 34 34 34 34 34 34
40128- 34 34 34 34 34 34 34 34 34 34 34 34
40129- 34 34 34 34 34 34 38 38 38 42 42 42
40130- 54 54 54 82 82 82 94 86 76 91 60 6
40131-134 86 6 156 107 11 167 114 7 175 118 6
40132-175 118 6 167 114 7 152 99 6 121 87 25
40133-101 98 89 62 62 62 34 34 34 18 18 18
40134- 6 6 6 0 0 0 0 0 0 0 0 0
40135- 0 0 0 0 0 0 0 0 0 0 0 0
40136- 0 0 0 0 0 0 0 0 0 0 0 0
40137- 0 0 0 0 0 0 0 0 0 0 0 0
40138- 0 0 0 0 0 0 0 0 0 0 0 0
40139- 0 0 0 0 0 0 0 0 0 0 0 0
40140- 0 0 0 0 0 0 0 0 0 0 0 0
40141- 0 0 0 6 6 6 6 6 6 10 10 10
40142- 18 18 18 22 22 22 30 30 30 42 42 42
40143- 50 50 50 66 66 66 86 86 86 101 98 89
40144-106 86 58 98 70 6 104 69 6 104 69 6
40145-104 69 6 91 60 6 82 62 34 90 90 90
40146- 62 62 62 38 38 38 22 22 22 14 14 14
40147- 10 10 10 10 10 10 10 10 10 10 10 10
40148- 10 10 10 10 10 10 6 6 6 10 10 10
40149- 10 10 10 10 10 10 10 10 10 14 14 14
40150- 22 22 22 42 42 42 70 70 70 89 81 66
40151- 80 54 7 104 69 6 124 80 6 137 92 6
40152-134 86 6 116 81 8 100 82 52 86 86 86
40153- 58 58 58 30 30 30 14 14 14 6 6 6
40154- 0 0 0 0 0 0 0 0 0 0 0 0
40155- 0 0 0 0 0 0 0 0 0 0 0 0
40156- 0 0 0 0 0 0 0 0 0 0 0 0
40157- 0 0 0 0 0 0 0 0 0 0 0 0
40158- 0 0 0 0 0 0 0 0 0 0 0 0
40159- 0 0 0 0 0 0 0 0 0 0 0 0
40160- 0 0 0 0 0 0 0 0 0 0 0 0
40161- 0 0 0 0 0 0 0 0 0 0 0 0
40162- 0 0 0 6 6 6 10 10 10 14 14 14
40163- 18 18 18 26 26 26 38 38 38 54 54 54
40164- 70 70 70 86 86 86 94 86 76 89 81 66
40165- 89 81 66 86 86 86 74 74 74 50 50 50
40166- 30 30 30 14 14 14 6 6 6 0 0 0
40167- 0 0 0 0 0 0 0 0 0 0 0 0
40168- 0 0 0 0 0 0 0 0 0 0 0 0
40169- 0 0 0 0 0 0 0 0 0 0 0 0
40170- 6 6 6 18 18 18 34 34 34 58 58 58
40171- 82 82 82 89 81 66 89 81 66 89 81 66
40172- 94 86 66 94 86 76 74 74 74 50 50 50
40173- 26 26 26 14 14 14 6 6 6 0 0 0
40174- 0 0 0 0 0 0 0 0 0 0 0 0
40175- 0 0 0 0 0 0 0 0 0 0 0 0
40176- 0 0 0 0 0 0 0 0 0 0 0 0
40177- 0 0 0 0 0 0 0 0 0 0 0 0
40178- 0 0 0 0 0 0 0 0 0 0 0 0
40179- 0 0 0 0 0 0 0 0 0 0 0 0
40180- 0 0 0 0 0 0 0 0 0 0 0 0
40181- 0 0 0 0 0 0 0 0 0 0 0 0
40182- 0 0 0 0 0 0 0 0 0 0 0 0
40183- 6 6 6 6 6 6 14 14 14 18 18 18
40184- 30 30 30 38 38 38 46 46 46 54 54 54
40185- 50 50 50 42 42 42 30 30 30 18 18 18
40186- 10 10 10 0 0 0 0 0 0 0 0 0
40187- 0 0 0 0 0 0 0 0 0 0 0 0
40188- 0 0 0 0 0 0 0 0 0 0 0 0
40189- 0 0 0 0 0 0 0 0 0 0 0 0
40190- 0 0 0 6 6 6 14 14 14 26 26 26
40191- 38 38 38 50 50 50 58 58 58 58 58 58
40192- 54 54 54 42 42 42 30 30 30 18 18 18
40193- 10 10 10 0 0 0 0 0 0 0 0 0
40194- 0 0 0 0 0 0 0 0 0 0 0 0
40195- 0 0 0 0 0 0 0 0 0 0 0 0
40196- 0 0 0 0 0 0 0 0 0 0 0 0
40197- 0 0 0 0 0 0 0 0 0 0 0 0
40198- 0 0 0 0 0 0 0 0 0 0 0 0
40199- 0 0 0 0 0 0 0 0 0 0 0 0
40200- 0 0 0 0 0 0 0 0 0 0 0 0
40201- 0 0 0 0 0 0 0 0 0 0 0 0
40202- 0 0 0 0 0 0 0 0 0 0 0 0
40203- 0 0 0 0 0 0 0 0 0 6 6 6
40204- 6 6 6 10 10 10 14 14 14 18 18 18
40205- 18 18 18 14 14 14 10 10 10 6 6 6
40206- 0 0 0 0 0 0 0 0 0 0 0 0
40207- 0 0 0 0 0 0 0 0 0 0 0 0
40208- 0 0 0 0 0 0 0 0 0 0 0 0
40209- 0 0 0 0 0 0 0 0 0 0 0 0
40210- 0 0 0 0 0 0 0 0 0 6 6 6
40211- 14 14 14 18 18 18 22 22 22 22 22 22
40212- 18 18 18 14 14 14 10 10 10 6 6 6
40213- 0 0 0 0 0 0 0 0 0 0 0 0
40214- 0 0 0 0 0 0 0 0 0 0 0 0
40215- 0 0 0 0 0 0 0 0 0 0 0 0
40216- 0 0 0 0 0 0 0 0 0 0 0 0
40217- 0 0 0 0 0 0 0 0 0 0 0 0
40218+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40219+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40220+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40221+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40222+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40223+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40224+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40225+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40226+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40227+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40228+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40229+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40230+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40231+4 4 4 4 4 4
40232+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40233+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40234+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40235+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40236+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40237+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40238+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40239+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40240+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40241+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40242+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40243+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40244+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40245+4 4 4 4 4 4
40246+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40247+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40248+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40249+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40250+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40251+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40252+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40253+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40254+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40255+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40256+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40257+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40258+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40259+4 4 4 4 4 4
40260+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40261+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40262+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40263+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40264+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40265+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40266+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40267+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40268+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40269+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40270+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40271+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40272+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40273+4 4 4 4 4 4
40274+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40275+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40276+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40277+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40278+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40279+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40280+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40281+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40282+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40283+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40284+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40285+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40286+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40287+4 4 4 4 4 4
40288+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40289+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40290+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40291+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40292+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40293+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40294+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40295+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40296+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40297+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40298+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40299+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40300+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40301+4 4 4 4 4 4
40302+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40303+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40304+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40305+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40306+4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
40307+0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
40308+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40309+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40310+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40311+4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
40312+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40313+4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
40314+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40315+4 4 4 4 4 4
40316+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40317+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40318+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40319+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40320+4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
40321+37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
40322+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40323+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40324+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40325+4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
40326+2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
40327+4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
40328+1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40329+4 4 4 4 4 4
40330+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40331+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40332+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40333+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40334+2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
40335+153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
40336+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40337+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40338+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40339+4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
40340+60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
40341+4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
40342+2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
40343+4 4 4 4 4 4
40344+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40345+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40346+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40347+4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
40348+4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
40349+165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
40350+1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
40351+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40352+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40353+3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
40354+163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
40355+0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
40356+37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
40357+4 4 4 4 4 4
40358+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40359+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40360+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40361+4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
40362+37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
40363+156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
40364+125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
40365+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40366+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
40367+0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
40368+174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
40369+0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
40370+64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
40371+4 4 4 4 4 4
40372+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40373+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40374+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
40375+5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
40376+156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
40377+156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
40378+174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
40379+1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
40380+4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
40381+13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
40382+174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
40383+22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
40384+90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
40385+4 4 4 4 4 4
40386+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40387+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40388+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
40389+0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
40390+174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
40391+156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
40392+163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
40393+4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
40394+5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
40395+131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
40396+190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
40397+90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
40398+31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
40399+4 4 4 4 4 4
40400+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40401+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40402+4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
40403+4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
40404+155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
40405+167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
40406+153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
40407+41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
40408+1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
40409+177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
40410+125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
40411+136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
40412+7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
40413+4 4 4 4 4 4
40414+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40415+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40416+4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
40417+125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
40418+156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
40419+137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
40420+156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
40421+167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
40422+0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
40423+166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
40424+6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
40425+90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
40426+1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40427+4 4 4 4 4 4
40428+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40429+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40430+1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
40431+167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
40432+157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
40433+26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
40434+158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
40435+165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
40436+60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
40437+137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
40438+52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
40439+13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
40440+4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
40441+4 4 4 4 4 4
40442+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40443+4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
40444+0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
40445+158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
40446+167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
40447+4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
40448+174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
40449+155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
40450+137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
40451+16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
40452+136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
40453+2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
40454+4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
40455+4 4 4 4 4 4
40456+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40457+4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
40458+37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
40459+157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
40460+153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
40461+4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
40462+125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
40463+156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
40464+174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
40465+4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
40466+136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
40467+1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
40468+2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
40469+0 0 0 4 4 4
40470+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40471+4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
40472+158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
40473+153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
40474+37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
40475+4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
40476+4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
40477+154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
40478+174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
40479+32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
40480+28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
40481+50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
40482+0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
40483+2 0 0 0 0 0
40484+4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
40485+0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
40486+174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
40487+165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
40488+4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
40489+4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
40490+4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
40491+174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
40492+60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
40493+136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
40494+22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
40495+136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
40496+26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
40497+37 38 37 0 0 0
40498+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40499+13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
40500+153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
40501+177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
40502+4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
40503+5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
40504+6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
40505+166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
40506+4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
40507+146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
40508+71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
40509+90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
40510+125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
40511+85 115 134 4 0 0
40512+4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
40513+125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
40514+155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
40515+125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
40516+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
40517+0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
40518+5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
40519+37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
40520+4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
40521+90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
40522+2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
40523+13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
40524+166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
40525+60 73 81 4 0 0
40526+4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
40527+174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
40528+156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
40529+4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
40530+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
40531+10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
40532+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
40533+4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
40534+80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
40535+28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
40536+50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
40537+1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
40538+167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
40539+16 19 21 4 0 0
40540+4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
40541+158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
40542+167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
40543+4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
40544+4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
40545+80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
40546+4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
40547+3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
40548+146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
40549+68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
40550+136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
40551+24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
40552+163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
40553+4 0 0 4 3 3
40554+3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
40555+156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
40556+155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
40557+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
40558+2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
40559+136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
40560+0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
40561+0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
40562+136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
40563+28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
40564+22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
40565+137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
40566+60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
40567+3 2 2 4 4 4
40568+3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
40569+157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
40570+37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
40571+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40572+0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
40573+101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
40574+14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
40575+22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
40576+136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
40577+17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
40578+2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
40579+166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
40580+13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
40581+4 4 4 4 4 4
40582+1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
40583+163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
40584+4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
40585+4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
40586+40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
40587+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
40588+101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
40589+136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
40590+136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
40591+136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
40592+3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
40593+174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
40594+4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
40595+4 4 4 4 4 4
40596+4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
40597+155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
40598+4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
40599+4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
40600+101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
40601+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40602+136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
40603+136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
40604+136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
40605+90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
40606+85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
40607+167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
40608+6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
40609+5 5 5 5 5 5
40610+1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
40611+131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
40612+6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
40613+0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
40614+101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
40615+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40616+101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
40617+136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
40618+101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
40619+7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
40620+174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
40621+24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
40622+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
40623+5 5 5 4 4 4
40624+4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
40625+131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
40626+6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
40627+13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
40628+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40629+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
40630+101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
40631+136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
40632+136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
40633+2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
40634+174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
40635+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
40636+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40637+4 4 4 4 4 4
40638+1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
40639+137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
40640+4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
40641+64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
40642+90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
40643+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40644+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40645+136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
40646+101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
40647+37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
40648+167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
40649+3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
40650+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40651+4 4 4 4 4 4
40652+4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
40653+153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
40654+4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
40655+90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
40656+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40657+90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
40658+101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
40659+101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
40660+35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
40661+154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
40662+60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
40663+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40664+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40665+4 4 4 4 4 4
40666+1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
40667+153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
40668+4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
40669+64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
40670+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40671+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40672+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40673+136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
40674+13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
40675+174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
40676+6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
40677+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40678+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40679+4 4 4 4 4 4
40680+4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
40681+156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
40682+4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
40683+90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
40684+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40685+90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
40686+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40687+101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
40688+2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
40689+174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
40690+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40691+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40692+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40693+4 4 4 4 4 4
40694+3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
40695+158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
40696+4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
40697+37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
40698+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40699+90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
40700+101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
40701+90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
40702+5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
40703+167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
40704+6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
40705+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40706+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40707+4 4 4 4 4 4
40708+4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
40709+163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
40710+4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
40711+18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
40712+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40713+90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
40714+101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
40715+13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
40716+3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
40717+174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
40718+4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
40719+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40720+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40721+4 4 4 4 4 4
40722+1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
40723+167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
40724+4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
40725+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40726+26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
40727+90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
40728+101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
40729+7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
40730+4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
40731+174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
40732+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40733+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40734+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40735+4 4 4 4 4 4
40736+4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
40737+174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
40738+5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
40739+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40740+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40741+90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
40742+101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
40743+2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
40744+3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
40745+153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
40746+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40747+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40748+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40749+4 4 4 4 4 4
40750+1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
40751+174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
40752+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40753+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40754+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40755+26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
40756+35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
40757+2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
40758+3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
40759+131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
40760+4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40761+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40762+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40763+4 4 4 4 4 4
40764+3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
40765+174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
40766+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40767+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40768+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40769+26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
40770+7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
40771+4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
40772+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40773+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40774+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40775+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40776+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40777+4 4 4 4 4 4
40778+1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40779+174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
40780+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40781+18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
40782+18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
40783+26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
40784+28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
40785+3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
40786+4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40787+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40788+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40789+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40790+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40791+4 4 4 4 4 4
40792+4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40793+174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
40794+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40795+10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
40796+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40797+18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
40798+90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
40799+3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
40800+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40801+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40802+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40803+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40804+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40805+4 4 4 4 4 4
40806+1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
40807+177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
40808+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40809+10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
40810+26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
40811+6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
40812+10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
40813+2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
40814+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40815+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40816+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40817+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40818+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40819+4 4 4 4 4 4
40820+4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
40821+177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
40822+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40823+10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
40824+26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
40825+7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
40826+3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
40827+21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
40828+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40829+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40830+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40831+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40832+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40833+4 4 4 4 4 4
40834+3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40835+190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
40836+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40837+10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
40838+24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
40839+18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
40840+28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
40841+26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
40842+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40843+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40844+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40845+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40846+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40847+4 4 4 4 4 4
40848+4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
40849+190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
40850+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40851+10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
40852+0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
40853+26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
40854+37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
40855+90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
40856+4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
40857+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40858+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40859+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40860+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40861+4 4 4 4 4 4
40862+4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40863+193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
40864+5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
40865+10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
40866+1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
40867+26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
40868+22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
40869+26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
40870+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40871+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40872+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40873+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40874+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40875+4 4 4 4 4 4
40876+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40877+190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
40878+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40879+10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
40880+2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
40881+26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
40882+10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
40883+26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
40884+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40885+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40886+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40887+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40888+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40889+4 4 4 4 4 4
40890+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40891+193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
40892+5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
40893+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
40894+13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
40895+10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
40896+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40897+26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
40898+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40899+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40900+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40901+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40902+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40903+4 4 4 4 4 4
40904+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40905+190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
40906+5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
40907+28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
40908+10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
40909+28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
40910+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40911+26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
40912+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40913+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40914+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40915+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40916+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40917+4 4 4 4 4 4
40918+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40919+193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
40920+5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
40921+4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
40922+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
40923+10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
40924+18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
40925+22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
40926+4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
40927+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40928+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40929+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40930+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40931+4 4 4 4 4 4
40932+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40933+190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
40934+6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
40935+1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
40936+18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
40937+10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
40938+26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
40939+1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
40940+5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
40941+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40942+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40943+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40944+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40945+4 4 4 4 4 4
40946+4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
40947+193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
40948+2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
40949+4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
40950+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
40951+10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
40952+26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
40953+2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
40954+3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
40955+131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40956+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40957+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40958+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40959+4 4 4 4 4 4
40960+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40961+193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
40962+0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
40963+4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
40964+13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
40965+10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
40966+28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
40967+4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
40968+0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
40969+125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40970+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40971+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40972+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40973+4 4 4 4 4 4
40974+4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
40975+193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
40976+120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
40977+4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
40978+4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
40979+10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
40980+4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
40981+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
40982+24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
40983+125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
40984+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40985+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40986+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40987+4 4 4 4 4 4
40988+4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
40989+174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
40990+220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
40991+3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
40992+4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
40993+10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
40994+1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
40995+5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
40996+137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
40997+125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
40998+0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40999+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41000+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41001+4 4 4 4 4 4
41002+5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
41003+193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41004+220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
41005+4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
41006+4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
41007+22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
41008+4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41009+1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
41010+166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
41011+125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
41012+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41013+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41014+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41015+4 4 4 4 4 4
41016+4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
41017+220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
41018+205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
41019+24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
41020+4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
41021+4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
41022+4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
41023+2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
41024+156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
41025+137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
41026+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41027+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41028+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41029+4 4 4 4 4 4
41030+5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
41031+125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
41032+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41033+193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
41034+5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
41035+1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
41036+5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
41037+60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
41038+153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
41039+125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
41040+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41041+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41042+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41043+4 4 4 4 4 4
41044+4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41045+6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
41046+193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
41047+244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
41048+0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
41049+4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
41050+3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
41051+220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
41052+153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
41053+13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41054+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41055+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41056+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41057+4 4 4 4 4 4
41058+5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
41059+6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
41060+244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
41061+220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
41062+3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
41063+4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
41064+0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
41065+177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
41066+158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
41067+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41068+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41069+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41070+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41071+4 4 4 4 4 4
41072+5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
41073+6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
41074+177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
41075+220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
41076+125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
41077+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
41078+37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
41079+174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
41080+158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41081+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41082+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41083+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41084+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41085+4 4 4 4 4 4
41086+4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
41087+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41088+26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
41089+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41090+244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
41091+0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
41092+177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
41093+174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
41094+60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
41095+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41096+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41097+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41098+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41099+4 4 4 4 4 4
41100+5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
41101+6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
41102+6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
41103+220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
41104+220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
41105+0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
41106+220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
41107+174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
41108+4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
41109+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41110+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41111+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41112+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41113+4 4 4 4 4 4
41114+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41115+6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
41116+4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
41117+220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
41118+205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
41119+60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
41120+177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
41121+190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
41122+4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41123+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41124+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41125+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41126+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41127+4 4 4 4 4 4
41128+4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
41129+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
41130+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41131+125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
41132+205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
41133+193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
41134+190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
41135+153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
41136+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41137+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41138+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41139+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41140+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41141+4 4 4 4 4 4
41142+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41143+6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
41144+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
41145+4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
41146+205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
41147+220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
41148+174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
41149+6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41150+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41151+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41152+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41153+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41154+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41155+4 4 4 4 4 4
41156+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41157+5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
41158+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41159+4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
41160+220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
41161+190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
41162+193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
41163+4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
41164+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41165+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41166+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41167+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41168+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41169+4 4 4 4 4 4
41170+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41171+4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
41172+4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
41173+6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
41174+174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
41175+193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
41176+193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
41177+6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
41178+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41179+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41180+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41181+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41182+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41183+4 4 4 4 4 4
41184+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41185+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41186+5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
41187+5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41188+6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
41189+193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
41190+60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
41191+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41192+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41193+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41194+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41195+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41196+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41197+4 4 4 4 4 4
41198+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41199+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41200+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41201+5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
41202+4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
41203+193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
41204+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
41205+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41206+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41207+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41208+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41209+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41210+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41211+4 4 4 4 4 4
41212+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41213+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41214+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41215+4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41216+6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
41217+153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
41218+6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
41219+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41220+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41221+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41222+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41223+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41224+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41225+4 4 4 4 4 4
41226+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41227+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41228+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41229+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41230+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41231+24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
41232+6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
41233+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41234+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41235+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41236+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41237+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41238+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41239+4 4 4 4 4 4
41240+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41241+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41242+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41243+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41244+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41245+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41246+4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
41247+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41248+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41249+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41250+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41251+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41252+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41253+4 4 4 4 4 4
41254+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41255+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41256+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41257+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
41258+5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
41259+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
41260+6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
41261+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41262+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41263+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41264+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41265+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41266+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41267+4 4 4 4 4 4
41268+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41269+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41270+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41271+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41272+4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
41273+4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41274+6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41275+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41276+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41277+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41278+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41279+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41280+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41281+4 4 4 4 4 4
41282+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41283+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41284+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41285+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41286+4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
41287+6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
41288+4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41289+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41290+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41291+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41292+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41293+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41294+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41295+4 4 4 4 4 4
41296+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41297+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41298+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41299+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41300+4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
41301+4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
41302+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41303+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41304+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41305+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41306+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41307+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41308+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41309+4 4 4 4 4 4
41310+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41311+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41312+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41313+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41314+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
41315+5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
41316+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41317+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41318+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41319+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41320+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41321+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41322+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41323+4 4 4 4 4 4
41324+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41325+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41326+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41327+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41328+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41329+5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
41330+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41331+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41332+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41333+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41334+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41335+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41336+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41337+4 4 4 4 4 4
41338diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
41339index 087fc99..f85ed76 100644
41340--- a/drivers/video/udlfb.c
41341+++ b/drivers/video/udlfb.c
41342@@ -585,11 +585,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
41343 dlfb_urb_completion(urb);
41344
41345 error:
41346- atomic_add(bytes_sent, &dev->bytes_sent);
41347- atomic_add(bytes_identical, &dev->bytes_identical);
41348- atomic_add(width*height*2, &dev->bytes_rendered);
41349+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41350+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41351+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
41352 end_cycles = get_cycles();
41353- atomic_add(((unsigned int) ((end_cycles - start_cycles)
41354+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41355 >> 10)), /* Kcycles */
41356 &dev->cpu_kcycles_used);
41357
41358@@ -710,11 +710,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
41359 dlfb_urb_completion(urb);
41360
41361 error:
41362- atomic_add(bytes_sent, &dev->bytes_sent);
41363- atomic_add(bytes_identical, &dev->bytes_identical);
41364- atomic_add(bytes_rendered, &dev->bytes_rendered);
41365+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41366+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41367+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
41368 end_cycles = get_cycles();
41369- atomic_add(((unsigned int) ((end_cycles - start_cycles)
41370+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41371 >> 10)), /* Kcycles */
41372 &dev->cpu_kcycles_used);
41373 }
41374@@ -1306,7 +1306,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
41375 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41376 struct dlfb_data *dev = fb_info->par;
41377 return snprintf(buf, PAGE_SIZE, "%u\n",
41378- atomic_read(&dev->bytes_rendered));
41379+ atomic_read_unchecked(&dev->bytes_rendered));
41380 }
41381
41382 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41383@@ -1314,7 +1314,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41384 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41385 struct dlfb_data *dev = fb_info->par;
41386 return snprintf(buf, PAGE_SIZE, "%u\n",
41387- atomic_read(&dev->bytes_identical));
41388+ atomic_read_unchecked(&dev->bytes_identical));
41389 }
41390
41391 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41392@@ -1322,7 +1322,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41393 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41394 struct dlfb_data *dev = fb_info->par;
41395 return snprintf(buf, PAGE_SIZE, "%u\n",
41396- atomic_read(&dev->bytes_sent));
41397+ atomic_read_unchecked(&dev->bytes_sent));
41398 }
41399
41400 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41401@@ -1330,7 +1330,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41402 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41403 struct dlfb_data *dev = fb_info->par;
41404 return snprintf(buf, PAGE_SIZE, "%u\n",
41405- atomic_read(&dev->cpu_kcycles_used));
41406+ atomic_read_unchecked(&dev->cpu_kcycles_used));
41407 }
41408
41409 static ssize_t edid_show(
41410@@ -1387,10 +1387,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
41411 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41412 struct dlfb_data *dev = fb_info->par;
41413
41414- atomic_set(&dev->bytes_rendered, 0);
41415- atomic_set(&dev->bytes_identical, 0);
41416- atomic_set(&dev->bytes_sent, 0);
41417- atomic_set(&dev->cpu_kcycles_used, 0);
41418+ atomic_set_unchecked(&dev->bytes_rendered, 0);
41419+ atomic_set_unchecked(&dev->bytes_identical, 0);
41420+ atomic_set_unchecked(&dev->bytes_sent, 0);
41421+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
41422
41423 return count;
41424 }
41425diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
41426index 7f8472c..9842e87 100644
41427--- a/drivers/video/uvesafb.c
41428+++ b/drivers/video/uvesafb.c
41429@@ -19,6 +19,7 @@
41430 #include <linux/io.h>
41431 #include <linux/mutex.h>
41432 #include <linux/slab.h>
41433+#include <linux/moduleloader.h>
41434 #include <video/edid.h>
41435 #include <video/uvesafb.h>
41436 #ifdef CONFIG_X86
41437@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
41438 NULL,
41439 };
41440
41441- return call_usermodehelper(v86d_path, argv, envp, 1);
41442+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
41443 }
41444
41445 /*
41446@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
41447 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
41448 par->pmi_setpal = par->ypan = 0;
41449 } else {
41450+
41451+#ifdef CONFIG_PAX_KERNEXEC
41452+#ifdef CONFIG_MODULES
41453+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
41454+#endif
41455+ if (!par->pmi_code) {
41456+ par->pmi_setpal = par->ypan = 0;
41457+ return 0;
41458+ }
41459+#endif
41460+
41461 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
41462 + task->t.regs.edi);
41463+
41464+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41465+ pax_open_kernel();
41466+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
41467+ pax_close_kernel();
41468+
41469+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
41470+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
41471+#else
41472 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
41473 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
41474+#endif
41475+
41476 printk(KERN_INFO "uvesafb: protected mode interface info at "
41477 "%04x:%04x\n",
41478 (u16)task->t.regs.es, (u16)task->t.regs.edi);
41479@@ -1821,6 +1844,11 @@ out:
41480 if (par->vbe_modes)
41481 kfree(par->vbe_modes);
41482
41483+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41484+ if (par->pmi_code)
41485+ module_free_exec(NULL, par->pmi_code);
41486+#endif
41487+
41488 framebuffer_release(info);
41489 return err;
41490 }
41491@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platform_device *dev)
41492 kfree(par->vbe_state_orig);
41493 if (par->vbe_state_saved)
41494 kfree(par->vbe_state_saved);
41495+
41496+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41497+ if (par->pmi_code)
41498+ module_free_exec(NULL, par->pmi_code);
41499+#endif
41500+
41501 }
41502
41503 framebuffer_release(info);
41504diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
41505index 501b340..86bd4cf 100644
41506--- a/drivers/video/vesafb.c
41507+++ b/drivers/video/vesafb.c
41508@@ -9,6 +9,7 @@
41509 */
41510
41511 #include <linux/module.h>
41512+#include <linux/moduleloader.h>
41513 #include <linux/kernel.h>
41514 #include <linux/errno.h>
41515 #include <linux/string.h>
41516@@ -52,8 +53,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
41517 static int vram_total __initdata; /* Set total amount of memory */
41518 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
41519 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
41520-static void (*pmi_start)(void) __read_mostly;
41521-static void (*pmi_pal) (void) __read_mostly;
41522+static void (*pmi_start)(void) __read_only;
41523+static void (*pmi_pal) (void) __read_only;
41524 static int depth __read_mostly;
41525 static int vga_compat __read_mostly;
41526 /* --------------------------------------------------------------------- */
41527@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
41528 unsigned int size_vmode;
41529 unsigned int size_remap;
41530 unsigned int size_total;
41531+ void *pmi_code = NULL;
41532
41533 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
41534 return -ENODEV;
41535@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
41536 size_remap = size_total;
41537 vesafb_fix.smem_len = size_remap;
41538
41539-#ifndef __i386__
41540- screen_info.vesapm_seg = 0;
41541-#endif
41542-
41543 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
41544 printk(KERN_WARNING
41545 "vesafb: cannot reserve video memory at 0x%lx\n",
41546@@ -307,9 +305,21 @@ static int __init vesafb_probe(struct platform_device *dev)
41547 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
41548 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
41549
41550+#ifdef __i386__
41551+
41552+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41553+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
41554+ if (!pmi_code)
41555+#elif !defined(CONFIG_PAX_KERNEXEC)
41556+ if (0)
41557+#endif
41558+
41559+#endif
41560+ screen_info.vesapm_seg = 0;
41561+
41562 if (screen_info.vesapm_seg) {
41563- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
41564- screen_info.vesapm_seg,screen_info.vesapm_off);
41565+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
41566+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
41567 }
41568
41569 if (screen_info.vesapm_seg < 0xc000)
41570@@ -317,9 +327,25 @@ static int __init vesafb_probe(struct platform_device *dev)
41571
41572 if (ypan || pmi_setpal) {
41573 unsigned short *pmi_base;
41574+
41575 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
41576- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
41577- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
41578+
41579+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41580+ pax_open_kernel();
41581+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
41582+#else
41583+ pmi_code = pmi_base;
41584+#endif
41585+
41586+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
41587+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
41588+
41589+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41590+ pmi_start = ktva_ktla(pmi_start);
41591+ pmi_pal = ktva_ktla(pmi_pal);
41592+ pax_close_kernel();
41593+#endif
41594+
41595 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
41596 if (pmi_base[3]) {
41597 printk(KERN_INFO "vesafb: pmi: ports = ");
41598@@ -488,6 +514,11 @@ static int __init vesafb_probe(struct platform_device *dev)
41599 info->node, info->fix.id);
41600 return 0;
41601 err:
41602+
41603+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41604+ module_free_exec(NULL, pmi_code);
41605+#endif
41606+
41607 if (info->screen_base)
41608 iounmap(info->screen_base);
41609 framebuffer_release(info);
41610diff --git a/drivers/video/via/via_clock.h b/drivers/video/via/via_clock.h
41611index 88714ae..16c2e11 100644
41612--- a/drivers/video/via/via_clock.h
41613+++ b/drivers/video/via/via_clock.h
41614@@ -56,7 +56,7 @@ struct via_clock {
41615
41616 void (*set_engine_pll_state)(u8 state);
41617 void (*set_engine_pll)(struct via_pll_config config);
41618-};
41619+} __no_const;
41620
41621
41622 static inline u32 get_pll_internal_frequency(u32 ref_freq,
41623diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
41624index e058ace..2424d93 100644
41625--- a/drivers/virtio/virtio_balloon.c
41626+++ b/drivers/virtio/virtio_balloon.c
41627@@ -174,6 +174,8 @@ static void update_balloon_stats(struct virtio_balloon *vb)
41628 struct sysinfo i;
41629 int idx = 0;
41630
41631+ pax_track_stack();
41632+
41633 all_vm_events(events);
41634 si_meminfo(&i);
41635
41636diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
41637index e56c934..fc22f4b 100644
41638--- a/drivers/xen/xen-pciback/conf_space.h
41639+++ b/drivers/xen/xen-pciback/conf_space.h
41640@@ -44,15 +44,15 @@ struct config_field {
41641 struct {
41642 conf_dword_write write;
41643 conf_dword_read read;
41644- } dw;
41645+ } __no_const dw;
41646 struct {
41647 conf_word_write write;
41648 conf_word_read read;
41649- } w;
41650+ } __no_const w;
41651 struct {
41652 conf_byte_write write;
41653 conf_byte_read read;
41654- } b;
41655+ } __no_const b;
41656 } u;
41657 struct list_head list;
41658 };
41659diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
41660index e3c03db..93b0172 100644
41661--- a/fs/9p/vfs_inode.c
41662+++ b/fs/9p/vfs_inode.c
41663@@ -1288,7 +1288,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
41664 void
41665 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41666 {
41667- char *s = nd_get_link(nd);
41668+ const char *s = nd_get_link(nd);
41669
41670 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
41671 IS_ERR(s) ? "<error>" : s);
41672diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
41673index 79e2ca7..5828ad1 100644
41674--- a/fs/Kconfig.binfmt
41675+++ b/fs/Kconfig.binfmt
41676@@ -86,7 +86,7 @@ config HAVE_AOUT
41677
41678 config BINFMT_AOUT
41679 tristate "Kernel support for a.out and ECOFF binaries"
41680- depends on HAVE_AOUT
41681+ depends on HAVE_AOUT && BROKEN
41682 ---help---
41683 A.out (Assembler.OUTput) is a set of formats for libraries and
41684 executables used in the earliest versions of UNIX. Linux used
41685diff --git a/fs/aio.c b/fs/aio.c
41686index e29ec48..f083e5e 100644
41687--- a/fs/aio.c
41688+++ b/fs/aio.c
41689@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
41690 size += sizeof(struct io_event) * nr_events;
41691 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
41692
41693- if (nr_pages < 0)
41694+ if (nr_pages <= 0)
41695 return -EINVAL;
41696
41697 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
41698@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ctx,
41699 struct aio_timeout to;
41700 int retry = 0;
41701
41702+ pax_track_stack();
41703+
41704 /* needed to zero any padding within an entry (there shouldn't be
41705 * any, but C is fun!
41706 */
41707@@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
41708 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
41709 {
41710 ssize_t ret;
41711+ struct iovec iovstack;
41712
41713 #ifdef CONFIG_COMPAT
41714 if (compat)
41715 ret = compat_rw_copy_check_uvector(type,
41716 (struct compat_iovec __user *)kiocb->ki_buf,
41717- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
41718+ kiocb->ki_nbytes, 1, &iovstack,
41719 &kiocb->ki_iovec);
41720 else
41721 #endif
41722 ret = rw_copy_check_uvector(type,
41723 (struct iovec __user *)kiocb->ki_buf,
41724- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
41725+ kiocb->ki_nbytes, 1, &iovstack,
41726 &kiocb->ki_iovec);
41727 if (ret < 0)
41728 goto out;
41729
41730+ if (kiocb->ki_iovec == &iovstack) {
41731+ kiocb->ki_inline_vec = iovstack;
41732+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
41733+ }
41734 kiocb->ki_nr_segs = kiocb->ki_nbytes;
41735 kiocb->ki_cur_seg = 0;
41736 /* ki_nbytes/left now reflect bytes instead of segs */
41737diff --git a/fs/attr.c b/fs/attr.c
41738index 538e279..046cc6d 100644
41739--- a/fs/attr.c
41740+++ b/fs/attr.c
41741@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
41742 unsigned long limit;
41743
41744 limit = rlimit(RLIMIT_FSIZE);
41745+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
41746 if (limit != RLIM_INFINITY && offset > limit)
41747 goto out_sig;
41748 if (offset > inode->i_sb->s_maxbytes)
41749diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
41750index e1fbdee..cd5ea56 100644
41751--- a/fs/autofs4/waitq.c
41752+++ b/fs/autofs4/waitq.c
41753@@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
41754 {
41755 unsigned long sigpipe, flags;
41756 mm_segment_t fs;
41757- const char *data = (const char *)addr;
41758+ const char __user *data = (const char __force_user *)addr;
41759 ssize_t wr = 0;
41760
41761 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
41762diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
41763index 720d885..012e7f0 100644
41764--- a/fs/befs/linuxvfs.c
41765+++ b/fs/befs/linuxvfs.c
41766@@ -503,7 +503,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41767 {
41768 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
41769 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
41770- char *link = nd_get_link(nd);
41771+ const char *link = nd_get_link(nd);
41772 if (!IS_ERR(link))
41773 kfree(link);
41774 }
41775diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
41776index a6395bd..a5b24c4 100644
41777--- a/fs/binfmt_aout.c
41778+++ b/fs/binfmt_aout.c
41779@@ -16,6 +16,7 @@
41780 #include <linux/string.h>
41781 #include <linux/fs.h>
41782 #include <linux/file.h>
41783+#include <linux/security.h>
41784 #include <linux/stat.h>
41785 #include <linux/fcntl.h>
41786 #include <linux/ptrace.h>
41787@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredump_params *cprm)
41788 #endif
41789 # define START_STACK(u) ((void __user *)u.start_stack)
41790
41791+ memset(&dump, 0, sizeof(dump));
41792+
41793 fs = get_fs();
41794 set_fs(KERNEL_DS);
41795 has_dumped = 1;
41796@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredump_params *cprm)
41797
41798 /* If the size of the dump file exceeds the rlimit, then see what would happen
41799 if we wrote the stack, but not the data area. */
41800+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
41801 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
41802 dump.u_dsize = 0;
41803
41804 /* Make sure we have enough room to write the stack and data areas. */
41805+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
41806 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
41807 dump.u_ssize = 0;
41808
41809@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41810 rlim = rlimit(RLIMIT_DATA);
41811 if (rlim >= RLIM_INFINITY)
41812 rlim = ~0;
41813+
41814+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
41815 if (ex.a_data + ex.a_bss > rlim)
41816 return -ENOMEM;
41817
41818@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41819 install_exec_creds(bprm);
41820 current->flags &= ~PF_FORKNOEXEC;
41821
41822+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
41823+ current->mm->pax_flags = 0UL;
41824+#endif
41825+
41826+#ifdef CONFIG_PAX_PAGEEXEC
41827+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
41828+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
41829+
41830+#ifdef CONFIG_PAX_EMUTRAMP
41831+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
41832+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
41833+#endif
41834+
41835+#ifdef CONFIG_PAX_MPROTECT
41836+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
41837+ current->mm->pax_flags |= MF_PAX_MPROTECT;
41838+#endif
41839+
41840+ }
41841+#endif
41842+
41843 if (N_MAGIC(ex) == OMAGIC) {
41844 unsigned long text_addr, map_size;
41845 loff_t pos;
41846@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41847
41848 down_write(&current->mm->mmap_sem);
41849 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
41850- PROT_READ | PROT_WRITE | PROT_EXEC,
41851+ PROT_READ | PROT_WRITE,
41852 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
41853 fd_offset + ex.a_text);
41854 up_write(&current->mm->mmap_sem);
41855diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
41856index 21ac5ee..171b1d0 100644
41857--- a/fs/binfmt_elf.c
41858+++ b/fs/binfmt_elf.c
41859@@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump_params *cprm);
41860 #define elf_core_dump NULL
41861 #endif
41862
41863+#ifdef CONFIG_PAX_MPROTECT
41864+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
41865+#endif
41866+
41867 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
41868 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
41869 #else
41870@@ -70,6 +74,11 @@ static struct linux_binfmt elf_format = {
41871 .load_binary = load_elf_binary,
41872 .load_shlib = load_elf_library,
41873 .core_dump = elf_core_dump,
41874+
41875+#ifdef CONFIG_PAX_MPROTECT
41876+ .handle_mprotect= elf_handle_mprotect,
41877+#endif
41878+
41879 .min_coredump = ELF_EXEC_PAGESIZE,
41880 };
41881
41882@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = {
41883
41884 static int set_brk(unsigned long start, unsigned long end)
41885 {
41886+ unsigned long e = end;
41887+
41888 start = ELF_PAGEALIGN(start);
41889 end = ELF_PAGEALIGN(end);
41890 if (end > start) {
41891@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, unsigned long end)
41892 if (BAD_ADDR(addr))
41893 return addr;
41894 }
41895- current->mm->start_brk = current->mm->brk = end;
41896+ current->mm->start_brk = current->mm->brk = e;
41897 return 0;
41898 }
41899
41900@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41901 elf_addr_t __user *u_rand_bytes;
41902 const char *k_platform = ELF_PLATFORM;
41903 const char *k_base_platform = ELF_BASE_PLATFORM;
41904- unsigned char k_rand_bytes[16];
41905+ u32 k_rand_bytes[4];
41906 int items;
41907 elf_addr_t *elf_info;
41908 int ei_index = 0;
41909 const struct cred *cred = current_cred();
41910 struct vm_area_struct *vma;
41911+ unsigned long saved_auxv[AT_VECTOR_SIZE];
41912+
41913+ pax_track_stack();
41914
41915 /*
41916 * In some cases (e.g. Hyper-Threading), we want to avoid L1
41917@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41918 * Generate 16 random bytes for userspace PRNG seeding.
41919 */
41920 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
41921- u_rand_bytes = (elf_addr_t __user *)
41922- STACK_ALLOC(p, sizeof(k_rand_bytes));
41923+ srandom32(k_rand_bytes[0] ^ random32());
41924+ srandom32(k_rand_bytes[1] ^ random32());
41925+ srandom32(k_rand_bytes[2] ^ random32());
41926+ srandom32(k_rand_bytes[3] ^ random32());
41927+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
41928+ u_rand_bytes = (elf_addr_t __user *) p;
41929 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
41930 return -EFAULT;
41931
41932@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41933 return -EFAULT;
41934 current->mm->env_end = p;
41935
41936+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
41937+
41938 /* Put the elf_info on the stack in the right place. */
41939 sp = (elf_addr_t __user *)envp + 1;
41940- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
41941+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
41942 return -EFAULT;
41943 return 0;
41944 }
41945@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
41946 {
41947 struct elf_phdr *elf_phdata;
41948 struct elf_phdr *eppnt;
41949- unsigned long load_addr = 0;
41950+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
41951 int load_addr_set = 0;
41952 unsigned long last_bss = 0, elf_bss = 0;
41953- unsigned long error = ~0UL;
41954+ unsigned long error = -EINVAL;
41955 unsigned long total_size;
41956 int retval, i, size;
41957
41958@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
41959 goto out_close;
41960 }
41961
41962+#ifdef CONFIG_PAX_SEGMEXEC
41963+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
41964+ pax_task_size = SEGMEXEC_TASK_SIZE;
41965+#endif
41966+
41967 eppnt = elf_phdata;
41968 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
41969 if (eppnt->p_type == PT_LOAD) {
41970@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
41971 k = load_addr + eppnt->p_vaddr;
41972 if (BAD_ADDR(k) ||
41973 eppnt->p_filesz > eppnt->p_memsz ||
41974- eppnt->p_memsz > TASK_SIZE ||
41975- TASK_SIZE - eppnt->p_memsz < k) {
41976+ eppnt->p_memsz > pax_task_size ||
41977+ pax_task_size - eppnt->p_memsz < k) {
41978 error = -ENOMEM;
41979 goto out_close;
41980 }
41981@@ -528,6 +553,193 @@ out:
41982 return error;
41983 }
41984
41985+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
41986+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
41987+{
41988+ unsigned long pax_flags = 0UL;
41989+
41990+#ifdef CONFIG_PAX_PAGEEXEC
41991+ if (elf_phdata->p_flags & PF_PAGEEXEC)
41992+ pax_flags |= MF_PAX_PAGEEXEC;
41993+#endif
41994+
41995+#ifdef CONFIG_PAX_SEGMEXEC
41996+ if (elf_phdata->p_flags & PF_SEGMEXEC)
41997+ pax_flags |= MF_PAX_SEGMEXEC;
41998+#endif
41999+
42000+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42001+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42002+ if ((__supported_pte_mask & _PAGE_NX))
42003+ pax_flags &= ~MF_PAX_SEGMEXEC;
42004+ else
42005+ pax_flags &= ~MF_PAX_PAGEEXEC;
42006+ }
42007+#endif
42008+
42009+#ifdef CONFIG_PAX_EMUTRAMP
42010+ if (elf_phdata->p_flags & PF_EMUTRAMP)
42011+ pax_flags |= MF_PAX_EMUTRAMP;
42012+#endif
42013+
42014+#ifdef CONFIG_PAX_MPROTECT
42015+ if (elf_phdata->p_flags & PF_MPROTECT)
42016+ pax_flags |= MF_PAX_MPROTECT;
42017+#endif
42018+
42019+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42020+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
42021+ pax_flags |= MF_PAX_RANDMMAP;
42022+#endif
42023+
42024+ return pax_flags;
42025+}
42026+#endif
42027+
42028+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42029+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
42030+{
42031+ unsigned long pax_flags = 0UL;
42032+
42033+#ifdef CONFIG_PAX_PAGEEXEC
42034+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
42035+ pax_flags |= MF_PAX_PAGEEXEC;
42036+#endif
42037+
42038+#ifdef CONFIG_PAX_SEGMEXEC
42039+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
42040+ pax_flags |= MF_PAX_SEGMEXEC;
42041+#endif
42042+
42043+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42044+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42045+ if ((__supported_pte_mask & _PAGE_NX))
42046+ pax_flags &= ~MF_PAX_SEGMEXEC;
42047+ else
42048+ pax_flags &= ~MF_PAX_PAGEEXEC;
42049+ }
42050+#endif
42051+
42052+#ifdef CONFIG_PAX_EMUTRAMP
42053+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
42054+ pax_flags |= MF_PAX_EMUTRAMP;
42055+#endif
42056+
42057+#ifdef CONFIG_PAX_MPROTECT
42058+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
42059+ pax_flags |= MF_PAX_MPROTECT;
42060+#endif
42061+
42062+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42063+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
42064+ pax_flags |= MF_PAX_RANDMMAP;
42065+#endif
42066+
42067+ return pax_flags;
42068+}
42069+#endif
42070+
42071+#ifdef CONFIG_PAX_EI_PAX
42072+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
42073+{
42074+ unsigned long pax_flags = 0UL;
42075+
42076+#ifdef CONFIG_PAX_PAGEEXEC
42077+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
42078+ pax_flags |= MF_PAX_PAGEEXEC;
42079+#endif
42080+
42081+#ifdef CONFIG_PAX_SEGMEXEC
42082+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
42083+ pax_flags |= MF_PAX_SEGMEXEC;
42084+#endif
42085+
42086+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42087+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42088+ if ((__supported_pte_mask & _PAGE_NX))
42089+ pax_flags &= ~MF_PAX_SEGMEXEC;
42090+ else
42091+ pax_flags &= ~MF_PAX_PAGEEXEC;
42092+ }
42093+#endif
42094+
42095+#ifdef CONFIG_PAX_EMUTRAMP
42096+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
42097+ pax_flags |= MF_PAX_EMUTRAMP;
42098+#endif
42099+
42100+#ifdef CONFIG_PAX_MPROTECT
42101+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
42102+ pax_flags |= MF_PAX_MPROTECT;
42103+#endif
42104+
42105+#ifdef CONFIG_PAX_ASLR
42106+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
42107+ pax_flags |= MF_PAX_RANDMMAP;
42108+#endif
42109+
42110+ return pax_flags;
42111+}
42112+#endif
42113+
42114+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42115+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
42116+{
42117+ unsigned long pax_flags = 0UL;
42118+
42119+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42120+ unsigned long i;
42121+ int found_flags = 0;
42122+#endif
42123+
42124+#ifdef CONFIG_PAX_EI_PAX
42125+ pax_flags = pax_parse_ei_pax(elf_ex);
42126+#endif
42127+
42128+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42129+ for (i = 0UL; i < elf_ex->e_phnum; i++)
42130+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
42131+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
42132+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
42133+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
42134+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
42135+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
42136+ return -EINVAL;
42137+
42138+#ifdef CONFIG_PAX_SOFTMODE
42139+ if (pax_softmode)
42140+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
42141+ else
42142+#endif
42143+
42144+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
42145+ found_flags = 1;
42146+ break;
42147+ }
42148+#endif
42149+
42150+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
42151+ if (found_flags == 0) {
42152+ struct elf_phdr phdr;
42153+ memset(&phdr, 0, sizeof(phdr));
42154+ phdr.p_flags = PF_NOEMUTRAMP;
42155+#ifdef CONFIG_PAX_SOFTMODE
42156+ if (pax_softmode)
42157+ pax_flags = pax_parse_softmode(&phdr);
42158+ else
42159+#endif
42160+ pax_flags = pax_parse_hardmode(&phdr);
42161+ }
42162+#endif
42163+
42164+ if (0 > pax_check_flags(&pax_flags))
42165+ return -EINVAL;
42166+
42167+ current->mm->pax_flags = pax_flags;
42168+ return 0;
42169+}
42170+#endif
42171+
42172 /*
42173 * These are the functions used to load ELF style executables and shared
42174 * libraries. There is no binary dependent code anywhere else.
42175@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
42176 {
42177 unsigned int random_variable = 0;
42178
42179+#ifdef CONFIG_PAX_RANDUSTACK
42180+ if (randomize_va_space)
42181+ return stack_top - current->mm->delta_stack;
42182+#endif
42183+
42184 if ((current->flags & PF_RANDOMIZE) &&
42185 !(current->personality & ADDR_NO_RANDOMIZE)) {
42186 random_variable = get_random_int() & STACK_RND_MASK;
42187@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42188 unsigned long load_addr = 0, load_bias = 0;
42189 int load_addr_set = 0;
42190 char * elf_interpreter = NULL;
42191- unsigned long error;
42192+ unsigned long error = 0;
42193 struct elf_phdr *elf_ppnt, *elf_phdata;
42194 unsigned long elf_bss, elf_brk;
42195 int retval, i;
42196@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42197 unsigned long start_code, end_code, start_data, end_data;
42198 unsigned long reloc_func_desc __maybe_unused = 0;
42199 int executable_stack = EXSTACK_DEFAULT;
42200- unsigned long def_flags = 0;
42201 struct {
42202 struct elfhdr elf_ex;
42203 struct elfhdr interp_elf_ex;
42204 } *loc;
42205+ unsigned long pax_task_size = TASK_SIZE;
42206
42207 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
42208 if (!loc) {
42209@@ -713,11 +930,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42210
42211 /* OK, This is the point of no return */
42212 current->flags &= ~PF_FORKNOEXEC;
42213- current->mm->def_flags = def_flags;
42214+
42215+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42216+ current->mm->pax_flags = 0UL;
42217+#endif
42218+
42219+#ifdef CONFIG_PAX_DLRESOLVE
42220+ current->mm->call_dl_resolve = 0UL;
42221+#endif
42222+
42223+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
42224+ current->mm->call_syscall = 0UL;
42225+#endif
42226+
42227+#ifdef CONFIG_PAX_ASLR
42228+ current->mm->delta_mmap = 0UL;
42229+ current->mm->delta_stack = 0UL;
42230+#endif
42231+
42232+ current->mm->def_flags = 0;
42233+
42234+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42235+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
42236+ send_sig(SIGKILL, current, 0);
42237+ goto out_free_dentry;
42238+ }
42239+#endif
42240+
42241+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
42242+ pax_set_initial_flags(bprm);
42243+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
42244+ if (pax_set_initial_flags_func)
42245+ (pax_set_initial_flags_func)(bprm);
42246+#endif
42247+
42248+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
42249+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
42250+ current->mm->context.user_cs_limit = PAGE_SIZE;
42251+ current->mm->def_flags |= VM_PAGEEXEC;
42252+ }
42253+#endif
42254+
42255+#ifdef CONFIG_PAX_SEGMEXEC
42256+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
42257+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
42258+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
42259+ pax_task_size = SEGMEXEC_TASK_SIZE;
42260+ current->mm->def_flags |= VM_NOHUGEPAGE;
42261+ }
42262+#endif
42263+
42264+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
42265+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42266+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
42267+ put_cpu();
42268+ }
42269+#endif
42270
42271 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
42272 may depend on the personality. */
42273 SET_PERSONALITY(loc->elf_ex);
42274+
42275+#ifdef CONFIG_PAX_ASLR
42276+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
42277+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
42278+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
42279+ }
42280+#endif
42281+
42282+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
42283+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42284+ executable_stack = EXSTACK_DISABLE_X;
42285+ current->personality &= ~READ_IMPLIES_EXEC;
42286+ } else
42287+#endif
42288+
42289 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
42290 current->personality |= READ_IMPLIES_EXEC;
42291
42292@@ -808,6 +1095,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42293 #else
42294 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
42295 #endif
42296+
42297+#ifdef CONFIG_PAX_RANDMMAP
42298+ /* PaX: randomize base address at the default exe base if requested */
42299+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
42300+#ifdef CONFIG_SPARC64
42301+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
42302+#else
42303+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
42304+#endif
42305+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
42306+ elf_flags |= MAP_FIXED;
42307+ }
42308+#endif
42309+
42310 }
42311
42312 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
42313@@ -840,9 +1141,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42314 * allowed task size. Note that p_filesz must always be
42315 * <= p_memsz so it is only necessary to check p_memsz.
42316 */
42317- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42318- elf_ppnt->p_memsz > TASK_SIZE ||
42319- TASK_SIZE - elf_ppnt->p_memsz < k) {
42320+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42321+ elf_ppnt->p_memsz > pax_task_size ||
42322+ pax_task_size - elf_ppnt->p_memsz < k) {
42323 /* set_brk can never work. Avoid overflows. */
42324 send_sig(SIGKILL, current, 0);
42325 retval = -EINVAL;
42326@@ -870,6 +1171,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42327 start_data += load_bias;
42328 end_data += load_bias;
42329
42330+#ifdef CONFIG_PAX_RANDMMAP
42331+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
42332+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
42333+#endif
42334+
42335 /* Calling set_brk effectively mmaps the pages that we need
42336 * for the bss and break sections. We must do this before
42337 * mapping in the interpreter, to make sure it doesn't wind
42338@@ -881,9 +1187,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42339 goto out_free_dentry;
42340 }
42341 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
42342- send_sig(SIGSEGV, current, 0);
42343- retval = -EFAULT; /* Nobody gets to see this, but.. */
42344- goto out_free_dentry;
42345+ /*
42346+ * This bss-zeroing can fail if the ELF
42347+ * file specifies odd protections. So
42348+ * we don't check the return value
42349+ */
42350 }
42351
42352 if (elf_interpreter) {
42353@@ -1098,7 +1406,7 @@ out:
42354 * Decide what to dump of a segment, part, all or none.
42355 */
42356 static unsigned long vma_dump_size(struct vm_area_struct *vma,
42357- unsigned long mm_flags)
42358+ unsigned long mm_flags, long signr)
42359 {
42360 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
42361
42362@@ -1132,7 +1440,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
42363 if (vma->vm_file == NULL)
42364 return 0;
42365
42366- if (FILTER(MAPPED_PRIVATE))
42367+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
42368 goto whole;
42369
42370 /*
42371@@ -1354,9 +1662,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
42372 {
42373 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
42374 int i = 0;
42375- do
42376+ do {
42377 i += 2;
42378- while (auxv[i - 2] != AT_NULL);
42379+ } while (auxv[i - 2] != AT_NULL);
42380 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
42381 }
42382
42383@@ -1862,14 +2170,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
42384 }
42385
42386 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
42387- unsigned long mm_flags)
42388+ struct coredump_params *cprm)
42389 {
42390 struct vm_area_struct *vma;
42391 size_t size = 0;
42392
42393 for (vma = first_vma(current, gate_vma); vma != NULL;
42394 vma = next_vma(vma, gate_vma))
42395- size += vma_dump_size(vma, mm_flags);
42396+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42397 return size;
42398 }
42399
42400@@ -1963,7 +2271,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42401
42402 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
42403
42404- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
42405+ offset += elf_core_vma_data_size(gate_vma, cprm);
42406 offset += elf_core_extra_data_size();
42407 e_shoff = offset;
42408
42409@@ -1977,10 +2285,12 @@ static int elf_core_dump(struct coredump_params *cprm)
42410 offset = dataoff;
42411
42412 size += sizeof(*elf);
42413+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42414 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
42415 goto end_coredump;
42416
42417 size += sizeof(*phdr4note);
42418+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42419 if (size > cprm->limit
42420 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
42421 goto end_coredump;
42422@@ -1994,7 +2304,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42423 phdr.p_offset = offset;
42424 phdr.p_vaddr = vma->vm_start;
42425 phdr.p_paddr = 0;
42426- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
42427+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42428 phdr.p_memsz = vma->vm_end - vma->vm_start;
42429 offset += phdr.p_filesz;
42430 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
42431@@ -2005,6 +2315,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42432 phdr.p_align = ELF_EXEC_PAGESIZE;
42433
42434 size += sizeof(phdr);
42435+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42436 if (size > cprm->limit
42437 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
42438 goto end_coredump;
42439@@ -2029,7 +2340,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42440 unsigned long addr;
42441 unsigned long end;
42442
42443- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
42444+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42445
42446 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
42447 struct page *page;
42448@@ -2038,6 +2349,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42449 page = get_dump_page(addr);
42450 if (page) {
42451 void *kaddr = kmap(page);
42452+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
42453 stop = ((size += PAGE_SIZE) > cprm->limit) ||
42454 !dump_write(cprm->file, kaddr,
42455 PAGE_SIZE);
42456@@ -2055,6 +2367,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42457
42458 if (e_phnum == PN_XNUM) {
42459 size += sizeof(*shdr4extnum);
42460+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42461 if (size > cprm->limit
42462 || !dump_write(cprm->file, shdr4extnum,
42463 sizeof(*shdr4extnum)))
42464@@ -2075,6 +2388,97 @@ out:
42465
42466 #endif /* CONFIG_ELF_CORE */
42467
42468+#ifdef CONFIG_PAX_MPROTECT
42469+/* PaX: non-PIC ELF libraries need relocations on their executable segments
42470+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
42471+ * we'll remove VM_MAYWRITE for good on RELRO segments.
42472+ *
42473+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
42474+ * basis because we want to allow the common case and not the special ones.
42475+ */
42476+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
42477+{
42478+ struct elfhdr elf_h;
42479+ struct elf_phdr elf_p;
42480+ unsigned long i;
42481+ unsigned long oldflags;
42482+ bool is_textrel_rw, is_textrel_rx, is_relro;
42483+
42484+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
42485+ return;
42486+
42487+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
42488+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
42489+
42490+#ifdef CONFIG_PAX_ELFRELOCS
42491+ /* possible TEXTREL */
42492+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
42493+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
42494+#else
42495+ is_textrel_rw = false;
42496+ is_textrel_rx = false;
42497+#endif
42498+
42499+ /* possible RELRO */
42500+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
42501+
42502+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
42503+ return;
42504+
42505+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
42506+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
42507+
42508+#ifdef CONFIG_PAX_ETEXECRELOCS
42509+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42510+#else
42511+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
42512+#endif
42513+
42514+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42515+ !elf_check_arch(&elf_h) ||
42516+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
42517+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
42518+ return;
42519+
42520+ for (i = 0UL; i < elf_h.e_phnum; i++) {
42521+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
42522+ return;
42523+ switch (elf_p.p_type) {
42524+ case PT_DYNAMIC:
42525+ if (!is_textrel_rw && !is_textrel_rx)
42526+ continue;
42527+ i = 0UL;
42528+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
42529+ elf_dyn dyn;
42530+
42531+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
42532+ return;
42533+ if (dyn.d_tag == DT_NULL)
42534+ return;
42535+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
42536+ gr_log_textrel(vma);
42537+ if (is_textrel_rw)
42538+ vma->vm_flags |= VM_MAYWRITE;
42539+ else
42540+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
42541+ vma->vm_flags &= ~VM_MAYWRITE;
42542+ return;
42543+ }
42544+ i++;
42545+ }
42546+ return;
42547+
42548+ case PT_GNU_RELRO:
42549+ if (!is_relro)
42550+ continue;
42551+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
42552+ vma->vm_flags &= ~VM_MAYWRITE;
42553+ return;
42554+ }
42555+ }
42556+}
42557+#endif
42558+
42559 static int __init init_elf_binfmt(void)
42560 {
42561 return register_binfmt(&elf_format);
42562diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
42563index 1bffbe0..c8c283e 100644
42564--- a/fs/binfmt_flat.c
42565+++ b/fs/binfmt_flat.c
42566@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_binprm * bprm,
42567 realdatastart = (unsigned long) -ENOMEM;
42568 printk("Unable to allocate RAM for process data, errno %d\n",
42569 (int)-realdatastart);
42570+ down_write(&current->mm->mmap_sem);
42571 do_munmap(current->mm, textpos, text_len);
42572+ up_write(&current->mm->mmap_sem);
42573 ret = realdatastart;
42574 goto err;
42575 }
42576@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_binprm * bprm,
42577 }
42578 if (IS_ERR_VALUE(result)) {
42579 printk("Unable to read data+bss, errno %d\n", (int)-result);
42580+ down_write(&current->mm->mmap_sem);
42581 do_munmap(current->mm, textpos, text_len);
42582 do_munmap(current->mm, realdatastart, len);
42583+ up_write(&current->mm->mmap_sem);
42584 ret = result;
42585 goto err;
42586 }
42587@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_binprm * bprm,
42588 }
42589 if (IS_ERR_VALUE(result)) {
42590 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
42591+ down_write(&current->mm->mmap_sem);
42592 do_munmap(current->mm, textpos, text_len + data_len + extra +
42593 MAX_SHARED_LIBS * sizeof(unsigned long));
42594+ up_write(&current->mm->mmap_sem);
42595 ret = result;
42596 goto err;
42597 }
42598diff --git a/fs/bio.c b/fs/bio.c
42599index 9bfade8..782f3b9 100644
42600--- a/fs/bio.c
42601+++ b/fs/bio.c
42602@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
42603 const int read = bio_data_dir(bio) == READ;
42604 struct bio_map_data *bmd = bio->bi_private;
42605 int i;
42606- char *p = bmd->sgvecs[0].iov_base;
42607+ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
42608
42609 __bio_for_each_segment(bvec, bio, i, 0) {
42610 char *addr = page_address(bvec->bv_page);
42611diff --git a/fs/block_dev.c b/fs/block_dev.c
42612index 1c44b8d..e2507b4 100644
42613--- a/fs/block_dev.c
42614+++ b/fs/block_dev.c
42615@@ -681,7 +681,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
42616 else if (bdev->bd_contains == bdev)
42617 return true; /* is a whole device which isn't held */
42618
42619- else if (whole->bd_holder == bd_may_claim)
42620+ else if (whole->bd_holder == (void *)bd_may_claim)
42621 return true; /* is a partition of a device that is being partitioned */
42622 else if (whole->bd_holder != NULL)
42623 return false; /* is a partition of a held device */
42624diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
42625index 011cab3..9ace713 100644
42626--- a/fs/btrfs/ctree.c
42627+++ b/fs/btrfs/ctree.c
42628@@ -488,9 +488,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
42629 free_extent_buffer(buf);
42630 add_root_to_dirty_list(root);
42631 } else {
42632- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
42633- parent_start = parent->start;
42634- else
42635+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
42636+ if (parent)
42637+ parent_start = parent->start;
42638+ else
42639+ parent_start = 0;
42640+ } else
42641 parent_start = 0;
42642
42643 WARN_ON(trans->transid != btrfs_header_generation(parent));
42644diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
42645index b2d004a..6bb543d 100644
42646--- a/fs/btrfs/inode.c
42647+++ b/fs/btrfs/inode.c
42648@@ -6922,7 +6922,7 @@ fail:
42649 return -ENOMEM;
42650 }
42651
42652-static int btrfs_getattr(struct vfsmount *mnt,
42653+int btrfs_getattr(struct vfsmount *mnt,
42654 struct dentry *dentry, struct kstat *stat)
42655 {
42656 struct inode *inode = dentry->d_inode;
42657@@ -6934,6 +6934,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
42658 return 0;
42659 }
42660
42661+EXPORT_SYMBOL(btrfs_getattr);
42662+
42663+dev_t get_btrfs_dev_from_inode(struct inode *inode)
42664+{
42665+ return BTRFS_I(inode)->root->anon_dev;
42666+}
42667+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
42668+
42669 /*
42670 * If a file is moved, it will inherit the cow and compression flags of the new
42671 * directory.
42672diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
42673index dae5dfe..6aa01b1 100644
42674--- a/fs/btrfs/ioctl.c
42675+++ b/fs/btrfs/ioctl.c
42676@@ -2704,9 +2704,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
42677 for (i = 0; i < num_types; i++) {
42678 struct btrfs_space_info *tmp;
42679
42680+ /* Don't copy in more than we allocated */
42681 if (!slot_count)
42682 break;
42683
42684+ slot_count--;
42685+
42686 info = NULL;
42687 rcu_read_lock();
42688 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
42689@@ -2728,15 +2731,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
42690 memcpy(dest, &space, sizeof(space));
42691 dest++;
42692 space_args.total_spaces++;
42693- slot_count--;
42694 }
42695- if (!slot_count)
42696- break;
42697 }
42698 up_read(&info->groups_sem);
42699 }
42700
42701- user_dest = (struct btrfs_ioctl_space_info *)
42702+ user_dest = (struct btrfs_ioctl_space_info __user *)
42703 (arg + sizeof(struct btrfs_ioctl_space_args));
42704
42705 if (copy_to_user(user_dest, dest_orig, alloc_size))
42706diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
42707index 59bb176..be9977d 100644
42708--- a/fs/btrfs/relocation.c
42709+++ b/fs/btrfs/relocation.c
42710@@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
42711 }
42712 spin_unlock(&rc->reloc_root_tree.lock);
42713
42714- BUG_ON((struct btrfs_root *)node->data != root);
42715+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
42716
42717 if (!del) {
42718 spin_lock(&rc->reloc_root_tree.lock);
42719diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
42720index 622f469..e8d2d55 100644
42721--- a/fs/cachefiles/bind.c
42722+++ b/fs/cachefiles/bind.c
42723@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
42724 args);
42725
42726 /* start by checking things over */
42727- ASSERT(cache->fstop_percent >= 0 &&
42728- cache->fstop_percent < cache->fcull_percent &&
42729+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
42730 cache->fcull_percent < cache->frun_percent &&
42731 cache->frun_percent < 100);
42732
42733- ASSERT(cache->bstop_percent >= 0 &&
42734- cache->bstop_percent < cache->bcull_percent &&
42735+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
42736 cache->bcull_percent < cache->brun_percent &&
42737 cache->brun_percent < 100);
42738
42739diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
42740index 0a1467b..6a53245 100644
42741--- a/fs/cachefiles/daemon.c
42742+++ b/fs/cachefiles/daemon.c
42743@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(struct file *file, char __user *_buffer,
42744 if (n > buflen)
42745 return -EMSGSIZE;
42746
42747- if (copy_to_user(_buffer, buffer, n) != 0)
42748+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
42749 return -EFAULT;
42750
42751 return n;
42752@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
42753 if (test_bit(CACHEFILES_DEAD, &cache->flags))
42754 return -EIO;
42755
42756- if (datalen < 0 || datalen > PAGE_SIZE - 1)
42757+ if (datalen > PAGE_SIZE - 1)
42758 return -EOPNOTSUPP;
42759
42760 /* drag the command string into the kernel so we can parse it */
42761@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
42762 if (args[0] != '%' || args[1] != '\0')
42763 return -EINVAL;
42764
42765- if (fstop < 0 || fstop >= cache->fcull_percent)
42766+ if (fstop >= cache->fcull_percent)
42767 return cachefiles_daemon_range_error(cache, args);
42768
42769 cache->fstop_percent = fstop;
42770@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
42771 if (args[0] != '%' || args[1] != '\0')
42772 return -EINVAL;
42773
42774- if (bstop < 0 || bstop >= cache->bcull_percent)
42775+ if (bstop >= cache->bcull_percent)
42776 return cachefiles_daemon_range_error(cache, args);
42777
42778 cache->bstop_percent = bstop;
42779diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
42780index bd6bc1b..b627b53 100644
42781--- a/fs/cachefiles/internal.h
42782+++ b/fs/cachefiles/internal.h
42783@@ -57,7 +57,7 @@ struct cachefiles_cache {
42784 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
42785 struct rb_root active_nodes; /* active nodes (can't be culled) */
42786 rwlock_t active_lock; /* lock for active_nodes */
42787- atomic_t gravecounter; /* graveyard uniquifier */
42788+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
42789 unsigned frun_percent; /* when to stop culling (% files) */
42790 unsigned fcull_percent; /* when to start culling (% files) */
42791 unsigned fstop_percent; /* when to stop allocating (% files) */
42792@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
42793 * proc.c
42794 */
42795 #ifdef CONFIG_CACHEFILES_HISTOGRAM
42796-extern atomic_t cachefiles_lookup_histogram[HZ];
42797-extern atomic_t cachefiles_mkdir_histogram[HZ];
42798-extern atomic_t cachefiles_create_histogram[HZ];
42799+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42800+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42801+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
42802
42803 extern int __init cachefiles_proc_init(void);
42804 extern void cachefiles_proc_cleanup(void);
42805 static inline
42806-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
42807+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
42808 {
42809 unsigned long jif = jiffies - start_jif;
42810 if (jif >= HZ)
42811 jif = HZ - 1;
42812- atomic_inc(&histogram[jif]);
42813+ atomic_inc_unchecked(&histogram[jif]);
42814 }
42815
42816 #else
42817diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
42818index a0358c2..d6137f2 100644
42819--- a/fs/cachefiles/namei.c
42820+++ b/fs/cachefiles/namei.c
42821@@ -318,7 +318,7 @@ try_again:
42822 /* first step is to make up a grave dentry in the graveyard */
42823 sprintf(nbuffer, "%08x%08x",
42824 (uint32_t) get_seconds(),
42825- (uint32_t) atomic_inc_return(&cache->gravecounter));
42826+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
42827
42828 /* do the multiway lock magic */
42829 trap = lock_rename(cache->graveyard, dir);
42830diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
42831index eccd339..4c1d995 100644
42832--- a/fs/cachefiles/proc.c
42833+++ b/fs/cachefiles/proc.c
42834@@ -14,9 +14,9 @@
42835 #include <linux/seq_file.h>
42836 #include "internal.h"
42837
42838-atomic_t cachefiles_lookup_histogram[HZ];
42839-atomic_t cachefiles_mkdir_histogram[HZ];
42840-atomic_t cachefiles_create_histogram[HZ];
42841+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42842+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42843+atomic_unchecked_t cachefiles_create_histogram[HZ];
42844
42845 /*
42846 * display the latency histogram
42847@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
42848 return 0;
42849 default:
42850 index = (unsigned long) v - 3;
42851- x = atomic_read(&cachefiles_lookup_histogram[index]);
42852- y = atomic_read(&cachefiles_mkdir_histogram[index]);
42853- z = atomic_read(&cachefiles_create_histogram[index]);
42854+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
42855+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
42856+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
42857 if (x == 0 && y == 0 && z == 0)
42858 return 0;
42859
42860diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
42861index 0e3c092..818480e 100644
42862--- a/fs/cachefiles/rdwr.c
42863+++ b/fs/cachefiles/rdwr.c
42864@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
42865 old_fs = get_fs();
42866 set_fs(KERNEL_DS);
42867 ret = file->f_op->write(
42868- file, (const void __user *) data, len, &pos);
42869+ file, (const void __force_user *) data, len, &pos);
42870 set_fs(old_fs);
42871 kunmap(page);
42872 if (ret != len)
42873diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
42874index 382abc9..bd89646 100644
42875--- a/fs/ceph/dir.c
42876+++ b/fs/ceph/dir.c
42877@@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
42878 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
42879 struct ceph_mds_client *mdsc = fsc->mdsc;
42880 unsigned frag = fpos_frag(filp->f_pos);
42881- int off = fpos_off(filp->f_pos);
42882+ unsigned int off = fpos_off(filp->f_pos);
42883 int err;
42884 u32 ftype;
42885 struct ceph_mds_reply_info_parsed *rinfo;
42886diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
42887index 6d40656..bc1f825 100644
42888--- a/fs/cifs/cifs_debug.c
42889+++ b/fs/cifs/cifs_debug.c
42890@@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
42891
42892 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
42893 #ifdef CONFIG_CIFS_STATS2
42894- atomic_set(&totBufAllocCount, 0);
42895- atomic_set(&totSmBufAllocCount, 0);
42896+ atomic_set_unchecked(&totBufAllocCount, 0);
42897+ atomic_set_unchecked(&totSmBufAllocCount, 0);
42898 #endif /* CONFIG_CIFS_STATS2 */
42899 spin_lock(&cifs_tcp_ses_lock);
42900 list_for_each(tmp1, &cifs_tcp_ses_list) {
42901@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
42902 tcon = list_entry(tmp3,
42903 struct cifs_tcon,
42904 tcon_list);
42905- atomic_set(&tcon->num_smbs_sent, 0);
42906- atomic_set(&tcon->num_writes, 0);
42907- atomic_set(&tcon->num_reads, 0);
42908- atomic_set(&tcon->num_oplock_brks, 0);
42909- atomic_set(&tcon->num_opens, 0);
42910- atomic_set(&tcon->num_posixopens, 0);
42911- atomic_set(&tcon->num_posixmkdirs, 0);
42912- atomic_set(&tcon->num_closes, 0);
42913- atomic_set(&tcon->num_deletes, 0);
42914- atomic_set(&tcon->num_mkdirs, 0);
42915- atomic_set(&tcon->num_rmdirs, 0);
42916- atomic_set(&tcon->num_renames, 0);
42917- atomic_set(&tcon->num_t2renames, 0);
42918- atomic_set(&tcon->num_ffirst, 0);
42919- atomic_set(&tcon->num_fnext, 0);
42920- atomic_set(&tcon->num_fclose, 0);
42921- atomic_set(&tcon->num_hardlinks, 0);
42922- atomic_set(&tcon->num_symlinks, 0);
42923- atomic_set(&tcon->num_locks, 0);
42924+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
42925+ atomic_set_unchecked(&tcon->num_writes, 0);
42926+ atomic_set_unchecked(&tcon->num_reads, 0);
42927+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
42928+ atomic_set_unchecked(&tcon->num_opens, 0);
42929+ atomic_set_unchecked(&tcon->num_posixopens, 0);
42930+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
42931+ atomic_set_unchecked(&tcon->num_closes, 0);
42932+ atomic_set_unchecked(&tcon->num_deletes, 0);
42933+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
42934+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
42935+ atomic_set_unchecked(&tcon->num_renames, 0);
42936+ atomic_set_unchecked(&tcon->num_t2renames, 0);
42937+ atomic_set_unchecked(&tcon->num_ffirst, 0);
42938+ atomic_set_unchecked(&tcon->num_fnext, 0);
42939+ atomic_set_unchecked(&tcon->num_fclose, 0);
42940+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
42941+ atomic_set_unchecked(&tcon->num_symlinks, 0);
42942+ atomic_set_unchecked(&tcon->num_locks, 0);
42943 }
42944 }
42945 }
42946@@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
42947 smBufAllocCount.counter, cifs_min_small);
42948 #ifdef CONFIG_CIFS_STATS2
42949 seq_printf(m, "Total Large %d Small %d Allocations\n",
42950- atomic_read(&totBufAllocCount),
42951- atomic_read(&totSmBufAllocCount));
42952+ atomic_read_unchecked(&totBufAllocCount),
42953+ atomic_read_unchecked(&totSmBufAllocCount));
42954 #endif /* CONFIG_CIFS_STATS2 */
42955
42956 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
42957@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
42958 if (tcon->need_reconnect)
42959 seq_puts(m, "\tDISCONNECTED ");
42960 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
42961- atomic_read(&tcon->num_smbs_sent),
42962- atomic_read(&tcon->num_oplock_brks));
42963+ atomic_read_unchecked(&tcon->num_smbs_sent),
42964+ atomic_read_unchecked(&tcon->num_oplock_brks));
42965 seq_printf(m, "\nReads: %d Bytes: %lld",
42966- atomic_read(&tcon->num_reads),
42967+ atomic_read_unchecked(&tcon->num_reads),
42968 (long long)(tcon->bytes_read));
42969 seq_printf(m, "\nWrites: %d Bytes: %lld",
42970- atomic_read(&tcon->num_writes),
42971+ atomic_read_unchecked(&tcon->num_writes),
42972 (long long)(tcon->bytes_written));
42973 seq_printf(m, "\nFlushes: %d",
42974- atomic_read(&tcon->num_flushes));
42975+ atomic_read_unchecked(&tcon->num_flushes));
42976 seq_printf(m, "\nLocks: %d HardLinks: %d "
42977 "Symlinks: %d",
42978- atomic_read(&tcon->num_locks),
42979- atomic_read(&tcon->num_hardlinks),
42980- atomic_read(&tcon->num_symlinks));
42981+ atomic_read_unchecked(&tcon->num_locks),
42982+ atomic_read_unchecked(&tcon->num_hardlinks),
42983+ atomic_read_unchecked(&tcon->num_symlinks));
42984 seq_printf(m, "\nOpens: %d Closes: %d "
42985 "Deletes: %d",
42986- atomic_read(&tcon->num_opens),
42987- atomic_read(&tcon->num_closes),
42988- atomic_read(&tcon->num_deletes));
42989+ atomic_read_unchecked(&tcon->num_opens),
42990+ atomic_read_unchecked(&tcon->num_closes),
42991+ atomic_read_unchecked(&tcon->num_deletes));
42992 seq_printf(m, "\nPosix Opens: %d "
42993 "Posix Mkdirs: %d",
42994- atomic_read(&tcon->num_posixopens),
42995- atomic_read(&tcon->num_posixmkdirs));
42996+ atomic_read_unchecked(&tcon->num_posixopens),
42997+ atomic_read_unchecked(&tcon->num_posixmkdirs));
42998 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
42999- atomic_read(&tcon->num_mkdirs),
43000- atomic_read(&tcon->num_rmdirs));
43001+ atomic_read_unchecked(&tcon->num_mkdirs),
43002+ atomic_read_unchecked(&tcon->num_rmdirs));
43003 seq_printf(m, "\nRenames: %d T2 Renames %d",
43004- atomic_read(&tcon->num_renames),
43005- atomic_read(&tcon->num_t2renames));
43006+ atomic_read_unchecked(&tcon->num_renames),
43007+ atomic_read_unchecked(&tcon->num_t2renames));
43008 seq_printf(m, "\nFindFirst: %d FNext %d "
43009 "FClose %d",
43010- atomic_read(&tcon->num_ffirst),
43011- atomic_read(&tcon->num_fnext),
43012- atomic_read(&tcon->num_fclose));
43013+ atomic_read_unchecked(&tcon->num_ffirst),
43014+ atomic_read_unchecked(&tcon->num_fnext),
43015+ atomic_read_unchecked(&tcon->num_fclose));
43016 }
43017 }
43018 }
43019diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
43020index 54b8f1e..f6a4c00 100644
43021--- a/fs/cifs/cifsfs.c
43022+++ b/fs/cifs/cifsfs.c
43023@@ -981,7 +981,7 @@ cifs_init_request_bufs(void)
43024 cifs_req_cachep = kmem_cache_create("cifs_request",
43025 CIFSMaxBufSize +
43026 MAX_CIFS_HDR_SIZE, 0,
43027- SLAB_HWCACHE_ALIGN, NULL);
43028+ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
43029 if (cifs_req_cachep == NULL)
43030 return -ENOMEM;
43031
43032@@ -1008,7 +1008,7 @@ cifs_init_request_bufs(void)
43033 efficient to alloc 1 per page off the slab compared to 17K (5page)
43034 alloc of large cifs buffers even when page debugging is on */
43035 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
43036- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
43037+ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
43038 NULL);
43039 if (cifs_sm_req_cachep == NULL) {
43040 mempool_destroy(cifs_req_poolp);
43041@@ -1093,8 +1093,8 @@ init_cifs(void)
43042 atomic_set(&bufAllocCount, 0);
43043 atomic_set(&smBufAllocCount, 0);
43044 #ifdef CONFIG_CIFS_STATS2
43045- atomic_set(&totBufAllocCount, 0);
43046- atomic_set(&totSmBufAllocCount, 0);
43047+ atomic_set_unchecked(&totBufAllocCount, 0);
43048+ atomic_set_unchecked(&totSmBufAllocCount, 0);
43049 #endif /* CONFIG_CIFS_STATS2 */
43050
43051 atomic_set(&midCount, 0);
43052diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
43053index 95dad9d..fe7af1a 100644
43054--- a/fs/cifs/cifsglob.h
43055+++ b/fs/cifs/cifsglob.h
43056@@ -381,28 +381,28 @@ struct cifs_tcon {
43057 __u16 Flags; /* optional support bits */
43058 enum statusEnum tidStatus;
43059 #ifdef CONFIG_CIFS_STATS
43060- atomic_t num_smbs_sent;
43061- atomic_t num_writes;
43062- atomic_t num_reads;
43063- atomic_t num_flushes;
43064- atomic_t num_oplock_brks;
43065- atomic_t num_opens;
43066- atomic_t num_closes;
43067- atomic_t num_deletes;
43068- atomic_t num_mkdirs;
43069- atomic_t num_posixopens;
43070- atomic_t num_posixmkdirs;
43071- atomic_t num_rmdirs;
43072- atomic_t num_renames;
43073- atomic_t num_t2renames;
43074- atomic_t num_ffirst;
43075- atomic_t num_fnext;
43076- atomic_t num_fclose;
43077- atomic_t num_hardlinks;
43078- atomic_t num_symlinks;
43079- atomic_t num_locks;
43080- atomic_t num_acl_get;
43081- atomic_t num_acl_set;
43082+ atomic_unchecked_t num_smbs_sent;
43083+ atomic_unchecked_t num_writes;
43084+ atomic_unchecked_t num_reads;
43085+ atomic_unchecked_t num_flushes;
43086+ atomic_unchecked_t num_oplock_brks;
43087+ atomic_unchecked_t num_opens;
43088+ atomic_unchecked_t num_closes;
43089+ atomic_unchecked_t num_deletes;
43090+ atomic_unchecked_t num_mkdirs;
43091+ atomic_unchecked_t num_posixopens;
43092+ atomic_unchecked_t num_posixmkdirs;
43093+ atomic_unchecked_t num_rmdirs;
43094+ atomic_unchecked_t num_renames;
43095+ atomic_unchecked_t num_t2renames;
43096+ atomic_unchecked_t num_ffirst;
43097+ atomic_unchecked_t num_fnext;
43098+ atomic_unchecked_t num_fclose;
43099+ atomic_unchecked_t num_hardlinks;
43100+ atomic_unchecked_t num_symlinks;
43101+ atomic_unchecked_t num_locks;
43102+ atomic_unchecked_t num_acl_get;
43103+ atomic_unchecked_t num_acl_set;
43104 #ifdef CONFIG_CIFS_STATS2
43105 unsigned long long time_writes;
43106 unsigned long long time_reads;
43107@@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim)
43108 }
43109
43110 #ifdef CONFIG_CIFS_STATS
43111-#define cifs_stats_inc atomic_inc
43112+#define cifs_stats_inc atomic_inc_unchecked
43113
43114 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
43115 unsigned int bytes)
43116@@ -953,8 +953,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
43117 /* Various Debug counters */
43118 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
43119 #ifdef CONFIG_CIFS_STATS2
43120-GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
43121-GLOBAL_EXTERN atomic_t totSmBufAllocCount;
43122+GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
43123+GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
43124 #endif
43125 GLOBAL_EXTERN atomic_t smBufAllocCount;
43126 GLOBAL_EXTERN atomic_t midCount;
43127diff --git a/fs/cifs/link.c b/fs/cifs/link.c
43128index db3f18c..1f5955e 100644
43129--- a/fs/cifs/link.c
43130+++ b/fs/cifs/link.c
43131@@ -593,7 +593,7 @@ symlink_exit:
43132
43133 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
43134 {
43135- char *p = nd_get_link(nd);
43136+ const char *p = nd_get_link(nd);
43137 if (!IS_ERR(p))
43138 kfree(p);
43139 }
43140diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
43141index 7c16933..c8212b5 100644
43142--- a/fs/cifs/misc.c
43143+++ b/fs/cifs/misc.c
43144@@ -156,7 +156,7 @@ cifs_buf_get(void)
43145 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
43146 atomic_inc(&bufAllocCount);
43147 #ifdef CONFIG_CIFS_STATS2
43148- atomic_inc(&totBufAllocCount);
43149+ atomic_inc_unchecked(&totBufAllocCount);
43150 #endif /* CONFIG_CIFS_STATS2 */
43151 }
43152
43153@@ -191,7 +191,7 @@ cifs_small_buf_get(void)
43154 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
43155 atomic_inc(&smBufAllocCount);
43156 #ifdef CONFIG_CIFS_STATS2
43157- atomic_inc(&totSmBufAllocCount);
43158+ atomic_inc_unchecked(&totSmBufAllocCount);
43159 #endif /* CONFIG_CIFS_STATS2 */
43160
43161 }
43162diff --git a/fs/coda/cache.c b/fs/coda/cache.c
43163index 6901578..d402eb5 100644
43164--- a/fs/coda/cache.c
43165+++ b/fs/coda/cache.c
43166@@ -24,7 +24,7 @@
43167 #include "coda_linux.h"
43168 #include "coda_cache.h"
43169
43170-static atomic_t permission_epoch = ATOMIC_INIT(0);
43171+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
43172
43173 /* replace or extend an acl cache hit */
43174 void coda_cache_enter(struct inode *inode, int mask)
43175@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inode, int mask)
43176 struct coda_inode_info *cii = ITOC(inode);
43177
43178 spin_lock(&cii->c_lock);
43179- cii->c_cached_epoch = atomic_read(&permission_epoch);
43180+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
43181 if (cii->c_uid != current_fsuid()) {
43182 cii->c_uid = current_fsuid();
43183 cii->c_cached_perm = mask;
43184@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode *inode)
43185 {
43186 struct coda_inode_info *cii = ITOC(inode);
43187 spin_lock(&cii->c_lock);
43188- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
43189+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
43190 spin_unlock(&cii->c_lock);
43191 }
43192
43193 /* remove all acl caches */
43194 void coda_cache_clear_all(struct super_block *sb)
43195 {
43196- atomic_inc(&permission_epoch);
43197+ atomic_inc_unchecked(&permission_epoch);
43198 }
43199
43200
43201@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode, int mask)
43202 spin_lock(&cii->c_lock);
43203 hit = (mask & cii->c_cached_perm) == mask &&
43204 cii->c_uid == current_fsuid() &&
43205- cii->c_cached_epoch == atomic_read(&permission_epoch);
43206+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
43207 spin_unlock(&cii->c_lock);
43208
43209 return hit;
43210diff --git a/fs/compat.c b/fs/compat.c
43211index 58b1da4..afcd9b8 100644
43212--- a/fs/compat.c
43213+++ b/fs/compat.c
43214@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
43215 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
43216 {
43217 compat_ino_t ino = stat->ino;
43218- typeof(ubuf->st_uid) uid = 0;
43219- typeof(ubuf->st_gid) gid = 0;
43220+ typeof(((struct compat_stat *)0)->st_uid) uid = 0;
43221+ typeof(((struct compat_stat *)0)->st_gid) gid = 0;
43222 int err;
43223
43224 SET_UID(uid, stat->uid);
43225@@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
43226
43227 set_fs(KERNEL_DS);
43228 /* The __user pointer cast is valid because of the set_fs() */
43229- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
43230+ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
43231 set_fs(oldfs);
43232 /* truncating is ok because it's a user address */
43233 if (!ret)
43234@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
43235 goto out;
43236
43237 ret = -EINVAL;
43238- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
43239+ if (nr_segs > UIO_MAXIOV)
43240 goto out;
43241 if (nr_segs > fast_segs) {
43242 ret = -ENOMEM;
43243@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
43244
43245 struct compat_readdir_callback {
43246 struct compat_old_linux_dirent __user *dirent;
43247+ struct file * file;
43248 int result;
43249 };
43250
43251@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
43252 buf->result = -EOVERFLOW;
43253 return -EOVERFLOW;
43254 }
43255+
43256+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43257+ return 0;
43258+
43259 buf->result++;
43260 dirent = buf->dirent;
43261 if (!access_ok(VERIFY_WRITE, dirent,
43262@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
43263
43264 buf.result = 0;
43265 buf.dirent = dirent;
43266+ buf.file = file;
43267
43268 error = vfs_readdir(file, compat_fillonedir, &buf);
43269 if (buf.result)
43270@@ -917,6 +923,7 @@ struct compat_linux_dirent {
43271 struct compat_getdents_callback {
43272 struct compat_linux_dirent __user *current_dir;
43273 struct compat_linux_dirent __user *previous;
43274+ struct file * file;
43275 int count;
43276 int error;
43277 };
43278@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
43279 buf->error = -EOVERFLOW;
43280 return -EOVERFLOW;
43281 }
43282+
43283+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43284+ return 0;
43285+
43286 dirent = buf->previous;
43287 if (dirent) {
43288 if (__put_user(offset, &dirent->d_off))
43289@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
43290 buf.previous = NULL;
43291 buf.count = count;
43292 buf.error = 0;
43293+ buf.file = file;
43294
43295 error = vfs_readdir(file, compat_filldir, &buf);
43296 if (error >= 0)
43297@@ -1006,6 +1018,7 @@ out:
43298 struct compat_getdents_callback64 {
43299 struct linux_dirent64 __user *current_dir;
43300 struct linux_dirent64 __user *previous;
43301+ struct file * file;
43302 int count;
43303 int error;
43304 };
43305@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
43306 buf->error = -EINVAL; /* only used if we fail.. */
43307 if (reclen > buf->count)
43308 return -EINVAL;
43309+
43310+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43311+ return 0;
43312+
43313 dirent = buf->previous;
43314
43315 if (dirent) {
43316@@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
43317 buf.previous = NULL;
43318 buf.count = count;
43319 buf.error = 0;
43320+ buf.file = file;
43321
43322 error = vfs_readdir(file, compat_filldir64, &buf);
43323 if (error >= 0)
43324 error = buf.error;
43325 lastdirent = buf.previous;
43326 if (lastdirent) {
43327- typeof(lastdirent->d_off) d_off = file->f_pos;
43328+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
43329 if (__put_user_unaligned(d_off, &lastdirent->d_off))
43330 error = -EFAULT;
43331 else
43332@@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
43333 struct fdtable *fdt;
43334 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
43335
43336+ pax_track_stack();
43337+
43338 if (n < 0)
43339 goto out_nofds;
43340
43341diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
43342index 112e45a..b59845b 100644
43343--- a/fs/compat_binfmt_elf.c
43344+++ b/fs/compat_binfmt_elf.c
43345@@ -30,11 +30,13 @@
43346 #undef elf_phdr
43347 #undef elf_shdr
43348 #undef elf_note
43349+#undef elf_dyn
43350 #undef elf_addr_t
43351 #define elfhdr elf32_hdr
43352 #define elf_phdr elf32_phdr
43353 #define elf_shdr elf32_shdr
43354 #define elf_note elf32_note
43355+#define elf_dyn Elf32_Dyn
43356 #define elf_addr_t Elf32_Addr
43357
43358 /*
43359diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
43360index 51352de..93292ff 100644
43361--- a/fs/compat_ioctl.c
43362+++ b/fs/compat_ioctl.c
43363@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
43364
43365 err = get_user(palp, &up->palette);
43366 err |= get_user(length, &up->length);
43367+ if (err)
43368+ return -EFAULT;
43369
43370 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
43371 err = put_user(compat_ptr(palp), &up_native->palette);
43372@@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
43373 return -EFAULT;
43374 if (__get_user(udata, &ss32->iomem_base))
43375 return -EFAULT;
43376- ss.iomem_base = compat_ptr(udata);
43377+ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
43378 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
43379 __get_user(ss.port_high, &ss32->port_high))
43380 return -EFAULT;
43381@@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
43382 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
43383 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
43384 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
43385- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43386+ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43387 return -EFAULT;
43388
43389 return ioctl_preallocate(file, p);
43390@@ -1644,8 +1646,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
43391 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
43392 {
43393 unsigned int a, b;
43394- a = *(unsigned int *)p;
43395- b = *(unsigned int *)q;
43396+ a = *(const unsigned int *)p;
43397+ b = *(const unsigned int *)q;
43398 if (a > b)
43399 return 1;
43400 if (a < b)
43401diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
43402index 9a37a9b..35792b6 100644
43403--- a/fs/configfs/dir.c
43404+++ b/fs/configfs/dir.c
43405@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43406 }
43407 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
43408 struct configfs_dirent *next;
43409- const char * name;
43410+ const unsigned char * name;
43411+ char d_name[sizeof(next->s_dentry->d_iname)];
43412 int len;
43413 struct inode *inode = NULL;
43414
43415@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43416 continue;
43417
43418 name = configfs_get_name(next);
43419- len = strlen(name);
43420+ if (next->s_dentry && name == next->s_dentry->d_iname) {
43421+ len = next->s_dentry->d_name.len;
43422+ memcpy(d_name, name, len);
43423+ name = d_name;
43424+ } else
43425+ len = strlen(name);
43426
43427 /*
43428 * We'll have a dentry and an inode for
43429diff --git a/fs/dcache.c b/fs/dcache.c
43430index 8b732a2..6db6c27 100644
43431--- a/fs/dcache.c
43432+++ b/fs/dcache.c
43433@@ -3015,7 +3015,7 @@ void __init vfs_caches_init(unsigned long mempages)
43434 mempages -= reserve;
43435
43436 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
43437- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
43438+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
43439
43440 dcache_init();
43441 inode_init();
43442diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
43443index 528da01..bd8c23d 100644
43444--- a/fs/ecryptfs/inode.c
43445+++ b/fs/ecryptfs/inode.c
43446@@ -691,7 +691,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
43447 old_fs = get_fs();
43448 set_fs(get_ds());
43449 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
43450- (char __user *)lower_buf,
43451+ (char __force_user *)lower_buf,
43452 lower_bufsiz);
43453 set_fs(old_fs);
43454 if (rc < 0)
43455@@ -737,7 +737,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
43456 }
43457 old_fs = get_fs();
43458 set_fs(get_ds());
43459- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
43460+ rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len);
43461 set_fs(old_fs);
43462 if (rc < 0) {
43463 kfree(buf);
43464@@ -752,7 +752,7 @@ out:
43465 static void
43466 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
43467 {
43468- char *buf = nd_get_link(nd);
43469+ const char *buf = nd_get_link(nd);
43470 if (!IS_ERR(buf)) {
43471 /* Free the char* */
43472 kfree(buf);
43473diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
43474index 940a82e..63af89e 100644
43475--- a/fs/ecryptfs/miscdev.c
43476+++ b/fs/ecryptfs/miscdev.c
43477@@ -328,7 +328,7 @@ check_list:
43478 goto out_unlock_msg_ctx;
43479 i = 5;
43480 if (msg_ctx->msg) {
43481- if (copy_to_user(&buf[i], packet_length, packet_length_size))
43482+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
43483 goto out_unlock_msg_ctx;
43484 i += packet_length_size;
43485 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
43486diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
43487index 3745f7c..89cc7a3 100644
43488--- a/fs/ecryptfs/read_write.c
43489+++ b/fs/ecryptfs/read_write.c
43490@@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
43491 return -EIO;
43492 fs_save = get_fs();
43493 set_fs(get_ds());
43494- rc = vfs_write(lower_file, data, size, &offset);
43495+ rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
43496 set_fs(fs_save);
43497 mark_inode_dirty_sync(ecryptfs_inode);
43498 return rc;
43499@@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
43500 return -EIO;
43501 fs_save = get_fs();
43502 set_fs(get_ds());
43503- rc = vfs_read(lower_file, data, size, &offset);
43504+ rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
43505 set_fs(fs_save);
43506 return rc;
43507 }
43508diff --git a/fs/exec.c b/fs/exec.c
43509index 25dcbe5..4ffaa78 100644
43510--- a/fs/exec.c
43511+++ b/fs/exec.c
43512@@ -55,12 +55,24 @@
43513 #include <linux/pipe_fs_i.h>
43514 #include <linux/oom.h>
43515 #include <linux/compat.h>
43516+#include <linux/random.h>
43517+#include <linux/seq_file.h>
43518+
43519+#ifdef CONFIG_PAX_REFCOUNT
43520+#include <linux/kallsyms.h>
43521+#include <linux/kdebug.h>
43522+#endif
43523
43524 #include <asm/uaccess.h>
43525 #include <asm/mmu_context.h>
43526 #include <asm/tlb.h>
43527 #include "internal.h"
43528
43529+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
43530+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
43531+EXPORT_SYMBOL(pax_set_initial_flags_func);
43532+#endif
43533+
43534 int core_uses_pid;
43535 char core_pattern[CORENAME_MAX_SIZE] = "core";
43536 unsigned int core_pipe_limit;
43537@@ -70,7 +82,7 @@ struct core_name {
43538 char *corename;
43539 int used, size;
43540 };
43541-static atomic_t call_count = ATOMIC_INIT(1);
43542+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
43543
43544 /* The maximal length of core_pattern is also specified in sysctl.c */
43545
43546@@ -188,18 +200,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
43547 int write)
43548 {
43549 struct page *page;
43550- int ret;
43551
43552-#ifdef CONFIG_STACK_GROWSUP
43553- if (write) {
43554- ret = expand_downwards(bprm->vma, pos);
43555- if (ret < 0)
43556- return NULL;
43557- }
43558-#endif
43559- ret = get_user_pages(current, bprm->mm, pos,
43560- 1, write, 1, &page, NULL);
43561- if (ret <= 0)
43562+ if (0 > expand_downwards(bprm->vma, pos))
43563+ return NULL;
43564+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
43565 return NULL;
43566
43567 if (write) {
43568@@ -274,6 +278,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
43569 vma->vm_end = STACK_TOP_MAX;
43570 vma->vm_start = vma->vm_end - PAGE_SIZE;
43571 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
43572+
43573+#ifdef CONFIG_PAX_SEGMEXEC
43574+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
43575+#endif
43576+
43577 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
43578 INIT_LIST_HEAD(&vma->anon_vma_chain);
43579
43580@@ -288,6 +297,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
43581 mm->stack_vm = mm->total_vm = 1;
43582 up_write(&mm->mmap_sem);
43583 bprm->p = vma->vm_end - sizeof(void *);
43584+
43585+#ifdef CONFIG_PAX_RANDUSTACK
43586+ if (randomize_va_space)
43587+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
43588+#endif
43589+
43590 return 0;
43591 err:
43592 up_write(&mm->mmap_sem);
43593@@ -396,19 +411,7 @@ err:
43594 return err;
43595 }
43596
43597-struct user_arg_ptr {
43598-#ifdef CONFIG_COMPAT
43599- bool is_compat;
43600-#endif
43601- union {
43602- const char __user *const __user *native;
43603-#ifdef CONFIG_COMPAT
43604- compat_uptr_t __user *compat;
43605-#endif
43606- } ptr;
43607-};
43608-
43609-static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43610+const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43611 {
43612 const char __user *native;
43613
43614@@ -417,14 +420,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43615 compat_uptr_t compat;
43616
43617 if (get_user(compat, argv.ptr.compat + nr))
43618- return ERR_PTR(-EFAULT);
43619+ return (const char __force_user *)ERR_PTR(-EFAULT);
43620
43621 return compat_ptr(compat);
43622 }
43623 #endif
43624
43625 if (get_user(native, argv.ptr.native + nr))
43626- return ERR_PTR(-EFAULT);
43627+ return (const char __force_user *)ERR_PTR(-EFAULT);
43628
43629 return native;
43630 }
43631@@ -443,7 +446,7 @@ static int count(struct user_arg_ptr argv, int max)
43632 if (!p)
43633 break;
43634
43635- if (IS_ERR(p))
43636+ if (IS_ERR((const char __force_kernel *)p))
43637 return -EFAULT;
43638
43639 if (i++ >= max)
43640@@ -477,7 +480,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
43641
43642 ret = -EFAULT;
43643 str = get_user_arg_ptr(argv, argc);
43644- if (IS_ERR(str))
43645+ if (IS_ERR((const char __force_kernel *)str))
43646 goto out;
43647
43648 len = strnlen_user(str, MAX_ARG_STRLEN);
43649@@ -559,7 +562,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
43650 int r;
43651 mm_segment_t oldfs = get_fs();
43652 struct user_arg_ptr argv = {
43653- .ptr.native = (const char __user *const __user *)__argv,
43654+ .ptr.native = (const char __force_user *const __force_user *)__argv,
43655 };
43656
43657 set_fs(KERNEL_DS);
43658@@ -594,7 +597,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
43659 unsigned long new_end = old_end - shift;
43660 struct mmu_gather tlb;
43661
43662- BUG_ON(new_start > new_end);
43663+ if (new_start >= new_end || new_start < mmap_min_addr)
43664+ return -ENOMEM;
43665
43666 /*
43667 * ensure there are no vmas between where we want to go
43668@@ -603,6 +607,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
43669 if (vma != find_vma(mm, new_start))
43670 return -EFAULT;
43671
43672+#ifdef CONFIG_PAX_SEGMEXEC
43673+ BUG_ON(pax_find_mirror_vma(vma));
43674+#endif
43675+
43676 /*
43677 * cover the whole range: [new_start, old_end)
43678 */
43679@@ -683,10 +691,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
43680 stack_top = arch_align_stack(stack_top);
43681 stack_top = PAGE_ALIGN(stack_top);
43682
43683- if (unlikely(stack_top < mmap_min_addr) ||
43684- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
43685- return -ENOMEM;
43686-
43687 stack_shift = vma->vm_end - stack_top;
43688
43689 bprm->p -= stack_shift;
43690@@ -698,8 +702,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
43691 bprm->exec -= stack_shift;
43692
43693 down_write(&mm->mmap_sem);
43694+
43695+ /* Move stack pages down in memory. */
43696+ if (stack_shift) {
43697+ ret = shift_arg_pages(vma, stack_shift);
43698+ if (ret)
43699+ goto out_unlock;
43700+ }
43701+
43702 vm_flags = VM_STACK_FLAGS;
43703
43704+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43705+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43706+ vm_flags &= ~VM_EXEC;
43707+
43708+#ifdef CONFIG_PAX_MPROTECT
43709+ if (mm->pax_flags & MF_PAX_MPROTECT)
43710+ vm_flags &= ~VM_MAYEXEC;
43711+#endif
43712+
43713+ }
43714+#endif
43715+
43716 /*
43717 * Adjust stack execute permissions; explicitly enable for
43718 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
43719@@ -718,13 +742,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
43720 goto out_unlock;
43721 BUG_ON(prev != vma);
43722
43723- /* Move stack pages down in memory. */
43724- if (stack_shift) {
43725- ret = shift_arg_pages(vma, stack_shift);
43726- if (ret)
43727- goto out_unlock;
43728- }
43729-
43730 /* mprotect_fixup is overkill to remove the temporary stack flags */
43731 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
43732
43733@@ -805,7 +822,7 @@ int kernel_read(struct file *file, loff_t offset,
43734 old_fs = get_fs();
43735 set_fs(get_ds());
43736 /* The cast to a user pointer is valid due to the set_fs() */
43737- result = vfs_read(file, (void __user *)addr, count, &pos);
43738+ result = vfs_read(file, (void __force_user *)addr, count, &pos);
43739 set_fs(old_fs);
43740 return result;
43741 }
43742@@ -1251,7 +1268,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
43743 }
43744 rcu_read_unlock();
43745
43746- if (p->fs->users > n_fs) {
43747+ if (atomic_read(&p->fs->users) > n_fs) {
43748 bprm->unsafe |= LSM_UNSAFE_SHARE;
43749 } else {
43750 res = -EAGAIN;
43751@@ -1454,6 +1471,11 @@ static int do_execve_common(const char *filename,
43752 struct user_arg_ptr envp,
43753 struct pt_regs *regs)
43754 {
43755+#ifdef CONFIG_GRKERNSEC
43756+ struct file *old_exec_file;
43757+ struct acl_subject_label *old_acl;
43758+ struct rlimit old_rlim[RLIM_NLIMITS];
43759+#endif
43760 struct linux_binprm *bprm;
43761 struct file *file;
43762 struct files_struct *displaced;
43763@@ -1461,6 +1483,8 @@ static int do_execve_common(const char *filename,
43764 int retval;
43765 const struct cred *cred = current_cred();
43766
43767+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
43768+
43769 /*
43770 * We move the actual failure in case of RLIMIT_NPROC excess from
43771 * set*uid() to execve() because too many poorly written programs
43772@@ -1507,6 +1531,16 @@ static int do_execve_common(const char *filename,
43773 bprm->filename = filename;
43774 bprm->interp = filename;
43775
43776+ if (gr_process_user_ban()) {
43777+ retval = -EPERM;
43778+ goto out_file;
43779+ }
43780+
43781+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
43782+ retval = -EACCES;
43783+ goto out_file;
43784+ }
43785+
43786 retval = bprm_mm_init(bprm);
43787 if (retval)
43788 goto out_file;
43789@@ -1536,9 +1570,40 @@ static int do_execve_common(const char *filename,
43790 if (retval < 0)
43791 goto out;
43792
43793+ if (!gr_tpe_allow(file)) {
43794+ retval = -EACCES;
43795+ goto out;
43796+ }
43797+
43798+ if (gr_check_crash_exec(file)) {
43799+ retval = -EACCES;
43800+ goto out;
43801+ }
43802+
43803+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
43804+
43805+ gr_handle_exec_args(bprm, argv);
43806+
43807+#ifdef CONFIG_GRKERNSEC
43808+ old_acl = current->acl;
43809+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
43810+ old_exec_file = current->exec_file;
43811+ get_file(file);
43812+ current->exec_file = file;
43813+#endif
43814+
43815+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
43816+ bprm->unsafe & LSM_UNSAFE_SHARE);
43817+ if (retval < 0)
43818+ goto out_fail;
43819+
43820 retval = search_binary_handler(bprm,regs);
43821 if (retval < 0)
43822- goto out;
43823+ goto out_fail;
43824+#ifdef CONFIG_GRKERNSEC
43825+ if (old_exec_file)
43826+ fput(old_exec_file);
43827+#endif
43828
43829 /* execve succeeded */
43830 current->fs->in_exec = 0;
43831@@ -1549,6 +1614,14 @@ static int do_execve_common(const char *filename,
43832 put_files_struct(displaced);
43833 return retval;
43834
43835+out_fail:
43836+#ifdef CONFIG_GRKERNSEC
43837+ current->acl = old_acl;
43838+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
43839+ fput(current->exec_file);
43840+ current->exec_file = old_exec_file;
43841+#endif
43842+
43843 out:
43844 if (bprm->mm) {
43845 acct_arg_size(bprm, 0);
43846@@ -1622,7 +1695,7 @@ static int expand_corename(struct core_name *cn)
43847 {
43848 char *old_corename = cn->corename;
43849
43850- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
43851+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
43852 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
43853
43854 if (!cn->corename) {
43855@@ -1719,7 +1792,7 @@ static int format_corename(struct core_name *cn, long signr)
43856 int pid_in_pattern = 0;
43857 int err = 0;
43858
43859- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
43860+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
43861 cn->corename = kmalloc(cn->size, GFP_KERNEL);
43862 cn->used = 0;
43863
43864@@ -1816,6 +1889,218 @@ out:
43865 return ispipe;
43866 }
43867
43868+int pax_check_flags(unsigned long *flags)
43869+{
43870+ int retval = 0;
43871+
43872+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
43873+ if (*flags & MF_PAX_SEGMEXEC)
43874+ {
43875+ *flags &= ~MF_PAX_SEGMEXEC;
43876+ retval = -EINVAL;
43877+ }
43878+#endif
43879+
43880+ if ((*flags & MF_PAX_PAGEEXEC)
43881+
43882+#ifdef CONFIG_PAX_PAGEEXEC
43883+ && (*flags & MF_PAX_SEGMEXEC)
43884+#endif
43885+
43886+ )
43887+ {
43888+ *flags &= ~MF_PAX_PAGEEXEC;
43889+ retval = -EINVAL;
43890+ }
43891+
43892+ if ((*flags & MF_PAX_MPROTECT)
43893+
43894+#ifdef CONFIG_PAX_MPROTECT
43895+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43896+#endif
43897+
43898+ )
43899+ {
43900+ *flags &= ~MF_PAX_MPROTECT;
43901+ retval = -EINVAL;
43902+ }
43903+
43904+ if ((*flags & MF_PAX_EMUTRAMP)
43905+
43906+#ifdef CONFIG_PAX_EMUTRAMP
43907+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43908+#endif
43909+
43910+ )
43911+ {
43912+ *flags &= ~MF_PAX_EMUTRAMP;
43913+ retval = -EINVAL;
43914+ }
43915+
43916+ return retval;
43917+}
43918+
43919+EXPORT_SYMBOL(pax_check_flags);
43920+
43921+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43922+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
43923+{
43924+ struct task_struct *tsk = current;
43925+ struct mm_struct *mm = current->mm;
43926+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
43927+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
43928+ char *path_exec = NULL;
43929+ char *path_fault = NULL;
43930+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
43931+
43932+ if (buffer_exec && buffer_fault) {
43933+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
43934+
43935+ down_read(&mm->mmap_sem);
43936+ vma = mm->mmap;
43937+ while (vma && (!vma_exec || !vma_fault)) {
43938+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
43939+ vma_exec = vma;
43940+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
43941+ vma_fault = vma;
43942+ vma = vma->vm_next;
43943+ }
43944+ if (vma_exec) {
43945+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
43946+ if (IS_ERR(path_exec))
43947+ path_exec = "<path too long>";
43948+ else {
43949+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
43950+ if (path_exec) {
43951+ *path_exec = 0;
43952+ path_exec = buffer_exec;
43953+ } else
43954+ path_exec = "<path too long>";
43955+ }
43956+ }
43957+ if (vma_fault) {
43958+ start = vma_fault->vm_start;
43959+ end = vma_fault->vm_end;
43960+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
43961+ if (vma_fault->vm_file) {
43962+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
43963+ if (IS_ERR(path_fault))
43964+ path_fault = "<path too long>";
43965+ else {
43966+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
43967+ if (path_fault) {
43968+ *path_fault = 0;
43969+ path_fault = buffer_fault;
43970+ } else
43971+ path_fault = "<path too long>";
43972+ }
43973+ } else
43974+ path_fault = "<anonymous mapping>";
43975+ }
43976+ up_read(&mm->mmap_sem);
43977+ }
43978+ if (tsk->signal->curr_ip)
43979+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
43980+ else
43981+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
43982+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
43983+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
43984+ task_uid(tsk), task_euid(tsk), pc, sp);
43985+ free_page((unsigned long)buffer_exec);
43986+ free_page((unsigned long)buffer_fault);
43987+ pax_report_insns(regs, pc, sp);
43988+ do_coredump(SIGKILL, SIGKILL, regs);
43989+}
43990+#endif
43991+
43992+#ifdef CONFIG_PAX_REFCOUNT
43993+void pax_report_refcount_overflow(struct pt_regs *regs)
43994+{
43995+ if (current->signal->curr_ip)
43996+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
43997+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
43998+ else
43999+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44000+ current->comm, task_pid_nr(current), current_uid(), current_euid());
44001+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
44002+ show_regs(regs);
44003+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
44004+}
44005+#endif
44006+
44007+#ifdef CONFIG_PAX_USERCOPY
44008+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
44009+int object_is_on_stack(const void *obj, unsigned long len)
44010+{
44011+ const void * const stack = task_stack_page(current);
44012+ const void * const stackend = stack + THREAD_SIZE;
44013+
44014+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44015+ const void *frame = NULL;
44016+ const void *oldframe;
44017+#endif
44018+
44019+ if (obj + len < obj)
44020+ return -1;
44021+
44022+ if (obj + len <= stack || stackend <= obj)
44023+ return 0;
44024+
44025+ if (obj < stack || stackend < obj + len)
44026+ return -1;
44027+
44028+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44029+ oldframe = __builtin_frame_address(1);
44030+ if (oldframe)
44031+ frame = __builtin_frame_address(2);
44032+ /*
44033+ low ----------------------------------------------> high
44034+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
44035+ ^----------------^
44036+ allow copies only within here
44037+ */
44038+ while (stack <= frame && frame < stackend) {
44039+ /* if obj + len extends past the last frame, this
44040+ check won't pass and the next frame will be 0,
44041+ causing us to bail out and correctly report
44042+ the copy as invalid
44043+ */
44044+ if (obj + len <= frame)
44045+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
44046+ oldframe = frame;
44047+ frame = *(const void * const *)frame;
44048+ }
44049+ return -1;
44050+#else
44051+ return 1;
44052+#endif
44053+}
44054+
44055+NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
44056+{
44057+ if (current->signal->curr_ip)
44058+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44059+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44060+ else
44061+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44062+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44063+ dump_stack();
44064+ gr_handle_kernel_exploit();
44065+ do_group_exit(SIGKILL);
44066+}
44067+#endif
44068+
44069+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
44070+void pax_track_stack(void)
44071+{
44072+ unsigned long sp = (unsigned long)&sp;
44073+ if (sp < current_thread_info()->lowest_stack &&
44074+ sp > (unsigned long)task_stack_page(current))
44075+ current_thread_info()->lowest_stack = sp;
44076+}
44077+EXPORT_SYMBOL(pax_track_stack);
44078+#endif
44079+
44080 static int zap_process(struct task_struct *start, int exit_code)
44081 {
44082 struct task_struct *t;
44083@@ -2027,17 +2312,17 @@ static void wait_for_dump_helpers(struct file *file)
44084 pipe = file->f_path.dentry->d_inode->i_pipe;
44085
44086 pipe_lock(pipe);
44087- pipe->readers++;
44088- pipe->writers--;
44089+ atomic_inc(&pipe->readers);
44090+ atomic_dec(&pipe->writers);
44091
44092- while ((pipe->readers > 1) && (!signal_pending(current))) {
44093+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
44094 wake_up_interruptible_sync(&pipe->wait);
44095 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
44096 pipe_wait(pipe);
44097 }
44098
44099- pipe->readers--;
44100- pipe->writers++;
44101+ atomic_dec(&pipe->readers);
44102+ atomic_inc(&pipe->writers);
44103 pipe_unlock(pipe);
44104
44105 }
44106@@ -2098,7 +2383,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44107 int retval = 0;
44108 int flag = 0;
44109 int ispipe;
44110- static atomic_t core_dump_count = ATOMIC_INIT(0);
44111+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
44112 struct coredump_params cprm = {
44113 .signr = signr,
44114 .regs = regs,
44115@@ -2113,6 +2398,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44116
44117 audit_core_dumps(signr);
44118
44119+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
44120+ gr_handle_brute_attach(current, cprm.mm_flags);
44121+
44122 binfmt = mm->binfmt;
44123 if (!binfmt || !binfmt->core_dump)
44124 goto fail;
44125@@ -2180,7 +2468,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44126 }
44127 cprm.limit = RLIM_INFINITY;
44128
44129- dump_count = atomic_inc_return(&core_dump_count);
44130+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
44131 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
44132 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
44133 task_tgid_vnr(current), current->comm);
44134@@ -2207,6 +2495,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44135 } else {
44136 struct inode *inode;
44137
44138+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
44139+
44140 if (cprm.limit < binfmt->min_coredump)
44141 goto fail_unlock;
44142
44143@@ -2250,7 +2540,7 @@ close_fail:
44144 filp_close(cprm.file, NULL);
44145 fail_dropcount:
44146 if (ispipe)
44147- atomic_dec(&core_dump_count);
44148+ atomic_dec_unchecked(&core_dump_count);
44149 fail_unlock:
44150 kfree(cn.corename);
44151 fail_corename:
44152@@ -2269,7 +2559,7 @@ fail:
44153 */
44154 int dump_write(struct file *file, const void *addr, int nr)
44155 {
44156- return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
44157+ return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
44158 }
44159 EXPORT_SYMBOL(dump_write);
44160
44161diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
44162index 8f44cef..cb07120 100644
44163--- a/fs/ext2/balloc.c
44164+++ b/fs/ext2/balloc.c
44165@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
44166
44167 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44168 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44169- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44170+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44171 sbi->s_resuid != current_fsuid() &&
44172 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44173 return 0;
44174diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
44175index 6386d76..0a266b1 100644
44176--- a/fs/ext3/balloc.c
44177+++ b/fs/ext3/balloc.c
44178@@ -1446,7 +1446,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
44179
44180 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44181 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44182- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44183+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44184 sbi->s_resuid != current_fsuid() &&
44185 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44186 return 0;
44187diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
44188index f8224ad..fbef97c 100644
44189--- a/fs/ext4/balloc.c
44190+++ b/fs/ext4/balloc.c
44191@@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct ext4_sb_info *sbi,
44192 /* Hm, nope. Are (enough) root reserved blocks available? */
44193 if (sbi->s_resuid == current_fsuid() ||
44194 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
44195- capable(CAP_SYS_RESOURCE) ||
44196- (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
44197+ (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
44198+ capable_nolog(CAP_SYS_RESOURCE)) {
44199
44200 if (free_blocks >= (nblocks + dirty_blocks))
44201 return 1;
44202diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
44203index 5c38120..2291d18 100644
44204--- a/fs/ext4/ext4.h
44205+++ b/fs/ext4/ext4.h
44206@@ -1180,19 +1180,19 @@ struct ext4_sb_info {
44207 unsigned long s_mb_last_start;
44208
44209 /* stats for buddy allocator */
44210- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
44211- atomic_t s_bal_success; /* we found long enough chunks */
44212- atomic_t s_bal_allocated; /* in blocks */
44213- atomic_t s_bal_ex_scanned; /* total extents scanned */
44214- atomic_t s_bal_goals; /* goal hits */
44215- atomic_t s_bal_breaks; /* too long searches */
44216- atomic_t s_bal_2orders; /* 2^order hits */
44217+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
44218+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
44219+ atomic_unchecked_t s_bal_allocated; /* in blocks */
44220+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
44221+ atomic_unchecked_t s_bal_goals; /* goal hits */
44222+ atomic_unchecked_t s_bal_breaks; /* too long searches */
44223+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
44224 spinlock_t s_bal_lock;
44225 unsigned long s_mb_buddies_generated;
44226 unsigned long long s_mb_generation_time;
44227- atomic_t s_mb_lost_chunks;
44228- atomic_t s_mb_preallocated;
44229- atomic_t s_mb_discarded;
44230+ atomic_unchecked_t s_mb_lost_chunks;
44231+ atomic_unchecked_t s_mb_preallocated;
44232+ atomic_unchecked_t s_mb_discarded;
44233 atomic_t s_lock_busy;
44234
44235 /* locality groups */
44236diff --git a/fs/ext4/file.c b/fs/ext4/file.c
44237index e4095e9..1c006c5 100644
44238--- a/fs/ext4/file.c
44239+++ b/fs/ext4/file.c
44240@@ -181,8 +181,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
44241 path.dentry = mnt->mnt_root;
44242 cp = d_path(&path, buf, sizeof(buf));
44243 if (!IS_ERR(cp)) {
44244- memcpy(sbi->s_es->s_last_mounted, cp,
44245- sizeof(sbi->s_es->s_last_mounted));
44246+ strlcpy(sbi->s_es->s_last_mounted, cp,
44247+ sizeof(sbi->s_es->s_last_mounted));
44248 ext4_mark_super_dirty(sb);
44249 }
44250 }
44251diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
44252index f18bfe3..43759b1 100644
44253--- a/fs/ext4/ioctl.c
44254+++ b/fs/ext4/ioctl.c
44255@@ -348,7 +348,7 @@ mext_out:
44256 if (!blk_queue_discard(q))
44257 return -EOPNOTSUPP;
44258
44259- if (copy_from_user(&range, (struct fstrim_range *)arg,
44260+ if (copy_from_user(&range, (struct fstrim_range __user *)arg,
44261 sizeof(range)))
44262 return -EFAULT;
44263
44264@@ -358,7 +358,7 @@ mext_out:
44265 if (ret < 0)
44266 return ret;
44267
44268- if (copy_to_user((struct fstrim_range *)arg, &range,
44269+ if (copy_to_user((struct fstrim_range __user *)arg, &range,
44270 sizeof(range)))
44271 return -EFAULT;
44272
44273diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
44274index 17a5a57..b6be3c5 100644
44275--- a/fs/ext4/mballoc.c
44276+++ b/fs/ext4/mballoc.c
44277@@ -1795,7 +1795,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
44278 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
44279
44280 if (EXT4_SB(sb)->s_mb_stats)
44281- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
44282+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
44283
44284 break;
44285 }
44286@@ -2089,7 +2089,7 @@ repeat:
44287 ac->ac_status = AC_STATUS_CONTINUE;
44288 ac->ac_flags |= EXT4_MB_HINT_FIRST;
44289 cr = 3;
44290- atomic_inc(&sbi->s_mb_lost_chunks);
44291+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
44292 goto repeat;
44293 }
44294 }
44295@@ -2132,6 +2132,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
44296 ext4_grpblk_t counters[16];
44297 } sg;
44298
44299+ pax_track_stack();
44300+
44301 group--;
44302 if (group == 0)
44303 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
44304@@ -2573,25 +2575,25 @@ int ext4_mb_release(struct super_block *sb)
44305 if (sbi->s_mb_stats) {
44306 ext4_msg(sb, KERN_INFO,
44307 "mballoc: %u blocks %u reqs (%u success)",
44308- atomic_read(&sbi->s_bal_allocated),
44309- atomic_read(&sbi->s_bal_reqs),
44310- atomic_read(&sbi->s_bal_success));
44311+ atomic_read_unchecked(&sbi->s_bal_allocated),
44312+ atomic_read_unchecked(&sbi->s_bal_reqs),
44313+ atomic_read_unchecked(&sbi->s_bal_success));
44314 ext4_msg(sb, KERN_INFO,
44315 "mballoc: %u extents scanned, %u goal hits, "
44316 "%u 2^N hits, %u breaks, %u lost",
44317- atomic_read(&sbi->s_bal_ex_scanned),
44318- atomic_read(&sbi->s_bal_goals),
44319- atomic_read(&sbi->s_bal_2orders),
44320- atomic_read(&sbi->s_bal_breaks),
44321- atomic_read(&sbi->s_mb_lost_chunks));
44322+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
44323+ atomic_read_unchecked(&sbi->s_bal_goals),
44324+ atomic_read_unchecked(&sbi->s_bal_2orders),
44325+ atomic_read_unchecked(&sbi->s_bal_breaks),
44326+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
44327 ext4_msg(sb, KERN_INFO,
44328 "mballoc: %lu generated and it took %Lu",
44329 sbi->s_mb_buddies_generated,
44330 sbi->s_mb_generation_time);
44331 ext4_msg(sb, KERN_INFO,
44332 "mballoc: %u preallocated, %u discarded",
44333- atomic_read(&sbi->s_mb_preallocated),
44334- atomic_read(&sbi->s_mb_discarded));
44335+ atomic_read_unchecked(&sbi->s_mb_preallocated),
44336+ atomic_read_unchecked(&sbi->s_mb_discarded));
44337 }
44338
44339 free_percpu(sbi->s_locality_groups);
44340@@ -3070,16 +3072,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
44341 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
44342
44343 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
44344- atomic_inc(&sbi->s_bal_reqs);
44345- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44346+ atomic_inc_unchecked(&sbi->s_bal_reqs);
44347+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44348 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
44349- atomic_inc(&sbi->s_bal_success);
44350- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
44351+ atomic_inc_unchecked(&sbi->s_bal_success);
44352+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
44353 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
44354 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
44355- atomic_inc(&sbi->s_bal_goals);
44356+ atomic_inc_unchecked(&sbi->s_bal_goals);
44357 if (ac->ac_found > sbi->s_mb_max_to_scan)
44358- atomic_inc(&sbi->s_bal_breaks);
44359+ atomic_inc_unchecked(&sbi->s_bal_breaks);
44360 }
44361
44362 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
44363@@ -3477,7 +3479,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
44364 trace_ext4_mb_new_inode_pa(ac, pa);
44365
44366 ext4_mb_use_inode_pa(ac, pa);
44367- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44368+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44369
44370 ei = EXT4_I(ac->ac_inode);
44371 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44372@@ -3537,7 +3539,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
44373 trace_ext4_mb_new_group_pa(ac, pa);
44374
44375 ext4_mb_use_group_pa(ac, pa);
44376- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44377+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44378
44379 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44380 lg = ac->ac_lg;
44381@@ -3625,7 +3627,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
44382 * from the bitmap and continue.
44383 */
44384 }
44385- atomic_add(free, &sbi->s_mb_discarded);
44386+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
44387
44388 return err;
44389 }
44390@@ -3643,7 +3645,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
44391 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
44392 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
44393 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
44394- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44395+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44396 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
44397
44398 return 0;
44399diff --git a/fs/fcntl.c b/fs/fcntl.c
44400index 22764c7..86372c9 100644
44401--- a/fs/fcntl.c
44402+++ b/fs/fcntl.c
44403@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
44404 if (err)
44405 return err;
44406
44407+ if (gr_handle_chroot_fowner(pid, type))
44408+ return -ENOENT;
44409+ if (gr_check_protected_task_fowner(pid, type))
44410+ return -EACCES;
44411+
44412 f_modown(filp, pid, type, force);
44413 return 0;
44414 }
44415@@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
44416
44417 static int f_setown_ex(struct file *filp, unsigned long arg)
44418 {
44419- struct f_owner_ex * __user owner_p = (void * __user)arg;
44420+ struct f_owner_ex __user *owner_p = (void __user *)arg;
44421 struct f_owner_ex owner;
44422 struct pid *pid;
44423 int type;
44424@@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
44425
44426 static int f_getown_ex(struct file *filp, unsigned long arg)
44427 {
44428- struct f_owner_ex * __user owner_p = (void * __user)arg;
44429+ struct f_owner_ex __user *owner_p = (void __user *)arg;
44430 struct f_owner_ex owner;
44431 int ret = 0;
44432
44433@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
44434 switch (cmd) {
44435 case F_DUPFD:
44436 case F_DUPFD_CLOEXEC:
44437+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
44438 if (arg >= rlimit(RLIMIT_NOFILE))
44439 break;
44440 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
44441diff --git a/fs/fifo.c b/fs/fifo.c
44442index b1a524d..4ee270e 100644
44443--- a/fs/fifo.c
44444+++ b/fs/fifo.c
44445@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
44446 */
44447 filp->f_op = &read_pipefifo_fops;
44448 pipe->r_counter++;
44449- if (pipe->readers++ == 0)
44450+ if (atomic_inc_return(&pipe->readers) == 1)
44451 wake_up_partner(inode);
44452
44453- if (!pipe->writers) {
44454+ if (!atomic_read(&pipe->writers)) {
44455 if ((filp->f_flags & O_NONBLOCK)) {
44456 /* suppress POLLHUP until we have
44457 * seen a writer */
44458@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode, struct file *filp)
44459 * errno=ENXIO when there is no process reading the FIFO.
44460 */
44461 ret = -ENXIO;
44462- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
44463+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
44464 goto err;
44465
44466 filp->f_op = &write_pipefifo_fops;
44467 pipe->w_counter++;
44468- if (!pipe->writers++)
44469+ if (atomic_inc_return(&pipe->writers) == 1)
44470 wake_up_partner(inode);
44471
44472- if (!pipe->readers) {
44473+ if (!atomic_read(&pipe->readers)) {
44474 wait_for_partner(inode, &pipe->r_counter);
44475 if (signal_pending(current))
44476 goto err_wr;
44477@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
44478 */
44479 filp->f_op = &rdwr_pipefifo_fops;
44480
44481- pipe->readers++;
44482- pipe->writers++;
44483+ atomic_inc(&pipe->readers);
44484+ atomic_inc(&pipe->writers);
44485 pipe->r_counter++;
44486 pipe->w_counter++;
44487- if (pipe->readers == 1 || pipe->writers == 1)
44488+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
44489 wake_up_partner(inode);
44490 break;
44491
44492@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
44493 return 0;
44494
44495 err_rd:
44496- if (!--pipe->readers)
44497+ if (atomic_dec_and_test(&pipe->readers))
44498 wake_up_interruptible(&pipe->wait);
44499 ret = -ERESTARTSYS;
44500 goto err;
44501
44502 err_wr:
44503- if (!--pipe->writers)
44504+ if (atomic_dec_and_test(&pipe->writers))
44505 wake_up_interruptible(&pipe->wait);
44506 ret = -ERESTARTSYS;
44507 goto err;
44508
44509 err:
44510- if (!pipe->readers && !pipe->writers)
44511+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
44512 free_pipe_info(inode);
44513
44514 err_nocleanup:
44515diff --git a/fs/file.c b/fs/file.c
44516index 4c6992d..104cdea 100644
44517--- a/fs/file.c
44518+++ b/fs/file.c
44519@@ -15,6 +15,7 @@
44520 #include <linux/slab.h>
44521 #include <linux/vmalloc.h>
44522 #include <linux/file.h>
44523+#include <linux/security.h>
44524 #include <linux/fdtable.h>
44525 #include <linux/bitops.h>
44526 #include <linux/interrupt.h>
44527@@ -254,6 +255,7 @@ int expand_files(struct files_struct *files, int nr)
44528 * N.B. For clone tasks sharing a files structure, this test
44529 * will limit the total number of files that can be opened.
44530 */
44531+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
44532 if (nr >= rlimit(RLIMIT_NOFILE))
44533 return -EMFILE;
44534
44535diff --git a/fs/filesystems.c b/fs/filesystems.c
44536index 0845f84..7b4ebef 100644
44537--- a/fs/filesystems.c
44538+++ b/fs/filesystems.c
44539@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(const char *name)
44540 int len = dot ? dot - name : strlen(name);
44541
44542 fs = __get_fs_type(name, len);
44543+
44544+#ifdef CONFIG_GRKERNSEC_MODHARDEN
44545+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
44546+#else
44547 if (!fs && (request_module("%.*s", len, name) == 0))
44548+#endif
44549 fs = __get_fs_type(name, len);
44550
44551 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
44552diff --git a/fs/fs_struct.c b/fs/fs_struct.c
44553index 78b519c..212c0d0 100644
44554--- a/fs/fs_struct.c
44555+++ b/fs/fs_struct.c
44556@@ -4,6 +4,7 @@
44557 #include <linux/path.h>
44558 #include <linux/slab.h>
44559 #include <linux/fs_struct.h>
44560+#include <linux/grsecurity.h>
44561 #include "internal.h"
44562
44563 static inline void path_get_longterm(struct path *path)
44564@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
44565 old_root = fs->root;
44566 fs->root = *path;
44567 path_get_longterm(path);
44568+ gr_set_chroot_entries(current, path);
44569 write_seqcount_end(&fs->seq);
44570 spin_unlock(&fs->lock);
44571 if (old_root.dentry)
44572@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
44573 && fs->root.mnt == old_root->mnt) {
44574 path_get_longterm(new_root);
44575 fs->root = *new_root;
44576+ gr_set_chroot_entries(p, new_root);
44577 count++;
44578 }
44579 if (fs->pwd.dentry == old_root->dentry
44580@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
44581 spin_lock(&fs->lock);
44582 write_seqcount_begin(&fs->seq);
44583 tsk->fs = NULL;
44584- kill = !--fs->users;
44585+ gr_clear_chroot_entries(tsk);
44586+ kill = !atomic_dec_return(&fs->users);
44587 write_seqcount_end(&fs->seq);
44588 spin_unlock(&fs->lock);
44589 task_unlock(tsk);
44590@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
44591 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
44592 /* We don't need to lock fs - think why ;-) */
44593 if (fs) {
44594- fs->users = 1;
44595+ atomic_set(&fs->users, 1);
44596 fs->in_exec = 0;
44597 spin_lock_init(&fs->lock);
44598 seqcount_init(&fs->seq);
44599@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
44600 spin_lock(&old->lock);
44601 fs->root = old->root;
44602 path_get_longterm(&fs->root);
44603+ /* instead of calling gr_set_chroot_entries here,
44604+ we call it from every caller of this function
44605+ */
44606 fs->pwd = old->pwd;
44607 path_get_longterm(&fs->pwd);
44608 spin_unlock(&old->lock);
44609@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
44610
44611 task_lock(current);
44612 spin_lock(&fs->lock);
44613- kill = !--fs->users;
44614+ kill = !atomic_dec_return(&fs->users);
44615 current->fs = new_fs;
44616+ gr_set_chroot_entries(current, &new_fs->root);
44617 spin_unlock(&fs->lock);
44618 task_unlock(current);
44619
44620@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
44621
44622 /* to be mentioned only in INIT_TASK */
44623 struct fs_struct init_fs = {
44624- .users = 1,
44625+ .users = ATOMIC_INIT(1),
44626 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
44627 .seq = SEQCNT_ZERO,
44628 .umask = 0022,
44629@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
44630 task_lock(current);
44631
44632 spin_lock(&init_fs.lock);
44633- init_fs.users++;
44634+ atomic_inc(&init_fs.users);
44635 spin_unlock(&init_fs.lock);
44636
44637 spin_lock(&fs->lock);
44638 current->fs = &init_fs;
44639- kill = !--fs->users;
44640+ gr_set_chroot_entries(current, &current->fs->root);
44641+ kill = !atomic_dec_return(&fs->users);
44642 spin_unlock(&fs->lock);
44643
44644 task_unlock(current);
44645diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
44646index 9905350..02eaec4 100644
44647--- a/fs/fscache/cookie.c
44648+++ b/fs/fscache/cookie.c
44649@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
44650 parent ? (char *) parent->def->name : "<no-parent>",
44651 def->name, netfs_data);
44652
44653- fscache_stat(&fscache_n_acquires);
44654+ fscache_stat_unchecked(&fscache_n_acquires);
44655
44656 /* if there's no parent cookie, then we don't create one here either */
44657 if (!parent) {
44658- fscache_stat(&fscache_n_acquires_null);
44659+ fscache_stat_unchecked(&fscache_n_acquires_null);
44660 _leave(" [no parent]");
44661 return NULL;
44662 }
44663@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
44664 /* allocate and initialise a cookie */
44665 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
44666 if (!cookie) {
44667- fscache_stat(&fscache_n_acquires_oom);
44668+ fscache_stat_unchecked(&fscache_n_acquires_oom);
44669 _leave(" [ENOMEM]");
44670 return NULL;
44671 }
44672@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
44673
44674 switch (cookie->def->type) {
44675 case FSCACHE_COOKIE_TYPE_INDEX:
44676- fscache_stat(&fscache_n_cookie_index);
44677+ fscache_stat_unchecked(&fscache_n_cookie_index);
44678 break;
44679 case FSCACHE_COOKIE_TYPE_DATAFILE:
44680- fscache_stat(&fscache_n_cookie_data);
44681+ fscache_stat_unchecked(&fscache_n_cookie_data);
44682 break;
44683 default:
44684- fscache_stat(&fscache_n_cookie_special);
44685+ fscache_stat_unchecked(&fscache_n_cookie_special);
44686 break;
44687 }
44688
44689@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
44690 if (fscache_acquire_non_index_cookie(cookie) < 0) {
44691 atomic_dec(&parent->n_children);
44692 __fscache_cookie_put(cookie);
44693- fscache_stat(&fscache_n_acquires_nobufs);
44694+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
44695 _leave(" = NULL");
44696 return NULL;
44697 }
44698 }
44699
44700- fscache_stat(&fscache_n_acquires_ok);
44701+ fscache_stat_unchecked(&fscache_n_acquires_ok);
44702 _leave(" = %p", cookie);
44703 return cookie;
44704 }
44705@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
44706 cache = fscache_select_cache_for_object(cookie->parent);
44707 if (!cache) {
44708 up_read(&fscache_addremove_sem);
44709- fscache_stat(&fscache_n_acquires_no_cache);
44710+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
44711 _leave(" = -ENOMEDIUM [no cache]");
44712 return -ENOMEDIUM;
44713 }
44714@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
44715 object = cache->ops->alloc_object(cache, cookie);
44716 fscache_stat_d(&fscache_n_cop_alloc_object);
44717 if (IS_ERR(object)) {
44718- fscache_stat(&fscache_n_object_no_alloc);
44719+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
44720 ret = PTR_ERR(object);
44721 goto error;
44722 }
44723
44724- fscache_stat(&fscache_n_object_alloc);
44725+ fscache_stat_unchecked(&fscache_n_object_alloc);
44726
44727 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
44728
44729@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
44730 struct fscache_object *object;
44731 struct hlist_node *_p;
44732
44733- fscache_stat(&fscache_n_updates);
44734+ fscache_stat_unchecked(&fscache_n_updates);
44735
44736 if (!cookie) {
44737- fscache_stat(&fscache_n_updates_null);
44738+ fscache_stat_unchecked(&fscache_n_updates_null);
44739 _leave(" [no cookie]");
44740 return;
44741 }
44742@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
44743 struct fscache_object *object;
44744 unsigned long event;
44745
44746- fscache_stat(&fscache_n_relinquishes);
44747+ fscache_stat_unchecked(&fscache_n_relinquishes);
44748 if (retire)
44749- fscache_stat(&fscache_n_relinquishes_retire);
44750+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
44751
44752 if (!cookie) {
44753- fscache_stat(&fscache_n_relinquishes_null);
44754+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
44755 _leave(" [no cookie]");
44756 return;
44757 }
44758@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
44759
44760 /* wait for the cookie to finish being instantiated (or to fail) */
44761 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
44762- fscache_stat(&fscache_n_relinquishes_waitcrt);
44763+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
44764 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
44765 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
44766 }
44767diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
44768index f6aad48..88dcf26 100644
44769--- a/fs/fscache/internal.h
44770+++ b/fs/fscache/internal.h
44771@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
44772 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
44773 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
44774
44775-extern atomic_t fscache_n_op_pend;
44776-extern atomic_t fscache_n_op_run;
44777-extern atomic_t fscache_n_op_enqueue;
44778-extern atomic_t fscache_n_op_deferred_release;
44779-extern atomic_t fscache_n_op_release;
44780-extern atomic_t fscache_n_op_gc;
44781-extern atomic_t fscache_n_op_cancelled;
44782-extern atomic_t fscache_n_op_rejected;
44783+extern atomic_unchecked_t fscache_n_op_pend;
44784+extern atomic_unchecked_t fscache_n_op_run;
44785+extern atomic_unchecked_t fscache_n_op_enqueue;
44786+extern atomic_unchecked_t fscache_n_op_deferred_release;
44787+extern atomic_unchecked_t fscache_n_op_release;
44788+extern atomic_unchecked_t fscache_n_op_gc;
44789+extern atomic_unchecked_t fscache_n_op_cancelled;
44790+extern atomic_unchecked_t fscache_n_op_rejected;
44791
44792-extern atomic_t fscache_n_attr_changed;
44793-extern atomic_t fscache_n_attr_changed_ok;
44794-extern atomic_t fscache_n_attr_changed_nobufs;
44795-extern atomic_t fscache_n_attr_changed_nomem;
44796-extern atomic_t fscache_n_attr_changed_calls;
44797+extern atomic_unchecked_t fscache_n_attr_changed;
44798+extern atomic_unchecked_t fscache_n_attr_changed_ok;
44799+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
44800+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
44801+extern atomic_unchecked_t fscache_n_attr_changed_calls;
44802
44803-extern atomic_t fscache_n_allocs;
44804-extern atomic_t fscache_n_allocs_ok;
44805-extern atomic_t fscache_n_allocs_wait;
44806-extern atomic_t fscache_n_allocs_nobufs;
44807-extern atomic_t fscache_n_allocs_intr;
44808-extern atomic_t fscache_n_allocs_object_dead;
44809-extern atomic_t fscache_n_alloc_ops;
44810-extern atomic_t fscache_n_alloc_op_waits;
44811+extern atomic_unchecked_t fscache_n_allocs;
44812+extern atomic_unchecked_t fscache_n_allocs_ok;
44813+extern atomic_unchecked_t fscache_n_allocs_wait;
44814+extern atomic_unchecked_t fscache_n_allocs_nobufs;
44815+extern atomic_unchecked_t fscache_n_allocs_intr;
44816+extern atomic_unchecked_t fscache_n_allocs_object_dead;
44817+extern atomic_unchecked_t fscache_n_alloc_ops;
44818+extern atomic_unchecked_t fscache_n_alloc_op_waits;
44819
44820-extern atomic_t fscache_n_retrievals;
44821-extern atomic_t fscache_n_retrievals_ok;
44822-extern atomic_t fscache_n_retrievals_wait;
44823-extern atomic_t fscache_n_retrievals_nodata;
44824-extern atomic_t fscache_n_retrievals_nobufs;
44825-extern atomic_t fscache_n_retrievals_intr;
44826-extern atomic_t fscache_n_retrievals_nomem;
44827-extern atomic_t fscache_n_retrievals_object_dead;
44828-extern atomic_t fscache_n_retrieval_ops;
44829-extern atomic_t fscache_n_retrieval_op_waits;
44830+extern atomic_unchecked_t fscache_n_retrievals;
44831+extern atomic_unchecked_t fscache_n_retrievals_ok;
44832+extern atomic_unchecked_t fscache_n_retrievals_wait;
44833+extern atomic_unchecked_t fscache_n_retrievals_nodata;
44834+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
44835+extern atomic_unchecked_t fscache_n_retrievals_intr;
44836+extern atomic_unchecked_t fscache_n_retrievals_nomem;
44837+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
44838+extern atomic_unchecked_t fscache_n_retrieval_ops;
44839+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
44840
44841-extern atomic_t fscache_n_stores;
44842-extern atomic_t fscache_n_stores_ok;
44843-extern atomic_t fscache_n_stores_again;
44844-extern atomic_t fscache_n_stores_nobufs;
44845-extern atomic_t fscache_n_stores_oom;
44846-extern atomic_t fscache_n_store_ops;
44847-extern atomic_t fscache_n_store_calls;
44848-extern atomic_t fscache_n_store_pages;
44849-extern atomic_t fscache_n_store_radix_deletes;
44850-extern atomic_t fscache_n_store_pages_over_limit;
44851+extern atomic_unchecked_t fscache_n_stores;
44852+extern atomic_unchecked_t fscache_n_stores_ok;
44853+extern atomic_unchecked_t fscache_n_stores_again;
44854+extern atomic_unchecked_t fscache_n_stores_nobufs;
44855+extern atomic_unchecked_t fscache_n_stores_oom;
44856+extern atomic_unchecked_t fscache_n_store_ops;
44857+extern atomic_unchecked_t fscache_n_store_calls;
44858+extern atomic_unchecked_t fscache_n_store_pages;
44859+extern atomic_unchecked_t fscache_n_store_radix_deletes;
44860+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
44861
44862-extern atomic_t fscache_n_store_vmscan_not_storing;
44863-extern atomic_t fscache_n_store_vmscan_gone;
44864-extern atomic_t fscache_n_store_vmscan_busy;
44865-extern atomic_t fscache_n_store_vmscan_cancelled;
44866+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
44867+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
44868+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
44869+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
44870
44871-extern atomic_t fscache_n_marks;
44872-extern atomic_t fscache_n_uncaches;
44873+extern atomic_unchecked_t fscache_n_marks;
44874+extern atomic_unchecked_t fscache_n_uncaches;
44875
44876-extern atomic_t fscache_n_acquires;
44877-extern atomic_t fscache_n_acquires_null;
44878-extern atomic_t fscache_n_acquires_no_cache;
44879-extern atomic_t fscache_n_acquires_ok;
44880-extern atomic_t fscache_n_acquires_nobufs;
44881-extern atomic_t fscache_n_acquires_oom;
44882+extern atomic_unchecked_t fscache_n_acquires;
44883+extern atomic_unchecked_t fscache_n_acquires_null;
44884+extern atomic_unchecked_t fscache_n_acquires_no_cache;
44885+extern atomic_unchecked_t fscache_n_acquires_ok;
44886+extern atomic_unchecked_t fscache_n_acquires_nobufs;
44887+extern atomic_unchecked_t fscache_n_acquires_oom;
44888
44889-extern atomic_t fscache_n_updates;
44890-extern atomic_t fscache_n_updates_null;
44891-extern atomic_t fscache_n_updates_run;
44892+extern atomic_unchecked_t fscache_n_updates;
44893+extern atomic_unchecked_t fscache_n_updates_null;
44894+extern atomic_unchecked_t fscache_n_updates_run;
44895
44896-extern atomic_t fscache_n_relinquishes;
44897-extern atomic_t fscache_n_relinquishes_null;
44898-extern atomic_t fscache_n_relinquishes_waitcrt;
44899-extern atomic_t fscache_n_relinquishes_retire;
44900+extern atomic_unchecked_t fscache_n_relinquishes;
44901+extern atomic_unchecked_t fscache_n_relinquishes_null;
44902+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
44903+extern atomic_unchecked_t fscache_n_relinquishes_retire;
44904
44905-extern atomic_t fscache_n_cookie_index;
44906-extern atomic_t fscache_n_cookie_data;
44907-extern atomic_t fscache_n_cookie_special;
44908+extern atomic_unchecked_t fscache_n_cookie_index;
44909+extern atomic_unchecked_t fscache_n_cookie_data;
44910+extern atomic_unchecked_t fscache_n_cookie_special;
44911
44912-extern atomic_t fscache_n_object_alloc;
44913-extern atomic_t fscache_n_object_no_alloc;
44914-extern atomic_t fscache_n_object_lookups;
44915-extern atomic_t fscache_n_object_lookups_negative;
44916-extern atomic_t fscache_n_object_lookups_positive;
44917-extern atomic_t fscache_n_object_lookups_timed_out;
44918-extern atomic_t fscache_n_object_created;
44919-extern atomic_t fscache_n_object_avail;
44920-extern atomic_t fscache_n_object_dead;
44921+extern atomic_unchecked_t fscache_n_object_alloc;
44922+extern atomic_unchecked_t fscache_n_object_no_alloc;
44923+extern atomic_unchecked_t fscache_n_object_lookups;
44924+extern atomic_unchecked_t fscache_n_object_lookups_negative;
44925+extern atomic_unchecked_t fscache_n_object_lookups_positive;
44926+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
44927+extern atomic_unchecked_t fscache_n_object_created;
44928+extern atomic_unchecked_t fscache_n_object_avail;
44929+extern atomic_unchecked_t fscache_n_object_dead;
44930
44931-extern atomic_t fscache_n_checkaux_none;
44932-extern atomic_t fscache_n_checkaux_okay;
44933-extern atomic_t fscache_n_checkaux_update;
44934-extern atomic_t fscache_n_checkaux_obsolete;
44935+extern atomic_unchecked_t fscache_n_checkaux_none;
44936+extern atomic_unchecked_t fscache_n_checkaux_okay;
44937+extern atomic_unchecked_t fscache_n_checkaux_update;
44938+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
44939
44940 extern atomic_t fscache_n_cop_alloc_object;
44941 extern atomic_t fscache_n_cop_lookup_object;
44942@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t *stat)
44943 atomic_inc(stat);
44944 }
44945
44946+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
44947+{
44948+ atomic_inc_unchecked(stat);
44949+}
44950+
44951 static inline void fscache_stat_d(atomic_t *stat)
44952 {
44953 atomic_dec(stat);
44954@@ -267,6 +272,7 @@ extern const struct file_operations fscache_stats_fops;
44955
44956 #define __fscache_stat(stat) (NULL)
44957 #define fscache_stat(stat) do {} while (0)
44958+#define fscache_stat_unchecked(stat) do {} while (0)
44959 #define fscache_stat_d(stat) do {} while (0)
44960 #endif
44961
44962diff --git a/fs/fscache/object.c b/fs/fscache/object.c
44963index b6b897c..0ffff9c 100644
44964--- a/fs/fscache/object.c
44965+++ b/fs/fscache/object.c
44966@@ -128,7 +128,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
44967 /* update the object metadata on disk */
44968 case FSCACHE_OBJECT_UPDATING:
44969 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
44970- fscache_stat(&fscache_n_updates_run);
44971+ fscache_stat_unchecked(&fscache_n_updates_run);
44972 fscache_stat(&fscache_n_cop_update_object);
44973 object->cache->ops->update_object(object);
44974 fscache_stat_d(&fscache_n_cop_update_object);
44975@@ -217,7 +217,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
44976 spin_lock(&object->lock);
44977 object->state = FSCACHE_OBJECT_DEAD;
44978 spin_unlock(&object->lock);
44979- fscache_stat(&fscache_n_object_dead);
44980+ fscache_stat_unchecked(&fscache_n_object_dead);
44981 goto terminal_transit;
44982
44983 /* handle the parent cache of this object being withdrawn from
44984@@ -232,7 +232,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
44985 spin_lock(&object->lock);
44986 object->state = FSCACHE_OBJECT_DEAD;
44987 spin_unlock(&object->lock);
44988- fscache_stat(&fscache_n_object_dead);
44989+ fscache_stat_unchecked(&fscache_n_object_dead);
44990 goto terminal_transit;
44991
44992 /* complain about the object being woken up once it is
44993@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct fscache_object *object)
44994 parent->cookie->def->name, cookie->def->name,
44995 object->cache->tag->name);
44996
44997- fscache_stat(&fscache_n_object_lookups);
44998+ fscache_stat_unchecked(&fscache_n_object_lookups);
44999 fscache_stat(&fscache_n_cop_lookup_object);
45000 ret = object->cache->ops->lookup_object(object);
45001 fscache_stat_d(&fscache_n_cop_lookup_object);
45002@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45003 if (ret == -ETIMEDOUT) {
45004 /* probably stuck behind another object, so move this one to
45005 * the back of the queue */
45006- fscache_stat(&fscache_n_object_lookups_timed_out);
45007+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
45008 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45009 }
45010
45011@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
45012
45013 spin_lock(&object->lock);
45014 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45015- fscache_stat(&fscache_n_object_lookups_negative);
45016+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
45017
45018 /* transit here to allow write requests to begin stacking up
45019 * and read requests to begin returning ENODATA */
45020@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fscache_object *object)
45021 * result, in which case there may be data available */
45022 spin_lock(&object->lock);
45023 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45024- fscache_stat(&fscache_n_object_lookups_positive);
45025+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
45026
45027 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
45028
45029@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fscache_object *object)
45030 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45031 } else {
45032 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
45033- fscache_stat(&fscache_n_object_created);
45034+ fscache_stat_unchecked(&fscache_n_object_created);
45035
45036 object->state = FSCACHE_OBJECT_AVAILABLE;
45037 spin_unlock(&object->lock);
45038@@ -602,7 +602,7 @@ static void fscache_object_available(struct fscache_object *object)
45039 fscache_enqueue_dependents(object);
45040
45041 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
45042- fscache_stat(&fscache_n_object_avail);
45043+ fscache_stat_unchecked(&fscache_n_object_avail);
45044
45045 _leave("");
45046 }
45047@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45048 enum fscache_checkaux result;
45049
45050 if (!object->cookie->def->check_aux) {
45051- fscache_stat(&fscache_n_checkaux_none);
45052+ fscache_stat_unchecked(&fscache_n_checkaux_none);
45053 return FSCACHE_CHECKAUX_OKAY;
45054 }
45055
45056@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45057 switch (result) {
45058 /* entry okay as is */
45059 case FSCACHE_CHECKAUX_OKAY:
45060- fscache_stat(&fscache_n_checkaux_okay);
45061+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
45062 break;
45063
45064 /* entry requires update */
45065 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
45066- fscache_stat(&fscache_n_checkaux_update);
45067+ fscache_stat_unchecked(&fscache_n_checkaux_update);
45068 break;
45069
45070 /* entry requires deletion */
45071 case FSCACHE_CHECKAUX_OBSOLETE:
45072- fscache_stat(&fscache_n_checkaux_obsolete);
45073+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
45074 break;
45075
45076 default:
45077diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
45078index 30afdfa..2256596 100644
45079--- a/fs/fscache/operation.c
45080+++ b/fs/fscache/operation.c
45081@@ -17,7 +17,7 @@
45082 #include <linux/slab.h>
45083 #include "internal.h"
45084
45085-atomic_t fscache_op_debug_id;
45086+atomic_unchecked_t fscache_op_debug_id;
45087 EXPORT_SYMBOL(fscache_op_debug_id);
45088
45089 /**
45090@@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
45091 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
45092 ASSERTCMP(atomic_read(&op->usage), >, 0);
45093
45094- fscache_stat(&fscache_n_op_enqueue);
45095+ fscache_stat_unchecked(&fscache_n_op_enqueue);
45096 switch (op->flags & FSCACHE_OP_TYPE) {
45097 case FSCACHE_OP_ASYNC:
45098 _debug("queue async");
45099@@ -69,7 +69,7 @@ static void fscache_run_op(struct fscache_object *object,
45100 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
45101 if (op->processor)
45102 fscache_enqueue_operation(op);
45103- fscache_stat(&fscache_n_op_run);
45104+ fscache_stat_unchecked(&fscache_n_op_run);
45105 }
45106
45107 /*
45108@@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45109 if (object->n_ops > 1) {
45110 atomic_inc(&op->usage);
45111 list_add_tail(&op->pend_link, &object->pending_ops);
45112- fscache_stat(&fscache_n_op_pend);
45113+ fscache_stat_unchecked(&fscache_n_op_pend);
45114 } else if (!list_empty(&object->pending_ops)) {
45115 atomic_inc(&op->usage);
45116 list_add_tail(&op->pend_link, &object->pending_ops);
45117- fscache_stat(&fscache_n_op_pend);
45118+ fscache_stat_unchecked(&fscache_n_op_pend);
45119 fscache_start_operations(object);
45120 } else {
45121 ASSERTCMP(object->n_in_progress, ==, 0);
45122@@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45123 object->n_exclusive++; /* reads and writes must wait */
45124 atomic_inc(&op->usage);
45125 list_add_tail(&op->pend_link, &object->pending_ops);
45126- fscache_stat(&fscache_n_op_pend);
45127+ fscache_stat_unchecked(&fscache_n_op_pend);
45128 ret = 0;
45129 } else {
45130 /* not allowed to submit ops in any other state */
45131@@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_object *object,
45132 if (object->n_exclusive > 0) {
45133 atomic_inc(&op->usage);
45134 list_add_tail(&op->pend_link, &object->pending_ops);
45135- fscache_stat(&fscache_n_op_pend);
45136+ fscache_stat_unchecked(&fscache_n_op_pend);
45137 } else if (!list_empty(&object->pending_ops)) {
45138 atomic_inc(&op->usage);
45139 list_add_tail(&op->pend_link, &object->pending_ops);
45140- fscache_stat(&fscache_n_op_pend);
45141+ fscache_stat_unchecked(&fscache_n_op_pend);
45142 fscache_start_operations(object);
45143 } else {
45144 ASSERTCMP(object->n_exclusive, ==, 0);
45145@@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_object *object,
45146 object->n_ops++;
45147 atomic_inc(&op->usage);
45148 list_add_tail(&op->pend_link, &object->pending_ops);
45149- fscache_stat(&fscache_n_op_pend);
45150+ fscache_stat_unchecked(&fscache_n_op_pend);
45151 ret = 0;
45152 } else if (object->state == FSCACHE_OBJECT_DYING ||
45153 object->state == FSCACHE_OBJECT_LC_DYING ||
45154 object->state == FSCACHE_OBJECT_WITHDRAWING) {
45155- fscache_stat(&fscache_n_op_rejected);
45156+ fscache_stat_unchecked(&fscache_n_op_rejected);
45157 ret = -ENOBUFS;
45158 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
45159 fscache_report_unexpected_submission(object, op, ostate);
45160@@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_operation *op)
45161
45162 ret = -EBUSY;
45163 if (!list_empty(&op->pend_link)) {
45164- fscache_stat(&fscache_n_op_cancelled);
45165+ fscache_stat_unchecked(&fscache_n_op_cancelled);
45166 list_del_init(&op->pend_link);
45167 object->n_ops--;
45168 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
45169@@ -331,7 +331,7 @@ void fscache_put_operation(struct fscache_operation *op)
45170 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
45171 BUG();
45172
45173- fscache_stat(&fscache_n_op_release);
45174+ fscache_stat_unchecked(&fscache_n_op_release);
45175
45176 if (op->release) {
45177 op->release(op);
45178@@ -348,7 +348,7 @@ void fscache_put_operation(struct fscache_operation *op)
45179 * lock, and defer it otherwise */
45180 if (!spin_trylock(&object->lock)) {
45181 _debug("defer put");
45182- fscache_stat(&fscache_n_op_deferred_release);
45183+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
45184
45185 cache = object->cache;
45186 spin_lock(&cache->op_gc_list_lock);
45187@@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_struct *work)
45188
45189 _debug("GC DEFERRED REL OBJ%x OP%x",
45190 object->debug_id, op->debug_id);
45191- fscache_stat(&fscache_n_op_gc);
45192+ fscache_stat_unchecked(&fscache_n_op_gc);
45193
45194 ASSERTCMP(atomic_read(&op->usage), ==, 0);
45195
45196diff --git a/fs/fscache/page.c b/fs/fscache/page.c
45197index 3f7a59b..cf196cc 100644
45198--- a/fs/fscache/page.c
45199+++ b/fs/fscache/page.c
45200@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45201 val = radix_tree_lookup(&cookie->stores, page->index);
45202 if (!val) {
45203 rcu_read_unlock();
45204- fscache_stat(&fscache_n_store_vmscan_not_storing);
45205+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
45206 __fscache_uncache_page(cookie, page);
45207 return true;
45208 }
45209@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45210 spin_unlock(&cookie->stores_lock);
45211
45212 if (xpage) {
45213- fscache_stat(&fscache_n_store_vmscan_cancelled);
45214- fscache_stat(&fscache_n_store_radix_deletes);
45215+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
45216+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45217 ASSERTCMP(xpage, ==, page);
45218 } else {
45219- fscache_stat(&fscache_n_store_vmscan_gone);
45220+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
45221 }
45222
45223 wake_up_bit(&cookie->flags, 0);
45224@@ -107,7 +107,7 @@ page_busy:
45225 /* we might want to wait here, but that could deadlock the allocator as
45226 * the work threads writing to the cache may all end up sleeping
45227 * on memory allocation */
45228- fscache_stat(&fscache_n_store_vmscan_busy);
45229+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
45230 return false;
45231 }
45232 EXPORT_SYMBOL(__fscache_maybe_release_page);
45233@@ -131,7 +131,7 @@ static void fscache_end_page_write(struct fscache_object *object,
45234 FSCACHE_COOKIE_STORING_TAG);
45235 if (!radix_tree_tag_get(&cookie->stores, page->index,
45236 FSCACHE_COOKIE_PENDING_TAG)) {
45237- fscache_stat(&fscache_n_store_radix_deletes);
45238+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45239 xpage = radix_tree_delete(&cookie->stores, page->index);
45240 }
45241 spin_unlock(&cookie->stores_lock);
45242@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
45243
45244 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
45245
45246- fscache_stat(&fscache_n_attr_changed_calls);
45247+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
45248
45249 if (fscache_object_is_active(object)) {
45250 fscache_stat(&fscache_n_cop_attr_changed);
45251@@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45252
45253 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45254
45255- fscache_stat(&fscache_n_attr_changed);
45256+ fscache_stat_unchecked(&fscache_n_attr_changed);
45257
45258 op = kzalloc(sizeof(*op), GFP_KERNEL);
45259 if (!op) {
45260- fscache_stat(&fscache_n_attr_changed_nomem);
45261+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
45262 _leave(" = -ENOMEM");
45263 return -ENOMEM;
45264 }
45265@@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45266 if (fscache_submit_exclusive_op(object, op) < 0)
45267 goto nobufs;
45268 spin_unlock(&cookie->lock);
45269- fscache_stat(&fscache_n_attr_changed_ok);
45270+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
45271 fscache_put_operation(op);
45272 _leave(" = 0");
45273 return 0;
45274@@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45275 nobufs:
45276 spin_unlock(&cookie->lock);
45277 kfree(op);
45278- fscache_stat(&fscache_n_attr_changed_nobufs);
45279+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
45280 _leave(" = %d", -ENOBUFS);
45281 return -ENOBUFS;
45282 }
45283@@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
45284 /* allocate a retrieval operation and attempt to submit it */
45285 op = kzalloc(sizeof(*op), GFP_NOIO);
45286 if (!op) {
45287- fscache_stat(&fscache_n_retrievals_nomem);
45288+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45289 return NULL;
45290 }
45291
45292@@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45293 return 0;
45294 }
45295
45296- fscache_stat(&fscache_n_retrievals_wait);
45297+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
45298
45299 jif = jiffies;
45300 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
45301 fscache_wait_bit_interruptible,
45302 TASK_INTERRUPTIBLE) != 0) {
45303- fscache_stat(&fscache_n_retrievals_intr);
45304+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45305 _leave(" = -ERESTARTSYS");
45306 return -ERESTARTSYS;
45307 }
45308@@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45309 */
45310 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45311 struct fscache_retrieval *op,
45312- atomic_t *stat_op_waits,
45313- atomic_t *stat_object_dead)
45314+ atomic_unchecked_t *stat_op_waits,
45315+ atomic_unchecked_t *stat_object_dead)
45316 {
45317 int ret;
45318
45319@@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45320 goto check_if_dead;
45321
45322 _debug(">>> WT");
45323- fscache_stat(stat_op_waits);
45324+ fscache_stat_unchecked(stat_op_waits);
45325 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
45326 fscache_wait_bit_interruptible,
45327 TASK_INTERRUPTIBLE) < 0) {
45328@@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45329
45330 check_if_dead:
45331 if (unlikely(fscache_object_is_dead(object))) {
45332- fscache_stat(stat_object_dead);
45333+ fscache_stat_unchecked(stat_object_dead);
45334 return -ENOBUFS;
45335 }
45336 return 0;
45337@@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45338
45339 _enter("%p,%p,,,", cookie, page);
45340
45341- fscache_stat(&fscache_n_retrievals);
45342+ fscache_stat_unchecked(&fscache_n_retrievals);
45343
45344 if (hlist_empty(&cookie->backing_objects))
45345 goto nobufs;
45346@@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45347 goto nobufs_unlock;
45348 spin_unlock(&cookie->lock);
45349
45350- fscache_stat(&fscache_n_retrieval_ops);
45351+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45352
45353 /* pin the netfs read context in case we need to do the actual netfs
45354 * read because we've encountered a cache read failure */
45355@@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45356
45357 error:
45358 if (ret == -ENOMEM)
45359- fscache_stat(&fscache_n_retrievals_nomem);
45360+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45361 else if (ret == -ERESTARTSYS)
45362- fscache_stat(&fscache_n_retrievals_intr);
45363+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45364 else if (ret == -ENODATA)
45365- fscache_stat(&fscache_n_retrievals_nodata);
45366+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45367 else if (ret < 0)
45368- fscache_stat(&fscache_n_retrievals_nobufs);
45369+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45370 else
45371- fscache_stat(&fscache_n_retrievals_ok);
45372+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45373
45374 fscache_put_retrieval(op);
45375 _leave(" = %d", ret);
45376@@ -429,7 +429,7 @@ nobufs_unlock:
45377 spin_unlock(&cookie->lock);
45378 kfree(op);
45379 nobufs:
45380- fscache_stat(&fscache_n_retrievals_nobufs);
45381+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45382 _leave(" = -ENOBUFS");
45383 return -ENOBUFS;
45384 }
45385@@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45386
45387 _enter("%p,,%d,,,", cookie, *nr_pages);
45388
45389- fscache_stat(&fscache_n_retrievals);
45390+ fscache_stat_unchecked(&fscache_n_retrievals);
45391
45392 if (hlist_empty(&cookie->backing_objects))
45393 goto nobufs;
45394@@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45395 goto nobufs_unlock;
45396 spin_unlock(&cookie->lock);
45397
45398- fscache_stat(&fscache_n_retrieval_ops);
45399+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45400
45401 /* pin the netfs read context in case we need to do the actual netfs
45402 * read because we've encountered a cache read failure */
45403@@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45404
45405 error:
45406 if (ret == -ENOMEM)
45407- fscache_stat(&fscache_n_retrievals_nomem);
45408+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45409 else if (ret == -ERESTARTSYS)
45410- fscache_stat(&fscache_n_retrievals_intr);
45411+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45412 else if (ret == -ENODATA)
45413- fscache_stat(&fscache_n_retrievals_nodata);
45414+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45415 else if (ret < 0)
45416- fscache_stat(&fscache_n_retrievals_nobufs);
45417+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45418 else
45419- fscache_stat(&fscache_n_retrievals_ok);
45420+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45421
45422 fscache_put_retrieval(op);
45423 _leave(" = %d", ret);
45424@@ -545,7 +545,7 @@ nobufs_unlock:
45425 spin_unlock(&cookie->lock);
45426 kfree(op);
45427 nobufs:
45428- fscache_stat(&fscache_n_retrievals_nobufs);
45429+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45430 _leave(" = -ENOBUFS");
45431 return -ENOBUFS;
45432 }
45433@@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45434
45435 _enter("%p,%p,,,", cookie, page);
45436
45437- fscache_stat(&fscache_n_allocs);
45438+ fscache_stat_unchecked(&fscache_n_allocs);
45439
45440 if (hlist_empty(&cookie->backing_objects))
45441 goto nobufs;
45442@@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45443 goto nobufs_unlock;
45444 spin_unlock(&cookie->lock);
45445
45446- fscache_stat(&fscache_n_alloc_ops);
45447+ fscache_stat_unchecked(&fscache_n_alloc_ops);
45448
45449 ret = fscache_wait_for_retrieval_activation(
45450 object, op,
45451@@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45452
45453 error:
45454 if (ret == -ERESTARTSYS)
45455- fscache_stat(&fscache_n_allocs_intr);
45456+ fscache_stat_unchecked(&fscache_n_allocs_intr);
45457 else if (ret < 0)
45458- fscache_stat(&fscache_n_allocs_nobufs);
45459+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45460 else
45461- fscache_stat(&fscache_n_allocs_ok);
45462+ fscache_stat_unchecked(&fscache_n_allocs_ok);
45463
45464 fscache_put_retrieval(op);
45465 _leave(" = %d", ret);
45466@@ -625,7 +625,7 @@ nobufs_unlock:
45467 spin_unlock(&cookie->lock);
45468 kfree(op);
45469 nobufs:
45470- fscache_stat(&fscache_n_allocs_nobufs);
45471+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45472 _leave(" = -ENOBUFS");
45473 return -ENOBUFS;
45474 }
45475@@ -666,7 +666,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45476
45477 spin_lock(&cookie->stores_lock);
45478
45479- fscache_stat(&fscache_n_store_calls);
45480+ fscache_stat_unchecked(&fscache_n_store_calls);
45481
45482 /* find a page to store */
45483 page = NULL;
45484@@ -677,7 +677,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45485 page = results[0];
45486 _debug("gang %d [%lx]", n, page->index);
45487 if (page->index > op->store_limit) {
45488- fscache_stat(&fscache_n_store_pages_over_limit);
45489+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
45490 goto superseded;
45491 }
45492
45493@@ -689,7 +689,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45494 spin_unlock(&cookie->stores_lock);
45495 spin_unlock(&object->lock);
45496
45497- fscache_stat(&fscache_n_store_pages);
45498+ fscache_stat_unchecked(&fscache_n_store_pages);
45499 fscache_stat(&fscache_n_cop_write_page);
45500 ret = object->cache->ops->write_page(op, page);
45501 fscache_stat_d(&fscache_n_cop_write_page);
45502@@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45503 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45504 ASSERT(PageFsCache(page));
45505
45506- fscache_stat(&fscache_n_stores);
45507+ fscache_stat_unchecked(&fscache_n_stores);
45508
45509 op = kzalloc(sizeof(*op), GFP_NOIO);
45510 if (!op)
45511@@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45512 spin_unlock(&cookie->stores_lock);
45513 spin_unlock(&object->lock);
45514
45515- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
45516+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
45517 op->store_limit = object->store_limit;
45518
45519 if (fscache_submit_op(object, &op->op) < 0)
45520@@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45521
45522 spin_unlock(&cookie->lock);
45523 radix_tree_preload_end();
45524- fscache_stat(&fscache_n_store_ops);
45525- fscache_stat(&fscache_n_stores_ok);
45526+ fscache_stat_unchecked(&fscache_n_store_ops);
45527+ fscache_stat_unchecked(&fscache_n_stores_ok);
45528
45529 /* the work queue now carries its own ref on the object */
45530 fscache_put_operation(&op->op);
45531@@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45532 return 0;
45533
45534 already_queued:
45535- fscache_stat(&fscache_n_stores_again);
45536+ fscache_stat_unchecked(&fscache_n_stores_again);
45537 already_pending:
45538 spin_unlock(&cookie->stores_lock);
45539 spin_unlock(&object->lock);
45540 spin_unlock(&cookie->lock);
45541 radix_tree_preload_end();
45542 kfree(op);
45543- fscache_stat(&fscache_n_stores_ok);
45544+ fscache_stat_unchecked(&fscache_n_stores_ok);
45545 _leave(" = 0");
45546 return 0;
45547
45548@@ -851,14 +851,14 @@ nobufs:
45549 spin_unlock(&cookie->lock);
45550 radix_tree_preload_end();
45551 kfree(op);
45552- fscache_stat(&fscache_n_stores_nobufs);
45553+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
45554 _leave(" = -ENOBUFS");
45555 return -ENOBUFS;
45556
45557 nomem_free:
45558 kfree(op);
45559 nomem:
45560- fscache_stat(&fscache_n_stores_oom);
45561+ fscache_stat_unchecked(&fscache_n_stores_oom);
45562 _leave(" = -ENOMEM");
45563 return -ENOMEM;
45564 }
45565@@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
45566 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45567 ASSERTCMP(page, !=, NULL);
45568
45569- fscache_stat(&fscache_n_uncaches);
45570+ fscache_stat_unchecked(&fscache_n_uncaches);
45571
45572 /* cache withdrawal may beat us to it */
45573 if (!PageFsCache(page))
45574@@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
45575 unsigned long loop;
45576
45577 #ifdef CONFIG_FSCACHE_STATS
45578- atomic_add(pagevec->nr, &fscache_n_marks);
45579+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
45580 #endif
45581
45582 for (loop = 0; loop < pagevec->nr; loop++) {
45583diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
45584index 4765190..2a067f2 100644
45585--- a/fs/fscache/stats.c
45586+++ b/fs/fscache/stats.c
45587@@ -18,95 +18,95 @@
45588 /*
45589 * operation counters
45590 */
45591-atomic_t fscache_n_op_pend;
45592-atomic_t fscache_n_op_run;
45593-atomic_t fscache_n_op_enqueue;
45594-atomic_t fscache_n_op_requeue;
45595-atomic_t fscache_n_op_deferred_release;
45596-atomic_t fscache_n_op_release;
45597-atomic_t fscache_n_op_gc;
45598-atomic_t fscache_n_op_cancelled;
45599-atomic_t fscache_n_op_rejected;
45600+atomic_unchecked_t fscache_n_op_pend;
45601+atomic_unchecked_t fscache_n_op_run;
45602+atomic_unchecked_t fscache_n_op_enqueue;
45603+atomic_unchecked_t fscache_n_op_requeue;
45604+atomic_unchecked_t fscache_n_op_deferred_release;
45605+atomic_unchecked_t fscache_n_op_release;
45606+atomic_unchecked_t fscache_n_op_gc;
45607+atomic_unchecked_t fscache_n_op_cancelled;
45608+atomic_unchecked_t fscache_n_op_rejected;
45609
45610-atomic_t fscache_n_attr_changed;
45611-atomic_t fscache_n_attr_changed_ok;
45612-atomic_t fscache_n_attr_changed_nobufs;
45613-atomic_t fscache_n_attr_changed_nomem;
45614-atomic_t fscache_n_attr_changed_calls;
45615+atomic_unchecked_t fscache_n_attr_changed;
45616+atomic_unchecked_t fscache_n_attr_changed_ok;
45617+atomic_unchecked_t fscache_n_attr_changed_nobufs;
45618+atomic_unchecked_t fscache_n_attr_changed_nomem;
45619+atomic_unchecked_t fscache_n_attr_changed_calls;
45620
45621-atomic_t fscache_n_allocs;
45622-atomic_t fscache_n_allocs_ok;
45623-atomic_t fscache_n_allocs_wait;
45624-atomic_t fscache_n_allocs_nobufs;
45625-atomic_t fscache_n_allocs_intr;
45626-atomic_t fscache_n_allocs_object_dead;
45627-atomic_t fscache_n_alloc_ops;
45628-atomic_t fscache_n_alloc_op_waits;
45629+atomic_unchecked_t fscache_n_allocs;
45630+atomic_unchecked_t fscache_n_allocs_ok;
45631+atomic_unchecked_t fscache_n_allocs_wait;
45632+atomic_unchecked_t fscache_n_allocs_nobufs;
45633+atomic_unchecked_t fscache_n_allocs_intr;
45634+atomic_unchecked_t fscache_n_allocs_object_dead;
45635+atomic_unchecked_t fscache_n_alloc_ops;
45636+atomic_unchecked_t fscache_n_alloc_op_waits;
45637
45638-atomic_t fscache_n_retrievals;
45639-atomic_t fscache_n_retrievals_ok;
45640-atomic_t fscache_n_retrievals_wait;
45641-atomic_t fscache_n_retrievals_nodata;
45642-atomic_t fscache_n_retrievals_nobufs;
45643-atomic_t fscache_n_retrievals_intr;
45644-atomic_t fscache_n_retrievals_nomem;
45645-atomic_t fscache_n_retrievals_object_dead;
45646-atomic_t fscache_n_retrieval_ops;
45647-atomic_t fscache_n_retrieval_op_waits;
45648+atomic_unchecked_t fscache_n_retrievals;
45649+atomic_unchecked_t fscache_n_retrievals_ok;
45650+atomic_unchecked_t fscache_n_retrievals_wait;
45651+atomic_unchecked_t fscache_n_retrievals_nodata;
45652+atomic_unchecked_t fscache_n_retrievals_nobufs;
45653+atomic_unchecked_t fscache_n_retrievals_intr;
45654+atomic_unchecked_t fscache_n_retrievals_nomem;
45655+atomic_unchecked_t fscache_n_retrievals_object_dead;
45656+atomic_unchecked_t fscache_n_retrieval_ops;
45657+atomic_unchecked_t fscache_n_retrieval_op_waits;
45658
45659-atomic_t fscache_n_stores;
45660-atomic_t fscache_n_stores_ok;
45661-atomic_t fscache_n_stores_again;
45662-atomic_t fscache_n_stores_nobufs;
45663-atomic_t fscache_n_stores_oom;
45664-atomic_t fscache_n_store_ops;
45665-atomic_t fscache_n_store_calls;
45666-atomic_t fscache_n_store_pages;
45667-atomic_t fscache_n_store_radix_deletes;
45668-atomic_t fscache_n_store_pages_over_limit;
45669+atomic_unchecked_t fscache_n_stores;
45670+atomic_unchecked_t fscache_n_stores_ok;
45671+atomic_unchecked_t fscache_n_stores_again;
45672+atomic_unchecked_t fscache_n_stores_nobufs;
45673+atomic_unchecked_t fscache_n_stores_oom;
45674+atomic_unchecked_t fscache_n_store_ops;
45675+atomic_unchecked_t fscache_n_store_calls;
45676+atomic_unchecked_t fscache_n_store_pages;
45677+atomic_unchecked_t fscache_n_store_radix_deletes;
45678+atomic_unchecked_t fscache_n_store_pages_over_limit;
45679
45680-atomic_t fscache_n_store_vmscan_not_storing;
45681-atomic_t fscache_n_store_vmscan_gone;
45682-atomic_t fscache_n_store_vmscan_busy;
45683-atomic_t fscache_n_store_vmscan_cancelled;
45684+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45685+atomic_unchecked_t fscache_n_store_vmscan_gone;
45686+atomic_unchecked_t fscache_n_store_vmscan_busy;
45687+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45688
45689-atomic_t fscache_n_marks;
45690-atomic_t fscache_n_uncaches;
45691+atomic_unchecked_t fscache_n_marks;
45692+atomic_unchecked_t fscache_n_uncaches;
45693
45694-atomic_t fscache_n_acquires;
45695-atomic_t fscache_n_acquires_null;
45696-atomic_t fscache_n_acquires_no_cache;
45697-atomic_t fscache_n_acquires_ok;
45698-atomic_t fscache_n_acquires_nobufs;
45699-atomic_t fscache_n_acquires_oom;
45700+atomic_unchecked_t fscache_n_acquires;
45701+atomic_unchecked_t fscache_n_acquires_null;
45702+atomic_unchecked_t fscache_n_acquires_no_cache;
45703+atomic_unchecked_t fscache_n_acquires_ok;
45704+atomic_unchecked_t fscache_n_acquires_nobufs;
45705+atomic_unchecked_t fscache_n_acquires_oom;
45706
45707-atomic_t fscache_n_updates;
45708-atomic_t fscache_n_updates_null;
45709-atomic_t fscache_n_updates_run;
45710+atomic_unchecked_t fscache_n_updates;
45711+atomic_unchecked_t fscache_n_updates_null;
45712+atomic_unchecked_t fscache_n_updates_run;
45713
45714-atomic_t fscache_n_relinquishes;
45715-atomic_t fscache_n_relinquishes_null;
45716-atomic_t fscache_n_relinquishes_waitcrt;
45717-atomic_t fscache_n_relinquishes_retire;
45718+atomic_unchecked_t fscache_n_relinquishes;
45719+atomic_unchecked_t fscache_n_relinquishes_null;
45720+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45721+atomic_unchecked_t fscache_n_relinquishes_retire;
45722
45723-atomic_t fscache_n_cookie_index;
45724-atomic_t fscache_n_cookie_data;
45725-atomic_t fscache_n_cookie_special;
45726+atomic_unchecked_t fscache_n_cookie_index;
45727+atomic_unchecked_t fscache_n_cookie_data;
45728+atomic_unchecked_t fscache_n_cookie_special;
45729
45730-atomic_t fscache_n_object_alloc;
45731-atomic_t fscache_n_object_no_alloc;
45732-atomic_t fscache_n_object_lookups;
45733-atomic_t fscache_n_object_lookups_negative;
45734-atomic_t fscache_n_object_lookups_positive;
45735-atomic_t fscache_n_object_lookups_timed_out;
45736-atomic_t fscache_n_object_created;
45737-atomic_t fscache_n_object_avail;
45738-atomic_t fscache_n_object_dead;
45739+atomic_unchecked_t fscache_n_object_alloc;
45740+atomic_unchecked_t fscache_n_object_no_alloc;
45741+atomic_unchecked_t fscache_n_object_lookups;
45742+atomic_unchecked_t fscache_n_object_lookups_negative;
45743+atomic_unchecked_t fscache_n_object_lookups_positive;
45744+atomic_unchecked_t fscache_n_object_lookups_timed_out;
45745+atomic_unchecked_t fscache_n_object_created;
45746+atomic_unchecked_t fscache_n_object_avail;
45747+atomic_unchecked_t fscache_n_object_dead;
45748
45749-atomic_t fscache_n_checkaux_none;
45750-atomic_t fscache_n_checkaux_okay;
45751-atomic_t fscache_n_checkaux_update;
45752-atomic_t fscache_n_checkaux_obsolete;
45753+atomic_unchecked_t fscache_n_checkaux_none;
45754+atomic_unchecked_t fscache_n_checkaux_okay;
45755+atomic_unchecked_t fscache_n_checkaux_update;
45756+atomic_unchecked_t fscache_n_checkaux_obsolete;
45757
45758 atomic_t fscache_n_cop_alloc_object;
45759 atomic_t fscache_n_cop_lookup_object;
45760@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
45761 seq_puts(m, "FS-Cache statistics\n");
45762
45763 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
45764- atomic_read(&fscache_n_cookie_index),
45765- atomic_read(&fscache_n_cookie_data),
45766- atomic_read(&fscache_n_cookie_special));
45767+ atomic_read_unchecked(&fscache_n_cookie_index),
45768+ atomic_read_unchecked(&fscache_n_cookie_data),
45769+ atomic_read_unchecked(&fscache_n_cookie_special));
45770
45771 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
45772- atomic_read(&fscache_n_object_alloc),
45773- atomic_read(&fscache_n_object_no_alloc),
45774- atomic_read(&fscache_n_object_avail),
45775- atomic_read(&fscache_n_object_dead));
45776+ atomic_read_unchecked(&fscache_n_object_alloc),
45777+ atomic_read_unchecked(&fscache_n_object_no_alloc),
45778+ atomic_read_unchecked(&fscache_n_object_avail),
45779+ atomic_read_unchecked(&fscache_n_object_dead));
45780 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
45781- atomic_read(&fscache_n_checkaux_none),
45782- atomic_read(&fscache_n_checkaux_okay),
45783- atomic_read(&fscache_n_checkaux_update),
45784- atomic_read(&fscache_n_checkaux_obsolete));
45785+ atomic_read_unchecked(&fscache_n_checkaux_none),
45786+ atomic_read_unchecked(&fscache_n_checkaux_okay),
45787+ atomic_read_unchecked(&fscache_n_checkaux_update),
45788+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
45789
45790 seq_printf(m, "Pages : mrk=%u unc=%u\n",
45791- atomic_read(&fscache_n_marks),
45792- atomic_read(&fscache_n_uncaches));
45793+ atomic_read_unchecked(&fscache_n_marks),
45794+ atomic_read_unchecked(&fscache_n_uncaches));
45795
45796 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
45797 " oom=%u\n",
45798- atomic_read(&fscache_n_acquires),
45799- atomic_read(&fscache_n_acquires_null),
45800- atomic_read(&fscache_n_acquires_no_cache),
45801- atomic_read(&fscache_n_acquires_ok),
45802- atomic_read(&fscache_n_acquires_nobufs),
45803- atomic_read(&fscache_n_acquires_oom));
45804+ atomic_read_unchecked(&fscache_n_acquires),
45805+ atomic_read_unchecked(&fscache_n_acquires_null),
45806+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
45807+ atomic_read_unchecked(&fscache_n_acquires_ok),
45808+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
45809+ atomic_read_unchecked(&fscache_n_acquires_oom));
45810
45811 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
45812- atomic_read(&fscache_n_object_lookups),
45813- atomic_read(&fscache_n_object_lookups_negative),
45814- atomic_read(&fscache_n_object_lookups_positive),
45815- atomic_read(&fscache_n_object_created),
45816- atomic_read(&fscache_n_object_lookups_timed_out));
45817+ atomic_read_unchecked(&fscache_n_object_lookups),
45818+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
45819+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
45820+ atomic_read_unchecked(&fscache_n_object_created),
45821+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
45822
45823 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
45824- atomic_read(&fscache_n_updates),
45825- atomic_read(&fscache_n_updates_null),
45826- atomic_read(&fscache_n_updates_run));
45827+ atomic_read_unchecked(&fscache_n_updates),
45828+ atomic_read_unchecked(&fscache_n_updates_null),
45829+ atomic_read_unchecked(&fscache_n_updates_run));
45830
45831 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
45832- atomic_read(&fscache_n_relinquishes),
45833- atomic_read(&fscache_n_relinquishes_null),
45834- atomic_read(&fscache_n_relinquishes_waitcrt),
45835- atomic_read(&fscache_n_relinquishes_retire));
45836+ atomic_read_unchecked(&fscache_n_relinquishes),
45837+ atomic_read_unchecked(&fscache_n_relinquishes_null),
45838+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
45839+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
45840
45841 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
45842- atomic_read(&fscache_n_attr_changed),
45843- atomic_read(&fscache_n_attr_changed_ok),
45844- atomic_read(&fscache_n_attr_changed_nobufs),
45845- atomic_read(&fscache_n_attr_changed_nomem),
45846- atomic_read(&fscache_n_attr_changed_calls));
45847+ atomic_read_unchecked(&fscache_n_attr_changed),
45848+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
45849+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
45850+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
45851+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
45852
45853 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
45854- atomic_read(&fscache_n_allocs),
45855- atomic_read(&fscache_n_allocs_ok),
45856- atomic_read(&fscache_n_allocs_wait),
45857- atomic_read(&fscache_n_allocs_nobufs),
45858- atomic_read(&fscache_n_allocs_intr));
45859+ atomic_read_unchecked(&fscache_n_allocs),
45860+ atomic_read_unchecked(&fscache_n_allocs_ok),
45861+ atomic_read_unchecked(&fscache_n_allocs_wait),
45862+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
45863+ atomic_read_unchecked(&fscache_n_allocs_intr));
45864 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
45865- atomic_read(&fscache_n_alloc_ops),
45866- atomic_read(&fscache_n_alloc_op_waits),
45867- atomic_read(&fscache_n_allocs_object_dead));
45868+ atomic_read_unchecked(&fscache_n_alloc_ops),
45869+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
45870+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
45871
45872 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
45873 " int=%u oom=%u\n",
45874- atomic_read(&fscache_n_retrievals),
45875- atomic_read(&fscache_n_retrievals_ok),
45876- atomic_read(&fscache_n_retrievals_wait),
45877- atomic_read(&fscache_n_retrievals_nodata),
45878- atomic_read(&fscache_n_retrievals_nobufs),
45879- atomic_read(&fscache_n_retrievals_intr),
45880- atomic_read(&fscache_n_retrievals_nomem));
45881+ atomic_read_unchecked(&fscache_n_retrievals),
45882+ atomic_read_unchecked(&fscache_n_retrievals_ok),
45883+ atomic_read_unchecked(&fscache_n_retrievals_wait),
45884+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
45885+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
45886+ atomic_read_unchecked(&fscache_n_retrievals_intr),
45887+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
45888 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
45889- atomic_read(&fscache_n_retrieval_ops),
45890- atomic_read(&fscache_n_retrieval_op_waits),
45891- atomic_read(&fscache_n_retrievals_object_dead));
45892+ atomic_read_unchecked(&fscache_n_retrieval_ops),
45893+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
45894+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
45895
45896 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
45897- atomic_read(&fscache_n_stores),
45898- atomic_read(&fscache_n_stores_ok),
45899- atomic_read(&fscache_n_stores_again),
45900- atomic_read(&fscache_n_stores_nobufs),
45901- atomic_read(&fscache_n_stores_oom));
45902+ atomic_read_unchecked(&fscache_n_stores),
45903+ atomic_read_unchecked(&fscache_n_stores_ok),
45904+ atomic_read_unchecked(&fscache_n_stores_again),
45905+ atomic_read_unchecked(&fscache_n_stores_nobufs),
45906+ atomic_read_unchecked(&fscache_n_stores_oom));
45907 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
45908- atomic_read(&fscache_n_store_ops),
45909- atomic_read(&fscache_n_store_calls),
45910- atomic_read(&fscache_n_store_pages),
45911- atomic_read(&fscache_n_store_radix_deletes),
45912- atomic_read(&fscache_n_store_pages_over_limit));
45913+ atomic_read_unchecked(&fscache_n_store_ops),
45914+ atomic_read_unchecked(&fscache_n_store_calls),
45915+ atomic_read_unchecked(&fscache_n_store_pages),
45916+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
45917+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
45918
45919 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
45920- atomic_read(&fscache_n_store_vmscan_not_storing),
45921- atomic_read(&fscache_n_store_vmscan_gone),
45922- atomic_read(&fscache_n_store_vmscan_busy),
45923- atomic_read(&fscache_n_store_vmscan_cancelled));
45924+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
45925+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
45926+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
45927+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
45928
45929 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
45930- atomic_read(&fscache_n_op_pend),
45931- atomic_read(&fscache_n_op_run),
45932- atomic_read(&fscache_n_op_enqueue),
45933- atomic_read(&fscache_n_op_cancelled),
45934- atomic_read(&fscache_n_op_rejected));
45935+ atomic_read_unchecked(&fscache_n_op_pend),
45936+ atomic_read_unchecked(&fscache_n_op_run),
45937+ atomic_read_unchecked(&fscache_n_op_enqueue),
45938+ atomic_read_unchecked(&fscache_n_op_cancelled),
45939+ atomic_read_unchecked(&fscache_n_op_rejected));
45940 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
45941- atomic_read(&fscache_n_op_deferred_release),
45942- atomic_read(&fscache_n_op_release),
45943- atomic_read(&fscache_n_op_gc));
45944+ atomic_read_unchecked(&fscache_n_op_deferred_release),
45945+ atomic_read_unchecked(&fscache_n_op_release),
45946+ atomic_read_unchecked(&fscache_n_op_gc));
45947
45948 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
45949 atomic_read(&fscache_n_cop_alloc_object),
45950diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
45951index b6cca47..ec782c3 100644
45952--- a/fs/fuse/cuse.c
45953+++ b/fs/fuse/cuse.c
45954@@ -586,10 +586,12 @@ static int __init cuse_init(void)
45955 INIT_LIST_HEAD(&cuse_conntbl[i]);
45956
45957 /* inherit and extend fuse_dev_operations */
45958- cuse_channel_fops = fuse_dev_operations;
45959- cuse_channel_fops.owner = THIS_MODULE;
45960- cuse_channel_fops.open = cuse_channel_open;
45961- cuse_channel_fops.release = cuse_channel_release;
45962+ pax_open_kernel();
45963+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
45964+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
45965+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
45966+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
45967+ pax_close_kernel();
45968
45969 cuse_class = class_create(THIS_MODULE, "cuse");
45970 if (IS_ERR(cuse_class))
45971diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
45972index 2aaf3ea..8e50863 100644
45973--- a/fs/fuse/dev.c
45974+++ b/fs/fuse/dev.c
45975@@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
45976 ret = 0;
45977 pipe_lock(pipe);
45978
45979- if (!pipe->readers) {
45980+ if (!atomic_read(&pipe->readers)) {
45981 send_sig(SIGPIPE, current, 0);
45982 if (!ret)
45983 ret = -EPIPE;
45984diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
45985index 9f63e49..d8a64c0 100644
45986--- a/fs/fuse/dir.c
45987+++ b/fs/fuse/dir.c
45988@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *dentry)
45989 return link;
45990 }
45991
45992-static void free_link(char *link)
45993+static void free_link(const char *link)
45994 {
45995 if (!IS_ERR(link))
45996 free_page((unsigned long) link);
45997diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
45998index 900cf98..3896726 100644
45999--- a/fs/gfs2/inode.c
46000+++ b/fs/gfs2/inode.c
46001@@ -1517,7 +1517,7 @@ out:
46002
46003 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
46004 {
46005- char *s = nd_get_link(nd);
46006+ const char *s = nd_get_link(nd);
46007 if (!IS_ERR(s))
46008 kfree(s);
46009 }
46010diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
46011index 4dfbfec..947c9c2 100644
46012--- a/fs/hfsplus/catalog.c
46013+++ b/fs/hfsplus/catalog.c
46014@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
46015 int err;
46016 u16 type;
46017
46018+ pax_track_stack();
46019+
46020 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
46021 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
46022 if (err)
46023@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
46024 int entry_size;
46025 int err;
46026
46027+ pax_track_stack();
46028+
46029 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
46030 str->name, cnid, inode->i_nlink);
46031 err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
46032@@ -353,6 +357,8 @@ int hfsplus_rename_cat(u32 cnid,
46033 int entry_size, type;
46034 int err;
46035
46036+ pax_track_stack();
46037+
46038 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
46039 cnid, src_dir->i_ino, src_name->name,
46040 dst_dir->i_ino, dst_name->name);
46041diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
46042index 25b2443..09a3341 100644
46043--- a/fs/hfsplus/dir.c
46044+++ b/fs/hfsplus/dir.c
46045@@ -131,6 +131,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
46046 struct hfsplus_readdir_data *rd;
46047 u16 type;
46048
46049+ pax_track_stack();
46050+
46051 if (filp->f_pos >= inode->i_size)
46052 return 0;
46053
46054diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
46055index 4cc1e3a..ad0f70b 100644
46056--- a/fs/hfsplus/inode.c
46057+++ b/fs/hfsplus/inode.c
46058@@ -501,6 +501,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
46059 int res = 0;
46060 u16 type;
46061
46062+ pax_track_stack();
46063+
46064 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
46065
46066 HFSPLUS_I(inode)->linkid = 0;
46067@@ -564,6 +566,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
46068 struct hfs_find_data fd;
46069 hfsplus_cat_entry entry;
46070
46071+ pax_track_stack();
46072+
46073 if (HFSPLUS_IS_RSRC(inode))
46074 main_inode = HFSPLUS_I(inode)->rsrc_inode;
46075
46076diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
46077index fbaa669..c548cd0 100644
46078--- a/fs/hfsplus/ioctl.c
46079+++ b/fs/hfsplus/ioctl.c
46080@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
46081 struct hfsplus_cat_file *file;
46082 int res;
46083
46084+ pax_track_stack();
46085+
46086 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46087 return -EOPNOTSUPP;
46088
46089@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
46090 struct hfsplus_cat_file *file;
46091 ssize_t res = 0;
46092
46093+ pax_track_stack();
46094+
46095 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46096 return -EOPNOTSUPP;
46097
46098diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
46099index d24a9b6..dd9b3dd 100644
46100--- a/fs/hfsplus/super.c
46101+++ b/fs/hfsplus/super.c
46102@@ -347,6 +347,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
46103 u64 last_fs_block, last_fs_page;
46104 int err;
46105
46106+ pax_track_stack();
46107+
46108 err = -EINVAL;
46109 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
46110 if (!sbi)
46111diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
46112index ec88953..cb5e98e 100644
46113--- a/fs/hugetlbfs/inode.c
46114+++ b/fs/hugetlbfs/inode.c
46115@@ -915,7 +915,7 @@ static struct file_system_type hugetlbfs_fs_type = {
46116 .kill_sb = kill_litter_super,
46117 };
46118
46119-static struct vfsmount *hugetlbfs_vfsmount;
46120+struct vfsmount *hugetlbfs_vfsmount;
46121
46122 static int can_do_hugetlb_shm(void)
46123 {
46124diff --git a/fs/inode.c b/fs/inode.c
46125index ec79246..054c36a 100644
46126--- a/fs/inode.c
46127+++ b/fs/inode.c
46128@@ -787,8 +787,8 @@ unsigned int get_next_ino(void)
46129
46130 #ifdef CONFIG_SMP
46131 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
46132- static atomic_t shared_last_ino;
46133- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
46134+ static atomic_unchecked_t shared_last_ino;
46135+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
46136
46137 res = next - LAST_INO_BATCH;
46138 }
46139diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
46140index f94fc48..3bb8d30 100644
46141--- a/fs/jbd/checkpoint.c
46142+++ b/fs/jbd/checkpoint.c
46143@@ -358,6 +358,8 @@ int log_do_checkpoint(journal_t *journal)
46144 tid_t this_tid;
46145 int result;
46146
46147+ pax_track_stack();
46148+
46149 jbd_debug(1, "Start checkpoint\n");
46150
46151 /*
46152diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
46153index 16a5047..88ff6ca 100644
46154--- a/fs/jffs2/compr_rtime.c
46155+++ b/fs/jffs2/compr_rtime.c
46156@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
46157 int outpos = 0;
46158 int pos=0;
46159
46160+ pax_track_stack();
46161+
46162 memset(positions,0,sizeof(positions));
46163
46164 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
46165@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
46166 int outpos = 0;
46167 int pos=0;
46168
46169+ pax_track_stack();
46170+
46171 memset(positions,0,sizeof(positions));
46172
46173 while (outpos<destlen) {
46174diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
46175index 9e7cec8..4713089 100644
46176--- a/fs/jffs2/compr_rubin.c
46177+++ b/fs/jffs2/compr_rubin.c
46178@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
46179 int ret;
46180 uint32_t mysrclen, mydstlen;
46181
46182+ pax_track_stack();
46183+
46184 mysrclen = *sourcelen;
46185 mydstlen = *dstlen - 8;
46186
46187diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
46188index e513f19..2ab1351 100644
46189--- a/fs/jffs2/erase.c
46190+++ b/fs/jffs2/erase.c
46191@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
46192 struct jffs2_unknown_node marker = {
46193 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
46194 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46195- .totlen = cpu_to_je32(c->cleanmarker_size)
46196+ .totlen = cpu_to_je32(c->cleanmarker_size),
46197+ .hdr_crc = cpu_to_je32(0)
46198 };
46199
46200 jffs2_prealloc_raw_node_refs(c, jeb, 1);
46201diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
46202index 4515bea..178f2d6 100644
46203--- a/fs/jffs2/wbuf.c
46204+++ b/fs/jffs2/wbuf.c
46205@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
46206 {
46207 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
46208 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46209- .totlen = constant_cpu_to_je32(8)
46210+ .totlen = constant_cpu_to_je32(8),
46211+ .hdr_crc = constant_cpu_to_je32(0)
46212 };
46213
46214 /*
46215diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
46216index 3e93cdd..c8a80e1 100644
46217--- a/fs/jffs2/xattr.c
46218+++ b/fs/jffs2/xattr.c
46219@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
46220
46221 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
46222
46223+ pax_track_stack();
46224+
46225 /* Phase.1 : Merge same xref */
46226 for (i=0; i < XREF_TMPHASH_SIZE; i++)
46227 xref_tmphash[i] = NULL;
46228diff --git a/fs/jfs/super.c b/fs/jfs/super.c
46229index 06c8a67..589dbbd 100644
46230--- a/fs/jfs/super.c
46231+++ b/fs/jfs/super.c
46232@@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
46233
46234 jfs_inode_cachep =
46235 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
46236- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
46237+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
46238 init_once);
46239 if (jfs_inode_cachep == NULL)
46240 return -ENOMEM;
46241diff --git a/fs/libfs.c b/fs/libfs.c
46242index c18e9a1..0b04e2c 100644
46243--- a/fs/libfs.c
46244+++ b/fs/libfs.c
46245@@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46246
46247 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
46248 struct dentry *next;
46249+ char d_name[sizeof(next->d_iname)];
46250+ const unsigned char *name;
46251+
46252 next = list_entry(p, struct dentry, d_u.d_child);
46253 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
46254 if (!simple_positive(next)) {
46255@@ -174,7 +177,12 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46256
46257 spin_unlock(&next->d_lock);
46258 spin_unlock(&dentry->d_lock);
46259- if (filldir(dirent, next->d_name.name,
46260+ name = next->d_name.name;
46261+ if (name == next->d_iname) {
46262+ memcpy(d_name, name, next->d_name.len);
46263+ name = d_name;
46264+ }
46265+ if (filldir(dirent, name,
46266 next->d_name.len, filp->f_pos,
46267 next->d_inode->i_ino,
46268 dt_type(next->d_inode)) < 0)
46269diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
46270index 8392cb8..ae8ed40 100644
46271--- a/fs/lockd/clntproc.c
46272+++ b/fs/lockd/clntproc.c
46273@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
46274 /*
46275 * Cookie counter for NLM requests
46276 */
46277-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
46278+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
46279
46280 void nlmclnt_next_cookie(struct nlm_cookie *c)
46281 {
46282- u32 cookie = atomic_inc_return(&nlm_cookie);
46283+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
46284
46285 memcpy(c->data, &cookie, 4);
46286 c->len=4;
46287@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
46288 struct nlm_rqst reqst, *req;
46289 int status;
46290
46291+ pax_track_stack();
46292+
46293 req = &reqst;
46294 memset(req, 0, sizeof(*req));
46295 locks_init_lock(&req->a_args.lock.fl);
46296diff --git a/fs/locks.c b/fs/locks.c
46297index 703f545..150a552 100644
46298--- a/fs/locks.c
46299+++ b/fs/locks.c
46300@@ -2022,16 +2022,16 @@ void locks_remove_flock(struct file *filp)
46301 return;
46302
46303 if (filp->f_op && filp->f_op->flock) {
46304- struct file_lock fl = {
46305+ struct file_lock flock = {
46306 .fl_pid = current->tgid,
46307 .fl_file = filp,
46308 .fl_flags = FL_FLOCK,
46309 .fl_type = F_UNLCK,
46310 .fl_end = OFFSET_MAX,
46311 };
46312- filp->f_op->flock(filp, F_SETLKW, &fl);
46313- if (fl.fl_ops && fl.fl_ops->fl_release_private)
46314- fl.fl_ops->fl_release_private(&fl);
46315+ filp->f_op->flock(filp, F_SETLKW, &flock);
46316+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
46317+ flock.fl_ops->fl_release_private(&flock);
46318 }
46319
46320 lock_flocks();
46321diff --git a/fs/logfs/super.c b/fs/logfs/super.c
46322index ce03a18..ac8c14f 100644
46323--- a/fs/logfs/super.c
46324+++ b/fs/logfs/super.c
46325@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super_block *sb)
46326 struct logfs_disk_super _ds1, *ds1 = &_ds1;
46327 int err, valid0, valid1;
46328
46329+ pax_track_stack();
46330+
46331 /* read first superblock */
46332 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
46333 if (err)
46334diff --git a/fs/minix/bitmap.c b/fs/minix/bitmap.c
46335index 3f32bcb..7c82c29 100644
46336--- a/fs/minix/bitmap.c
46337+++ b/fs/minix/bitmap.c
46338@@ -20,10 +20,11 @@ static const int nibblemap[] = { 4,3,3,2,3,2,2,1,3,2,2,1,2,1,1,0 };
46339
46340 static DEFINE_SPINLOCK(bitmap_lock);
46341
46342-static unsigned long count_free(struct buffer_head *map[], unsigned numblocks, __u32 numbits)
46343+static unsigned long count_free(struct buffer_head *map[], unsigned blocksize, __u32 numbits)
46344 {
46345 unsigned i, j, sum = 0;
46346 struct buffer_head *bh;
46347+ unsigned numblocks = minix_blocks_needed(numbits, blocksize);
46348
46349 for (i=0; i<numblocks-1; i++) {
46350 if (!(bh=map[i]))
46351@@ -105,10 +106,12 @@ int minix_new_block(struct inode * inode)
46352 return 0;
46353 }
46354
46355-unsigned long minix_count_free_blocks(struct minix_sb_info *sbi)
46356+unsigned long minix_count_free_blocks(struct super_block *sb)
46357 {
46358- return (count_free(sbi->s_zmap, sbi->s_zmap_blocks,
46359- sbi->s_nzones - sbi->s_firstdatazone + 1)
46360+ struct minix_sb_info *sbi = minix_sb(sb);
46361+ u32 bits = sbi->s_nzones - (sbi->s_firstdatazone + 1);
46362+
46363+ return (count_free(sbi->s_zmap, sb->s_blocksize, bits)
46364 << sbi->s_log_zone_size);
46365 }
46366
46367@@ -273,7 +276,10 @@ struct inode *minix_new_inode(const struct inode *dir, int mode, int *error)
46368 return inode;
46369 }
46370
46371-unsigned long minix_count_free_inodes(struct minix_sb_info *sbi)
46372+unsigned long minix_count_free_inodes(struct super_block *sb)
46373 {
46374- return count_free(sbi->s_imap, sbi->s_imap_blocks, sbi->s_ninodes + 1);
46375+ struct minix_sb_info *sbi = minix_sb(sb);
46376+ u32 bits = sbi->s_ninodes + 1;
46377+
46378+ return count_free(sbi->s_imap, sb->s_blocksize, bits);
46379 }
46380diff --git a/fs/minix/inode.c b/fs/minix/inode.c
46381index e7d23e2..1ed1351 100644
46382--- a/fs/minix/inode.c
46383+++ b/fs/minix/inode.c
46384@@ -279,6 +279,27 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
46385 else if (sbi->s_mount_state & MINIX_ERROR_FS)
46386 printk("MINIX-fs: mounting file system with errors, "
46387 "running fsck is recommended\n");
46388+
46389+ /* Apparently minix can create filesystems that allocate more blocks for
46390+ * the bitmaps than needed. We simply ignore that, but verify it didn't
46391+ * create one with not enough blocks and bail out if so.
46392+ */
46393+ block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
46394+ if (sbi->s_imap_blocks < block) {
46395+ printk("MINIX-fs: file system does not have enough "
46396+ "imap blocks allocated. Refusing to mount\n");
46397+ goto out_iput;
46398+ }
46399+
46400+ block = minix_blocks_needed(
46401+ (sbi->s_nzones - (sbi->s_firstdatazone + 1)),
46402+ s->s_blocksize);
46403+ if (sbi->s_zmap_blocks < block) {
46404+ printk("MINIX-fs: file system does not have enough "
46405+ "zmap blocks allocated. Refusing to mount.\n");
46406+ goto out_iput;
46407+ }
46408+
46409 return 0;
46410
46411 out_iput:
46412@@ -339,10 +360,10 @@ static int minix_statfs(struct dentry *dentry, struct kstatfs *buf)
46413 buf->f_type = sb->s_magic;
46414 buf->f_bsize = sb->s_blocksize;
46415 buf->f_blocks = (sbi->s_nzones - sbi->s_firstdatazone) << sbi->s_log_zone_size;
46416- buf->f_bfree = minix_count_free_blocks(sbi);
46417+ buf->f_bfree = minix_count_free_blocks(sb);
46418 buf->f_bavail = buf->f_bfree;
46419 buf->f_files = sbi->s_ninodes;
46420- buf->f_ffree = minix_count_free_inodes(sbi);
46421+ buf->f_ffree = minix_count_free_inodes(sb);
46422 buf->f_namelen = sbi->s_namelen;
46423 buf->f_fsid.val[0] = (u32)id;
46424 buf->f_fsid.val[1] = (u32)(id >> 32);
46425diff --git a/fs/minix/minix.h b/fs/minix/minix.h
46426index 341e212..6415fe0 100644
46427--- a/fs/minix/minix.h
46428+++ b/fs/minix/minix.h
46429@@ -48,10 +48,10 @@ extern struct minix_inode * minix_V1_raw_inode(struct super_block *, ino_t, stru
46430 extern struct minix2_inode * minix_V2_raw_inode(struct super_block *, ino_t, struct buffer_head **);
46431 extern struct inode * minix_new_inode(const struct inode *, int, int *);
46432 extern void minix_free_inode(struct inode * inode);
46433-extern unsigned long minix_count_free_inodes(struct minix_sb_info *sbi);
46434+extern unsigned long minix_count_free_inodes(struct super_block *sb);
46435 extern int minix_new_block(struct inode * inode);
46436 extern void minix_free_block(struct inode *inode, unsigned long block);
46437-extern unsigned long minix_count_free_blocks(struct minix_sb_info *sbi);
46438+extern unsigned long minix_count_free_blocks(struct super_block *sb);
46439 extern int minix_getattr(struct vfsmount *, struct dentry *, struct kstat *);
46440 extern int minix_prepare_chunk(struct page *page, loff_t pos, unsigned len);
46441
46442@@ -88,6 +88,11 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)
46443 return list_entry(inode, struct minix_inode_info, vfs_inode);
46444 }
46445
46446+static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
46447+{
46448+ return DIV_ROUND_UP(bits, blocksize * 8);
46449+}
46450+
46451 #if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
46452 defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
46453
46454diff --git a/fs/namei.c b/fs/namei.c
46455index 3d15072..c1ddf9c 100644
46456--- a/fs/namei.c
46457+++ b/fs/namei.c
46458@@ -281,16 +281,32 @@ int generic_permission(struct inode *inode, int mask)
46459 if (ret != -EACCES)
46460 return ret;
46461
46462+#ifdef CONFIG_GRKERNSEC
46463+ /* we'll block if we have to log due to a denied capability use */
46464+ if (mask & MAY_NOT_BLOCK)
46465+ return -ECHILD;
46466+#endif
46467+
46468 if (S_ISDIR(inode->i_mode)) {
46469 /* DACs are overridable for directories */
46470- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46471- return 0;
46472 if (!(mask & MAY_WRITE))
46473- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46474+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46475+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46476 return 0;
46477+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46478+ return 0;
46479 return -EACCES;
46480 }
46481 /*
46482+ * Searching includes executable on directories, else just read.
46483+ */
46484+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46485+ if (mask == MAY_READ)
46486+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46487+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46488+ return 0;
46489+
46490+ /*
46491 * Read/write DACs are always overridable.
46492 * Executable DACs are overridable when there is
46493 * at least one exec bit set.
46494@@ -299,14 +315,6 @@ int generic_permission(struct inode *inode, int mask)
46495 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46496 return 0;
46497
46498- /*
46499- * Searching includes executable on directories, else just read.
46500- */
46501- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46502- if (mask == MAY_READ)
46503- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46504- return 0;
46505-
46506 return -EACCES;
46507 }
46508
46509@@ -653,11 +661,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
46510 return error;
46511 }
46512
46513+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
46514+ dentry->d_inode, dentry, nd->path.mnt)) {
46515+ error = -EACCES;
46516+ *p = ERR_PTR(error); /* no ->put_link(), please */
46517+ path_put(&nd->path);
46518+ return error;
46519+ }
46520+
46521 nd->last_type = LAST_BIND;
46522 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
46523 error = PTR_ERR(*p);
46524 if (!IS_ERR(*p)) {
46525- char *s = nd_get_link(nd);
46526+ const char *s = nd_get_link(nd);
46527 error = 0;
46528 if (s)
46529 error = __vfs_follow_link(nd, s);
46530@@ -1622,6 +1638,21 @@ static int path_lookupat(int dfd, const char *name,
46531 if (!err)
46532 err = complete_walk(nd);
46533
46534+ if (!(nd->flags & LOOKUP_PARENT)) {
46535+#ifdef CONFIG_GRKERNSEC
46536+ if (flags & LOOKUP_RCU) {
46537+ if (!err)
46538+ path_put(&nd->path);
46539+ err = -ECHILD;
46540+ } else
46541+#endif
46542+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46543+ if (!err)
46544+ path_put(&nd->path);
46545+ err = -ENOENT;
46546+ }
46547+ }
46548+
46549 if (!err && nd->flags & LOOKUP_DIRECTORY) {
46550 if (!nd->inode->i_op->lookup) {
46551 path_put(&nd->path);
46552@@ -1649,6 +1680,15 @@ static int do_path_lookup(int dfd, const char *name,
46553 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
46554
46555 if (likely(!retval)) {
46556+ if (*name != '/' && nd->path.dentry && nd->inode) {
46557+#ifdef CONFIG_GRKERNSEC
46558+ if (flags & LOOKUP_RCU)
46559+ return -ECHILD;
46560+#endif
46561+ if (!gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
46562+ return -ENOENT;
46563+ }
46564+
46565 if (unlikely(!audit_dummy_context())) {
46566 if (nd->path.dentry && nd->inode)
46567 audit_inode(name, nd->path.dentry);
46568@@ -2049,7 +2089,27 @@ static int may_open(struct path *path, int acc_mode, int flag)
46569 /*
46570 * Ensure there are no outstanding leases on the file.
46571 */
46572- return break_lease(inode, flag);
46573+ error = break_lease(inode, flag);
46574+
46575+ if (error)
46576+ return error;
46577+
46578+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
46579+ error = -EPERM;
46580+ goto exit;
46581+ }
46582+
46583+ if (gr_handle_rawio(inode)) {
46584+ error = -EPERM;
46585+ goto exit;
46586+ }
46587+
46588+ if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
46589+ error = -EACCES;
46590+ goto exit;
46591+ }
46592+exit:
46593+ return error;
46594 }
46595
46596 static int handle_truncate(struct file *filp)
46597@@ -2110,6 +2170,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46598 error = complete_walk(nd);
46599 if (error)
46600 return ERR_PTR(error);
46601+#ifdef CONFIG_GRKERNSEC
46602+ if (nd->flags & LOOKUP_RCU) {
46603+ error = -ECHILD;
46604+ goto exit;
46605+ }
46606+#endif
46607+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46608+ error = -ENOENT;
46609+ goto exit;
46610+ }
46611 audit_inode(pathname, nd->path.dentry);
46612 if (open_flag & O_CREAT) {
46613 error = -EISDIR;
46614@@ -2120,6 +2190,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46615 error = complete_walk(nd);
46616 if (error)
46617 return ERR_PTR(error);
46618+#ifdef CONFIG_GRKERNSEC
46619+ if (nd->flags & LOOKUP_RCU) {
46620+ error = -ECHILD;
46621+ goto exit;
46622+ }
46623+#endif
46624+ if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
46625+ error = -ENOENT;
46626+ goto exit;
46627+ }
46628 audit_inode(pathname, dir);
46629 goto ok;
46630 }
46631@@ -2141,6 +2221,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46632 error = complete_walk(nd);
46633 if (error)
46634 return ERR_PTR(-ECHILD);
46635+#ifdef CONFIG_GRKERNSEC
46636+ if (nd->flags & LOOKUP_RCU) {
46637+ error = -ECHILD;
46638+ goto exit;
46639+ }
46640+#endif
46641+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46642+ error = -ENOENT;
46643+ goto exit;
46644+ }
46645
46646 error = -ENOTDIR;
46647 if (nd->flags & LOOKUP_DIRECTORY) {
46648@@ -2181,6 +2271,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46649 /* Negative dentry, just create the file */
46650 if (!dentry->d_inode) {
46651 int mode = op->mode;
46652+
46653+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, open_flag, acc_mode, mode)) {
46654+ error = -EACCES;
46655+ goto exit_mutex_unlock;
46656+ }
46657+
46658 if (!IS_POSIXACL(dir->d_inode))
46659 mode &= ~current_umask();
46660 /*
46661@@ -2204,6 +2300,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46662 error = vfs_create(dir->d_inode, dentry, mode, nd);
46663 if (error)
46664 goto exit_mutex_unlock;
46665+ else
46666+ gr_handle_create(path->dentry, path->mnt);
46667 mutex_unlock(&dir->d_inode->i_mutex);
46668 dput(nd->path.dentry);
46669 nd->path.dentry = dentry;
46670@@ -2213,6 +2311,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46671 /*
46672 * It already exists.
46673 */
46674+
46675+ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
46676+ error = -ENOENT;
46677+ goto exit_mutex_unlock;
46678+ }
46679+
46680+ /* only check if O_CREAT is specified, all other checks need to go
46681+ into may_open */
46682+ if (gr_handle_fifo(path->dentry, path->mnt, dir, open_flag, acc_mode)) {
46683+ error = -EACCES;
46684+ goto exit_mutex_unlock;
46685+ }
46686+
46687 mutex_unlock(&dir->d_inode->i_mutex);
46688 audit_inode(pathname, path->dentry);
46689
46690@@ -2425,6 +2536,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
46691 *path = nd.path;
46692 return dentry;
46693 eexist:
46694+ if (!gr_acl_handle_hidden_file(dentry, nd.path.mnt)) {
46695+ dput(dentry);
46696+ dentry = ERR_PTR(-ENOENT);
46697+ goto fail;
46698+ }
46699 dput(dentry);
46700 dentry = ERR_PTR(-EEXIST);
46701 fail:
46702@@ -2447,6 +2563,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
46703 }
46704 EXPORT_SYMBOL(user_path_create);
46705
46706+static struct dentry *user_path_create_with_name(int dfd, const char __user *pathname, struct path *path, char **to, int is_dir)
46707+{
46708+ char *tmp = getname(pathname);
46709+ struct dentry *res;
46710+ if (IS_ERR(tmp))
46711+ return ERR_CAST(tmp);
46712+ res = kern_path_create(dfd, tmp, path, is_dir);
46713+ if (IS_ERR(res))
46714+ putname(tmp);
46715+ else
46716+ *to = tmp;
46717+ return res;
46718+}
46719+
46720 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
46721 {
46722 int error = may_create(dir, dentry);
46723@@ -2514,6 +2644,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
46724 error = mnt_want_write(path.mnt);
46725 if (error)
46726 goto out_dput;
46727+
46728+ if (gr_handle_chroot_mknod(dentry, path.mnt, mode)) {
46729+ error = -EPERM;
46730+ goto out_drop_write;
46731+ }
46732+
46733+ if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
46734+ error = -EACCES;
46735+ goto out_drop_write;
46736+ }
46737+
46738 error = security_path_mknod(&path, dentry, mode, dev);
46739 if (error)
46740 goto out_drop_write;
46741@@ -2531,6 +2672,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
46742 }
46743 out_drop_write:
46744 mnt_drop_write(path.mnt);
46745+
46746+ if (!error)
46747+ gr_handle_create(dentry, path.mnt);
46748 out_dput:
46749 dput(dentry);
46750 mutex_unlock(&path.dentry->d_inode->i_mutex);
46751@@ -2580,12 +2724,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
46752 error = mnt_want_write(path.mnt);
46753 if (error)
46754 goto out_dput;
46755+
46756+ if (!gr_acl_handle_mkdir(dentry, path.dentry, path.mnt)) {
46757+ error = -EACCES;
46758+ goto out_drop_write;
46759+ }
46760+
46761 error = security_path_mkdir(&path, dentry, mode);
46762 if (error)
46763 goto out_drop_write;
46764 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
46765 out_drop_write:
46766 mnt_drop_write(path.mnt);
46767+
46768+ if (!error)
46769+ gr_handle_create(dentry, path.mnt);
46770 out_dput:
46771 dput(dentry);
46772 mutex_unlock(&path.dentry->d_inode->i_mutex);
46773@@ -2665,6 +2818,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
46774 char * name;
46775 struct dentry *dentry;
46776 struct nameidata nd;
46777+ ino_t saved_ino = 0;
46778+ dev_t saved_dev = 0;
46779
46780 error = user_path_parent(dfd, pathname, &nd, &name);
46781 if (error)
46782@@ -2693,6 +2848,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
46783 error = -ENOENT;
46784 goto exit3;
46785 }
46786+
46787+ saved_ino = dentry->d_inode->i_ino;
46788+ saved_dev = gr_get_dev_from_dentry(dentry);
46789+
46790+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
46791+ error = -EACCES;
46792+ goto exit3;
46793+ }
46794+
46795 error = mnt_want_write(nd.path.mnt);
46796 if (error)
46797 goto exit3;
46798@@ -2700,6 +2864,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
46799 if (error)
46800 goto exit4;
46801 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
46802+ if (!error && (saved_dev || saved_ino))
46803+ gr_handle_delete(saved_ino, saved_dev);
46804 exit4:
46805 mnt_drop_write(nd.path.mnt);
46806 exit3:
46807@@ -2762,6 +2928,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46808 struct dentry *dentry;
46809 struct nameidata nd;
46810 struct inode *inode = NULL;
46811+ ino_t saved_ino = 0;
46812+ dev_t saved_dev = 0;
46813
46814 error = user_path_parent(dfd, pathname, &nd, &name);
46815 if (error)
46816@@ -2784,6 +2952,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46817 if (!inode)
46818 goto slashes;
46819 ihold(inode);
46820+
46821+ if (inode->i_nlink <= 1) {
46822+ saved_ino = inode->i_ino;
46823+ saved_dev = gr_get_dev_from_dentry(dentry);
46824+ }
46825+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
46826+ error = -EACCES;
46827+ goto exit2;
46828+ }
46829+
46830 error = mnt_want_write(nd.path.mnt);
46831 if (error)
46832 goto exit2;
46833@@ -2791,6 +2969,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46834 if (error)
46835 goto exit3;
46836 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
46837+ if (!error && (saved_ino || saved_dev))
46838+ gr_handle_delete(saved_ino, saved_dev);
46839 exit3:
46840 mnt_drop_write(nd.path.mnt);
46841 exit2:
46842@@ -2866,10 +3046,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
46843 error = mnt_want_write(path.mnt);
46844 if (error)
46845 goto out_dput;
46846+
46847+ if (!gr_acl_handle_symlink(dentry, path.dentry, path.mnt, from)) {
46848+ error = -EACCES;
46849+ goto out_drop_write;
46850+ }
46851+
46852 error = security_path_symlink(&path, dentry, from);
46853 if (error)
46854 goto out_drop_write;
46855 error = vfs_symlink(path.dentry->d_inode, dentry, from);
46856+ if (!error)
46857+ gr_handle_create(dentry, path.mnt);
46858 out_drop_write:
46859 mnt_drop_write(path.mnt);
46860 out_dput:
46861@@ -2941,6 +3129,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46862 {
46863 struct dentry *new_dentry;
46864 struct path old_path, new_path;
46865+ char *to = NULL;
46866 int how = 0;
46867 int error;
46868
46869@@ -2964,7 +3153,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46870 if (error)
46871 return error;
46872
46873- new_dentry = user_path_create(newdfd, newname, &new_path, 0);
46874+ new_dentry = user_path_create_with_name(newdfd, newname, &new_path, &to, 0);
46875 error = PTR_ERR(new_dentry);
46876 if (IS_ERR(new_dentry))
46877 goto out;
46878@@ -2975,13 +3164,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46879 error = mnt_want_write(new_path.mnt);
46880 if (error)
46881 goto out_dput;
46882+
46883+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
46884+ old_path.dentry->d_inode,
46885+ old_path.dentry->d_inode->i_mode, to)) {
46886+ error = -EACCES;
46887+ goto out_drop_write;
46888+ }
46889+
46890+ if (!gr_acl_handle_link(new_dentry, new_path.dentry, new_path.mnt,
46891+ old_path.dentry, old_path.mnt, to)) {
46892+ error = -EACCES;
46893+ goto out_drop_write;
46894+ }
46895+
46896 error = security_path_link(old_path.dentry, &new_path, new_dentry);
46897 if (error)
46898 goto out_drop_write;
46899 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
46900+ if (!error)
46901+ gr_handle_create(new_dentry, new_path.mnt);
46902 out_drop_write:
46903 mnt_drop_write(new_path.mnt);
46904 out_dput:
46905+ putname(to);
46906 dput(new_dentry);
46907 mutex_unlock(&new_path.dentry->d_inode->i_mutex);
46908 path_put(&new_path);
46909@@ -3153,6 +3359,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46910 char *to;
46911 int error;
46912
46913+ pax_track_stack();
46914+
46915 error = user_path_parent(olddfd, oldname, &oldnd, &from);
46916 if (error)
46917 goto exit;
46918@@ -3209,6 +3417,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46919 if (new_dentry == trap)
46920 goto exit5;
46921
46922+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
46923+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
46924+ to);
46925+ if (error)
46926+ goto exit5;
46927+
46928 error = mnt_want_write(oldnd.path.mnt);
46929 if (error)
46930 goto exit5;
46931@@ -3218,6 +3432,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46932 goto exit6;
46933 error = vfs_rename(old_dir->d_inode, old_dentry,
46934 new_dir->d_inode, new_dentry);
46935+ if (!error)
46936+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
46937+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
46938 exit6:
46939 mnt_drop_write(oldnd.path.mnt);
46940 exit5:
46941@@ -3243,6 +3460,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
46942
46943 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
46944 {
46945+ char tmpbuf[64];
46946+ const char *newlink;
46947 int len;
46948
46949 len = PTR_ERR(link);
46950@@ -3252,7 +3471,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
46951 len = strlen(link);
46952 if (len > (unsigned) buflen)
46953 len = buflen;
46954- if (copy_to_user(buffer, link, len))
46955+
46956+ if (len < sizeof(tmpbuf)) {
46957+ memcpy(tmpbuf, link, len);
46958+ newlink = tmpbuf;
46959+ } else
46960+ newlink = link;
46961+
46962+ if (copy_to_user(buffer, newlink, len))
46963 len = -EFAULT;
46964 out:
46965 return len;
46966diff --git a/fs/namespace.c b/fs/namespace.c
46967index 5e7f2e9..cd13685 100644
46968--- a/fs/namespace.c
46969+++ b/fs/namespace.c
46970@@ -1326,6 +1326,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
46971 if (!(sb->s_flags & MS_RDONLY))
46972 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
46973 up_write(&sb->s_umount);
46974+
46975+ gr_log_remount(mnt->mnt_devname, retval);
46976+
46977 return retval;
46978 }
46979
46980@@ -1345,6 +1348,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
46981 br_write_unlock(vfsmount_lock);
46982 up_write(&namespace_sem);
46983 release_mounts(&umount_list);
46984+
46985+ gr_log_unmount(mnt->mnt_devname, retval);
46986+
46987 return retval;
46988 }
46989
46990@@ -2336,6 +2342,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
46991 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
46992 MS_STRICTATIME);
46993
46994+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
46995+ retval = -EPERM;
46996+ goto dput_out;
46997+ }
46998+
46999+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
47000+ retval = -EPERM;
47001+ goto dput_out;
47002+ }
47003+
47004 if (flags & MS_REMOUNT)
47005 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
47006 data_page);
47007@@ -2350,6 +2366,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47008 dev_name, data_page);
47009 dput_out:
47010 path_put(&path);
47011+
47012+ gr_log_mount(dev_name, dir_name, retval);
47013+
47014 return retval;
47015 }
47016
47017@@ -2573,6 +2592,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
47018 if (error)
47019 goto out2;
47020
47021+ if (gr_handle_chroot_pivot()) {
47022+ error = -EPERM;
47023+ goto out2;
47024+ }
47025+
47026 get_fs_root(current->fs, &root);
47027 error = lock_mount(&old);
47028 if (error)
47029diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
47030index 9c51f62..503b252 100644
47031--- a/fs/ncpfs/dir.c
47032+++ b/fs/ncpfs/dir.c
47033@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentry, struct nameidata *nd)
47034 int res, val = 0, len;
47035 __u8 __name[NCP_MAXPATHLEN + 1];
47036
47037+ pax_track_stack();
47038+
47039 if (dentry == dentry->d_sb->s_root)
47040 return 1;
47041
47042@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
47043 int error, res, len;
47044 __u8 __name[NCP_MAXPATHLEN + 1];
47045
47046+ pax_track_stack();
47047+
47048 error = -EIO;
47049 if (!ncp_conn_valid(server))
47050 goto finished;
47051@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
47052 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
47053 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
47054
47055+ pax_track_stack();
47056+
47057 ncp_age_dentry(server, dentry);
47058 len = sizeof(__name);
47059 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
47060@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
47061 int error, len;
47062 __u8 __name[NCP_MAXPATHLEN + 1];
47063
47064+ pax_track_stack();
47065+
47066 DPRINTK("ncp_mkdir: making %s/%s\n",
47067 dentry->d_parent->d_name.name, dentry->d_name.name);
47068
47069@@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
47070 int old_len, new_len;
47071 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
47072
47073+ pax_track_stack();
47074+
47075 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
47076 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
47077 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
47078diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
47079index 202f370..9d4565e 100644
47080--- a/fs/ncpfs/inode.c
47081+++ b/fs/ncpfs/inode.c
47082@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
47083 #endif
47084 struct ncp_entry_info finfo;
47085
47086+ pax_track_stack();
47087+
47088 memset(&data, 0, sizeof(data));
47089 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
47090 if (!server)
47091diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
47092index 281ae95..dd895b9 100644
47093--- a/fs/nfs/blocklayout/blocklayout.c
47094+++ b/fs/nfs/blocklayout/blocklayout.c
47095@@ -90,7 +90,7 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
47096 */
47097 struct parallel_io {
47098 struct kref refcnt;
47099- struct rpc_call_ops call_ops;
47100+ rpc_call_ops_no_const call_ops;
47101 void (*pnfs_callback) (void *data);
47102 void *data;
47103 };
47104diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
47105index 679d2f5..ef1ffec 100644
47106--- a/fs/nfs/inode.c
47107+++ b/fs/nfs/inode.c
47108@@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
47109 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
47110 nfsi->attrtimeo_timestamp = jiffies;
47111
47112- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
47113+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
47114 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
47115 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
47116 else
47117@@ -1002,16 +1002,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
47118 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
47119 }
47120
47121-static atomic_long_t nfs_attr_generation_counter;
47122+static atomic_long_unchecked_t nfs_attr_generation_counter;
47123
47124 static unsigned long nfs_read_attr_generation_counter(void)
47125 {
47126- return atomic_long_read(&nfs_attr_generation_counter);
47127+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
47128 }
47129
47130 unsigned long nfs_inc_attr_generation_counter(void)
47131 {
47132- return atomic_long_inc_return(&nfs_attr_generation_counter);
47133+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
47134 }
47135
47136 void nfs_fattr_init(struct nfs_fattr *fattr)
47137diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
47138index 6f8bcc7..8f823c5 100644
47139--- a/fs/nfsd/nfs4state.c
47140+++ b/fs/nfsd/nfs4state.c
47141@@ -3999,6 +3999,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
47142 unsigned int strhashval;
47143 int err;
47144
47145+ pax_track_stack();
47146+
47147 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
47148 (long long) lock->lk_offset,
47149 (long long) lock->lk_length);
47150diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
47151index f810996..cec8977 100644
47152--- a/fs/nfsd/nfs4xdr.c
47153+++ b/fs/nfsd/nfs4xdr.c
47154@@ -1875,6 +1875,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
47155 .dentry = dentry,
47156 };
47157
47158+ pax_track_stack();
47159+
47160 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
47161 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
47162 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
47163diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
47164index acf88ae..4fd6245 100644
47165--- a/fs/nfsd/vfs.c
47166+++ b/fs/nfsd/vfs.c
47167@@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47168 } else {
47169 oldfs = get_fs();
47170 set_fs(KERNEL_DS);
47171- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
47172+ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
47173 set_fs(oldfs);
47174 }
47175
47176@@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47177
47178 /* Write the data. */
47179 oldfs = get_fs(); set_fs(KERNEL_DS);
47180- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
47181+ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
47182 set_fs(oldfs);
47183 if (host_err < 0)
47184 goto out_nfserr;
47185@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
47186 */
47187
47188 oldfs = get_fs(); set_fs(KERNEL_DS);
47189- host_err = inode->i_op->readlink(dentry, buf, *lenp);
47190+ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
47191 set_fs(oldfs);
47192
47193 if (host_err < 0)
47194diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
47195index 9fde1c0..14e8827 100644
47196--- a/fs/notify/fanotify/fanotify_user.c
47197+++ b/fs/notify/fanotify/fanotify_user.c
47198@@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
47199 goto out_close_fd;
47200
47201 ret = -EFAULT;
47202- if (copy_to_user(buf, &fanotify_event_metadata,
47203+ if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
47204+ copy_to_user(buf, &fanotify_event_metadata,
47205 fanotify_event_metadata.event_len))
47206 goto out_kill_access_response;
47207
47208diff --git a/fs/notify/notification.c b/fs/notify/notification.c
47209index ee18815..7aa5d01 100644
47210--- a/fs/notify/notification.c
47211+++ b/fs/notify/notification.c
47212@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
47213 * get set to 0 so it will never get 'freed'
47214 */
47215 static struct fsnotify_event *q_overflow_event;
47216-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47217+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47218
47219 /**
47220 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
47221@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47222 */
47223 u32 fsnotify_get_cookie(void)
47224 {
47225- return atomic_inc_return(&fsnotify_sync_cookie);
47226+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
47227 }
47228 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
47229
47230diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
47231index 99e3610..02c1068 100644
47232--- a/fs/ntfs/dir.c
47233+++ b/fs/ntfs/dir.c
47234@@ -1329,7 +1329,7 @@ find_next_index_buffer:
47235 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
47236 ~(s64)(ndir->itype.index.block_size - 1)));
47237 /* Bounds checks. */
47238- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47239+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47240 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
47241 "inode 0x%lx or driver bug.", vdir->i_ino);
47242 goto err_out;
47243diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
47244index c587e2d..3641eaa 100644
47245--- a/fs/ntfs/file.c
47246+++ b/fs/ntfs/file.c
47247@@ -2229,6 +2229,6 @@ const struct inode_operations ntfs_file_inode_ops = {
47248 #endif /* NTFS_RW */
47249 };
47250
47251-const struct file_operations ntfs_empty_file_ops = {};
47252+const struct file_operations ntfs_empty_file_ops __read_only;
47253
47254-const struct inode_operations ntfs_empty_inode_ops = {};
47255+const struct inode_operations ntfs_empty_inode_ops __read_only;
47256diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
47257index 210c352..a174f83 100644
47258--- a/fs/ocfs2/localalloc.c
47259+++ b/fs/ocfs2/localalloc.c
47260@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
47261 goto bail;
47262 }
47263
47264- atomic_inc(&osb->alloc_stats.moves);
47265+ atomic_inc_unchecked(&osb->alloc_stats.moves);
47266
47267 bail:
47268 if (handle)
47269diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
47270index 53aa41e..d7df9f1 100644
47271--- a/fs/ocfs2/namei.c
47272+++ b/fs/ocfs2/namei.c
47273@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *old_dir,
47274 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
47275 struct ocfs2_dir_lookup_result target_insert = { NULL, };
47276
47277+ pax_track_stack();
47278+
47279 /* At some point it might be nice to break this function up a
47280 * bit. */
47281
47282diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
47283index 4092858..51c70ff 100644
47284--- a/fs/ocfs2/ocfs2.h
47285+++ b/fs/ocfs2/ocfs2.h
47286@@ -235,11 +235,11 @@ enum ocfs2_vol_state
47287
47288 struct ocfs2_alloc_stats
47289 {
47290- atomic_t moves;
47291- atomic_t local_data;
47292- atomic_t bitmap_data;
47293- atomic_t bg_allocs;
47294- atomic_t bg_extends;
47295+ atomic_unchecked_t moves;
47296+ atomic_unchecked_t local_data;
47297+ atomic_unchecked_t bitmap_data;
47298+ atomic_unchecked_t bg_allocs;
47299+ atomic_unchecked_t bg_extends;
47300 };
47301
47302 enum ocfs2_local_alloc_state
47303diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
47304index ba5d97e..c77db25 100644
47305--- a/fs/ocfs2/suballoc.c
47306+++ b/fs/ocfs2/suballoc.c
47307@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
47308 mlog_errno(status);
47309 goto bail;
47310 }
47311- atomic_inc(&osb->alloc_stats.bg_extends);
47312+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
47313
47314 /* You should never ask for this much metadata */
47315 BUG_ON(bits_wanted >
47316@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handle,
47317 mlog_errno(status);
47318 goto bail;
47319 }
47320- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47321+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47322
47323 *suballoc_loc = res.sr_bg_blkno;
47324 *suballoc_bit_start = res.sr_bit_offset;
47325@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_t *handle,
47326 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
47327 res->sr_bits);
47328
47329- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47330+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47331
47332 BUG_ON(res->sr_bits != 1);
47333
47334@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *handle,
47335 mlog_errno(status);
47336 goto bail;
47337 }
47338- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47339+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47340
47341 BUG_ON(res.sr_bits != 1);
47342
47343@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47344 cluster_start,
47345 num_clusters);
47346 if (!status)
47347- atomic_inc(&osb->alloc_stats.local_data);
47348+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
47349 } else {
47350 if (min_clusters > (osb->bitmap_cpg - 1)) {
47351 /* The only paths asking for contiguousness
47352@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47353 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
47354 res.sr_bg_blkno,
47355 res.sr_bit_offset);
47356- atomic_inc(&osb->alloc_stats.bitmap_data);
47357+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
47358 *num_clusters = res.sr_bits;
47359 }
47360 }
47361diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
47362index 56f6102..1433c29 100644
47363--- a/fs/ocfs2/super.c
47364+++ b/fs/ocfs2/super.c
47365@@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
47366 "%10s => GlobalAllocs: %d LocalAllocs: %d "
47367 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
47368 "Stats",
47369- atomic_read(&osb->alloc_stats.bitmap_data),
47370- atomic_read(&osb->alloc_stats.local_data),
47371- atomic_read(&osb->alloc_stats.bg_allocs),
47372- atomic_read(&osb->alloc_stats.moves),
47373- atomic_read(&osb->alloc_stats.bg_extends));
47374+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
47375+ atomic_read_unchecked(&osb->alloc_stats.local_data),
47376+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
47377+ atomic_read_unchecked(&osb->alloc_stats.moves),
47378+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
47379
47380 out += snprintf(buf + out, len - out,
47381 "%10s => State: %u Descriptor: %llu Size: %u bits "
47382@@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
47383 spin_lock_init(&osb->osb_xattr_lock);
47384 ocfs2_init_steal_slots(osb);
47385
47386- atomic_set(&osb->alloc_stats.moves, 0);
47387- atomic_set(&osb->alloc_stats.local_data, 0);
47388- atomic_set(&osb->alloc_stats.bitmap_data, 0);
47389- atomic_set(&osb->alloc_stats.bg_allocs, 0);
47390- atomic_set(&osb->alloc_stats.bg_extends, 0);
47391+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
47392+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
47393+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
47394+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
47395+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
47396
47397 /* Copy the blockcheck stats from the superblock probe */
47398 osb->osb_ecc_stats = *stats;
47399diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
47400index 5d22872..523db20 100644
47401--- a/fs/ocfs2/symlink.c
47402+++ b/fs/ocfs2/symlink.c
47403@@ -142,7 +142,7 @@ bail:
47404
47405 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
47406 {
47407- char *link = nd_get_link(nd);
47408+ const char *link = nd_get_link(nd);
47409 if (!IS_ERR(link))
47410 kfree(link);
47411 }
47412diff --git a/fs/open.c b/fs/open.c
47413index f711921..28d5958 100644
47414--- a/fs/open.c
47415+++ b/fs/open.c
47416@@ -112,6 +112,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
47417 error = locks_verify_truncate(inode, NULL, length);
47418 if (!error)
47419 error = security_path_truncate(&path);
47420+
47421+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
47422+ error = -EACCES;
47423+
47424 if (!error)
47425 error = do_truncate(path.dentry, length, 0, NULL);
47426
47427@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
47428 if (__mnt_is_readonly(path.mnt))
47429 res = -EROFS;
47430
47431+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
47432+ res = -EACCES;
47433+
47434 out_path_release:
47435 path_put(&path);
47436 out:
47437@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
47438 if (error)
47439 goto dput_and_out;
47440
47441+ gr_log_chdir(path.dentry, path.mnt);
47442+
47443 set_fs_pwd(current->fs, &path);
47444
47445 dput_and_out:
47446@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
47447 goto out_putf;
47448
47449 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
47450+
47451+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
47452+ error = -EPERM;
47453+
47454+ if (!error)
47455+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
47456+
47457 if (!error)
47458 set_fs_pwd(current->fs, &file->f_path);
47459 out_putf:
47460@@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
47461 if (error)
47462 goto dput_and_out;
47463
47464+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
47465+ goto dput_and_out;
47466+
47467 set_fs_root(current->fs, &path);
47468+
47469+ gr_handle_chroot_chdir(&path);
47470+
47471 error = 0;
47472 dput_and_out:
47473 path_put(&path);
47474@@ -456,6 +478,16 @@ static int chmod_common(struct path *path, umode_t mode)
47475 if (error)
47476 return error;
47477 mutex_lock(&inode->i_mutex);
47478+
47479+ if (!gr_acl_handle_fchmod(path->dentry, path->mnt, mode)) {
47480+ error = -EACCES;
47481+ goto out_unlock;
47482+ }
47483+ if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
47484+ error = -EACCES;
47485+ goto out_unlock;
47486+ }
47487+
47488 error = security_path_chmod(path->dentry, path->mnt, mode);
47489 if (error)
47490 goto out_unlock;
47491@@ -506,6 +538,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
47492 int error;
47493 struct iattr newattrs;
47494
47495+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
47496+ return -EACCES;
47497+
47498 newattrs.ia_valid = ATTR_CTIME;
47499 if (user != (uid_t) -1) {
47500 newattrs.ia_valid |= ATTR_UID;
47501diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
47502index 6296b40..417c00f 100644
47503--- a/fs/partitions/efi.c
47504+++ b/fs/partitions/efi.c
47505@@ -234,14 +234,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
47506 if (!gpt)
47507 return NULL;
47508
47509+ if (!le32_to_cpu(gpt->num_partition_entries))
47510+ return NULL;
47511+ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
47512+ if (!pte)
47513+ return NULL;
47514+
47515 count = le32_to_cpu(gpt->num_partition_entries) *
47516 le32_to_cpu(gpt->sizeof_partition_entry);
47517- if (!count)
47518- return NULL;
47519- pte = kzalloc(count, GFP_KERNEL);
47520- if (!pte)
47521- return NULL;
47522-
47523 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
47524 (u8 *) pte,
47525 count) < count) {
47526diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
47527index af9fdf0..75b15c3 100644
47528--- a/fs/partitions/ldm.c
47529+++ b/fs/partitions/ldm.c
47530@@ -1322,7 +1322,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
47531 goto found;
47532 }
47533
47534- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
47535+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
47536 if (!f) {
47537 ldm_crit ("Out of memory.");
47538 return false;
47539diff --git a/fs/pipe.c b/fs/pipe.c
47540index 0e0be1d..f62a72d 100644
47541--- a/fs/pipe.c
47542+++ b/fs/pipe.c
47543@@ -420,9 +420,9 @@ redo:
47544 }
47545 if (bufs) /* More to do? */
47546 continue;
47547- if (!pipe->writers)
47548+ if (!atomic_read(&pipe->writers))
47549 break;
47550- if (!pipe->waiting_writers) {
47551+ if (!atomic_read(&pipe->waiting_writers)) {
47552 /* syscall merging: Usually we must not sleep
47553 * if O_NONBLOCK is set, or if we got some data.
47554 * But if a writer sleeps in kernel space, then
47555@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
47556 mutex_lock(&inode->i_mutex);
47557 pipe = inode->i_pipe;
47558
47559- if (!pipe->readers) {
47560+ if (!atomic_read(&pipe->readers)) {
47561 send_sig(SIGPIPE, current, 0);
47562 ret = -EPIPE;
47563 goto out;
47564@@ -530,7 +530,7 @@ redo1:
47565 for (;;) {
47566 int bufs;
47567
47568- if (!pipe->readers) {
47569+ if (!atomic_read(&pipe->readers)) {
47570 send_sig(SIGPIPE, current, 0);
47571 if (!ret)
47572 ret = -EPIPE;
47573@@ -616,9 +616,9 @@ redo2:
47574 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
47575 do_wakeup = 0;
47576 }
47577- pipe->waiting_writers++;
47578+ atomic_inc(&pipe->waiting_writers);
47579 pipe_wait(pipe);
47580- pipe->waiting_writers--;
47581+ atomic_dec(&pipe->waiting_writers);
47582 }
47583 out:
47584 mutex_unlock(&inode->i_mutex);
47585@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table *wait)
47586 mask = 0;
47587 if (filp->f_mode & FMODE_READ) {
47588 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
47589- if (!pipe->writers && filp->f_version != pipe->w_counter)
47590+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
47591 mask |= POLLHUP;
47592 }
47593
47594@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table *wait)
47595 * Most Unices do not set POLLERR for FIFOs but on Linux they
47596 * behave exactly like pipes for poll().
47597 */
47598- if (!pipe->readers)
47599+ if (!atomic_read(&pipe->readers))
47600 mask |= POLLERR;
47601 }
47602
47603@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int decr, int decw)
47604
47605 mutex_lock(&inode->i_mutex);
47606 pipe = inode->i_pipe;
47607- pipe->readers -= decr;
47608- pipe->writers -= decw;
47609+ atomic_sub(decr, &pipe->readers);
47610+ atomic_sub(decw, &pipe->writers);
47611
47612- if (!pipe->readers && !pipe->writers) {
47613+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
47614 free_pipe_info(inode);
47615 } else {
47616 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
47617@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
47618
47619 if (inode->i_pipe) {
47620 ret = 0;
47621- inode->i_pipe->readers++;
47622+ atomic_inc(&inode->i_pipe->readers);
47623 }
47624
47625 mutex_unlock(&inode->i_mutex);
47626@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
47627
47628 if (inode->i_pipe) {
47629 ret = 0;
47630- inode->i_pipe->writers++;
47631+ atomic_inc(&inode->i_pipe->writers);
47632 }
47633
47634 mutex_unlock(&inode->i_mutex);
47635@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
47636 if (inode->i_pipe) {
47637 ret = 0;
47638 if (filp->f_mode & FMODE_READ)
47639- inode->i_pipe->readers++;
47640+ atomic_inc(&inode->i_pipe->readers);
47641 if (filp->f_mode & FMODE_WRITE)
47642- inode->i_pipe->writers++;
47643+ atomic_inc(&inode->i_pipe->writers);
47644 }
47645
47646 mutex_unlock(&inode->i_mutex);
47647@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
47648 inode->i_pipe = NULL;
47649 }
47650
47651-static struct vfsmount *pipe_mnt __read_mostly;
47652+struct vfsmount *pipe_mnt __read_mostly;
47653
47654 /*
47655 * pipefs_dname() is called from d_path().
47656@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(void)
47657 goto fail_iput;
47658 inode->i_pipe = pipe;
47659
47660- pipe->readers = pipe->writers = 1;
47661+ atomic_set(&pipe->readers, 1);
47662+ atomic_set(&pipe->writers, 1);
47663 inode->i_fop = &rdwr_pipefifo_fops;
47664
47665 /*
47666diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
47667index 15af622..0e9f4467 100644
47668--- a/fs/proc/Kconfig
47669+++ b/fs/proc/Kconfig
47670@@ -30,12 +30,12 @@ config PROC_FS
47671
47672 config PROC_KCORE
47673 bool "/proc/kcore support" if !ARM
47674- depends on PROC_FS && MMU
47675+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
47676
47677 config PROC_VMCORE
47678 bool "/proc/vmcore support"
47679- depends on PROC_FS && CRASH_DUMP
47680- default y
47681+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
47682+ default n
47683 help
47684 Exports the dump image of crashed kernel in ELF format.
47685
47686@@ -59,8 +59,8 @@ config PROC_SYSCTL
47687 limited in memory.
47688
47689 config PROC_PAGE_MONITOR
47690- default y
47691- depends on PROC_FS && MMU
47692+ default n
47693+ depends on PROC_FS && MMU && !GRKERNSEC
47694 bool "Enable /proc page monitoring" if EXPERT
47695 help
47696 Various /proc files exist to monitor process memory utilization:
47697diff --git a/fs/proc/array.c b/fs/proc/array.c
47698index 3a1dafd..c7fed72 100644
47699--- a/fs/proc/array.c
47700+++ b/fs/proc/array.c
47701@@ -60,6 +60,7 @@
47702 #include <linux/tty.h>
47703 #include <linux/string.h>
47704 #include <linux/mman.h>
47705+#include <linux/grsecurity.h>
47706 #include <linux/proc_fs.h>
47707 #include <linux/ioport.h>
47708 #include <linux/uaccess.h>
47709@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
47710 seq_putc(m, '\n');
47711 }
47712
47713+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47714+static inline void task_pax(struct seq_file *m, struct task_struct *p)
47715+{
47716+ if (p->mm)
47717+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
47718+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
47719+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
47720+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
47721+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
47722+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
47723+ else
47724+ seq_printf(m, "PaX:\t-----\n");
47725+}
47726+#endif
47727+
47728 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47729 struct pid *pid, struct task_struct *task)
47730 {
47731@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47732 task_cpus_allowed(m, task);
47733 cpuset_task_status_allowed(m, task);
47734 task_context_switch_counts(m, task);
47735+
47736+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47737+ task_pax(m, task);
47738+#endif
47739+
47740+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
47741+ task_grsec_rbac(m, task);
47742+#endif
47743+
47744 return 0;
47745 }
47746
47747+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47748+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47749+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
47750+ _mm->pax_flags & MF_PAX_SEGMEXEC))
47751+#endif
47752+
47753 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47754 struct pid *pid, struct task_struct *task, int whole)
47755 {
47756@@ -378,6 +409,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47757 char tcomm[sizeof(task->comm)];
47758 unsigned long flags;
47759
47760+ pax_track_stack();
47761+
47762 state = *get_task_state(task);
47763 vsize = eip = esp = 0;
47764 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
47765@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47766 gtime = task->gtime;
47767 }
47768
47769+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47770+ if (PAX_RAND_FLAGS(mm)) {
47771+ eip = 0;
47772+ esp = 0;
47773+ wchan = 0;
47774+ }
47775+#endif
47776+#ifdef CONFIG_GRKERNSEC_HIDESYM
47777+ wchan = 0;
47778+ eip =0;
47779+ esp =0;
47780+#endif
47781+
47782 /* scale priority and nice values from timeslices to -20..20 */
47783 /* to make it look like a "normal" Unix priority/nice value */
47784 priority = task_prio(task);
47785@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47786 vsize,
47787 mm ? get_mm_rss(mm) : 0,
47788 rsslim,
47789+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47790+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
47791+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
47792+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
47793+#else
47794 mm ? (permitted ? mm->start_code : 1) : 0,
47795 mm ? (permitted ? mm->end_code : 1) : 0,
47796 (permitted && mm) ? mm->start_stack : 0,
47797+#endif
47798 esp,
47799 eip,
47800 /* The signal information here is obsolete.
47801@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
47802
47803 return 0;
47804 }
47805+
47806+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
47807+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
47808+{
47809+ u32 curr_ip = 0;
47810+ unsigned long flags;
47811+
47812+ if (lock_task_sighand(task, &flags)) {
47813+ curr_ip = task->signal->curr_ip;
47814+ unlock_task_sighand(task, &flags);
47815+ }
47816+
47817+ return sprintf(buffer, "%pI4\n", &curr_ip);
47818+}
47819+#endif
47820diff --git a/fs/proc/base.c b/fs/proc/base.c
47821index 5eb0206..fe01db4 100644
47822--- a/fs/proc/base.c
47823+++ b/fs/proc/base.c
47824@@ -107,6 +107,22 @@ struct pid_entry {
47825 union proc_op op;
47826 };
47827
47828+struct getdents_callback {
47829+ struct linux_dirent __user * current_dir;
47830+ struct linux_dirent __user * previous;
47831+ struct file * file;
47832+ int count;
47833+ int error;
47834+};
47835+
47836+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
47837+ loff_t offset, u64 ino, unsigned int d_type)
47838+{
47839+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
47840+ buf->error = -EINVAL;
47841+ return 0;
47842+}
47843+
47844 #define NOD(NAME, MODE, IOP, FOP, OP) { \
47845 .name = (NAME), \
47846 .len = sizeof(NAME) - 1, \
47847@@ -209,6 +225,9 @@ static struct mm_struct *__check_mem_permission(struct task_struct *task)
47848 if (task == current)
47849 return mm;
47850
47851+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
47852+ return ERR_PTR(-EPERM);
47853+
47854 /*
47855 * If current is actively ptrace'ing, and would also be
47856 * permitted to freshly attach with ptrace now, permit it.
47857@@ -282,6 +301,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
47858 if (!mm->arg_end)
47859 goto out_mm; /* Shh! No looking before we're done */
47860
47861+ if (gr_acl_handle_procpidmem(task))
47862+ goto out_mm;
47863+
47864 len = mm->arg_end - mm->arg_start;
47865
47866 if (len > PAGE_SIZE)
47867@@ -309,12 +331,28 @@ out:
47868 return res;
47869 }
47870
47871+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47872+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47873+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
47874+ _mm->pax_flags & MF_PAX_SEGMEXEC))
47875+#endif
47876+
47877 static int proc_pid_auxv(struct task_struct *task, char *buffer)
47878 {
47879 struct mm_struct *mm = mm_for_maps(task);
47880 int res = PTR_ERR(mm);
47881 if (mm && !IS_ERR(mm)) {
47882 unsigned int nwords = 0;
47883+
47884+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47885+ /* allow if we're currently ptracing this task */
47886+ if (PAX_RAND_FLAGS(mm) &&
47887+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
47888+ mmput(mm);
47889+ return 0;
47890+ }
47891+#endif
47892+
47893 do {
47894 nwords += 2;
47895 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
47896@@ -328,7 +366,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
47897 }
47898
47899
47900-#ifdef CONFIG_KALLSYMS
47901+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47902 /*
47903 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
47904 * Returns the resolved symbol. If that fails, simply return the address.
47905@@ -367,7 +405,7 @@ static void unlock_trace(struct task_struct *task)
47906 mutex_unlock(&task->signal->cred_guard_mutex);
47907 }
47908
47909-#ifdef CONFIG_STACKTRACE
47910+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47911
47912 #define MAX_STACK_TRACE_DEPTH 64
47913
47914@@ -558,7 +596,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
47915 return count;
47916 }
47917
47918-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
47919+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
47920 static int proc_pid_syscall(struct task_struct *task, char *buffer)
47921 {
47922 long nr;
47923@@ -587,7 +625,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
47924 /************************************************************************/
47925
47926 /* permission checks */
47927-static int proc_fd_access_allowed(struct inode *inode)
47928+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
47929 {
47930 struct task_struct *task;
47931 int allowed = 0;
47932@@ -597,7 +635,10 @@ static int proc_fd_access_allowed(struct inode *inode)
47933 */
47934 task = get_proc_task(inode);
47935 if (task) {
47936- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
47937+ if (log)
47938+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
47939+ else
47940+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
47941 put_task_struct(task);
47942 }
47943 return allowed;
47944@@ -978,6 +1019,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
47945 if (!task)
47946 goto out_no_task;
47947
47948+ if (gr_acl_handle_procpidmem(task))
47949+ goto out;
47950+
47951 ret = -ENOMEM;
47952 page = (char *)__get_free_page(GFP_TEMPORARY);
47953 if (!page)
47954@@ -1613,7 +1657,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
47955 path_put(&nd->path);
47956
47957 /* Are we allowed to snoop on the tasks file descriptors? */
47958- if (!proc_fd_access_allowed(inode))
47959+ if (!proc_fd_access_allowed(inode,0))
47960 goto out;
47961
47962 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
47963@@ -1652,8 +1696,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
47964 struct path path;
47965
47966 /* Are we allowed to snoop on the tasks file descriptors? */
47967- if (!proc_fd_access_allowed(inode))
47968- goto out;
47969+ /* logging this is needed for learning on chromium to work properly,
47970+ but we don't want to flood the logs from 'ps' which does a readlink
47971+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
47972+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
47973+ */
47974+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
47975+ if (!proc_fd_access_allowed(inode,0))
47976+ goto out;
47977+ } else {
47978+ if (!proc_fd_access_allowed(inode,1))
47979+ goto out;
47980+ }
47981
47982 error = PROC_I(inode)->op.proc_get_link(inode, &path);
47983 if (error)
47984@@ -1718,7 +1772,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
47985 rcu_read_lock();
47986 cred = __task_cred(task);
47987 inode->i_uid = cred->euid;
47988+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47989+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
47990+#else
47991 inode->i_gid = cred->egid;
47992+#endif
47993 rcu_read_unlock();
47994 }
47995 security_task_to_inode(task, inode);
47996@@ -1736,6 +1794,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
47997 struct inode *inode = dentry->d_inode;
47998 struct task_struct *task;
47999 const struct cred *cred;
48000+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48001+ const struct cred *tmpcred = current_cred();
48002+#endif
48003
48004 generic_fillattr(inode, stat);
48005
48006@@ -1743,13 +1804,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48007 stat->uid = 0;
48008 stat->gid = 0;
48009 task = pid_task(proc_pid(inode), PIDTYPE_PID);
48010+
48011+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
48012+ rcu_read_unlock();
48013+ return -ENOENT;
48014+ }
48015+
48016 if (task) {
48017+ cred = __task_cred(task);
48018+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48019+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
48020+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48021+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48022+#endif
48023+ ) {
48024+#endif
48025 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48026+#ifdef CONFIG_GRKERNSEC_PROC_USER
48027+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48028+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48029+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48030+#endif
48031 task_dumpable(task)) {
48032- cred = __task_cred(task);
48033 stat->uid = cred->euid;
48034+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48035+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
48036+#else
48037 stat->gid = cred->egid;
48038+#endif
48039 }
48040+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48041+ } else {
48042+ rcu_read_unlock();
48043+ return -ENOENT;
48044+ }
48045+#endif
48046 }
48047 rcu_read_unlock();
48048 return 0;
48049@@ -1786,11 +1875,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
48050
48051 if (task) {
48052 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48053+#ifdef CONFIG_GRKERNSEC_PROC_USER
48054+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48055+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48056+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48057+#endif
48058 task_dumpable(task)) {
48059 rcu_read_lock();
48060 cred = __task_cred(task);
48061 inode->i_uid = cred->euid;
48062+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48063+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48064+#else
48065 inode->i_gid = cred->egid;
48066+#endif
48067 rcu_read_unlock();
48068 } else {
48069 inode->i_uid = 0;
48070@@ -1908,7 +2006,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
48071 int fd = proc_fd(inode);
48072
48073 if (task) {
48074- files = get_files_struct(task);
48075+ if (!gr_acl_handle_procpidmem(task))
48076+ files = get_files_struct(task);
48077 put_task_struct(task);
48078 }
48079 if (files) {
48080@@ -2176,11 +2275,21 @@ static const struct file_operations proc_fd_operations = {
48081 */
48082 static int proc_fd_permission(struct inode *inode, int mask)
48083 {
48084+ struct task_struct *task;
48085 int rv = generic_permission(inode, mask);
48086- if (rv == 0)
48087- return 0;
48088+
48089 if (task_pid(current) == proc_pid(inode))
48090 rv = 0;
48091+
48092+ task = get_proc_task(inode);
48093+ if (task == NULL)
48094+ return rv;
48095+
48096+ if (gr_acl_handle_procpidmem(task))
48097+ rv = -EACCES;
48098+
48099+ put_task_struct(task);
48100+
48101 return rv;
48102 }
48103
48104@@ -2290,6 +2399,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
48105 if (!task)
48106 goto out_no_task;
48107
48108+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48109+ goto out;
48110+
48111 /*
48112 * Yes, it does not scale. And it should not. Don't add
48113 * new entries into /proc/<tgid>/ without very good reasons.
48114@@ -2334,6 +2446,9 @@ static int proc_pident_readdir(struct file *filp,
48115 if (!task)
48116 goto out_no_task;
48117
48118+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48119+ goto out;
48120+
48121 ret = 0;
48122 i = filp->f_pos;
48123 switch (i) {
48124@@ -2604,7 +2719,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
48125 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
48126 void *cookie)
48127 {
48128- char *s = nd_get_link(nd);
48129+ const char *s = nd_get_link(nd);
48130 if (!IS_ERR(s))
48131 __putname(s);
48132 }
48133@@ -2802,7 +2917,7 @@ static const struct pid_entry tgid_base_stuff[] = {
48134 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
48135 #endif
48136 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48137-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48138+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48139 INF("syscall", S_IRUGO, proc_pid_syscall),
48140 #endif
48141 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48142@@ -2827,10 +2942,10 @@ static const struct pid_entry tgid_base_stuff[] = {
48143 #ifdef CONFIG_SECURITY
48144 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48145 #endif
48146-#ifdef CONFIG_KALLSYMS
48147+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48148 INF("wchan", S_IRUGO, proc_pid_wchan),
48149 #endif
48150-#ifdef CONFIG_STACKTRACE
48151+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48152 ONE("stack", S_IRUGO, proc_pid_stack),
48153 #endif
48154 #ifdef CONFIG_SCHEDSTATS
48155@@ -2864,6 +2979,9 @@ static const struct pid_entry tgid_base_stuff[] = {
48156 #ifdef CONFIG_HARDWALL
48157 INF("hardwall", S_IRUGO, proc_pid_hardwall),
48158 #endif
48159+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48160+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
48161+#endif
48162 };
48163
48164 static int proc_tgid_base_readdir(struct file * filp,
48165@@ -2989,7 +3107,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
48166 if (!inode)
48167 goto out;
48168
48169+#ifdef CONFIG_GRKERNSEC_PROC_USER
48170+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
48171+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48172+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48173+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
48174+#else
48175 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
48176+#endif
48177 inode->i_op = &proc_tgid_base_inode_operations;
48178 inode->i_fop = &proc_tgid_base_operations;
48179 inode->i_flags|=S_IMMUTABLE;
48180@@ -3031,7 +3156,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
48181 if (!task)
48182 goto out;
48183
48184+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48185+ goto out_put_task;
48186+
48187 result = proc_pid_instantiate(dir, dentry, task, NULL);
48188+out_put_task:
48189 put_task_struct(task);
48190 out:
48191 return result;
48192@@ -3096,6 +3225,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48193 {
48194 unsigned int nr;
48195 struct task_struct *reaper;
48196+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48197+ const struct cred *tmpcred = current_cred();
48198+ const struct cred *itercred;
48199+#endif
48200+ filldir_t __filldir = filldir;
48201 struct tgid_iter iter;
48202 struct pid_namespace *ns;
48203
48204@@ -3119,8 +3253,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48205 for (iter = next_tgid(ns, iter);
48206 iter.task;
48207 iter.tgid += 1, iter = next_tgid(ns, iter)) {
48208+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48209+ rcu_read_lock();
48210+ itercred = __task_cred(iter.task);
48211+#endif
48212+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
48213+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48214+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
48215+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48216+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48217+#endif
48218+ )
48219+#endif
48220+ )
48221+ __filldir = &gr_fake_filldir;
48222+ else
48223+ __filldir = filldir;
48224+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48225+ rcu_read_unlock();
48226+#endif
48227 filp->f_pos = iter.tgid + TGID_OFFSET;
48228- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
48229+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
48230 put_task_struct(iter.task);
48231 goto out;
48232 }
48233@@ -3148,7 +3301,7 @@ static const struct pid_entry tid_base_stuff[] = {
48234 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
48235 #endif
48236 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48237-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48238+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48239 INF("syscall", S_IRUGO, proc_pid_syscall),
48240 #endif
48241 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48242@@ -3172,10 +3325,10 @@ static const struct pid_entry tid_base_stuff[] = {
48243 #ifdef CONFIG_SECURITY
48244 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48245 #endif
48246-#ifdef CONFIG_KALLSYMS
48247+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48248 INF("wchan", S_IRUGO, proc_pid_wchan),
48249 #endif
48250-#ifdef CONFIG_STACKTRACE
48251+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48252 ONE("stack", S_IRUGO, proc_pid_stack),
48253 #endif
48254 #ifdef CONFIG_SCHEDSTATS
48255diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
48256index 82676e3..5f8518a 100644
48257--- a/fs/proc/cmdline.c
48258+++ b/fs/proc/cmdline.c
48259@@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
48260
48261 static int __init proc_cmdline_init(void)
48262 {
48263+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48264+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
48265+#else
48266 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
48267+#endif
48268 return 0;
48269 }
48270 module_init(proc_cmdline_init);
48271diff --git a/fs/proc/devices.c b/fs/proc/devices.c
48272index b143471..bb105e5 100644
48273--- a/fs/proc/devices.c
48274+++ b/fs/proc/devices.c
48275@@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
48276
48277 static int __init proc_devices_init(void)
48278 {
48279+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48280+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
48281+#else
48282 proc_create("devices", 0, NULL, &proc_devinfo_operations);
48283+#endif
48284 return 0;
48285 }
48286 module_init(proc_devices_init);
48287diff --git a/fs/proc/inode.c b/fs/proc/inode.c
48288index 7ed72d6..d5f061a 100644
48289--- a/fs/proc/inode.c
48290+++ b/fs/proc/inode.c
48291@@ -18,12 +18,18 @@
48292 #include <linux/module.h>
48293 #include <linux/sysctl.h>
48294 #include <linux/slab.h>
48295+#include <linux/grsecurity.h>
48296
48297 #include <asm/system.h>
48298 #include <asm/uaccess.h>
48299
48300 #include "internal.h"
48301
48302+#ifdef CONFIG_PROC_SYSCTL
48303+extern const struct inode_operations proc_sys_inode_operations;
48304+extern const struct inode_operations proc_sys_dir_operations;
48305+#endif
48306+
48307 static void proc_evict_inode(struct inode *inode)
48308 {
48309 struct proc_dir_entry *de;
48310@@ -49,6 +55,13 @@ static void proc_evict_inode(struct inode *inode)
48311 ns_ops = PROC_I(inode)->ns_ops;
48312 if (ns_ops && ns_ops->put)
48313 ns_ops->put(PROC_I(inode)->ns);
48314+
48315+#ifdef CONFIG_PROC_SYSCTL
48316+ if (inode->i_op == &proc_sys_inode_operations ||
48317+ inode->i_op == &proc_sys_dir_operations)
48318+ gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
48319+#endif
48320+
48321 }
48322
48323 static struct kmem_cache * proc_inode_cachep;
48324@@ -440,7 +453,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
48325 if (de->mode) {
48326 inode->i_mode = de->mode;
48327 inode->i_uid = de->uid;
48328+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48329+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48330+#else
48331 inode->i_gid = de->gid;
48332+#endif
48333 }
48334 if (de->size)
48335 inode->i_size = de->size;
48336diff --git a/fs/proc/internal.h b/fs/proc/internal.h
48337index 7838e5c..ff92cbc 100644
48338--- a/fs/proc/internal.h
48339+++ b/fs/proc/internal.h
48340@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48341 struct pid *pid, struct task_struct *task);
48342 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48343 struct pid *pid, struct task_struct *task);
48344+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48345+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
48346+#endif
48347 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
48348
48349 extern const struct file_operations proc_maps_operations;
48350diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
48351index d245cb2..7e645bd 100644
48352--- a/fs/proc/kcore.c
48353+++ b/fs/proc/kcore.c
48354@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
48355 off_t offset = 0;
48356 struct kcore_list *m;
48357
48358+ pax_track_stack();
48359+
48360 /* setup ELF header */
48361 elf = (struct elfhdr *) bufp;
48362 bufp += sizeof(struct elfhdr);
48363@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48364 * the addresses in the elf_phdr on our list.
48365 */
48366 start = kc_offset_to_vaddr(*fpos - elf_buflen);
48367- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
48368+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
48369+ if (tsz > buflen)
48370 tsz = buflen;
48371-
48372+
48373 while (buflen) {
48374 struct kcore_list *m;
48375
48376@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48377 kfree(elf_buf);
48378 } else {
48379 if (kern_addr_valid(start)) {
48380- unsigned long n;
48381+ char *elf_buf;
48382+ mm_segment_t oldfs;
48383
48384- n = copy_to_user(buffer, (char *)start, tsz);
48385- /*
48386- * We cannot distingush between fault on source
48387- * and fault on destination. When this happens
48388- * we clear too and hope it will trigger the
48389- * EFAULT again.
48390- */
48391- if (n) {
48392- if (clear_user(buffer + tsz - n,
48393- n))
48394+ elf_buf = kmalloc(tsz, GFP_KERNEL);
48395+ if (!elf_buf)
48396+ return -ENOMEM;
48397+ oldfs = get_fs();
48398+ set_fs(KERNEL_DS);
48399+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
48400+ set_fs(oldfs);
48401+ if (copy_to_user(buffer, elf_buf, tsz)) {
48402+ kfree(elf_buf);
48403 return -EFAULT;
48404+ }
48405 }
48406+ set_fs(oldfs);
48407+ kfree(elf_buf);
48408 } else {
48409 if (clear_user(buffer, tsz))
48410 return -EFAULT;
48411@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48412
48413 static int open_kcore(struct inode *inode, struct file *filp)
48414 {
48415+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
48416+ return -EPERM;
48417+#endif
48418 if (!capable(CAP_SYS_RAWIO))
48419 return -EPERM;
48420 if (kcore_need_update)
48421diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
48422index 80e4645..d2689e9 100644
48423--- a/fs/proc/meminfo.c
48424+++ b/fs/proc/meminfo.c
48425@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
48426 unsigned long pages[NR_LRU_LISTS];
48427 int lru;
48428
48429+ pax_track_stack();
48430+
48431 /*
48432 * display in kilobytes.
48433 */
48434@@ -158,7 +160,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
48435 vmi.used >> 10,
48436 vmi.largest_chunk >> 10
48437 #ifdef CONFIG_MEMORY_FAILURE
48438- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
48439+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
48440 #endif
48441 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
48442 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
48443diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
48444index b1822dd..df622cb 100644
48445--- a/fs/proc/nommu.c
48446+++ b/fs/proc/nommu.c
48447@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
48448 if (len < 1)
48449 len = 1;
48450 seq_printf(m, "%*c", len, ' ');
48451- seq_path(m, &file->f_path, "");
48452+ seq_path(m, &file->f_path, "\n\\");
48453 }
48454
48455 seq_putc(m, '\n');
48456diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
48457index f738024..876984a 100644
48458--- a/fs/proc/proc_net.c
48459+++ b/fs/proc/proc_net.c
48460@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
48461 struct task_struct *task;
48462 struct nsproxy *ns;
48463 struct net *net = NULL;
48464+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48465+ const struct cred *cred = current_cred();
48466+#endif
48467+
48468+#ifdef CONFIG_GRKERNSEC_PROC_USER
48469+ if (cred->fsuid)
48470+ return net;
48471+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48472+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
48473+ return net;
48474+#endif
48475
48476 rcu_read_lock();
48477 task = pid_task(proc_pid(dir), PIDTYPE_PID);
48478diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
48479index 1a77dbe..56ec911 100644
48480--- a/fs/proc/proc_sysctl.c
48481+++ b/fs/proc/proc_sysctl.c
48482@@ -8,11 +8,13 @@
48483 #include <linux/namei.h>
48484 #include "internal.h"
48485
48486+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
48487+
48488 static const struct dentry_operations proc_sys_dentry_operations;
48489 static const struct file_operations proc_sys_file_operations;
48490-static const struct inode_operations proc_sys_inode_operations;
48491+const struct inode_operations proc_sys_inode_operations;
48492 static const struct file_operations proc_sys_dir_file_operations;
48493-static const struct inode_operations proc_sys_dir_operations;
48494+const struct inode_operations proc_sys_dir_operations;
48495
48496 static struct inode *proc_sys_make_inode(struct super_block *sb,
48497 struct ctl_table_header *head, struct ctl_table *table)
48498@@ -121,8 +123,14 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
48499
48500 err = NULL;
48501 d_set_d_op(dentry, &proc_sys_dentry_operations);
48502+
48503+ gr_handle_proc_create(dentry, inode);
48504+
48505 d_add(dentry, inode);
48506
48507+ if (gr_handle_sysctl(p, MAY_EXEC))
48508+ err = ERR_PTR(-ENOENT);
48509+
48510 out:
48511 sysctl_head_finish(head);
48512 return err;
48513@@ -202,6 +210,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
48514 return -ENOMEM;
48515 } else {
48516 d_set_d_op(child, &proc_sys_dentry_operations);
48517+
48518+ gr_handle_proc_create(child, inode);
48519+
48520 d_add(child, inode);
48521 }
48522 } else {
48523@@ -230,6 +241,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
48524 if (*pos < file->f_pos)
48525 continue;
48526
48527+ if (gr_handle_sysctl(table, 0))
48528+ continue;
48529+
48530 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
48531 if (res)
48532 return res;
48533@@ -355,6 +369,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
48534 if (IS_ERR(head))
48535 return PTR_ERR(head);
48536
48537+ if (table && gr_handle_sysctl(table, MAY_EXEC))
48538+ return -ENOENT;
48539+
48540 generic_fillattr(inode, stat);
48541 if (table)
48542 stat->mode = (stat->mode & S_IFMT) | table->mode;
48543@@ -370,17 +387,18 @@ static const struct file_operations proc_sys_file_operations = {
48544 };
48545
48546 static const struct file_operations proc_sys_dir_file_operations = {
48547+ .read = generic_read_dir,
48548 .readdir = proc_sys_readdir,
48549 .llseek = generic_file_llseek,
48550 };
48551
48552-static const struct inode_operations proc_sys_inode_operations = {
48553+const struct inode_operations proc_sys_inode_operations = {
48554 .permission = proc_sys_permission,
48555 .setattr = proc_sys_setattr,
48556 .getattr = proc_sys_getattr,
48557 };
48558
48559-static const struct inode_operations proc_sys_dir_operations = {
48560+const struct inode_operations proc_sys_dir_operations = {
48561 .lookup = proc_sys_lookup,
48562 .permission = proc_sys_permission,
48563 .setattr = proc_sys_setattr,
48564diff --git a/fs/proc/root.c b/fs/proc/root.c
48565index 9a8a2b7..3018df6 100644
48566--- a/fs/proc/root.c
48567+++ b/fs/proc/root.c
48568@@ -123,7 +123,15 @@ void __init proc_root_init(void)
48569 #ifdef CONFIG_PROC_DEVICETREE
48570 proc_device_tree_init();
48571 #endif
48572+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48573+#ifdef CONFIG_GRKERNSEC_PROC_USER
48574+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
48575+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48576+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
48577+#endif
48578+#else
48579 proc_mkdir("bus", NULL);
48580+#endif
48581 proc_sys_init();
48582 }
48583
48584diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
48585index c7d4ee6..41c5564 100644
48586--- a/fs/proc/task_mmu.c
48587+++ b/fs/proc/task_mmu.c
48588@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48589 "VmExe:\t%8lu kB\n"
48590 "VmLib:\t%8lu kB\n"
48591 "VmPTE:\t%8lu kB\n"
48592- "VmSwap:\t%8lu kB\n",
48593- hiwater_vm << (PAGE_SHIFT-10),
48594+ "VmSwap:\t%8lu kB\n"
48595+
48596+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48597+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
48598+#endif
48599+
48600+ ,hiwater_vm << (PAGE_SHIFT-10),
48601 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
48602 mm->locked_vm << (PAGE_SHIFT-10),
48603 hiwater_rss << (PAGE_SHIFT-10),
48604@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48605 data << (PAGE_SHIFT-10),
48606 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
48607 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
48608- swap << (PAGE_SHIFT-10));
48609+ swap << (PAGE_SHIFT-10)
48610+
48611+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48612+ , mm->context.user_cs_base, mm->context.user_cs_limit
48613+#endif
48614+
48615+ );
48616 }
48617
48618 unsigned long task_vsize(struct mm_struct *mm)
48619@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *inode, struct file *file,
48620 return ret;
48621 }
48622
48623+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48624+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48625+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
48626+ _mm->pax_flags & MF_PAX_SEGMEXEC))
48627+#endif
48628+
48629 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48630 {
48631 struct mm_struct *mm = vma->vm_mm;
48632@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48633 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
48634 }
48635
48636- /* We don't show the stack guard page in /proc/maps */
48637+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48638+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
48639+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
48640+#else
48641 start = vma->vm_start;
48642- if (stack_guard_page_start(vma, start))
48643- start += PAGE_SIZE;
48644 end = vma->vm_end;
48645- if (stack_guard_page_end(vma, end))
48646- end -= PAGE_SIZE;
48647+#endif
48648
48649 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
48650 start,
48651@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48652 flags & VM_WRITE ? 'w' : '-',
48653 flags & VM_EXEC ? 'x' : '-',
48654 flags & VM_MAYSHARE ? 's' : 'p',
48655+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48656+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
48657+#else
48658 pgoff,
48659+#endif
48660 MAJOR(dev), MINOR(dev), ino, &len);
48661
48662 /*
48663@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48664 */
48665 if (file) {
48666 pad_len_spaces(m, len);
48667- seq_path(m, &file->f_path, "\n");
48668+ seq_path(m, &file->f_path, "\n\\");
48669 } else {
48670 const char *name = arch_vma_name(vma);
48671 if (!name) {
48672@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48673 if (vma->vm_start <= mm->brk &&
48674 vma->vm_end >= mm->start_brk) {
48675 name = "[heap]";
48676- } else if (vma->vm_start <= mm->start_stack &&
48677- vma->vm_end >= mm->start_stack) {
48678+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
48679+ (vma->vm_start <= mm->start_stack &&
48680+ vma->vm_end >= mm->start_stack)) {
48681 name = "[stack]";
48682 }
48683 } else {
48684@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m, void *v)
48685 };
48686
48687 memset(&mss, 0, sizeof mss);
48688- mss.vma = vma;
48689- /* mmap_sem is held in m_start */
48690- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48691- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48692-
48693+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48694+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
48695+#endif
48696+ mss.vma = vma;
48697+ /* mmap_sem is held in m_start */
48698+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48699+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48700+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48701+ }
48702+#endif
48703 show_map_vma(m, vma);
48704
48705 seq_printf(m,
48706@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m, void *v)
48707 "KernelPageSize: %8lu kB\n"
48708 "MMUPageSize: %8lu kB\n"
48709 "Locked: %8lu kB\n",
48710+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48711+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
48712+#else
48713 (vma->vm_end - vma->vm_start) >> 10,
48714+#endif
48715 mss.resident >> 10,
48716 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
48717 mss.shared_clean >> 10,
48718@@ -1031,7 +1062,7 @@ static int show_numa_map(struct seq_file *m, void *v)
48719
48720 if (file) {
48721 seq_printf(m, " file=");
48722- seq_path(m, &file->f_path, "\n\t= ");
48723+ seq_path(m, &file->f_path, "\n\t\\= ");
48724 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
48725 seq_printf(m, " heap");
48726 } else if (vma->vm_start <= mm->start_stack &&
48727diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
48728index 980de54..2a4db5f 100644
48729--- a/fs/proc/task_nommu.c
48730+++ b/fs/proc/task_nommu.c
48731@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48732 else
48733 bytes += kobjsize(mm);
48734
48735- if (current->fs && current->fs->users > 1)
48736+ if (current->fs && atomic_read(&current->fs->users) > 1)
48737 sbytes += kobjsize(current->fs);
48738 else
48739 bytes += kobjsize(current->fs);
48740@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
48741
48742 if (file) {
48743 pad_len_spaces(m, len);
48744- seq_path(m, &file->f_path, "");
48745+ seq_path(m, &file->f_path, "\n\\");
48746 } else if (mm) {
48747 if (vma->vm_start <= mm->start_stack &&
48748 vma->vm_end >= mm->start_stack) {
48749diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
48750index d67908b..d13f6a6 100644
48751--- a/fs/quota/netlink.c
48752+++ b/fs/quota/netlink.c
48753@@ -33,7 +33,7 @@ static struct genl_family quota_genl_family = {
48754 void quota_send_warning(short type, unsigned int id, dev_t dev,
48755 const char warntype)
48756 {
48757- static atomic_t seq;
48758+ static atomic_unchecked_t seq;
48759 struct sk_buff *skb;
48760 void *msg_head;
48761 int ret;
48762@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsigned int id, dev_t dev,
48763 "VFS: Not enough memory to send quota warning.\n");
48764 return;
48765 }
48766- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
48767+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
48768 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
48769 if (!msg_head) {
48770 printk(KERN_ERR
48771diff --git a/fs/readdir.c b/fs/readdir.c
48772index 356f715..c918d38 100644
48773--- a/fs/readdir.c
48774+++ b/fs/readdir.c
48775@@ -17,6 +17,7 @@
48776 #include <linux/security.h>
48777 #include <linux/syscalls.h>
48778 #include <linux/unistd.h>
48779+#include <linux/namei.h>
48780
48781 #include <asm/uaccess.h>
48782
48783@@ -67,6 +68,7 @@ struct old_linux_dirent {
48784
48785 struct readdir_callback {
48786 struct old_linux_dirent __user * dirent;
48787+ struct file * file;
48788 int result;
48789 };
48790
48791@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
48792 buf->result = -EOVERFLOW;
48793 return -EOVERFLOW;
48794 }
48795+
48796+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48797+ return 0;
48798+
48799 buf->result++;
48800 dirent = buf->dirent;
48801 if (!access_ok(VERIFY_WRITE, dirent,
48802@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
48803
48804 buf.result = 0;
48805 buf.dirent = dirent;
48806+ buf.file = file;
48807
48808 error = vfs_readdir(file, fillonedir, &buf);
48809 if (buf.result)
48810@@ -142,6 +149,7 @@ struct linux_dirent {
48811 struct getdents_callback {
48812 struct linux_dirent __user * current_dir;
48813 struct linux_dirent __user * previous;
48814+ struct file * file;
48815 int count;
48816 int error;
48817 };
48818@@ -163,6 +171,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
48819 buf->error = -EOVERFLOW;
48820 return -EOVERFLOW;
48821 }
48822+
48823+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48824+ return 0;
48825+
48826 dirent = buf->previous;
48827 if (dirent) {
48828 if (__put_user(offset, &dirent->d_off))
48829@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
48830 buf.previous = NULL;
48831 buf.count = count;
48832 buf.error = 0;
48833+ buf.file = file;
48834
48835 error = vfs_readdir(file, filldir, &buf);
48836 if (error >= 0)
48837@@ -229,6 +242,7 @@ out:
48838 struct getdents_callback64 {
48839 struct linux_dirent64 __user * current_dir;
48840 struct linux_dirent64 __user * previous;
48841+ struct file *file;
48842 int count;
48843 int error;
48844 };
48845@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
48846 buf->error = -EINVAL; /* only used if we fail.. */
48847 if (reclen > buf->count)
48848 return -EINVAL;
48849+
48850+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48851+ return 0;
48852+
48853 dirent = buf->previous;
48854 if (dirent) {
48855 if (__put_user(offset, &dirent->d_off))
48856@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
48857
48858 buf.current_dir = dirent;
48859 buf.previous = NULL;
48860+ buf.file = file;
48861 buf.count = count;
48862 buf.error = 0;
48863
48864@@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
48865 error = buf.error;
48866 lastdirent = buf.previous;
48867 if (lastdirent) {
48868- typeof(lastdirent->d_off) d_off = file->f_pos;
48869+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
48870 if (__put_user(d_off, &lastdirent->d_off))
48871 error = -EFAULT;
48872 else
48873diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
48874index 133e935..349ef18 100644
48875--- a/fs/reiserfs/dir.c
48876+++ b/fs/reiserfs/dir.c
48877@@ -75,6 +75,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
48878 struct reiserfs_dir_entry de;
48879 int ret = 0;
48880
48881+ pax_track_stack();
48882+
48883 reiserfs_write_lock(inode->i_sb);
48884
48885 reiserfs_check_lock_depth(inode->i_sb, "readdir");
48886diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
48887index 60c0804..d814f98 100644
48888--- a/fs/reiserfs/do_balan.c
48889+++ b/fs/reiserfs/do_balan.c
48890@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
48891 return;
48892 }
48893
48894- atomic_inc(&(fs_generation(tb->tb_sb)));
48895+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
48896 do_balance_starts(tb);
48897
48898 /* balance leaf returns 0 except if combining L R and S into
48899diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
48900index a159ba5..0396a76 100644
48901--- a/fs/reiserfs/journal.c
48902+++ b/fs/reiserfs/journal.c
48903@@ -2289,6 +2289,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
48904 struct buffer_head *bh;
48905 int i, j;
48906
48907+ pax_track_stack();
48908+
48909 bh = __getblk(dev, block, bufsize);
48910 if (buffer_uptodate(bh))
48911 return (bh);
48912diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
48913index ef39232..0fa91ba 100644
48914--- a/fs/reiserfs/namei.c
48915+++ b/fs/reiserfs/namei.c
48916@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
48917 unsigned long savelink = 1;
48918 struct timespec ctime;
48919
48920+ pax_track_stack();
48921+
48922 /* three balancings: (1) old name removal, (2) new name insertion
48923 and (3) maybe "save" link insertion
48924 stat data updates: (1) old directory,
48925diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
48926index 7a99811..2c9286f 100644
48927--- a/fs/reiserfs/procfs.c
48928+++ b/fs/reiserfs/procfs.c
48929@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
48930 "SMALL_TAILS " : "NO_TAILS ",
48931 replay_only(sb) ? "REPLAY_ONLY " : "",
48932 convert_reiserfs(sb) ? "CONV " : "",
48933- atomic_read(&r->s_generation_counter),
48934+ atomic_read_unchecked(&r->s_generation_counter),
48935 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
48936 SF(s_do_balance), SF(s_unneeded_left_neighbor),
48937 SF(s_good_search_by_key_reada), SF(s_bmaps),
48938@@ -299,6 +299,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
48939 struct journal_params *jp = &rs->s_v1.s_journal;
48940 char b[BDEVNAME_SIZE];
48941
48942+ pax_track_stack();
48943+
48944 seq_printf(m, /* on-disk fields */
48945 "jp_journal_1st_block: \t%i\n"
48946 "jp_journal_dev: \t%s[%x]\n"
48947diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
48948index 313d39d..3a5811b 100644
48949--- a/fs/reiserfs/stree.c
48950+++ b/fs/reiserfs/stree.c
48951@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
48952 int iter = 0;
48953 #endif
48954
48955+ pax_track_stack();
48956+
48957 BUG_ON(!th->t_trans_id);
48958
48959 init_tb_struct(th, &s_del_balance, sb, path,
48960@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
48961 int retval;
48962 int quota_cut_bytes = 0;
48963
48964+ pax_track_stack();
48965+
48966 BUG_ON(!th->t_trans_id);
48967
48968 le_key2cpu_key(&cpu_key, key);
48969@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
48970 int quota_cut_bytes;
48971 loff_t tail_pos = 0;
48972
48973+ pax_track_stack();
48974+
48975 BUG_ON(!th->t_trans_id);
48976
48977 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
48978@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
48979 int retval;
48980 int fs_gen;
48981
48982+ pax_track_stack();
48983+
48984 BUG_ON(!th->t_trans_id);
48985
48986 fs_gen = get_generation(inode->i_sb);
48987@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
48988 int fs_gen = 0;
48989 int quota_bytes = 0;
48990
48991+ pax_track_stack();
48992+
48993 BUG_ON(!th->t_trans_id);
48994
48995 if (inode) { /* Do we count quotas for item? */
48996diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
48997index 14363b9..dd95a04 100644
48998--- a/fs/reiserfs/super.c
48999+++ b/fs/reiserfs/super.c
49000@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
49001 {.option_name = NULL}
49002 };
49003
49004+ pax_track_stack();
49005+
49006 *blocks = 0;
49007 if (!options || !*options)
49008 /* use default configuration: create tails, journaling on, no
49009diff --git a/fs/select.c b/fs/select.c
49010index d33418f..f8e06bc 100644
49011--- a/fs/select.c
49012+++ b/fs/select.c
49013@@ -20,6 +20,7 @@
49014 #include <linux/module.h>
49015 #include <linux/slab.h>
49016 #include <linux/poll.h>
49017+#include <linux/security.h>
49018 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
49019 #include <linux/file.h>
49020 #include <linux/fdtable.h>
49021@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
49022 int retval, i, timed_out = 0;
49023 unsigned long slack = 0;
49024
49025+ pax_track_stack();
49026+
49027 rcu_read_lock();
49028 retval = max_select_fd(n, fds);
49029 rcu_read_unlock();
49030@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
49031 /* Allocate small arguments on the stack to save memory and be faster */
49032 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
49033
49034+ pax_track_stack();
49035+
49036 ret = -EINVAL;
49037 if (n < 0)
49038 goto out_nofds;
49039@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
49040 struct poll_list *walk = head;
49041 unsigned long todo = nfds;
49042
49043+ pax_track_stack();
49044+
49045+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
49046 if (nfds > rlimit(RLIMIT_NOFILE))
49047 return -EINVAL;
49048
49049diff --git a/fs/seq_file.c b/fs/seq_file.c
49050index dba43c3..a99fb63 100644
49051--- a/fs/seq_file.c
49052+++ b/fs/seq_file.c
49053@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49054 return 0;
49055 }
49056 if (!m->buf) {
49057- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49058+ m->size = PAGE_SIZE;
49059+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49060 if (!m->buf)
49061 return -ENOMEM;
49062 }
49063@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49064 Eoverflow:
49065 m->op->stop(m, p);
49066 kfree(m->buf);
49067- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49068+ m->size <<= 1;
49069+ m->buf = kmalloc(m->size, GFP_KERNEL);
49070 return !m->buf ? -ENOMEM : -EAGAIN;
49071 }
49072
49073@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49074 m->version = file->f_version;
49075 /* grab buffer if we didn't have one */
49076 if (!m->buf) {
49077- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49078+ m->size = PAGE_SIZE;
49079+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49080 if (!m->buf)
49081 goto Enomem;
49082 }
49083@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49084 goto Fill;
49085 m->op->stop(m, p);
49086 kfree(m->buf);
49087- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49088+ m->size <<= 1;
49089+ m->buf = kmalloc(m->size, GFP_KERNEL);
49090 if (!m->buf)
49091 goto Enomem;
49092 m->count = 0;
49093@@ -549,7 +553,7 @@ static void single_stop(struct seq_file *p, void *v)
49094 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
49095 void *data)
49096 {
49097- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
49098+ seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
49099 int res = -ENOMEM;
49100
49101 if (op) {
49102diff --git a/fs/splice.c b/fs/splice.c
49103index fa2defa..9a697a5 100644
49104--- a/fs/splice.c
49105+++ b/fs/splice.c
49106@@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49107 pipe_lock(pipe);
49108
49109 for (;;) {
49110- if (!pipe->readers) {
49111+ if (!atomic_read(&pipe->readers)) {
49112 send_sig(SIGPIPE, current, 0);
49113 if (!ret)
49114 ret = -EPIPE;
49115@@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49116 do_wakeup = 0;
49117 }
49118
49119- pipe->waiting_writers++;
49120+ atomic_inc(&pipe->waiting_writers);
49121 pipe_wait(pipe);
49122- pipe->waiting_writers--;
49123+ atomic_dec(&pipe->waiting_writers);
49124 }
49125
49126 pipe_unlock(pipe);
49127@@ -320,6 +320,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
49128 .spd_release = spd_release_page,
49129 };
49130
49131+ pax_track_stack();
49132+
49133 if (splice_grow_spd(pipe, &spd))
49134 return -ENOMEM;
49135
49136@@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
49137 old_fs = get_fs();
49138 set_fs(get_ds());
49139 /* The cast to a user pointer is valid due to the set_fs() */
49140- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
49141+ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
49142 set_fs(old_fs);
49143
49144 return res;
49145@@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
49146 old_fs = get_fs();
49147 set_fs(get_ds());
49148 /* The cast to a user pointer is valid due to the set_fs() */
49149- res = vfs_write(file, (const char __user *)buf, count, &pos);
49150+ res = vfs_write(file, (const char __force_user *)buf, count, &pos);
49151 set_fs(old_fs);
49152
49153 return res;
49154@@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49155 .spd_release = spd_release_page,
49156 };
49157
49158+ pax_track_stack();
49159+
49160 if (splice_grow_spd(pipe, &spd))
49161 return -ENOMEM;
49162
49163@@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49164 goto err;
49165
49166 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
49167- vec[i].iov_base = (void __user *) page_address(page);
49168+ vec[i].iov_base = (void __force_user *) page_address(page);
49169 vec[i].iov_len = this_len;
49170 spd.pages[i] = page;
49171 spd.nr_pages++;
49172@@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
49173 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
49174 {
49175 while (!pipe->nrbufs) {
49176- if (!pipe->writers)
49177+ if (!atomic_read(&pipe->writers))
49178 return 0;
49179
49180- if (!pipe->waiting_writers && sd->num_spliced)
49181+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
49182 return 0;
49183
49184 if (sd->flags & SPLICE_F_NONBLOCK)
49185@@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
49186 * out of the pipe right after the splice_to_pipe(). So set
49187 * PIPE_READERS appropriately.
49188 */
49189- pipe->readers = 1;
49190+ atomic_set(&pipe->readers, 1);
49191
49192 current->splice_pipe = pipe;
49193 }
49194@@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
49195 };
49196 long ret;
49197
49198+ pax_track_stack();
49199+
49200 pipe = get_pipe_info(file);
49201 if (!pipe)
49202 return -EBADF;
49203@@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49204 ret = -ERESTARTSYS;
49205 break;
49206 }
49207- if (!pipe->writers)
49208+ if (!atomic_read(&pipe->writers))
49209 break;
49210- if (!pipe->waiting_writers) {
49211+ if (!atomic_read(&pipe->waiting_writers)) {
49212 if (flags & SPLICE_F_NONBLOCK) {
49213 ret = -EAGAIN;
49214 break;
49215@@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49216 pipe_lock(pipe);
49217
49218 while (pipe->nrbufs >= pipe->buffers) {
49219- if (!pipe->readers) {
49220+ if (!atomic_read(&pipe->readers)) {
49221 send_sig(SIGPIPE, current, 0);
49222 ret = -EPIPE;
49223 break;
49224@@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49225 ret = -ERESTARTSYS;
49226 break;
49227 }
49228- pipe->waiting_writers++;
49229+ atomic_inc(&pipe->waiting_writers);
49230 pipe_wait(pipe);
49231- pipe->waiting_writers--;
49232+ atomic_dec(&pipe->waiting_writers);
49233 }
49234
49235 pipe_unlock(pipe);
49236@@ -1819,14 +1825,14 @@ retry:
49237 pipe_double_lock(ipipe, opipe);
49238
49239 do {
49240- if (!opipe->readers) {
49241+ if (!atomic_read(&opipe->readers)) {
49242 send_sig(SIGPIPE, current, 0);
49243 if (!ret)
49244 ret = -EPIPE;
49245 break;
49246 }
49247
49248- if (!ipipe->nrbufs && !ipipe->writers)
49249+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
49250 break;
49251
49252 /*
49253@@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49254 pipe_double_lock(ipipe, opipe);
49255
49256 do {
49257- if (!opipe->readers) {
49258+ if (!atomic_read(&opipe->readers)) {
49259 send_sig(SIGPIPE, current, 0);
49260 if (!ret)
49261 ret = -EPIPE;
49262@@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49263 * return EAGAIN if we have the potential of some data in the
49264 * future, otherwise just return 0
49265 */
49266- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
49267+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
49268 ret = -EAGAIN;
49269
49270 pipe_unlock(ipipe);
49271diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
49272index 1ad8c93..6633545 100644
49273--- a/fs/sysfs/file.c
49274+++ b/fs/sysfs/file.c
49275@@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
49276
49277 struct sysfs_open_dirent {
49278 atomic_t refcnt;
49279- atomic_t event;
49280+ atomic_unchecked_t event;
49281 wait_queue_head_t poll;
49282 struct list_head buffers; /* goes through sysfs_buffer.list */
49283 };
49284@@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
49285 if (!sysfs_get_active(attr_sd))
49286 return -ENODEV;
49287
49288- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
49289+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
49290 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
49291
49292 sysfs_put_active(attr_sd);
49293@@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
49294 return -ENOMEM;
49295
49296 atomic_set(&new_od->refcnt, 0);
49297- atomic_set(&new_od->event, 1);
49298+ atomic_set_unchecked(&new_od->event, 1);
49299 init_waitqueue_head(&new_od->poll);
49300 INIT_LIST_HEAD(&new_od->buffers);
49301 goto retry;
49302@@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
49303
49304 sysfs_put_active(attr_sd);
49305
49306- if (buffer->event != atomic_read(&od->event))
49307+ if (buffer->event != atomic_read_unchecked(&od->event))
49308 goto trigger;
49309
49310 return DEFAULT_POLLMASK;
49311@@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
49312
49313 od = sd->s_attr.open;
49314 if (od) {
49315- atomic_inc(&od->event);
49316+ atomic_inc_unchecked(&od->event);
49317 wake_up_interruptible(&od->poll);
49318 }
49319
49320diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
49321index e34f0d9..740ea7b 100644
49322--- a/fs/sysfs/mount.c
49323+++ b/fs/sysfs/mount.c
49324@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
49325 .s_name = "",
49326 .s_count = ATOMIC_INIT(1),
49327 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
49328+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
49329+ .s_mode = S_IFDIR | S_IRWXU,
49330+#else
49331 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
49332+#endif
49333 .s_ino = 1,
49334 };
49335
49336diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
49337index a7ac78f..02158e1 100644
49338--- a/fs/sysfs/symlink.c
49339+++ b/fs/sysfs/symlink.c
49340@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
49341
49342 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49343 {
49344- char *page = nd_get_link(nd);
49345+ const char *page = nd_get_link(nd);
49346 if (!IS_ERR(page))
49347 free_page((unsigned long)page);
49348 }
49349diff --git a/fs/udf/inode.c b/fs/udf/inode.c
49350index 1d1358e..408bedb 100644
49351--- a/fs/udf/inode.c
49352+++ b/fs/udf/inode.c
49353@@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
49354 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
49355 int lastblock = 0;
49356
49357+ pax_track_stack();
49358+
49359 prev_epos.offset = udf_file_entry_alloc_offset(inode);
49360 prev_epos.block = iinfo->i_location;
49361 prev_epos.bh = NULL;
49362diff --git a/fs/udf/misc.c b/fs/udf/misc.c
49363index 9215700..bf1f68e 100644
49364--- a/fs/udf/misc.c
49365+++ b/fs/udf/misc.c
49366@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
49367
49368 u8 udf_tag_checksum(const struct tag *t)
49369 {
49370- u8 *data = (u8 *)t;
49371+ const u8 *data = (const u8 *)t;
49372 u8 checksum = 0;
49373 int i;
49374 for (i = 0; i < sizeof(struct tag); ++i)
49375diff --git a/fs/utimes.c b/fs/utimes.c
49376index ba653f3..06ea4b1 100644
49377--- a/fs/utimes.c
49378+++ b/fs/utimes.c
49379@@ -1,6 +1,7 @@
49380 #include <linux/compiler.h>
49381 #include <linux/file.h>
49382 #include <linux/fs.h>
49383+#include <linux/security.h>
49384 #include <linux/linkage.h>
49385 #include <linux/mount.h>
49386 #include <linux/namei.h>
49387@@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
49388 goto mnt_drop_write_and_out;
49389 }
49390 }
49391+
49392+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
49393+ error = -EACCES;
49394+ goto mnt_drop_write_and_out;
49395+ }
49396+
49397 mutex_lock(&inode->i_mutex);
49398 error = notify_change(path->dentry, &newattrs);
49399 mutex_unlock(&inode->i_mutex);
49400diff --git a/fs/xattr.c b/fs/xattr.c
49401index f060663..def7007 100644
49402--- a/fs/xattr.c
49403+++ b/fs/xattr.c
49404@@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
49405 * Extended attribute SET operations
49406 */
49407 static long
49408-setxattr(struct dentry *d, const char __user *name, const void __user *value,
49409+setxattr(struct path *path, const char __user *name, const void __user *value,
49410 size_t size, int flags)
49411 {
49412 int error;
49413@@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
49414 return PTR_ERR(kvalue);
49415 }
49416
49417- error = vfs_setxattr(d, kname, kvalue, size, flags);
49418+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
49419+ error = -EACCES;
49420+ goto out;
49421+ }
49422+
49423+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
49424+out:
49425 kfree(kvalue);
49426 return error;
49427 }
49428@@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
49429 return error;
49430 error = mnt_want_write(path.mnt);
49431 if (!error) {
49432- error = setxattr(path.dentry, name, value, size, flags);
49433+ error = setxattr(&path, name, value, size, flags);
49434 mnt_drop_write(path.mnt);
49435 }
49436 path_put(&path);
49437@@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
49438 return error;
49439 error = mnt_want_write(path.mnt);
49440 if (!error) {
49441- error = setxattr(path.dentry, name, value, size, flags);
49442+ error = setxattr(&path, name, value, size, flags);
49443 mnt_drop_write(path.mnt);
49444 }
49445 path_put(&path);
49446@@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
49447 const void __user *,value, size_t, size, int, flags)
49448 {
49449 struct file *f;
49450- struct dentry *dentry;
49451 int error = -EBADF;
49452
49453 f = fget(fd);
49454 if (!f)
49455 return error;
49456- dentry = f->f_path.dentry;
49457- audit_inode(NULL, dentry);
49458+ audit_inode(NULL, f->f_path.dentry);
49459 error = mnt_want_write_file(f);
49460 if (!error) {
49461- error = setxattr(dentry, name, value, size, flags);
49462+ error = setxattr(&f->f_path, name, value, size, flags);
49463 mnt_drop_write(f->f_path.mnt);
49464 }
49465 fput(f);
49466diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
49467index 8d5a506..7f62712 100644
49468--- a/fs/xattr_acl.c
49469+++ b/fs/xattr_acl.c
49470@@ -17,8 +17,8 @@
49471 struct posix_acl *
49472 posix_acl_from_xattr(const void *value, size_t size)
49473 {
49474- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
49475- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
49476+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
49477+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
49478 int count;
49479 struct posix_acl *acl;
49480 struct posix_acl_entry *acl_e;
49481diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
49482index 452a291..91a95f3b 100644
49483--- a/fs/xfs/xfs_bmap.c
49484+++ b/fs/xfs/xfs_bmap.c
49485@@ -250,7 +250,7 @@ xfs_bmap_validate_ret(
49486 int nmap,
49487 int ret_nmap);
49488 #else
49489-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
49490+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
49491 #endif /* DEBUG */
49492
49493 STATIC int
49494diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
49495index 79d05e8..e3e5861 100644
49496--- a/fs/xfs/xfs_dir2_sf.c
49497+++ b/fs/xfs/xfs_dir2_sf.c
49498@@ -852,7 +852,15 @@ xfs_dir2_sf_getdents(
49499 }
49500
49501 ino = xfs_dir2_sfe_get_ino(sfp, sfep);
49502- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
49503+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
49504+ char name[sfep->namelen];
49505+ memcpy(name, sfep->name, sfep->namelen);
49506+ if (filldir(dirent, name, sfep->namelen,
49507+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
49508+ *offset = off & 0x7fffffff;
49509+ return 0;
49510+ }
49511+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
49512 off & 0x7fffffff, ino, DT_UNKNOWN)) {
49513 *offset = off & 0x7fffffff;
49514 return 0;
49515diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
49516index f7ce7de..e1a5db0 100644
49517--- a/fs/xfs/xfs_ioctl.c
49518+++ b/fs/xfs/xfs_ioctl.c
49519@@ -128,7 +128,7 @@ xfs_find_handle(
49520 }
49521
49522 error = -EFAULT;
49523- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
49524+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
49525 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
49526 goto out_put;
49527
49528diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
49529index 474920b..97169a9 100644
49530--- a/fs/xfs/xfs_iops.c
49531+++ b/fs/xfs/xfs_iops.c
49532@@ -446,7 +446,7 @@ xfs_vn_put_link(
49533 struct nameidata *nd,
49534 void *p)
49535 {
49536- char *s = nd_get_link(nd);
49537+ const char *s = nd_get_link(nd);
49538
49539 if (!IS_ERR(s))
49540 kfree(s);
49541diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
49542new file mode 100644
49543index 0000000..4639511
49544--- /dev/null
49545+++ b/grsecurity/Kconfig
49546@@ -0,0 +1,1051 @@
49547+#
49548+# grecurity configuration
49549+#
49550+
49551+menu "Grsecurity"
49552+
49553+config GRKERNSEC
49554+ bool "Grsecurity"
49555+ select CRYPTO
49556+ select CRYPTO_SHA256
49557+ help
49558+ If you say Y here, you will be able to configure many features
49559+ that will enhance the security of your system. It is highly
49560+ recommended that you say Y here and read through the help
49561+ for each option so that you fully understand the features and
49562+ can evaluate their usefulness for your machine.
49563+
49564+choice
49565+ prompt "Security Level"
49566+ depends on GRKERNSEC
49567+ default GRKERNSEC_CUSTOM
49568+
49569+config GRKERNSEC_LOW
49570+ bool "Low"
49571+ select GRKERNSEC_LINK
49572+ select GRKERNSEC_FIFO
49573+ select GRKERNSEC_RANDNET
49574+ select GRKERNSEC_DMESG
49575+ select GRKERNSEC_CHROOT
49576+ select GRKERNSEC_CHROOT_CHDIR
49577+
49578+ help
49579+ If you choose this option, several of the grsecurity options will
49580+ be enabled that will give you greater protection against a number
49581+ of attacks, while assuring that none of your software will have any
49582+ conflicts with the additional security measures. If you run a lot
49583+ of unusual software, or you are having problems with the higher
49584+ security levels, you should say Y here. With this option, the
49585+ following features are enabled:
49586+
49587+ - Linking restrictions
49588+ - FIFO restrictions
49589+ - Restricted dmesg
49590+ - Enforced chdir("/") on chroot
49591+ - Runtime module disabling
49592+
49593+config GRKERNSEC_MEDIUM
49594+ bool "Medium"
49595+ select PAX
49596+ select PAX_EI_PAX
49597+ select PAX_PT_PAX_FLAGS
49598+ select PAX_HAVE_ACL_FLAGS
49599+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
49600+ select GRKERNSEC_CHROOT
49601+ select GRKERNSEC_CHROOT_SYSCTL
49602+ select GRKERNSEC_LINK
49603+ select GRKERNSEC_FIFO
49604+ select GRKERNSEC_DMESG
49605+ select GRKERNSEC_RANDNET
49606+ select GRKERNSEC_FORKFAIL
49607+ select GRKERNSEC_TIME
49608+ select GRKERNSEC_SIGNAL
49609+ select GRKERNSEC_CHROOT
49610+ select GRKERNSEC_CHROOT_UNIX
49611+ select GRKERNSEC_CHROOT_MOUNT
49612+ select GRKERNSEC_CHROOT_PIVOT
49613+ select GRKERNSEC_CHROOT_DOUBLE
49614+ select GRKERNSEC_CHROOT_CHDIR
49615+ select GRKERNSEC_CHROOT_MKNOD
49616+ select GRKERNSEC_PROC
49617+ select GRKERNSEC_PROC_USERGROUP
49618+ select PAX_RANDUSTACK
49619+ select PAX_ASLR
49620+ select PAX_RANDMMAP
49621+ select PAX_REFCOUNT if (X86 || SPARC64)
49622+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
49623+
49624+ help
49625+ If you say Y here, several features in addition to those included
49626+ in the low additional security level will be enabled. These
49627+ features provide even more security to your system, though in rare
49628+ cases they may be incompatible with very old or poorly written
49629+ software. If you enable this option, make sure that your auth
49630+ service (identd) is running as gid 1001. With this option,
49631+ the following features (in addition to those provided in the
49632+ low additional security level) will be enabled:
49633+
49634+ - Failed fork logging
49635+ - Time change logging
49636+ - Signal logging
49637+ - Deny mounts in chroot
49638+ - Deny double chrooting
49639+ - Deny sysctl writes in chroot
49640+ - Deny mknod in chroot
49641+ - Deny access to abstract AF_UNIX sockets out of chroot
49642+ - Deny pivot_root in chroot
49643+ - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
49644+ - /proc restrictions with special GID set to 10 (usually wheel)
49645+ - Address Space Layout Randomization (ASLR)
49646+ - Prevent exploitation of most refcount overflows
49647+ - Bounds checking of copying between the kernel and userland
49648+
49649+config GRKERNSEC_HIGH
49650+ bool "High"
49651+ select GRKERNSEC_LINK
49652+ select GRKERNSEC_FIFO
49653+ select GRKERNSEC_DMESG
49654+ select GRKERNSEC_FORKFAIL
49655+ select GRKERNSEC_TIME
49656+ select GRKERNSEC_SIGNAL
49657+ select GRKERNSEC_CHROOT
49658+ select GRKERNSEC_CHROOT_SHMAT
49659+ select GRKERNSEC_CHROOT_UNIX
49660+ select GRKERNSEC_CHROOT_MOUNT
49661+ select GRKERNSEC_CHROOT_FCHDIR
49662+ select GRKERNSEC_CHROOT_PIVOT
49663+ select GRKERNSEC_CHROOT_DOUBLE
49664+ select GRKERNSEC_CHROOT_CHDIR
49665+ select GRKERNSEC_CHROOT_MKNOD
49666+ select GRKERNSEC_CHROOT_CAPS
49667+ select GRKERNSEC_CHROOT_SYSCTL
49668+ select GRKERNSEC_CHROOT_FINDTASK
49669+ select GRKERNSEC_SYSFS_RESTRICT
49670+ select GRKERNSEC_PROC
49671+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
49672+ select GRKERNSEC_HIDESYM
49673+ select GRKERNSEC_BRUTE
49674+ select GRKERNSEC_PROC_USERGROUP
49675+ select GRKERNSEC_KMEM
49676+ select GRKERNSEC_RESLOG
49677+ select GRKERNSEC_RANDNET
49678+ select GRKERNSEC_PROC_ADD
49679+ select GRKERNSEC_CHROOT_CHMOD
49680+ select GRKERNSEC_CHROOT_NICE
49681+ select GRKERNSEC_SETXID
49682+ select GRKERNSEC_AUDIT_MOUNT
49683+ select GRKERNSEC_MODHARDEN if (MODULES)
49684+ select GRKERNSEC_HARDEN_PTRACE
49685+ select GRKERNSEC_VM86 if (X86_32)
49686+ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
49687+ select PAX
49688+ select PAX_RANDUSTACK
49689+ select PAX_ASLR
49690+ select PAX_RANDMMAP
49691+ select PAX_NOEXEC
49692+ select PAX_MPROTECT
49693+ select PAX_EI_PAX
49694+ select PAX_PT_PAX_FLAGS
49695+ select PAX_HAVE_ACL_FLAGS
49696+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
49697+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
49698+ select PAX_RANDKSTACK if (X86_TSC && X86)
49699+ select PAX_SEGMEXEC if (X86_32)
49700+ select PAX_PAGEEXEC
49701+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
49702+ select PAX_EMUTRAMP if (PARISC)
49703+ select PAX_EMUSIGRT if (PARISC)
49704+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
49705+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
49706+ select PAX_REFCOUNT if (X86 || SPARC64)
49707+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
49708+ help
49709+ If you say Y here, many of the features of grsecurity will be
49710+ enabled, which will protect you against many kinds of attacks
49711+ against your system. The heightened security comes at a cost
49712+ of an increased chance of incompatibilities with rare software
49713+ on your machine. Since this security level enables PaX, you should
49714+ view <http://pax.grsecurity.net> and read about the PaX
49715+ project. While you are there, download chpax and run it on
49716+ binaries that cause problems with PaX. Also remember that
49717+ since the /proc restrictions are enabled, you must run your
49718+ identd as gid 1001. This security level enables the following
49719+ features in addition to those listed in the low and medium
49720+ security levels:
49721+
49722+ - Additional /proc restrictions
49723+ - Chmod restrictions in chroot
49724+ - No signals, ptrace, or viewing of processes outside of chroot
49725+ - Capability restrictions in chroot
49726+ - Deny fchdir out of chroot
49727+ - Priority restrictions in chroot
49728+ - Segmentation-based implementation of PaX
49729+ - Mprotect restrictions
49730+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
49731+ - Kernel stack randomization
49732+ - Mount/unmount/remount logging
49733+ - Kernel symbol hiding
49734+ - Hardening of module auto-loading
49735+ - Ptrace restrictions
49736+ - Restricted vm86 mode
49737+ - Restricted sysfs/debugfs
49738+ - Active kernel exploit response
49739+
49740+config GRKERNSEC_CUSTOM
49741+ bool "Custom"
49742+ help
49743+ If you say Y here, you will be able to configure every grsecurity
49744+ option, which allows you to enable many more features that aren't
49745+ covered in the basic security levels. These additional features
49746+ include TPE, socket restrictions, and the sysctl system for
49747+ grsecurity. It is advised that you read through the help for
49748+ each option to determine its usefulness in your situation.
49749+
49750+endchoice
49751+
49752+menu "Address Space Protection"
49753+depends on GRKERNSEC
49754+
49755+config GRKERNSEC_KMEM
49756+ bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
49757+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
49758+ help
49759+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
49760+ be written to or read from to modify or leak the contents of the running
49761+ kernel. /dev/port will also not be allowed to be opened. If you have module
49762+ support disabled, enabling this will close up four ways that are
49763+ currently used to insert malicious code into the running kernel.
49764+ Even with all these features enabled, we still highly recommend that
49765+ you use the RBAC system, as it is still possible for an attacker to
49766+ modify the running kernel through privileged I/O granted by ioperm/iopl.
49767+ If you are not using XFree86, you may be able to stop this additional
49768+ case by enabling the 'Disable privileged I/O' option. Though nothing
49769+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
49770+ but only to video memory, which is the only writing we allow in this
49771+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
49772+ not be allowed to mprotect it with PROT_WRITE later.
49773+ It is highly recommended that you say Y here if you meet all the
49774+ conditions above.
49775+
49776+config GRKERNSEC_VM86
49777+ bool "Restrict VM86 mode"
49778+ depends on X86_32
49779+
49780+ help
49781+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
49782+ make use of a special execution mode on 32bit x86 processors called
49783+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
49784+ video cards and will still work with this option enabled. The purpose
49785+ of the option is to prevent exploitation of emulation errors in
49786+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
49787+ Nearly all users should be able to enable this option.
49788+
49789+config GRKERNSEC_IO
49790+ bool "Disable privileged I/O"
49791+ depends on X86
49792+ select RTC_CLASS
49793+ select RTC_INTF_DEV
49794+ select RTC_DRV_CMOS
49795+
49796+ help
49797+ If you say Y here, all ioperm and iopl calls will return an error.
49798+ Ioperm and iopl can be used to modify the running kernel.
49799+ Unfortunately, some programs need this access to operate properly,
49800+ the most notable of which are XFree86 and hwclock. hwclock can be
49801+ remedied by having RTC support in the kernel, so real-time
49802+ clock support is enabled if this option is enabled, to ensure
49803+ that hwclock operates correctly. XFree86 still will not
49804+ operate correctly with this option enabled, so DO NOT CHOOSE Y
49805+ IF YOU USE XFree86. If you use XFree86 and you still want to
49806+ protect your kernel against modification, use the RBAC system.
49807+
49808+config GRKERNSEC_PROC_MEMMAP
49809+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
49810+ default y if (PAX_NOEXEC || PAX_ASLR)
49811+ depends on PAX_NOEXEC || PAX_ASLR
49812+ help
49813+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
49814+ give no information about the addresses of its mappings if
49815+ PaX features that rely on random addresses are enabled on the task.
49816+ If you use PaX it is greatly recommended that you say Y here as it
49817+ closes up a hole that makes the full ASLR useless for suid
49818+ binaries.
49819+
49820+config GRKERNSEC_BRUTE
49821+ bool "Deter exploit bruteforcing"
49822+ help
49823+ If you say Y here, attempts to bruteforce exploits against forking
49824+ daemons such as apache or sshd, as well as against suid/sgid binaries
49825+ will be deterred. When a child of a forking daemon is killed by PaX
49826+ or crashes due to an illegal instruction or other suspicious signal,
49827+ the parent process will be delayed 30 seconds upon every subsequent
49828+ fork until the administrator is able to assess the situation and
49829+ restart the daemon.
49830+ In the suid/sgid case, the attempt is logged, the user has all their
49831+ processes terminated, and they are prevented from executing any further
49832+ processes for 15 minutes.
49833+ It is recommended that you also enable signal logging in the auditing
49834+ section so that logs are generated when a process triggers a suspicious
49835+ signal.
49836+ If the sysctl option is enabled, a sysctl option with name
49837+ "deter_bruteforce" is created.
49838+
49839+
49840+config GRKERNSEC_MODHARDEN
49841+ bool "Harden module auto-loading"
49842+ depends on MODULES
49843+ help
49844+ If you say Y here, module auto-loading in response to use of some
49845+ feature implemented by an unloaded module will be restricted to
49846+ root users. Enabling this option helps defend against attacks
49847+ by unprivileged users who abuse the auto-loading behavior to
49848+ cause a vulnerable module to load that is then exploited.
49849+
49850+ If this option prevents a legitimate use of auto-loading for a
49851+ non-root user, the administrator can execute modprobe manually
49852+ with the exact name of the module mentioned in the alert log.
49853+ Alternatively, the administrator can add the module to the list
49854+ of modules loaded at boot by modifying init scripts.
49855+
49856+ Modification of init scripts will most likely be needed on
49857+ Ubuntu servers with encrypted home directory support enabled,
49858+ as the first non-root user logging in will cause the ecb(aes),
49859+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
49860+
49861+config GRKERNSEC_HIDESYM
49862+ bool "Hide kernel symbols"
49863+ help
49864+ If you say Y here, getting information on loaded modules, and
49865+ displaying all kernel symbols through a syscall will be restricted
49866+ to users with CAP_SYS_MODULE. For software compatibility reasons,
49867+ /proc/kallsyms will be restricted to the root user. The RBAC
49868+ system can hide that entry even from root.
49869+
49870+ This option also prevents leaking of kernel addresses through
49871+ several /proc entries.
49872+
49873+ Note that this option is only effective provided the following
49874+ conditions are met:
49875+ 1) The kernel using grsecurity is not precompiled by some distribution
49876+ 2) You have also enabled GRKERNSEC_DMESG
49877+ 3) You are using the RBAC system and hiding other files such as your
49878+ kernel image and System.map. Alternatively, enabling this option
49879+ causes the permissions on /boot, /lib/modules, and the kernel
49880+ source directory to change at compile time to prevent
49881+ reading by non-root users.
49882+ If the above conditions are met, this option will aid in providing a
49883+ useful protection against local kernel exploitation of overflows
49884+ and arbitrary read/write vulnerabilities.
49885+
49886+config GRKERNSEC_KERN_LOCKOUT
49887+ bool "Active kernel exploit response"
49888+ depends on X86 || ARM || PPC || SPARC
49889+ help
49890+ If you say Y here, when a PaX alert is triggered due to suspicious
49891+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
49892+ or an OOPs occurs due to bad memory accesses, instead of just
49893+ terminating the offending process (and potentially allowing
49894+ a subsequent exploit from the same user), we will take one of two
49895+ actions:
49896+ If the user was root, we will panic the system
49897+ If the user was non-root, we will log the attempt, terminate
49898+ all processes owned by the user, then prevent them from creating
49899+ any new processes until the system is restarted
49900+ This deters repeated kernel exploitation/bruteforcing attempts
49901+ and is useful for later forensics.
49902+
49903+endmenu
49904+menu "Role Based Access Control Options"
49905+depends on GRKERNSEC
49906+
49907+config GRKERNSEC_RBAC_DEBUG
49908+ bool
49909+
49910+config GRKERNSEC_NO_RBAC
49911+ bool "Disable RBAC system"
49912+ help
49913+ If you say Y here, the /dev/grsec device will be removed from the kernel,
49914+ preventing the RBAC system from being enabled. You should only say Y
49915+ here if you have no intention of using the RBAC system, so as to prevent
49916+ an attacker with root access from misusing the RBAC system to hide files
49917+ and processes when loadable module support and /dev/[k]mem have been
49918+ locked down.
49919+
49920+config GRKERNSEC_ACL_HIDEKERN
49921+ bool "Hide kernel processes"
49922+ help
49923+ If you say Y here, all kernel threads will be hidden to all
49924+ processes but those whose subject has the "view hidden processes"
49925+ flag.
49926+
49927+config GRKERNSEC_ACL_MAXTRIES
49928+ int "Maximum tries before password lockout"
49929+ default 3
49930+ help
49931+ This option enforces the maximum number of times a user can attempt
49932+ to authorize themselves with the grsecurity RBAC system before being
49933+ denied the ability to attempt authorization again for a specified time.
49934+ The lower the number, the harder it will be to brute-force a password.
49935+
49936+config GRKERNSEC_ACL_TIMEOUT
49937+ int "Time to wait after max password tries, in seconds"
49938+ default 30
49939+ help
49940+ This option specifies the time the user must wait after attempting to
49941+ authorize to the RBAC system with the maximum number of invalid
49942+ passwords. The higher the number, the harder it will be to brute-force
49943+ a password.
49944+
49945+endmenu
49946+menu "Filesystem Protections"
49947+depends on GRKERNSEC
49948+
49949+config GRKERNSEC_PROC
49950+ bool "Proc restrictions"
49951+ help
49952+ If you say Y here, the permissions of the /proc filesystem
49953+ will be altered to enhance system security and privacy. You MUST
49954+ choose either a user only restriction or a user and group restriction.
49955+ Depending upon the option you choose, you can either restrict users to
49956+ see only the processes they themselves run, or choose a group that can
49957+ view all processes and files normally restricted to root if you choose
49958+ the "restrict to user only" option. NOTE: If you're running identd as
49959+ a non-root user, you will have to run it as the group you specify here.
49960+
49961+config GRKERNSEC_PROC_USER
49962+ bool "Restrict /proc to user only"
49963+ depends on GRKERNSEC_PROC
49964+ help
49965+ If you say Y here, non-root users will only be able to view their own
49966+ processes, and restricts them from viewing network-related information,
49967+ and viewing kernel symbol and module information.
49968+
49969+config GRKERNSEC_PROC_USERGROUP
49970+ bool "Allow special group"
49971+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
49972+ help
49973+ If you say Y here, you will be able to select a group that will be
49974+ able to view all processes and network-related information. If you've
49975+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
49976+ remain hidden. This option is useful if you want to run identd as
49977+ a non-root user.
49978+
49979+config GRKERNSEC_PROC_GID
49980+ int "GID for special group"
49981+ depends on GRKERNSEC_PROC_USERGROUP
49982+ default 1001
49983+
49984+config GRKERNSEC_PROC_ADD
49985+ bool "Additional restrictions"
49986+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
49987+ help
49988+ If you say Y here, additional restrictions will be placed on
49989+ /proc that keep normal users from viewing device information and
49990+ slabinfo information that could be useful for exploits.
49991+
49992+config GRKERNSEC_LINK
49993+ bool "Linking restrictions"
49994+ help
49995+ If you say Y here, /tmp race exploits will be prevented, since users
49996+ will no longer be able to follow symlinks owned by other users in
49997+ world-writable +t directories (e.g. /tmp), unless the owner of the
49998+ symlink is the owner of the directory. users will also not be
49999+ able to hardlink to files they do not own. If the sysctl option is
50000+ enabled, a sysctl option with name "linking_restrictions" is created.
50001+
50002+config GRKERNSEC_FIFO
50003+ bool "FIFO restrictions"
50004+ help
50005+ If you say Y here, users will not be able to write to FIFOs they don't
50006+ own in world-writable +t directories (e.g. /tmp), unless the owner of
50007+ the FIFO is the same owner of the directory it's held in. If the sysctl
50008+ option is enabled, a sysctl option with name "fifo_restrictions" is
50009+ created.
50010+
50011+config GRKERNSEC_SYSFS_RESTRICT
50012+ bool "Sysfs/debugfs restriction"
50013+ depends on SYSFS
50014+ help
50015+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
50016+ any filesystem normally mounted under it (e.g. debugfs) will only
50017+ be accessible by root. These filesystems generally provide access
50018+ to hardware and debug information that isn't appropriate for unprivileged
50019+ users of the system. Sysfs and debugfs have also become a large source
50020+ of new vulnerabilities, ranging from infoleaks to local compromise.
50021+ There has been very little oversight with an eye toward security involved
50022+ in adding new exporters of information to these filesystems, so their
50023+ use is discouraged.
50024+ This option is equivalent to a chmod 0700 of the mount paths.
50025+
50026+config GRKERNSEC_ROFS
50027+ bool "Runtime read-only mount protection"
50028+ help
50029+ If you say Y here, a sysctl option with name "romount_protect" will
50030+ be created. By setting this option to 1 at runtime, filesystems
50031+ will be protected in the following ways:
50032+ * No new writable mounts will be allowed
50033+ * Existing read-only mounts won't be able to be remounted read/write
50034+ * Write operations will be denied on all block devices
50035+ This option acts independently of grsec_lock: once it is set to 1,
50036+ it cannot be turned off. Therefore, please be mindful of the resulting
50037+ behavior if this option is enabled in an init script on a read-only
50038+ filesystem. This feature is mainly intended for secure embedded systems.
50039+
50040+config GRKERNSEC_CHROOT
50041+ bool "Chroot jail restrictions"
50042+ help
50043+ If you say Y here, you will be able to choose several options that will
50044+ make breaking out of a chrooted jail much more difficult. If you
50045+ encounter no software incompatibilities with the following options, it
50046+ is recommended that you enable each one.
50047+
50048+config GRKERNSEC_CHROOT_MOUNT
50049+ bool "Deny mounts"
50050+ depends on GRKERNSEC_CHROOT
50051+ help
50052+ If you say Y here, processes inside a chroot will not be able to
50053+ mount or remount filesystems. If the sysctl option is enabled, a
50054+ sysctl option with name "chroot_deny_mount" is created.
50055+
50056+config GRKERNSEC_CHROOT_DOUBLE
50057+ bool "Deny double-chroots"
50058+ depends on GRKERNSEC_CHROOT
50059+ help
50060+ If you say Y here, processes inside a chroot will not be able to chroot
50061+ again outside the chroot. This is a widely used method of breaking
50062+ out of a chroot jail and should not be allowed. If the sysctl
50063+ option is enabled, a sysctl option with name
50064+ "chroot_deny_chroot" is created.
50065+
50066+config GRKERNSEC_CHROOT_PIVOT
50067+ bool "Deny pivot_root in chroot"
50068+ depends on GRKERNSEC_CHROOT
50069+ help
50070+ If you say Y here, processes inside a chroot will not be able to use
50071+ a function called pivot_root() that was introduced in Linux 2.3.41. It
50072+ works similar to chroot in that it changes the root filesystem. This
50073+ function could be misused in a chrooted process to attempt to break out
50074+ of the chroot, and therefore should not be allowed. If the sysctl
50075+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
50076+ created.
50077+
50078+config GRKERNSEC_CHROOT_CHDIR
50079+ bool "Enforce chdir(\"/\") on all chroots"
50080+ depends on GRKERNSEC_CHROOT
50081+ help
50082+ If you say Y here, the current working directory of all newly-chrooted
50083+ applications will be set to the the root directory of the chroot.
50084+ The man page on chroot(2) states:
50085+ Note that this call does not change the current working
50086+ directory, so that `.' can be outside the tree rooted at
50087+ `/'. In particular, the super-user can escape from a
50088+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
50089+
50090+ It is recommended that you say Y here, since it's not known to break
50091+ any software. If the sysctl option is enabled, a sysctl option with
50092+ name "chroot_enforce_chdir" is created.
50093+
50094+config GRKERNSEC_CHROOT_CHMOD
50095+ bool "Deny (f)chmod +s"
50096+ depends on GRKERNSEC_CHROOT
50097+ help
50098+ If you say Y here, processes inside a chroot will not be able to chmod
50099+ or fchmod files to make them have suid or sgid bits. This protects
50100+ against another published method of breaking a chroot. If the sysctl
50101+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
50102+ created.
50103+
50104+config GRKERNSEC_CHROOT_FCHDIR
50105+ bool "Deny fchdir out of chroot"
50106+ depends on GRKERNSEC_CHROOT
50107+ help
50108+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
50109+ to a file descriptor of the chrooting process that points to a directory
50110+ outside the filesystem will be stopped. If the sysctl option
50111+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
50112+
50113+config GRKERNSEC_CHROOT_MKNOD
50114+ bool "Deny mknod"
50115+ depends on GRKERNSEC_CHROOT
50116+ help
50117+ If you say Y here, processes inside a chroot will not be allowed to
50118+ mknod. The problem with using mknod inside a chroot is that it
50119+ would allow an attacker to create a device entry that is the same
50120+ as one on the physical root of your system, which could range from
50121+ anything from the console device to a device for your harddrive (which
50122+ they could then use to wipe the drive or steal data). It is recommended
50123+ that you say Y here, unless you run into software incompatibilities.
50124+ If the sysctl option is enabled, a sysctl option with name
50125+ "chroot_deny_mknod" is created.
50126+
50127+config GRKERNSEC_CHROOT_SHMAT
50128+ bool "Deny shmat() out of chroot"
50129+ depends on GRKERNSEC_CHROOT
50130+ help
50131+ If you say Y here, processes inside a chroot will not be able to attach
50132+ to shared memory segments that were created outside of the chroot jail.
50133+ It is recommended that you say Y here. If the sysctl option is enabled,
50134+ a sysctl option with name "chroot_deny_shmat" is created.
50135+
50136+config GRKERNSEC_CHROOT_UNIX
50137+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
50138+ depends on GRKERNSEC_CHROOT
50139+ help
50140+ If you say Y here, processes inside a chroot will not be able to
50141+ connect to abstract (meaning not belonging to a filesystem) Unix
50142+ domain sockets that were bound outside of a chroot. It is recommended
50143+ that you say Y here. If the sysctl option is enabled, a sysctl option
50144+ with name "chroot_deny_unix" is created.
50145+
50146+config GRKERNSEC_CHROOT_FINDTASK
50147+ bool "Protect outside processes"
50148+ depends on GRKERNSEC_CHROOT
50149+ help
50150+ If you say Y here, processes inside a chroot will not be able to
50151+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
50152+ getsid, or view any process outside of the chroot. If the sysctl
50153+ option is enabled, a sysctl option with name "chroot_findtask" is
50154+ created.
50155+
50156+config GRKERNSEC_CHROOT_NICE
50157+ bool "Restrict priority changes"
50158+ depends on GRKERNSEC_CHROOT
50159+ help
50160+ If you say Y here, processes inside a chroot will not be able to raise
50161+ the priority of processes in the chroot, or alter the priority of
50162+ processes outside the chroot. This provides more security than simply
50163+ removing CAP_SYS_NICE from the process' capability set. If the
50164+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
50165+ is created.
50166+
50167+config GRKERNSEC_CHROOT_SYSCTL
50168+ bool "Deny sysctl writes"
50169+ depends on GRKERNSEC_CHROOT
50170+ help
50171+ If you say Y here, an attacker in a chroot will not be able to
50172+ write to sysctl entries, either by sysctl(2) or through a /proc
50173+ interface. It is strongly recommended that you say Y here. If the
50174+ sysctl option is enabled, a sysctl option with name
50175+ "chroot_deny_sysctl" is created.
50176+
50177+config GRKERNSEC_CHROOT_CAPS
50178+ bool "Capability restrictions"
50179+ depends on GRKERNSEC_CHROOT
50180+ help
50181+ If you say Y here, the capabilities on all processes within a
50182+ chroot jail will be lowered to stop module insertion, raw i/o,
50183+ system and net admin tasks, rebooting the system, modifying immutable
50184+ files, modifying IPC owned by another, and changing the system time.
50185+ This is left an option because it can break some apps. Disable this
50186+ if your chrooted apps are having problems performing those kinds of
50187+ tasks. If the sysctl option is enabled, a sysctl option with
50188+ name "chroot_caps" is created.
50189+
50190+endmenu
50191+menu "Kernel Auditing"
50192+depends on GRKERNSEC
50193+
50194+config GRKERNSEC_AUDIT_GROUP
50195+ bool "Single group for auditing"
50196+ help
50197+ If you say Y here, the exec, chdir, and (un)mount logging features
50198+ will only operate on a group you specify. This option is recommended
50199+ if you only want to watch certain users instead of having a large
50200+ amount of logs from the entire system. If the sysctl option is enabled,
50201+ a sysctl option with name "audit_group" is created.
50202+
50203+config GRKERNSEC_AUDIT_GID
50204+ int "GID for auditing"
50205+ depends on GRKERNSEC_AUDIT_GROUP
50206+ default 1007
50207+
50208+config GRKERNSEC_EXECLOG
50209+ bool "Exec logging"
50210+ help
50211+ If you say Y here, all execve() calls will be logged (since the
50212+ other exec*() calls are frontends to execve(), all execution
50213+ will be logged). Useful for shell-servers that like to keep track
50214+ of their users. If the sysctl option is enabled, a sysctl option with
50215+ name "exec_logging" is created.
50216+ WARNING: This option when enabled will produce a LOT of logs, especially
50217+ on an active system.
50218+
50219+config GRKERNSEC_RESLOG
50220+ bool "Resource logging"
50221+ help
50222+ If you say Y here, all attempts to overstep resource limits will
50223+ be logged with the resource name, the requested size, and the current
50224+ limit. It is highly recommended that you say Y here. If the sysctl
50225+ option is enabled, a sysctl option with name "resource_logging" is
50226+ created. If the RBAC system is enabled, the sysctl value is ignored.
50227+
50228+config GRKERNSEC_CHROOT_EXECLOG
50229+ bool "Log execs within chroot"
50230+ help
50231+ If you say Y here, all executions inside a chroot jail will be logged
50232+ to syslog. This can cause a large amount of logs if certain
50233+ applications (eg. djb's daemontools) are installed on the system, and
50234+ is therefore left as an option. If the sysctl option is enabled, a
50235+ sysctl option with name "chroot_execlog" is created.
50236+
50237+config GRKERNSEC_AUDIT_PTRACE
50238+ bool "Ptrace logging"
50239+ help
50240+ If you say Y here, all attempts to attach to a process via ptrace
50241+ will be logged. If the sysctl option is enabled, a sysctl option
50242+ with name "audit_ptrace" is created.
50243+
50244+config GRKERNSEC_AUDIT_CHDIR
50245+ bool "Chdir logging"
50246+ help
50247+ If you say Y here, all chdir() calls will be logged. If the sysctl
50248+ option is enabled, a sysctl option with name "audit_chdir" is created.
50249+
50250+config GRKERNSEC_AUDIT_MOUNT
50251+ bool "(Un)Mount logging"
50252+ help
50253+ If you say Y here, all mounts and unmounts will be logged. If the
50254+ sysctl option is enabled, a sysctl option with name "audit_mount" is
50255+ created.
50256+
50257+config GRKERNSEC_SIGNAL
50258+ bool "Signal logging"
50259+ help
50260+ If you say Y here, certain important signals will be logged, such as
50261+ SIGSEGV, which will as a result inform you of when a error in a program
50262+ occurred, which in some cases could mean a possible exploit attempt.
50263+ If the sysctl option is enabled, a sysctl option with name
50264+ "signal_logging" is created.
50265+
50266+config GRKERNSEC_FORKFAIL
50267+ bool "Fork failure logging"
50268+ help
50269+ If you say Y here, all failed fork() attempts will be logged.
50270+ This could suggest a fork bomb, or someone attempting to overstep
50271+ their process limit. If the sysctl option is enabled, a sysctl option
50272+ with name "forkfail_logging" is created.
50273+
50274+config GRKERNSEC_TIME
50275+ bool "Time change logging"
50276+ help
50277+ If you say Y here, any changes of the system clock will be logged.
50278+ If the sysctl option is enabled, a sysctl option with name
50279+ "timechange_logging" is created.
50280+
50281+config GRKERNSEC_PROC_IPADDR
50282+ bool "/proc/<pid>/ipaddr support"
50283+ help
50284+ If you say Y here, a new entry will be added to each /proc/<pid>
50285+ directory that contains the IP address of the person using the task.
50286+ The IP is carried across local TCP and AF_UNIX stream sockets.
50287+ This information can be useful for IDS/IPSes to perform remote response
50288+ to a local attack. The entry is readable by only the owner of the
50289+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
50290+ the RBAC system), and thus does not create privacy concerns.
50291+
50292+config GRKERNSEC_RWXMAP_LOG
50293+ bool 'Denied RWX mmap/mprotect logging'
50294+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
50295+ help
50296+ If you say Y here, calls to mmap() and mprotect() with explicit
50297+ usage of PROT_WRITE and PROT_EXEC together will be logged when
50298+ denied by the PAX_MPROTECT feature. If the sysctl option is
50299+ enabled, a sysctl option with name "rwxmap_logging" is created.
50300+
50301+config GRKERNSEC_AUDIT_TEXTREL
50302+ bool 'ELF text relocations logging (READ HELP)'
50303+ depends on PAX_MPROTECT
50304+ help
50305+ If you say Y here, text relocations will be logged with the filename
50306+ of the offending library or binary. The purpose of the feature is
50307+ to help Linux distribution developers get rid of libraries and
50308+ binaries that need text relocations which hinder the future progress
50309+ of PaX. Only Linux distribution developers should say Y here, and
50310+ never on a production machine, as this option creates an information
50311+ leak that could aid an attacker in defeating the randomization of
50312+ a single memory region. If the sysctl option is enabled, a sysctl
50313+ option with name "audit_textrel" is created.
50314+
50315+endmenu
50316+
50317+menu "Executable Protections"
50318+depends on GRKERNSEC
50319+
50320+config GRKERNSEC_DMESG
50321+ bool "Dmesg(8) restriction"
50322+ help
50323+ If you say Y here, non-root users will not be able to use dmesg(8)
50324+ to view up to the last 4kb of messages in the kernel's log buffer.
50325+ The kernel's log buffer often contains kernel addresses and other
50326+ identifying information useful to an attacker in fingerprinting a
50327+ system for a targeted exploit.
50328+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
50329+ created.
50330+
50331+config GRKERNSEC_HARDEN_PTRACE
50332+ bool "Deter ptrace-based process snooping"
50333+ help
50334+ If you say Y here, TTY sniffers and other malicious monitoring
50335+ programs implemented through ptrace will be defeated. If you
50336+ have been using the RBAC system, this option has already been
50337+ enabled for several years for all users, with the ability to make
50338+ fine-grained exceptions.
50339+
50340+ This option only affects the ability of non-root users to ptrace
50341+ processes that are not a descendent of the ptracing process.
50342+ This means that strace ./binary and gdb ./binary will still work,
50343+ but attaching to arbitrary processes will not. If the sysctl
50344+ option is enabled, a sysctl option with name "harden_ptrace" is
50345+ created.
50346+
50347+config GRKERNSEC_SETXID
50348+ bool "Enforce consistent multithreaded privileges"
50349+ help
50350+ If you say Y here, a change from a root uid to a non-root uid
50351+ in a multithreaded application will cause the resulting uids,
50352+ gids, supplementary groups, and capabilities in that thread
50353+ to be propagated to the other threads of the process. In most
50354+ cases this is unnecessary, as glibc will emulate this behavior
50355+ on behalf of the application. Other libcs do not act in the
50356+ same way, allowing the other threads of the process to continue
50357+ running with root privileges. If the sysctl option is enabled,
50358+ a sysctl option with name "consistent_setxid" is created.
50359+
50360+config GRKERNSEC_TPE
50361+ bool "Trusted Path Execution (TPE)"
50362+ help
50363+ If you say Y here, you will be able to choose a gid to add to the
50364+ supplementary groups of users you want to mark as "untrusted."
50365+ These users will not be able to execute any files that are not in
50366+ root-owned directories writable only by root. If the sysctl option
50367+ is enabled, a sysctl option with name "tpe" is created.
50368+
50369+config GRKERNSEC_TPE_ALL
50370+ bool "Partially restrict all non-root users"
50371+ depends on GRKERNSEC_TPE
50372+ help
50373+ If you say Y here, all non-root users will be covered under
50374+ a weaker TPE restriction. This is separate from, and in addition to,
50375+ the main TPE options that you have selected elsewhere. Thus, if a
50376+ "trusted" GID is chosen, this restriction applies to even that GID.
50377+ Under this restriction, all non-root users will only be allowed to
50378+ execute files in directories they own that are not group or
50379+ world-writable, or in directories owned by root and writable only by
50380+ root. If the sysctl option is enabled, a sysctl option with name
50381+ "tpe_restrict_all" is created.
50382+
50383+config GRKERNSEC_TPE_INVERT
50384+ bool "Invert GID option"
50385+ depends on GRKERNSEC_TPE
50386+ help
50387+ If you say Y here, the group you specify in the TPE configuration will
50388+ decide what group TPE restrictions will be *disabled* for. This
50389+ option is useful if you want TPE restrictions to be applied to most
50390+ users on the system. If the sysctl option is enabled, a sysctl option
50391+ with name "tpe_invert" is created. Unlike other sysctl options, this
50392+ entry will default to on for backward-compatibility.
50393+
50394+config GRKERNSEC_TPE_GID
50395+ int "GID for untrusted users"
50396+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
50397+ default 1005
50398+ help
50399+ Setting this GID determines what group TPE restrictions will be
50400+ *enabled* for. If the sysctl option is enabled, a sysctl option
50401+ with name "tpe_gid" is created.
50402+
50403+config GRKERNSEC_TPE_GID
50404+ int "GID for trusted users"
50405+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
50406+ default 1005
50407+ help
50408+ Setting this GID determines what group TPE restrictions will be
50409+ *disabled* for. If the sysctl option is enabled, a sysctl option
50410+ with name "tpe_gid" is created.
50411+
50412+endmenu
50413+menu "Network Protections"
50414+depends on GRKERNSEC
50415+
50416+config GRKERNSEC_RANDNET
50417+ bool "Larger entropy pools"
50418+ help
50419+ If you say Y here, the entropy pools used for many features of Linux
50420+ and grsecurity will be doubled in size. Since several grsecurity
50421+ features use additional randomness, it is recommended that you say Y
50422+ here. Saying Y here has a similar effect as modifying
50423+ /proc/sys/kernel/random/poolsize.
50424+
50425+config GRKERNSEC_BLACKHOLE
50426+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
50427+ depends on NET
50428+ help
50429+ If you say Y here, neither TCP resets nor ICMP
50430+ destination-unreachable packets will be sent in response to packets
50431+ sent to ports for which no associated listening process exists.
50432+ This feature supports both IPV4 and IPV6 and exempts the
50433+ loopback interface from blackholing. Enabling this feature
50434+ makes a host more resilient to DoS attacks and reduces network
50435+ visibility against scanners.
50436+
50437+ The blackhole feature as-implemented is equivalent to the FreeBSD
50438+ blackhole feature, as it prevents RST responses to all packets, not
50439+ just SYNs. Under most application behavior this causes no
50440+ problems, but applications (like haproxy) may not close certain
50441+ connections in a way that cleanly terminates them on the remote
50442+ end, leaving the remote host in LAST_ACK state. Because of this
50443+ side-effect and to prevent intentional LAST_ACK DoSes, this
50444+ feature also adds automatic mitigation against such attacks.
50445+ The mitigation drastically reduces the amount of time a socket
50446+ can spend in LAST_ACK state. If you're using haproxy and not
50447+ all servers it connects to have this option enabled, consider
50448+ disabling this feature on the haproxy host.
50449+
50450+ If the sysctl option is enabled, two sysctl options with names
50451+ "ip_blackhole" and "lastack_retries" will be created.
50452+ While "ip_blackhole" takes the standard zero/non-zero on/off
50453+ toggle, "lastack_retries" uses the same kinds of values as
50454+ "tcp_retries1" and "tcp_retries2". The default value of 4
50455+ prevents a socket from lasting more than 45 seconds in LAST_ACK
50456+ state.
50457+
50458+config GRKERNSEC_SOCKET
50459+ bool "Socket restrictions"
50460+ depends on NET
50461+ help
50462+ If you say Y here, you will be able to choose from several options.
50463+ If you assign a GID on your system and add it to the supplementary
50464+ groups of users you want to restrict socket access to, this patch
50465+ will perform up to three things, based on the option(s) you choose.
50466+
50467+config GRKERNSEC_SOCKET_ALL
50468+ bool "Deny any sockets to group"
50469+ depends on GRKERNSEC_SOCKET
50470+ help
50471+ If you say Y here, you will be able to choose a GID of whose users will
50472+ be unable to connect to other hosts from your machine or run server
50473+ applications from your machine. If the sysctl option is enabled, a
50474+ sysctl option with name "socket_all" is created.
50475+
50476+config GRKERNSEC_SOCKET_ALL_GID
50477+ int "GID to deny all sockets for"
50478+ depends on GRKERNSEC_SOCKET_ALL
50479+ default 1004
50480+ help
50481+ Here you can choose the GID to disable socket access for. Remember to
50482+ add the users you want socket access disabled for to the GID
50483+ specified here. If the sysctl option is enabled, a sysctl option
50484+ with name "socket_all_gid" is created.
50485+
50486+config GRKERNSEC_SOCKET_CLIENT
50487+ bool "Deny client sockets to group"
50488+ depends on GRKERNSEC_SOCKET
50489+ help
50490+ If you say Y here, you will be able to choose a GID of whose users will
50491+ be unable to connect to other hosts from your machine, but will be
50492+ able to run servers. If this option is enabled, all users in the group
50493+ you specify will have to use passive mode when initiating ftp transfers
50494+ from the shell on your machine. If the sysctl option is enabled, a
50495+ sysctl option with name "socket_client" is created.
50496+
50497+config GRKERNSEC_SOCKET_CLIENT_GID
50498+ int "GID to deny client sockets for"
50499+ depends on GRKERNSEC_SOCKET_CLIENT
50500+ default 1003
50501+ help
50502+ Here you can choose the GID to disable client socket access for.
50503+ Remember to add the users you want client socket access disabled for to
50504+ the GID specified here. If the sysctl option is enabled, a sysctl
50505+ option with name "socket_client_gid" is created.
50506+
50507+config GRKERNSEC_SOCKET_SERVER
50508+ bool "Deny server sockets to group"
50509+ depends on GRKERNSEC_SOCKET
50510+ help
50511+ If you say Y here, you will be able to choose a GID of whose users will
50512+ be unable to run server applications from your machine. If the sysctl
50513+ option is enabled, a sysctl option with name "socket_server" is created.
50514+
50515+config GRKERNSEC_SOCKET_SERVER_GID
50516+ int "GID to deny server sockets for"
50517+ depends on GRKERNSEC_SOCKET_SERVER
50518+ default 1002
50519+ help
50520+ Here you can choose the GID to disable server socket access for.
50521+ Remember to add the users you want server socket access disabled for to
50522+ the GID specified here. If the sysctl option is enabled, a sysctl
50523+ option with name "socket_server_gid" is created.
50524+
50525+endmenu
50526+menu "Sysctl support"
50527+depends on GRKERNSEC && SYSCTL
50528+
50529+config GRKERNSEC_SYSCTL
50530+ bool "Sysctl support"
50531+ help
50532+ If you say Y here, you will be able to change the options that
50533+ grsecurity runs with at bootup, without having to recompile your
50534+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
50535+ to enable (1) or disable (0) various features. All the sysctl entries
50536+ are mutable until the "grsec_lock" entry is set to a non-zero value.
50537+ All features enabled in the kernel configuration are disabled at boot
50538+ if you do not say Y to the "Turn on features by default" option.
50539+ All options should be set at startup, and the grsec_lock entry should
50540+ be set to a non-zero value after all the options are set.
50541+ *THIS IS EXTREMELY IMPORTANT*
50542+
50543+config GRKERNSEC_SYSCTL_DISTRO
50544+ bool "Extra sysctl support for distro makers (READ HELP)"
50545+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
50546+ help
50547+ If you say Y here, additional sysctl options will be created
50548+ for features that affect processes running as root. Therefore,
50549+ it is critical when using this option that the grsec_lock entry be
50550+ enabled after boot. Only distros with prebuilt kernel packages
50551+ with this option enabled that can ensure grsec_lock is enabled
50552+ after boot should use this option.
50553+ *Failure to set grsec_lock after boot makes all grsec features
50554+ this option covers useless*
50555+
50556+ Currently this option creates the following sysctl entries:
50557+ "Disable Privileged I/O": "disable_priv_io"
50558+
50559+config GRKERNSEC_SYSCTL_ON
50560+ bool "Turn on features by default"
50561+ depends on GRKERNSEC_SYSCTL
50562+ help
50563+ If you say Y here, instead of having all features enabled in the
50564+ kernel configuration disabled at boot time, the features will be
50565+ enabled at boot time. It is recommended you say Y here unless
50566+ there is some reason you would want all sysctl-tunable features to
50567+ be disabled by default. As mentioned elsewhere, it is important
50568+ to enable the grsec_lock entry once you have finished modifying
50569+ the sysctl entries.
50570+
50571+endmenu
50572+menu "Logging Options"
50573+depends on GRKERNSEC
50574+
50575+config GRKERNSEC_FLOODTIME
50576+ int "Seconds in between log messages (minimum)"
50577+ default 10
50578+ help
50579+ This option allows you to enforce the number of seconds between
50580+ grsecurity log messages. The default should be suitable for most
50581+ people, however, if you choose to change it, choose a value small enough
50582+ to allow informative logs to be produced, but large enough to
50583+ prevent flooding.
50584+
50585+config GRKERNSEC_FLOODBURST
50586+ int "Number of messages in a burst (maximum)"
50587+ default 6
50588+ help
50589+ This option allows you to choose the maximum number of messages allowed
50590+ within the flood time interval you chose in a separate option. The
50591+ default should be suitable for most people, however if you find that
50592+ many of your logs are being interpreted as flooding, you may want to
50593+ raise this value.
50594+
50595+endmenu
50596+
50597+endmenu
50598diff --git a/grsecurity/Makefile b/grsecurity/Makefile
50599new file mode 100644
50600index 0000000..be9ae3a
50601--- /dev/null
50602+++ b/grsecurity/Makefile
50603@@ -0,0 +1,36 @@
50604+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
50605+# during 2001-2009 it has been completely redesigned by Brad Spengler
50606+# into an RBAC system
50607+#
50608+# All code in this directory and various hooks inserted throughout the kernel
50609+# are copyright Brad Spengler - Open Source Security, Inc., and released
50610+# under the GPL v2 or higher
50611+
50612+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
50613+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
50614+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
50615+
50616+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
50617+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
50618+ gracl_learn.o grsec_log.o
50619+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
50620+
50621+ifdef CONFIG_NET
50622+obj-y += grsec_sock.o
50623+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
50624+endif
50625+
50626+ifndef CONFIG_GRKERNSEC
50627+obj-y += grsec_disabled.o
50628+endif
50629+
50630+ifdef CONFIG_GRKERNSEC_HIDESYM
50631+extra-y := grsec_hidesym.o
50632+$(obj)/grsec_hidesym.o:
50633+ @-chmod -f 500 /boot
50634+ @-chmod -f 500 /lib/modules
50635+ @-chmod -f 500 /lib64/modules
50636+ @-chmod -f 500 /lib32/modules
50637+ @-chmod -f 700 .
50638+ @echo ' grsec: protected kernel image paths'
50639+endif
50640diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
50641new file mode 100644
50642index 0000000..09258e0
50643--- /dev/null
50644+++ b/grsecurity/gracl.c
50645@@ -0,0 +1,4156 @@
50646+#include <linux/kernel.h>
50647+#include <linux/module.h>
50648+#include <linux/sched.h>
50649+#include <linux/mm.h>
50650+#include <linux/file.h>
50651+#include <linux/fs.h>
50652+#include <linux/namei.h>
50653+#include <linux/mount.h>
50654+#include <linux/tty.h>
50655+#include <linux/proc_fs.h>
50656+#include <linux/lglock.h>
50657+#include <linux/slab.h>
50658+#include <linux/vmalloc.h>
50659+#include <linux/types.h>
50660+#include <linux/sysctl.h>
50661+#include <linux/netdevice.h>
50662+#include <linux/ptrace.h>
50663+#include <linux/gracl.h>
50664+#include <linux/gralloc.h>
50665+#include <linux/grsecurity.h>
50666+#include <linux/grinternal.h>
50667+#include <linux/pid_namespace.h>
50668+#include <linux/fdtable.h>
50669+#include <linux/percpu.h>
50670+
50671+#include <asm/uaccess.h>
50672+#include <asm/errno.h>
50673+#include <asm/mman.h>
50674+
50675+static struct acl_role_db acl_role_set;
50676+static struct name_db name_set;
50677+static struct inodev_db inodev_set;
50678+
50679+/* for keeping track of userspace pointers used for subjects, so we
50680+ can share references in the kernel as well
50681+*/
50682+
50683+static struct path real_root;
50684+
50685+static struct acl_subj_map_db subj_map_set;
50686+
50687+static struct acl_role_label *default_role;
50688+
50689+static struct acl_role_label *role_list;
50690+
50691+static u16 acl_sp_role_value;
50692+
50693+extern char *gr_shared_page[4];
50694+static DEFINE_MUTEX(gr_dev_mutex);
50695+DEFINE_RWLOCK(gr_inode_lock);
50696+
50697+struct gr_arg *gr_usermode;
50698+
50699+static unsigned int gr_status __read_only = GR_STATUS_INIT;
50700+
50701+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
50702+extern void gr_clear_learn_entries(void);
50703+
50704+#ifdef CONFIG_GRKERNSEC_RESLOG
50705+extern void gr_log_resource(const struct task_struct *task,
50706+ const int res, const unsigned long wanted, const int gt);
50707+#endif
50708+
50709+unsigned char *gr_system_salt;
50710+unsigned char *gr_system_sum;
50711+
50712+static struct sprole_pw **acl_special_roles = NULL;
50713+static __u16 num_sprole_pws = 0;
50714+
50715+static struct acl_role_label *kernel_role = NULL;
50716+
50717+static unsigned int gr_auth_attempts = 0;
50718+static unsigned long gr_auth_expires = 0UL;
50719+
50720+#ifdef CONFIG_NET
50721+extern struct vfsmount *sock_mnt;
50722+#endif
50723+
50724+extern struct vfsmount *pipe_mnt;
50725+extern struct vfsmount *shm_mnt;
50726+#ifdef CONFIG_HUGETLBFS
50727+extern struct vfsmount *hugetlbfs_vfsmount;
50728+#endif
50729+
50730+static struct acl_object_label *fakefs_obj_rw;
50731+static struct acl_object_label *fakefs_obj_rwx;
50732+
50733+extern int gr_init_uidset(void);
50734+extern void gr_free_uidset(void);
50735+extern void gr_remove_uid(uid_t uid);
50736+extern int gr_find_uid(uid_t uid);
50737+
50738+DECLARE_BRLOCK(vfsmount_lock);
50739+
50740+__inline__ int
50741+gr_acl_is_enabled(void)
50742+{
50743+ return (gr_status & GR_READY);
50744+}
50745+
50746+#ifdef CONFIG_BTRFS_FS
50747+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
50748+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
50749+#endif
50750+
50751+static inline dev_t __get_dev(const struct dentry *dentry)
50752+{
50753+#ifdef CONFIG_BTRFS_FS
50754+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
50755+ return get_btrfs_dev_from_inode(dentry->d_inode);
50756+ else
50757+#endif
50758+ return dentry->d_inode->i_sb->s_dev;
50759+}
50760+
50761+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
50762+{
50763+ return __get_dev(dentry);
50764+}
50765+
50766+static char gr_task_roletype_to_char(struct task_struct *task)
50767+{
50768+ switch (task->role->roletype &
50769+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
50770+ GR_ROLE_SPECIAL)) {
50771+ case GR_ROLE_DEFAULT:
50772+ return 'D';
50773+ case GR_ROLE_USER:
50774+ return 'U';
50775+ case GR_ROLE_GROUP:
50776+ return 'G';
50777+ case GR_ROLE_SPECIAL:
50778+ return 'S';
50779+ }
50780+
50781+ return 'X';
50782+}
50783+
50784+char gr_roletype_to_char(void)
50785+{
50786+ return gr_task_roletype_to_char(current);
50787+}
50788+
50789+__inline__ int
50790+gr_acl_tpe_check(void)
50791+{
50792+ if (unlikely(!(gr_status & GR_READY)))
50793+ return 0;
50794+ if (current->role->roletype & GR_ROLE_TPE)
50795+ return 1;
50796+ else
50797+ return 0;
50798+}
50799+
50800+int
50801+gr_handle_rawio(const struct inode *inode)
50802+{
50803+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
50804+ if (inode && S_ISBLK(inode->i_mode) &&
50805+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
50806+ !capable(CAP_SYS_RAWIO))
50807+ return 1;
50808+#endif
50809+ return 0;
50810+}
50811+
50812+static int
50813+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
50814+{
50815+ if (likely(lena != lenb))
50816+ return 0;
50817+
50818+ return !memcmp(a, b, lena);
50819+}
50820+
50821+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
50822+{
50823+ *buflen -= namelen;
50824+ if (*buflen < 0)
50825+ return -ENAMETOOLONG;
50826+ *buffer -= namelen;
50827+ memcpy(*buffer, str, namelen);
50828+ return 0;
50829+}
50830+
50831+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
50832+{
50833+ return prepend(buffer, buflen, name->name, name->len);
50834+}
50835+
50836+static int prepend_path(const struct path *path, struct path *root,
50837+ char **buffer, int *buflen)
50838+{
50839+ struct dentry *dentry = path->dentry;
50840+ struct vfsmount *vfsmnt = path->mnt;
50841+ bool slash = false;
50842+ int error = 0;
50843+
50844+ while (dentry != root->dentry || vfsmnt != root->mnt) {
50845+ struct dentry * parent;
50846+
50847+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
50848+ /* Global root? */
50849+ if (vfsmnt->mnt_parent == vfsmnt) {
50850+ goto out;
50851+ }
50852+ dentry = vfsmnt->mnt_mountpoint;
50853+ vfsmnt = vfsmnt->mnt_parent;
50854+ continue;
50855+ }
50856+ parent = dentry->d_parent;
50857+ prefetch(parent);
50858+ spin_lock(&dentry->d_lock);
50859+ error = prepend_name(buffer, buflen, &dentry->d_name);
50860+ spin_unlock(&dentry->d_lock);
50861+ if (!error)
50862+ error = prepend(buffer, buflen, "/", 1);
50863+ if (error)
50864+ break;
50865+
50866+ slash = true;
50867+ dentry = parent;
50868+ }
50869+
50870+out:
50871+ if (!error && !slash)
50872+ error = prepend(buffer, buflen, "/", 1);
50873+
50874+ return error;
50875+}
50876+
50877+/* this must be called with vfsmount_lock and rename_lock held */
50878+
50879+static char *__our_d_path(const struct path *path, struct path *root,
50880+ char *buf, int buflen)
50881+{
50882+ char *res = buf + buflen;
50883+ int error;
50884+
50885+ prepend(&res, &buflen, "\0", 1);
50886+ error = prepend_path(path, root, &res, &buflen);
50887+ if (error)
50888+ return ERR_PTR(error);
50889+
50890+ return res;
50891+}
50892+
50893+static char *
50894+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
50895+{
50896+ char *retval;
50897+
50898+ retval = __our_d_path(path, root, buf, buflen);
50899+ if (unlikely(IS_ERR(retval)))
50900+ retval = strcpy(buf, "<path too long>");
50901+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
50902+ retval[1] = '\0';
50903+
50904+ return retval;
50905+}
50906+
50907+static char *
50908+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
50909+ char *buf, int buflen)
50910+{
50911+ struct path path;
50912+ char *res;
50913+
50914+ path.dentry = (struct dentry *)dentry;
50915+ path.mnt = (struct vfsmount *)vfsmnt;
50916+
50917+ /* we can use real_root.dentry, real_root.mnt, because this is only called
50918+ by the RBAC system */
50919+ res = gen_full_path(&path, &real_root, buf, buflen);
50920+
50921+ return res;
50922+}
50923+
50924+static char *
50925+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
50926+ char *buf, int buflen)
50927+{
50928+ char *res;
50929+ struct path path;
50930+ struct path root;
50931+ struct task_struct *reaper = &init_task;
50932+
50933+ path.dentry = (struct dentry *)dentry;
50934+ path.mnt = (struct vfsmount *)vfsmnt;
50935+
50936+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
50937+ get_fs_root(reaper->fs, &root);
50938+
50939+ write_seqlock(&rename_lock);
50940+ br_read_lock(vfsmount_lock);
50941+ res = gen_full_path(&path, &root, buf, buflen);
50942+ br_read_unlock(vfsmount_lock);
50943+ write_sequnlock(&rename_lock);
50944+
50945+ path_put(&root);
50946+ return res;
50947+}
50948+
50949+static char *
50950+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
50951+{
50952+ char *ret;
50953+ write_seqlock(&rename_lock);
50954+ br_read_lock(vfsmount_lock);
50955+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
50956+ PAGE_SIZE);
50957+ br_read_unlock(vfsmount_lock);
50958+ write_sequnlock(&rename_lock);
50959+ return ret;
50960+}
50961+
50962+static char *
50963+gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
50964+{
50965+ char *ret;
50966+ char *buf;
50967+ int buflen;
50968+
50969+ write_seqlock(&rename_lock);
50970+ br_read_lock(vfsmount_lock);
50971+ buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
50972+ ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
50973+ buflen = (int)(ret - buf);
50974+ if (buflen >= 5)
50975+ prepend(&ret, &buflen, "/proc", 5);
50976+ else
50977+ ret = strcpy(buf, "<path too long>");
50978+ br_read_unlock(vfsmount_lock);
50979+ write_sequnlock(&rename_lock);
50980+ return ret;
50981+}
50982+
50983+char *
50984+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
50985+{
50986+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
50987+ PAGE_SIZE);
50988+}
50989+
50990+char *
50991+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
50992+{
50993+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
50994+ PAGE_SIZE);
50995+}
50996+
50997+char *
50998+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
50999+{
51000+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51001+ PAGE_SIZE);
51002+}
51003+
51004+char *
51005+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51006+{
51007+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51008+ PAGE_SIZE);
51009+}
51010+
51011+char *
51012+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51013+{
51014+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51015+ PAGE_SIZE);
51016+}
51017+
51018+__inline__ __u32
51019+to_gr_audit(const __u32 reqmode)
51020+{
51021+ /* masks off auditable permission flags, then shifts them to create
51022+ auditing flags, and adds the special case of append auditing if
51023+ we're requesting write */
51024+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51025+}
51026+
51027+struct acl_subject_label *
51028+lookup_subject_map(const struct acl_subject_label *userp)
51029+{
51030+ unsigned int index = shash(userp, subj_map_set.s_size);
51031+ struct subject_map *match;
51032+
51033+ match = subj_map_set.s_hash[index];
51034+
51035+ while (match && match->user != userp)
51036+ match = match->next;
51037+
51038+ if (match != NULL)
51039+ return match->kernel;
51040+ else
51041+ return NULL;
51042+}
51043+
51044+static void
51045+insert_subj_map_entry(struct subject_map *subjmap)
51046+{
51047+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51048+ struct subject_map **curr;
51049+
51050+ subjmap->prev = NULL;
51051+
51052+ curr = &subj_map_set.s_hash[index];
51053+ if (*curr != NULL)
51054+ (*curr)->prev = subjmap;
51055+
51056+ subjmap->next = *curr;
51057+ *curr = subjmap;
51058+
51059+ return;
51060+}
51061+
51062+static struct acl_role_label *
51063+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51064+ const gid_t gid)
51065+{
51066+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51067+ struct acl_role_label *match;
51068+ struct role_allowed_ip *ipp;
51069+ unsigned int x;
51070+ u32 curr_ip = task->signal->curr_ip;
51071+
51072+ task->signal->saved_ip = curr_ip;
51073+
51074+ match = acl_role_set.r_hash[index];
51075+
51076+ while (match) {
51077+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51078+ for (x = 0; x < match->domain_child_num; x++) {
51079+ if (match->domain_children[x] == uid)
51080+ goto found;
51081+ }
51082+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51083+ break;
51084+ match = match->next;
51085+ }
51086+found:
51087+ if (match == NULL) {
51088+ try_group:
51089+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51090+ match = acl_role_set.r_hash[index];
51091+
51092+ while (match) {
51093+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51094+ for (x = 0; x < match->domain_child_num; x++) {
51095+ if (match->domain_children[x] == gid)
51096+ goto found2;
51097+ }
51098+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51099+ break;
51100+ match = match->next;
51101+ }
51102+found2:
51103+ if (match == NULL)
51104+ match = default_role;
51105+ if (match->allowed_ips == NULL)
51106+ return match;
51107+ else {
51108+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51109+ if (likely
51110+ ((ntohl(curr_ip) & ipp->netmask) ==
51111+ (ntohl(ipp->addr) & ipp->netmask)))
51112+ return match;
51113+ }
51114+ match = default_role;
51115+ }
51116+ } else if (match->allowed_ips == NULL) {
51117+ return match;
51118+ } else {
51119+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51120+ if (likely
51121+ ((ntohl(curr_ip) & ipp->netmask) ==
51122+ (ntohl(ipp->addr) & ipp->netmask)))
51123+ return match;
51124+ }
51125+ goto try_group;
51126+ }
51127+
51128+ return match;
51129+}
51130+
51131+struct acl_subject_label *
51132+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51133+ const struct acl_role_label *role)
51134+{
51135+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51136+ struct acl_subject_label *match;
51137+
51138+ match = role->subj_hash[index];
51139+
51140+ while (match && (match->inode != ino || match->device != dev ||
51141+ (match->mode & GR_DELETED))) {
51142+ match = match->next;
51143+ }
51144+
51145+ if (match && !(match->mode & GR_DELETED))
51146+ return match;
51147+ else
51148+ return NULL;
51149+}
51150+
51151+struct acl_subject_label *
51152+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51153+ const struct acl_role_label *role)
51154+{
51155+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51156+ struct acl_subject_label *match;
51157+
51158+ match = role->subj_hash[index];
51159+
51160+ while (match && (match->inode != ino || match->device != dev ||
51161+ !(match->mode & GR_DELETED))) {
51162+ match = match->next;
51163+ }
51164+
51165+ if (match && (match->mode & GR_DELETED))
51166+ return match;
51167+ else
51168+ return NULL;
51169+}
51170+
51171+static struct acl_object_label *
51172+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51173+ const struct acl_subject_label *subj)
51174+{
51175+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51176+ struct acl_object_label *match;
51177+
51178+ match = subj->obj_hash[index];
51179+
51180+ while (match && (match->inode != ino || match->device != dev ||
51181+ (match->mode & GR_DELETED))) {
51182+ match = match->next;
51183+ }
51184+
51185+ if (match && !(match->mode & GR_DELETED))
51186+ return match;
51187+ else
51188+ return NULL;
51189+}
51190+
51191+static struct acl_object_label *
51192+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51193+ const struct acl_subject_label *subj)
51194+{
51195+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51196+ struct acl_object_label *match;
51197+
51198+ match = subj->obj_hash[index];
51199+
51200+ while (match && (match->inode != ino || match->device != dev ||
51201+ !(match->mode & GR_DELETED))) {
51202+ match = match->next;
51203+ }
51204+
51205+ if (match && (match->mode & GR_DELETED))
51206+ return match;
51207+
51208+ match = subj->obj_hash[index];
51209+
51210+ while (match && (match->inode != ino || match->device != dev ||
51211+ (match->mode & GR_DELETED))) {
51212+ match = match->next;
51213+ }
51214+
51215+ if (match && !(match->mode & GR_DELETED))
51216+ return match;
51217+ else
51218+ return NULL;
51219+}
51220+
51221+static struct name_entry *
51222+lookup_name_entry(const char *name)
51223+{
51224+ unsigned int len = strlen(name);
51225+ unsigned int key = full_name_hash(name, len);
51226+ unsigned int index = key % name_set.n_size;
51227+ struct name_entry *match;
51228+
51229+ match = name_set.n_hash[index];
51230+
51231+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51232+ match = match->next;
51233+
51234+ return match;
51235+}
51236+
51237+static struct name_entry *
51238+lookup_name_entry_create(const char *name)
51239+{
51240+ unsigned int len = strlen(name);
51241+ unsigned int key = full_name_hash(name, len);
51242+ unsigned int index = key % name_set.n_size;
51243+ struct name_entry *match;
51244+
51245+ match = name_set.n_hash[index];
51246+
51247+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51248+ !match->deleted))
51249+ match = match->next;
51250+
51251+ if (match && match->deleted)
51252+ return match;
51253+
51254+ match = name_set.n_hash[index];
51255+
51256+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51257+ match->deleted))
51258+ match = match->next;
51259+
51260+ if (match && !match->deleted)
51261+ return match;
51262+ else
51263+ return NULL;
51264+}
51265+
51266+static struct inodev_entry *
51267+lookup_inodev_entry(const ino_t ino, const dev_t dev)
51268+{
51269+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
51270+ struct inodev_entry *match;
51271+
51272+ match = inodev_set.i_hash[index];
51273+
51274+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51275+ match = match->next;
51276+
51277+ return match;
51278+}
51279+
51280+static void
51281+insert_inodev_entry(struct inodev_entry *entry)
51282+{
51283+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51284+ inodev_set.i_size);
51285+ struct inodev_entry **curr;
51286+
51287+ entry->prev = NULL;
51288+
51289+ curr = &inodev_set.i_hash[index];
51290+ if (*curr != NULL)
51291+ (*curr)->prev = entry;
51292+
51293+ entry->next = *curr;
51294+ *curr = entry;
51295+
51296+ return;
51297+}
51298+
51299+static void
51300+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51301+{
51302+ unsigned int index =
51303+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51304+ struct acl_role_label **curr;
51305+ struct acl_role_label *tmp;
51306+
51307+ curr = &acl_role_set.r_hash[index];
51308+
51309+ /* if role was already inserted due to domains and already has
51310+ a role in the same bucket as it attached, then we need to
51311+ combine these two buckets
51312+ */
51313+ if (role->next) {
51314+ tmp = role->next;
51315+ while (tmp->next)
51316+ tmp = tmp->next;
51317+ tmp->next = *curr;
51318+ } else
51319+ role->next = *curr;
51320+ *curr = role;
51321+
51322+ return;
51323+}
51324+
51325+static void
51326+insert_acl_role_label(struct acl_role_label *role)
51327+{
51328+ int i;
51329+
51330+ if (role_list == NULL) {
51331+ role_list = role;
51332+ role->prev = NULL;
51333+ } else {
51334+ role->prev = role_list;
51335+ role_list = role;
51336+ }
51337+
51338+ /* used for hash chains */
51339+ role->next = NULL;
51340+
51341+ if (role->roletype & GR_ROLE_DOMAIN) {
51342+ for (i = 0; i < role->domain_child_num; i++)
51343+ __insert_acl_role_label(role, role->domain_children[i]);
51344+ } else
51345+ __insert_acl_role_label(role, role->uidgid);
51346+}
51347+
51348+static int
51349+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
51350+{
51351+ struct name_entry **curr, *nentry;
51352+ struct inodev_entry *ientry;
51353+ unsigned int len = strlen(name);
51354+ unsigned int key = full_name_hash(name, len);
51355+ unsigned int index = key % name_set.n_size;
51356+
51357+ curr = &name_set.n_hash[index];
51358+
51359+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
51360+ curr = &((*curr)->next);
51361+
51362+ if (*curr != NULL)
51363+ return 1;
51364+
51365+ nentry = acl_alloc(sizeof (struct name_entry));
51366+ if (nentry == NULL)
51367+ return 0;
51368+ ientry = acl_alloc(sizeof (struct inodev_entry));
51369+ if (ientry == NULL)
51370+ return 0;
51371+ ientry->nentry = nentry;
51372+
51373+ nentry->key = key;
51374+ nentry->name = name;
51375+ nentry->inode = inode;
51376+ nentry->device = device;
51377+ nentry->len = len;
51378+ nentry->deleted = deleted;
51379+
51380+ nentry->prev = NULL;
51381+ curr = &name_set.n_hash[index];
51382+ if (*curr != NULL)
51383+ (*curr)->prev = nentry;
51384+ nentry->next = *curr;
51385+ *curr = nentry;
51386+
51387+ /* insert us into the table searchable by inode/dev */
51388+ insert_inodev_entry(ientry);
51389+
51390+ return 1;
51391+}
51392+
51393+static void
51394+insert_acl_obj_label(struct acl_object_label *obj,
51395+ struct acl_subject_label *subj)
51396+{
51397+ unsigned int index =
51398+ fhash(obj->inode, obj->device, subj->obj_hash_size);
51399+ struct acl_object_label **curr;
51400+
51401+
51402+ obj->prev = NULL;
51403+
51404+ curr = &subj->obj_hash[index];
51405+ if (*curr != NULL)
51406+ (*curr)->prev = obj;
51407+
51408+ obj->next = *curr;
51409+ *curr = obj;
51410+
51411+ return;
51412+}
51413+
51414+static void
51415+insert_acl_subj_label(struct acl_subject_label *obj,
51416+ struct acl_role_label *role)
51417+{
51418+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
51419+ struct acl_subject_label **curr;
51420+
51421+ obj->prev = NULL;
51422+
51423+ curr = &role->subj_hash[index];
51424+ if (*curr != NULL)
51425+ (*curr)->prev = obj;
51426+
51427+ obj->next = *curr;
51428+ *curr = obj;
51429+
51430+ return;
51431+}
51432+
51433+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
51434+
51435+static void *
51436+create_table(__u32 * len, int elementsize)
51437+{
51438+ unsigned int table_sizes[] = {
51439+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
51440+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
51441+ 4194301, 8388593, 16777213, 33554393, 67108859
51442+ };
51443+ void *newtable = NULL;
51444+ unsigned int pwr = 0;
51445+
51446+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
51447+ table_sizes[pwr] <= *len)
51448+ pwr++;
51449+
51450+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
51451+ return newtable;
51452+
51453+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
51454+ newtable =
51455+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
51456+ else
51457+ newtable = vmalloc(table_sizes[pwr] * elementsize);
51458+
51459+ *len = table_sizes[pwr];
51460+
51461+ return newtable;
51462+}
51463+
51464+static int
51465+init_variables(const struct gr_arg *arg)
51466+{
51467+ struct task_struct *reaper = &init_task;
51468+ unsigned int stacksize;
51469+
51470+ subj_map_set.s_size = arg->role_db.num_subjects;
51471+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
51472+ name_set.n_size = arg->role_db.num_objects;
51473+ inodev_set.i_size = arg->role_db.num_objects;
51474+
51475+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
51476+ !name_set.n_size || !inodev_set.i_size)
51477+ return 1;
51478+
51479+ if (!gr_init_uidset())
51480+ return 1;
51481+
51482+ /* set up the stack that holds allocation info */
51483+
51484+ stacksize = arg->role_db.num_pointers + 5;
51485+
51486+ if (!acl_alloc_stack_init(stacksize))
51487+ return 1;
51488+
51489+ /* grab reference for the real root dentry and vfsmount */
51490+ get_fs_root(reaper->fs, &real_root);
51491+
51492+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
51493+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
51494+#endif
51495+
51496+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
51497+ if (fakefs_obj_rw == NULL)
51498+ return 1;
51499+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
51500+
51501+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
51502+ if (fakefs_obj_rwx == NULL)
51503+ return 1;
51504+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
51505+
51506+ subj_map_set.s_hash =
51507+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
51508+ acl_role_set.r_hash =
51509+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
51510+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
51511+ inodev_set.i_hash =
51512+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
51513+
51514+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
51515+ !name_set.n_hash || !inodev_set.i_hash)
51516+ return 1;
51517+
51518+ memset(subj_map_set.s_hash, 0,
51519+ sizeof(struct subject_map *) * subj_map_set.s_size);
51520+ memset(acl_role_set.r_hash, 0,
51521+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
51522+ memset(name_set.n_hash, 0,
51523+ sizeof (struct name_entry *) * name_set.n_size);
51524+ memset(inodev_set.i_hash, 0,
51525+ sizeof (struct inodev_entry *) * inodev_set.i_size);
51526+
51527+ return 0;
51528+}
51529+
51530+/* free information not needed after startup
51531+ currently contains user->kernel pointer mappings for subjects
51532+*/
51533+
51534+static void
51535+free_init_variables(void)
51536+{
51537+ __u32 i;
51538+
51539+ if (subj_map_set.s_hash) {
51540+ for (i = 0; i < subj_map_set.s_size; i++) {
51541+ if (subj_map_set.s_hash[i]) {
51542+ kfree(subj_map_set.s_hash[i]);
51543+ subj_map_set.s_hash[i] = NULL;
51544+ }
51545+ }
51546+
51547+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
51548+ PAGE_SIZE)
51549+ kfree(subj_map_set.s_hash);
51550+ else
51551+ vfree(subj_map_set.s_hash);
51552+ }
51553+
51554+ return;
51555+}
51556+
51557+static void
51558+free_variables(void)
51559+{
51560+ struct acl_subject_label *s;
51561+ struct acl_role_label *r;
51562+ struct task_struct *task, *task2;
51563+ unsigned int x;
51564+
51565+ gr_clear_learn_entries();
51566+
51567+ read_lock(&tasklist_lock);
51568+ do_each_thread(task2, task) {
51569+ task->acl_sp_role = 0;
51570+ task->acl_role_id = 0;
51571+ task->acl = NULL;
51572+ task->role = NULL;
51573+ } while_each_thread(task2, task);
51574+ read_unlock(&tasklist_lock);
51575+
51576+ /* release the reference to the real root dentry and vfsmount */
51577+ path_put(&real_root);
51578+
51579+ /* free all object hash tables */
51580+
51581+ FOR_EACH_ROLE_START(r)
51582+ if (r->subj_hash == NULL)
51583+ goto next_role;
51584+ FOR_EACH_SUBJECT_START(r, s, x)
51585+ if (s->obj_hash == NULL)
51586+ break;
51587+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51588+ kfree(s->obj_hash);
51589+ else
51590+ vfree(s->obj_hash);
51591+ FOR_EACH_SUBJECT_END(s, x)
51592+ FOR_EACH_NESTED_SUBJECT_START(r, s)
51593+ if (s->obj_hash == NULL)
51594+ break;
51595+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51596+ kfree(s->obj_hash);
51597+ else
51598+ vfree(s->obj_hash);
51599+ FOR_EACH_NESTED_SUBJECT_END(s)
51600+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
51601+ kfree(r->subj_hash);
51602+ else
51603+ vfree(r->subj_hash);
51604+ r->subj_hash = NULL;
51605+next_role:
51606+ FOR_EACH_ROLE_END(r)
51607+
51608+ acl_free_all();
51609+
51610+ if (acl_role_set.r_hash) {
51611+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
51612+ PAGE_SIZE)
51613+ kfree(acl_role_set.r_hash);
51614+ else
51615+ vfree(acl_role_set.r_hash);
51616+ }
51617+ if (name_set.n_hash) {
51618+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
51619+ PAGE_SIZE)
51620+ kfree(name_set.n_hash);
51621+ else
51622+ vfree(name_set.n_hash);
51623+ }
51624+
51625+ if (inodev_set.i_hash) {
51626+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
51627+ PAGE_SIZE)
51628+ kfree(inodev_set.i_hash);
51629+ else
51630+ vfree(inodev_set.i_hash);
51631+ }
51632+
51633+ gr_free_uidset();
51634+
51635+ memset(&name_set, 0, sizeof (struct name_db));
51636+ memset(&inodev_set, 0, sizeof (struct inodev_db));
51637+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
51638+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
51639+
51640+ default_role = NULL;
51641+ role_list = NULL;
51642+
51643+ return;
51644+}
51645+
51646+static __u32
51647+count_user_objs(struct acl_object_label *userp)
51648+{
51649+ struct acl_object_label o_tmp;
51650+ __u32 num = 0;
51651+
51652+ while (userp) {
51653+ if (copy_from_user(&o_tmp, userp,
51654+ sizeof (struct acl_object_label)))
51655+ break;
51656+
51657+ userp = o_tmp.prev;
51658+ num++;
51659+ }
51660+
51661+ return num;
51662+}
51663+
51664+static struct acl_subject_label *
51665+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
51666+
51667+static int
51668+copy_user_glob(struct acl_object_label *obj)
51669+{
51670+ struct acl_object_label *g_tmp, **guser;
51671+ unsigned int len;
51672+ char *tmp;
51673+
51674+ if (obj->globbed == NULL)
51675+ return 0;
51676+
51677+ guser = &obj->globbed;
51678+ while (*guser) {
51679+ g_tmp = (struct acl_object_label *)
51680+ acl_alloc(sizeof (struct acl_object_label));
51681+ if (g_tmp == NULL)
51682+ return -ENOMEM;
51683+
51684+ if (copy_from_user(g_tmp, *guser,
51685+ sizeof (struct acl_object_label)))
51686+ return -EFAULT;
51687+
51688+ len = strnlen_user(g_tmp->filename, PATH_MAX);
51689+
51690+ if (!len || len >= PATH_MAX)
51691+ return -EINVAL;
51692+
51693+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51694+ return -ENOMEM;
51695+
51696+ if (copy_from_user(tmp, g_tmp->filename, len))
51697+ return -EFAULT;
51698+ tmp[len-1] = '\0';
51699+ g_tmp->filename = tmp;
51700+
51701+ *guser = g_tmp;
51702+ guser = &(g_tmp->next);
51703+ }
51704+
51705+ return 0;
51706+}
51707+
51708+static int
51709+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
51710+ struct acl_role_label *role)
51711+{
51712+ struct acl_object_label *o_tmp;
51713+ unsigned int len;
51714+ int ret;
51715+ char *tmp;
51716+
51717+ while (userp) {
51718+ if ((o_tmp = (struct acl_object_label *)
51719+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
51720+ return -ENOMEM;
51721+
51722+ if (copy_from_user(o_tmp, userp,
51723+ sizeof (struct acl_object_label)))
51724+ return -EFAULT;
51725+
51726+ userp = o_tmp->prev;
51727+
51728+ len = strnlen_user(o_tmp->filename, PATH_MAX);
51729+
51730+ if (!len || len >= PATH_MAX)
51731+ return -EINVAL;
51732+
51733+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51734+ return -ENOMEM;
51735+
51736+ if (copy_from_user(tmp, o_tmp->filename, len))
51737+ return -EFAULT;
51738+ tmp[len-1] = '\0';
51739+ o_tmp->filename = tmp;
51740+
51741+ insert_acl_obj_label(o_tmp, subj);
51742+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
51743+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
51744+ return -ENOMEM;
51745+
51746+ ret = copy_user_glob(o_tmp);
51747+ if (ret)
51748+ return ret;
51749+
51750+ if (o_tmp->nested) {
51751+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
51752+ if (IS_ERR(o_tmp->nested))
51753+ return PTR_ERR(o_tmp->nested);
51754+
51755+ /* insert into nested subject list */
51756+ o_tmp->nested->next = role->hash->first;
51757+ role->hash->first = o_tmp->nested;
51758+ }
51759+ }
51760+
51761+ return 0;
51762+}
51763+
51764+static __u32
51765+count_user_subjs(struct acl_subject_label *userp)
51766+{
51767+ struct acl_subject_label s_tmp;
51768+ __u32 num = 0;
51769+
51770+ while (userp) {
51771+ if (copy_from_user(&s_tmp, userp,
51772+ sizeof (struct acl_subject_label)))
51773+ break;
51774+
51775+ userp = s_tmp.prev;
51776+ /* do not count nested subjects against this count, since
51777+ they are not included in the hash table, but are
51778+ attached to objects. We have already counted
51779+ the subjects in userspace for the allocation
51780+ stack
51781+ */
51782+ if (!(s_tmp.mode & GR_NESTED))
51783+ num++;
51784+ }
51785+
51786+ return num;
51787+}
51788+
51789+static int
51790+copy_user_allowedips(struct acl_role_label *rolep)
51791+{
51792+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
51793+
51794+ ruserip = rolep->allowed_ips;
51795+
51796+ while (ruserip) {
51797+ rlast = rtmp;
51798+
51799+ if ((rtmp = (struct role_allowed_ip *)
51800+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
51801+ return -ENOMEM;
51802+
51803+ if (copy_from_user(rtmp, ruserip,
51804+ sizeof (struct role_allowed_ip)))
51805+ return -EFAULT;
51806+
51807+ ruserip = rtmp->prev;
51808+
51809+ if (!rlast) {
51810+ rtmp->prev = NULL;
51811+ rolep->allowed_ips = rtmp;
51812+ } else {
51813+ rlast->next = rtmp;
51814+ rtmp->prev = rlast;
51815+ }
51816+
51817+ if (!ruserip)
51818+ rtmp->next = NULL;
51819+ }
51820+
51821+ return 0;
51822+}
51823+
51824+static int
51825+copy_user_transitions(struct acl_role_label *rolep)
51826+{
51827+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
51828+
51829+ unsigned int len;
51830+ char *tmp;
51831+
51832+ rusertp = rolep->transitions;
51833+
51834+ while (rusertp) {
51835+ rlast = rtmp;
51836+
51837+ if ((rtmp = (struct role_transition *)
51838+ acl_alloc(sizeof (struct role_transition))) == NULL)
51839+ return -ENOMEM;
51840+
51841+ if (copy_from_user(rtmp, rusertp,
51842+ sizeof (struct role_transition)))
51843+ return -EFAULT;
51844+
51845+ rusertp = rtmp->prev;
51846+
51847+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
51848+
51849+ if (!len || len >= GR_SPROLE_LEN)
51850+ return -EINVAL;
51851+
51852+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51853+ return -ENOMEM;
51854+
51855+ if (copy_from_user(tmp, rtmp->rolename, len))
51856+ return -EFAULT;
51857+ tmp[len-1] = '\0';
51858+ rtmp->rolename = tmp;
51859+
51860+ if (!rlast) {
51861+ rtmp->prev = NULL;
51862+ rolep->transitions = rtmp;
51863+ } else {
51864+ rlast->next = rtmp;
51865+ rtmp->prev = rlast;
51866+ }
51867+
51868+ if (!rusertp)
51869+ rtmp->next = NULL;
51870+ }
51871+
51872+ return 0;
51873+}
51874+
51875+static struct acl_subject_label *
51876+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
51877+{
51878+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
51879+ unsigned int len;
51880+ char *tmp;
51881+ __u32 num_objs;
51882+ struct acl_ip_label **i_tmp, *i_utmp2;
51883+ struct gr_hash_struct ghash;
51884+ struct subject_map *subjmap;
51885+ unsigned int i_num;
51886+ int err;
51887+
51888+ s_tmp = lookup_subject_map(userp);
51889+
51890+ /* we've already copied this subject into the kernel, just return
51891+ the reference to it, and don't copy it over again
51892+ */
51893+ if (s_tmp)
51894+ return(s_tmp);
51895+
51896+ if ((s_tmp = (struct acl_subject_label *)
51897+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
51898+ return ERR_PTR(-ENOMEM);
51899+
51900+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
51901+ if (subjmap == NULL)
51902+ return ERR_PTR(-ENOMEM);
51903+
51904+ subjmap->user = userp;
51905+ subjmap->kernel = s_tmp;
51906+ insert_subj_map_entry(subjmap);
51907+
51908+ if (copy_from_user(s_tmp, userp,
51909+ sizeof (struct acl_subject_label)))
51910+ return ERR_PTR(-EFAULT);
51911+
51912+ len = strnlen_user(s_tmp->filename, PATH_MAX);
51913+
51914+ if (!len || len >= PATH_MAX)
51915+ return ERR_PTR(-EINVAL);
51916+
51917+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51918+ return ERR_PTR(-ENOMEM);
51919+
51920+ if (copy_from_user(tmp, s_tmp->filename, len))
51921+ return ERR_PTR(-EFAULT);
51922+ tmp[len-1] = '\0';
51923+ s_tmp->filename = tmp;
51924+
51925+ if (!strcmp(s_tmp->filename, "/"))
51926+ role->root_label = s_tmp;
51927+
51928+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
51929+ return ERR_PTR(-EFAULT);
51930+
51931+ /* copy user and group transition tables */
51932+
51933+ if (s_tmp->user_trans_num) {
51934+ uid_t *uidlist;
51935+
51936+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
51937+ if (uidlist == NULL)
51938+ return ERR_PTR(-ENOMEM);
51939+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
51940+ return ERR_PTR(-EFAULT);
51941+
51942+ s_tmp->user_transitions = uidlist;
51943+ }
51944+
51945+ if (s_tmp->group_trans_num) {
51946+ gid_t *gidlist;
51947+
51948+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
51949+ if (gidlist == NULL)
51950+ return ERR_PTR(-ENOMEM);
51951+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
51952+ return ERR_PTR(-EFAULT);
51953+
51954+ s_tmp->group_transitions = gidlist;
51955+ }
51956+
51957+ /* set up object hash table */
51958+ num_objs = count_user_objs(ghash.first);
51959+
51960+ s_tmp->obj_hash_size = num_objs;
51961+ s_tmp->obj_hash =
51962+ (struct acl_object_label **)
51963+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
51964+
51965+ if (!s_tmp->obj_hash)
51966+ return ERR_PTR(-ENOMEM);
51967+
51968+ memset(s_tmp->obj_hash, 0,
51969+ s_tmp->obj_hash_size *
51970+ sizeof (struct acl_object_label *));
51971+
51972+ /* add in objects */
51973+ err = copy_user_objs(ghash.first, s_tmp, role);
51974+
51975+ if (err)
51976+ return ERR_PTR(err);
51977+
51978+ /* set pointer for parent subject */
51979+ if (s_tmp->parent_subject) {
51980+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
51981+
51982+ if (IS_ERR(s_tmp2))
51983+ return s_tmp2;
51984+
51985+ s_tmp->parent_subject = s_tmp2;
51986+ }
51987+
51988+ /* add in ip acls */
51989+
51990+ if (!s_tmp->ip_num) {
51991+ s_tmp->ips = NULL;
51992+ goto insert;
51993+ }
51994+
51995+ i_tmp =
51996+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
51997+ sizeof (struct acl_ip_label *));
51998+
51999+ if (!i_tmp)
52000+ return ERR_PTR(-ENOMEM);
52001+
52002+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52003+ *(i_tmp + i_num) =
52004+ (struct acl_ip_label *)
52005+ acl_alloc(sizeof (struct acl_ip_label));
52006+ if (!*(i_tmp + i_num))
52007+ return ERR_PTR(-ENOMEM);
52008+
52009+ if (copy_from_user
52010+ (&i_utmp2, s_tmp->ips + i_num,
52011+ sizeof (struct acl_ip_label *)))
52012+ return ERR_PTR(-EFAULT);
52013+
52014+ if (copy_from_user
52015+ (*(i_tmp + i_num), i_utmp2,
52016+ sizeof (struct acl_ip_label)))
52017+ return ERR_PTR(-EFAULT);
52018+
52019+ if ((*(i_tmp + i_num))->iface == NULL)
52020+ continue;
52021+
52022+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52023+ if (!len || len >= IFNAMSIZ)
52024+ return ERR_PTR(-EINVAL);
52025+ tmp = acl_alloc(len);
52026+ if (tmp == NULL)
52027+ return ERR_PTR(-ENOMEM);
52028+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52029+ return ERR_PTR(-EFAULT);
52030+ (*(i_tmp + i_num))->iface = tmp;
52031+ }
52032+
52033+ s_tmp->ips = i_tmp;
52034+
52035+insert:
52036+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52037+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52038+ return ERR_PTR(-ENOMEM);
52039+
52040+ return s_tmp;
52041+}
52042+
52043+static int
52044+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52045+{
52046+ struct acl_subject_label s_pre;
52047+ struct acl_subject_label * ret;
52048+ int err;
52049+
52050+ while (userp) {
52051+ if (copy_from_user(&s_pre, userp,
52052+ sizeof (struct acl_subject_label)))
52053+ return -EFAULT;
52054+
52055+ /* do not add nested subjects here, add
52056+ while parsing objects
52057+ */
52058+
52059+ if (s_pre.mode & GR_NESTED) {
52060+ userp = s_pre.prev;
52061+ continue;
52062+ }
52063+
52064+ ret = do_copy_user_subj(userp, role);
52065+
52066+ err = PTR_ERR(ret);
52067+ if (IS_ERR(ret))
52068+ return err;
52069+
52070+ insert_acl_subj_label(ret, role);
52071+
52072+ userp = s_pre.prev;
52073+ }
52074+
52075+ return 0;
52076+}
52077+
52078+static int
52079+copy_user_acl(struct gr_arg *arg)
52080+{
52081+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52082+ struct sprole_pw *sptmp;
52083+ struct gr_hash_struct *ghash;
52084+ uid_t *domainlist;
52085+ unsigned int r_num;
52086+ unsigned int len;
52087+ char *tmp;
52088+ int err = 0;
52089+ __u16 i;
52090+ __u32 num_subjs;
52091+
52092+ /* we need a default and kernel role */
52093+ if (arg->role_db.num_roles < 2)
52094+ return -EINVAL;
52095+
52096+ /* copy special role authentication info from userspace */
52097+
52098+ num_sprole_pws = arg->num_sprole_pws;
52099+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52100+
52101+ if (!acl_special_roles) {
52102+ err = -ENOMEM;
52103+ goto cleanup;
52104+ }
52105+
52106+ for (i = 0; i < num_sprole_pws; i++) {
52107+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52108+ if (!sptmp) {
52109+ err = -ENOMEM;
52110+ goto cleanup;
52111+ }
52112+ if (copy_from_user(sptmp, arg->sprole_pws + i,
52113+ sizeof (struct sprole_pw))) {
52114+ err = -EFAULT;
52115+ goto cleanup;
52116+ }
52117+
52118+ len =
52119+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52120+
52121+ if (!len || len >= GR_SPROLE_LEN) {
52122+ err = -EINVAL;
52123+ goto cleanup;
52124+ }
52125+
52126+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52127+ err = -ENOMEM;
52128+ goto cleanup;
52129+ }
52130+
52131+ if (copy_from_user(tmp, sptmp->rolename, len)) {
52132+ err = -EFAULT;
52133+ goto cleanup;
52134+ }
52135+ tmp[len-1] = '\0';
52136+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52137+ printk(KERN_ALERT "Copying special role %s\n", tmp);
52138+#endif
52139+ sptmp->rolename = tmp;
52140+ acl_special_roles[i] = sptmp;
52141+ }
52142+
52143+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52144+
52145+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52146+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
52147+
52148+ if (!r_tmp) {
52149+ err = -ENOMEM;
52150+ goto cleanup;
52151+ }
52152+
52153+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
52154+ sizeof (struct acl_role_label *))) {
52155+ err = -EFAULT;
52156+ goto cleanup;
52157+ }
52158+
52159+ if (copy_from_user(r_tmp, r_utmp2,
52160+ sizeof (struct acl_role_label))) {
52161+ err = -EFAULT;
52162+ goto cleanup;
52163+ }
52164+
52165+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52166+
52167+ if (!len || len >= PATH_MAX) {
52168+ err = -EINVAL;
52169+ goto cleanup;
52170+ }
52171+
52172+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52173+ err = -ENOMEM;
52174+ goto cleanup;
52175+ }
52176+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
52177+ err = -EFAULT;
52178+ goto cleanup;
52179+ }
52180+ tmp[len-1] = '\0';
52181+ r_tmp->rolename = tmp;
52182+
52183+ if (!strcmp(r_tmp->rolename, "default")
52184+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52185+ default_role = r_tmp;
52186+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52187+ kernel_role = r_tmp;
52188+ }
52189+
52190+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52191+ err = -ENOMEM;
52192+ goto cleanup;
52193+ }
52194+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52195+ err = -EFAULT;
52196+ goto cleanup;
52197+ }
52198+
52199+ r_tmp->hash = ghash;
52200+
52201+ num_subjs = count_user_subjs(r_tmp->hash->first);
52202+
52203+ r_tmp->subj_hash_size = num_subjs;
52204+ r_tmp->subj_hash =
52205+ (struct acl_subject_label **)
52206+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52207+
52208+ if (!r_tmp->subj_hash) {
52209+ err = -ENOMEM;
52210+ goto cleanup;
52211+ }
52212+
52213+ err = copy_user_allowedips(r_tmp);
52214+ if (err)
52215+ goto cleanup;
52216+
52217+ /* copy domain info */
52218+ if (r_tmp->domain_children != NULL) {
52219+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52220+ if (domainlist == NULL) {
52221+ err = -ENOMEM;
52222+ goto cleanup;
52223+ }
52224+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52225+ err = -EFAULT;
52226+ goto cleanup;
52227+ }
52228+ r_tmp->domain_children = domainlist;
52229+ }
52230+
52231+ err = copy_user_transitions(r_tmp);
52232+ if (err)
52233+ goto cleanup;
52234+
52235+ memset(r_tmp->subj_hash, 0,
52236+ r_tmp->subj_hash_size *
52237+ sizeof (struct acl_subject_label *));
52238+
52239+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52240+
52241+ if (err)
52242+ goto cleanup;
52243+
52244+ /* set nested subject list to null */
52245+ r_tmp->hash->first = NULL;
52246+
52247+ insert_acl_role_label(r_tmp);
52248+ }
52249+
52250+ goto return_err;
52251+ cleanup:
52252+ free_variables();
52253+ return_err:
52254+ return err;
52255+
52256+}
52257+
52258+static int
52259+gracl_init(struct gr_arg *args)
52260+{
52261+ int error = 0;
52262+
52263+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52264+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52265+
52266+ if (init_variables(args)) {
52267+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52268+ error = -ENOMEM;
52269+ free_variables();
52270+ goto out;
52271+ }
52272+
52273+ error = copy_user_acl(args);
52274+ free_init_variables();
52275+ if (error) {
52276+ free_variables();
52277+ goto out;
52278+ }
52279+
52280+ if ((error = gr_set_acls(0))) {
52281+ free_variables();
52282+ goto out;
52283+ }
52284+
52285+ pax_open_kernel();
52286+ gr_status |= GR_READY;
52287+ pax_close_kernel();
52288+
52289+ out:
52290+ return error;
52291+}
52292+
52293+/* derived from glibc fnmatch() 0: match, 1: no match*/
52294+
52295+static int
52296+glob_match(const char *p, const char *n)
52297+{
52298+ char c;
52299+
52300+ while ((c = *p++) != '\0') {
52301+ switch (c) {
52302+ case '?':
52303+ if (*n == '\0')
52304+ return 1;
52305+ else if (*n == '/')
52306+ return 1;
52307+ break;
52308+ case '\\':
52309+ if (*n != c)
52310+ return 1;
52311+ break;
52312+ case '*':
52313+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
52314+ if (*n == '/')
52315+ return 1;
52316+ else if (c == '?') {
52317+ if (*n == '\0')
52318+ return 1;
52319+ else
52320+ ++n;
52321+ }
52322+ }
52323+ if (c == '\0') {
52324+ return 0;
52325+ } else {
52326+ const char *endp;
52327+
52328+ if ((endp = strchr(n, '/')) == NULL)
52329+ endp = n + strlen(n);
52330+
52331+ if (c == '[') {
52332+ for (--p; n < endp; ++n)
52333+ if (!glob_match(p, n))
52334+ return 0;
52335+ } else if (c == '/') {
52336+ while (*n != '\0' && *n != '/')
52337+ ++n;
52338+ if (*n == '/' && !glob_match(p, n + 1))
52339+ return 0;
52340+ } else {
52341+ for (--p; n < endp; ++n)
52342+ if (*n == c && !glob_match(p, n))
52343+ return 0;
52344+ }
52345+
52346+ return 1;
52347+ }
52348+ case '[':
52349+ {
52350+ int not;
52351+ char cold;
52352+
52353+ if (*n == '\0' || *n == '/')
52354+ return 1;
52355+
52356+ not = (*p == '!' || *p == '^');
52357+ if (not)
52358+ ++p;
52359+
52360+ c = *p++;
52361+ for (;;) {
52362+ unsigned char fn = (unsigned char)*n;
52363+
52364+ if (c == '\0')
52365+ return 1;
52366+ else {
52367+ if (c == fn)
52368+ goto matched;
52369+ cold = c;
52370+ c = *p++;
52371+
52372+ if (c == '-' && *p != ']') {
52373+ unsigned char cend = *p++;
52374+
52375+ if (cend == '\0')
52376+ return 1;
52377+
52378+ if (cold <= fn && fn <= cend)
52379+ goto matched;
52380+
52381+ c = *p++;
52382+ }
52383+ }
52384+
52385+ if (c == ']')
52386+ break;
52387+ }
52388+ if (!not)
52389+ return 1;
52390+ break;
52391+ matched:
52392+ while (c != ']') {
52393+ if (c == '\0')
52394+ return 1;
52395+
52396+ c = *p++;
52397+ }
52398+ if (not)
52399+ return 1;
52400+ }
52401+ break;
52402+ default:
52403+ if (c != *n)
52404+ return 1;
52405+ }
52406+
52407+ ++n;
52408+ }
52409+
52410+ if (*n == '\0')
52411+ return 0;
52412+
52413+ if (*n == '/')
52414+ return 0;
52415+
52416+ return 1;
52417+}
52418+
52419+static struct acl_object_label *
52420+chk_glob_label(struct acl_object_label *globbed,
52421+ struct dentry *dentry, struct vfsmount *mnt, char **path)
52422+{
52423+ struct acl_object_label *tmp;
52424+
52425+ if (*path == NULL)
52426+ *path = gr_to_filename_nolock(dentry, mnt);
52427+
52428+ tmp = globbed;
52429+
52430+ while (tmp) {
52431+ if (!glob_match(tmp->filename, *path))
52432+ return tmp;
52433+ tmp = tmp->next;
52434+ }
52435+
52436+ return NULL;
52437+}
52438+
52439+static struct acl_object_label *
52440+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52441+ const ino_t curr_ino, const dev_t curr_dev,
52442+ const struct acl_subject_label *subj, char **path, const int checkglob)
52443+{
52444+ struct acl_subject_label *tmpsubj;
52445+ struct acl_object_label *retval;
52446+ struct acl_object_label *retval2;
52447+
52448+ tmpsubj = (struct acl_subject_label *) subj;
52449+ read_lock(&gr_inode_lock);
52450+ do {
52451+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
52452+ if (retval) {
52453+ if (checkglob && retval->globbed) {
52454+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
52455+ (struct vfsmount *)orig_mnt, path);
52456+ if (retval2)
52457+ retval = retval2;
52458+ }
52459+ break;
52460+ }
52461+ } while ((tmpsubj = tmpsubj->parent_subject));
52462+ read_unlock(&gr_inode_lock);
52463+
52464+ return retval;
52465+}
52466+
52467+static __inline__ struct acl_object_label *
52468+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52469+ struct dentry *curr_dentry,
52470+ const struct acl_subject_label *subj, char **path, const int checkglob)
52471+{
52472+ int newglob = checkglob;
52473+ ino_t inode;
52474+ dev_t device;
52475+
52476+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
52477+ as we don't want a / * rule to match instead of the / object
52478+ don't do this for create lookups that call this function though, since they're looking up
52479+ on the parent and thus need globbing checks on all paths
52480+ */
52481+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
52482+ newglob = GR_NO_GLOB;
52483+
52484+ spin_lock(&curr_dentry->d_lock);
52485+ inode = curr_dentry->d_inode->i_ino;
52486+ device = __get_dev(curr_dentry);
52487+ spin_unlock(&curr_dentry->d_lock);
52488+
52489+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
52490+}
52491+
52492+static struct acl_object_label *
52493+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52494+ const struct acl_subject_label *subj, char *path, const int checkglob)
52495+{
52496+ struct dentry *dentry = (struct dentry *) l_dentry;
52497+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52498+ struct acl_object_label *retval;
52499+ struct dentry *parent;
52500+
52501+ write_seqlock(&rename_lock);
52502+ br_read_lock(vfsmount_lock);
52503+
52504+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
52505+#ifdef CONFIG_NET
52506+ mnt == sock_mnt ||
52507+#endif
52508+#ifdef CONFIG_HUGETLBFS
52509+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
52510+#endif
52511+ /* ignore Eric Biederman */
52512+ IS_PRIVATE(l_dentry->d_inode))) {
52513+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
52514+ goto out;
52515+ }
52516+
52517+ for (;;) {
52518+ if (dentry == real_root.dentry && mnt == real_root.mnt)
52519+ break;
52520+
52521+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52522+ if (mnt->mnt_parent == mnt)
52523+ break;
52524+
52525+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52526+ if (retval != NULL)
52527+ goto out;
52528+
52529+ dentry = mnt->mnt_mountpoint;
52530+ mnt = mnt->mnt_parent;
52531+ continue;
52532+ }
52533+
52534+ parent = dentry->d_parent;
52535+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52536+ if (retval != NULL)
52537+ goto out;
52538+
52539+ dentry = parent;
52540+ }
52541+
52542+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52543+
52544+ /* real_root is pinned so we don't have to hold a reference */
52545+ if (retval == NULL)
52546+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
52547+out:
52548+ br_read_unlock(vfsmount_lock);
52549+ write_sequnlock(&rename_lock);
52550+
52551+ BUG_ON(retval == NULL);
52552+
52553+ return retval;
52554+}
52555+
52556+static __inline__ struct acl_object_label *
52557+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52558+ const struct acl_subject_label *subj)
52559+{
52560+ char *path = NULL;
52561+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
52562+}
52563+
52564+static __inline__ struct acl_object_label *
52565+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52566+ const struct acl_subject_label *subj)
52567+{
52568+ char *path = NULL;
52569+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
52570+}
52571+
52572+static __inline__ struct acl_object_label *
52573+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52574+ const struct acl_subject_label *subj, char *path)
52575+{
52576+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
52577+}
52578+
52579+static struct acl_subject_label *
52580+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52581+ const struct acl_role_label *role)
52582+{
52583+ struct dentry *dentry = (struct dentry *) l_dentry;
52584+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52585+ struct acl_subject_label *retval;
52586+ struct dentry *parent;
52587+
52588+ write_seqlock(&rename_lock);
52589+ br_read_lock(vfsmount_lock);
52590+
52591+ for (;;) {
52592+ if (dentry == real_root.dentry && mnt == real_root.mnt)
52593+ break;
52594+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52595+ if (mnt->mnt_parent == mnt)
52596+ break;
52597+
52598+ spin_lock(&dentry->d_lock);
52599+ read_lock(&gr_inode_lock);
52600+ retval =
52601+ lookup_acl_subj_label(dentry->d_inode->i_ino,
52602+ __get_dev(dentry), role);
52603+ read_unlock(&gr_inode_lock);
52604+ spin_unlock(&dentry->d_lock);
52605+ if (retval != NULL)
52606+ goto out;
52607+
52608+ dentry = mnt->mnt_mountpoint;
52609+ mnt = mnt->mnt_parent;
52610+ continue;
52611+ }
52612+
52613+ spin_lock(&dentry->d_lock);
52614+ read_lock(&gr_inode_lock);
52615+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52616+ __get_dev(dentry), role);
52617+ read_unlock(&gr_inode_lock);
52618+ parent = dentry->d_parent;
52619+ spin_unlock(&dentry->d_lock);
52620+
52621+ if (retval != NULL)
52622+ goto out;
52623+
52624+ dentry = parent;
52625+ }
52626+
52627+ spin_lock(&dentry->d_lock);
52628+ read_lock(&gr_inode_lock);
52629+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52630+ __get_dev(dentry), role);
52631+ read_unlock(&gr_inode_lock);
52632+ spin_unlock(&dentry->d_lock);
52633+
52634+ if (unlikely(retval == NULL)) {
52635+ /* real_root is pinned, we don't need to hold a reference */
52636+ read_lock(&gr_inode_lock);
52637+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
52638+ __get_dev(real_root.dentry), role);
52639+ read_unlock(&gr_inode_lock);
52640+ }
52641+out:
52642+ br_read_unlock(vfsmount_lock);
52643+ write_sequnlock(&rename_lock);
52644+
52645+ BUG_ON(retval == NULL);
52646+
52647+ return retval;
52648+}
52649+
52650+static void
52651+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
52652+{
52653+ struct task_struct *task = current;
52654+ const struct cred *cred = current_cred();
52655+
52656+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52657+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52658+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52659+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
52660+
52661+ return;
52662+}
52663+
52664+static void
52665+gr_log_learn_sysctl(const char *path, const __u32 mode)
52666+{
52667+ struct task_struct *task = current;
52668+ const struct cred *cred = current_cred();
52669+
52670+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52671+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52672+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52673+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
52674+
52675+ return;
52676+}
52677+
52678+static void
52679+gr_log_learn_id_change(const char type, const unsigned int real,
52680+ const unsigned int effective, const unsigned int fs)
52681+{
52682+ struct task_struct *task = current;
52683+ const struct cred *cred = current_cred();
52684+
52685+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
52686+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52687+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52688+ type, real, effective, fs, &task->signal->saved_ip);
52689+
52690+ return;
52691+}
52692+
52693+__u32
52694+gr_search_file(const struct dentry * dentry, const __u32 mode,
52695+ const struct vfsmount * mnt)
52696+{
52697+ __u32 retval = mode;
52698+ struct acl_subject_label *curracl;
52699+ struct acl_object_label *currobj;
52700+
52701+ if (unlikely(!(gr_status & GR_READY)))
52702+ return (mode & ~GR_AUDITS);
52703+
52704+ curracl = current->acl;
52705+
52706+ currobj = chk_obj_label(dentry, mnt, curracl);
52707+ retval = currobj->mode & mode;
52708+
52709+ /* if we're opening a specified transfer file for writing
52710+ (e.g. /dev/initctl), then transfer our role to init
52711+ */
52712+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
52713+ current->role->roletype & GR_ROLE_PERSIST)) {
52714+ struct task_struct *task = init_pid_ns.child_reaper;
52715+
52716+ if (task->role != current->role) {
52717+ task->acl_sp_role = 0;
52718+ task->acl_role_id = current->acl_role_id;
52719+ task->role = current->role;
52720+ rcu_read_lock();
52721+ read_lock(&grsec_exec_file_lock);
52722+ gr_apply_subject_to_task(task);
52723+ read_unlock(&grsec_exec_file_lock);
52724+ rcu_read_unlock();
52725+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
52726+ }
52727+ }
52728+
52729+ if (unlikely
52730+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
52731+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
52732+ __u32 new_mode = mode;
52733+
52734+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52735+
52736+ retval = new_mode;
52737+
52738+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
52739+ new_mode |= GR_INHERIT;
52740+
52741+ if (!(mode & GR_NOLEARN))
52742+ gr_log_learn(dentry, mnt, new_mode);
52743+ }
52744+
52745+ return retval;
52746+}
52747+
52748+struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
52749+ const struct dentry *parent,
52750+ const struct vfsmount *mnt)
52751+{
52752+ struct name_entry *match;
52753+ struct acl_object_label *matchpo;
52754+ struct acl_subject_label *curracl;
52755+ char *path;
52756+
52757+ if (unlikely(!(gr_status & GR_READY)))
52758+ return NULL;
52759+
52760+ preempt_disable();
52761+ path = gr_to_filename_rbac(new_dentry, mnt);
52762+ match = lookup_name_entry_create(path);
52763+
52764+ curracl = current->acl;
52765+
52766+ if (match) {
52767+ read_lock(&gr_inode_lock);
52768+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
52769+ read_unlock(&gr_inode_lock);
52770+
52771+ if (matchpo) {
52772+ preempt_enable();
52773+ return matchpo;
52774+ }
52775+ }
52776+
52777+ // lookup parent
52778+
52779+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
52780+
52781+ preempt_enable();
52782+ return matchpo;
52783+}
52784+
52785+__u32
52786+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
52787+ const struct vfsmount * mnt, const __u32 mode)
52788+{
52789+ struct acl_object_label *matchpo;
52790+ __u32 retval;
52791+
52792+ if (unlikely(!(gr_status & GR_READY)))
52793+ return (mode & ~GR_AUDITS);
52794+
52795+ matchpo = gr_get_create_object(new_dentry, parent, mnt);
52796+
52797+ retval = matchpo->mode & mode;
52798+
52799+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
52800+ && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
52801+ __u32 new_mode = mode;
52802+
52803+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52804+
52805+ gr_log_learn(new_dentry, mnt, new_mode);
52806+ return new_mode;
52807+ }
52808+
52809+ return retval;
52810+}
52811+
52812+__u32
52813+gr_check_link(const struct dentry * new_dentry,
52814+ const struct dentry * parent_dentry,
52815+ const struct vfsmount * parent_mnt,
52816+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
52817+{
52818+ struct acl_object_label *obj;
52819+ __u32 oldmode, newmode;
52820+ __u32 needmode;
52821+ __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
52822+ GR_DELETE | GR_INHERIT;
52823+
52824+ if (unlikely(!(gr_status & GR_READY)))
52825+ return (GR_CREATE | GR_LINK);
52826+
52827+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
52828+ oldmode = obj->mode;
52829+
52830+ obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
52831+ newmode = obj->mode;
52832+
52833+ needmode = newmode & checkmodes;
52834+
52835+ // old name for hardlink must have at least the permissions of the new name
52836+ if ((oldmode & needmode) != needmode)
52837+ goto bad;
52838+
52839+ // if old name had restrictions/auditing, make sure the new name does as well
52840+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
52841+
52842+ // don't allow hardlinking of suid/sgid files without permission
52843+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52844+ needmode |= GR_SETID;
52845+
52846+ if ((newmode & needmode) != needmode)
52847+ goto bad;
52848+
52849+ // enforce minimum permissions
52850+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
52851+ return newmode;
52852+bad:
52853+ needmode = oldmode;
52854+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52855+ needmode |= GR_SETID;
52856+
52857+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
52858+ gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
52859+ return (GR_CREATE | GR_LINK);
52860+ } else if (newmode & GR_SUPPRESS)
52861+ return GR_SUPPRESS;
52862+ else
52863+ return 0;
52864+}
52865+
52866+int
52867+gr_check_hidden_task(const struct task_struct *task)
52868+{
52869+ if (unlikely(!(gr_status & GR_READY)))
52870+ return 0;
52871+
52872+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
52873+ return 1;
52874+
52875+ return 0;
52876+}
52877+
52878+int
52879+gr_check_protected_task(const struct task_struct *task)
52880+{
52881+ if (unlikely(!(gr_status & GR_READY) || !task))
52882+ return 0;
52883+
52884+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52885+ task->acl != current->acl)
52886+ return 1;
52887+
52888+ return 0;
52889+}
52890+
52891+int
52892+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
52893+{
52894+ struct task_struct *p;
52895+ int ret = 0;
52896+
52897+ if (unlikely(!(gr_status & GR_READY) || !pid))
52898+ return ret;
52899+
52900+ read_lock(&tasklist_lock);
52901+ do_each_pid_task(pid, type, p) {
52902+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52903+ p->acl != current->acl) {
52904+ ret = 1;
52905+ goto out;
52906+ }
52907+ } while_each_pid_task(pid, type, p);
52908+out:
52909+ read_unlock(&tasklist_lock);
52910+
52911+ return ret;
52912+}
52913+
52914+void
52915+gr_copy_label(struct task_struct *tsk)
52916+{
52917+ tsk->signal->used_accept = 0;
52918+ tsk->acl_sp_role = 0;
52919+ tsk->acl_role_id = current->acl_role_id;
52920+ tsk->acl = current->acl;
52921+ tsk->role = current->role;
52922+ tsk->signal->curr_ip = current->signal->curr_ip;
52923+ tsk->signal->saved_ip = current->signal->saved_ip;
52924+ if (current->exec_file)
52925+ get_file(current->exec_file);
52926+ tsk->exec_file = current->exec_file;
52927+ tsk->is_writable = current->is_writable;
52928+ if (unlikely(current->signal->used_accept)) {
52929+ current->signal->curr_ip = 0;
52930+ current->signal->saved_ip = 0;
52931+ }
52932+
52933+ return;
52934+}
52935+
52936+static void
52937+gr_set_proc_res(struct task_struct *task)
52938+{
52939+ struct acl_subject_label *proc;
52940+ unsigned short i;
52941+
52942+ proc = task->acl;
52943+
52944+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
52945+ return;
52946+
52947+ for (i = 0; i < RLIM_NLIMITS; i++) {
52948+ if (!(proc->resmask & (1 << i)))
52949+ continue;
52950+
52951+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
52952+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
52953+ }
52954+
52955+ return;
52956+}
52957+
52958+extern int __gr_process_user_ban(struct user_struct *user);
52959+
52960+int
52961+gr_check_user_change(int real, int effective, int fs)
52962+{
52963+ unsigned int i;
52964+ __u16 num;
52965+ uid_t *uidlist;
52966+ int curuid;
52967+ int realok = 0;
52968+ int effectiveok = 0;
52969+ int fsok = 0;
52970+
52971+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
52972+ struct user_struct *user;
52973+
52974+ if (real == -1)
52975+ goto skipit;
52976+
52977+ user = find_user(real);
52978+ if (user == NULL)
52979+ goto skipit;
52980+
52981+ if (__gr_process_user_ban(user)) {
52982+ /* for find_user */
52983+ free_uid(user);
52984+ return 1;
52985+ }
52986+
52987+ /* for find_user */
52988+ free_uid(user);
52989+
52990+skipit:
52991+#endif
52992+
52993+ if (unlikely(!(gr_status & GR_READY)))
52994+ return 0;
52995+
52996+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
52997+ gr_log_learn_id_change('u', real, effective, fs);
52998+
52999+ num = current->acl->user_trans_num;
53000+ uidlist = current->acl->user_transitions;
53001+
53002+ if (uidlist == NULL)
53003+ return 0;
53004+
53005+ if (real == -1)
53006+ realok = 1;
53007+ if (effective == -1)
53008+ effectiveok = 1;
53009+ if (fs == -1)
53010+ fsok = 1;
53011+
53012+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53013+ for (i = 0; i < num; i++) {
53014+ curuid = (int)uidlist[i];
53015+ if (real == curuid)
53016+ realok = 1;
53017+ if (effective == curuid)
53018+ effectiveok = 1;
53019+ if (fs == curuid)
53020+ fsok = 1;
53021+ }
53022+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53023+ for (i = 0; i < num; i++) {
53024+ curuid = (int)uidlist[i];
53025+ if (real == curuid)
53026+ break;
53027+ if (effective == curuid)
53028+ break;
53029+ if (fs == curuid)
53030+ break;
53031+ }
53032+ /* not in deny list */
53033+ if (i == num) {
53034+ realok = 1;
53035+ effectiveok = 1;
53036+ fsok = 1;
53037+ }
53038+ }
53039+
53040+ if (realok && effectiveok && fsok)
53041+ return 0;
53042+ else {
53043+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53044+ return 1;
53045+ }
53046+}
53047+
53048+int
53049+gr_check_group_change(int real, int effective, int fs)
53050+{
53051+ unsigned int i;
53052+ __u16 num;
53053+ gid_t *gidlist;
53054+ int curgid;
53055+ int realok = 0;
53056+ int effectiveok = 0;
53057+ int fsok = 0;
53058+
53059+ if (unlikely(!(gr_status & GR_READY)))
53060+ return 0;
53061+
53062+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53063+ gr_log_learn_id_change('g', real, effective, fs);
53064+
53065+ num = current->acl->group_trans_num;
53066+ gidlist = current->acl->group_transitions;
53067+
53068+ if (gidlist == NULL)
53069+ return 0;
53070+
53071+ if (real == -1)
53072+ realok = 1;
53073+ if (effective == -1)
53074+ effectiveok = 1;
53075+ if (fs == -1)
53076+ fsok = 1;
53077+
53078+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
53079+ for (i = 0; i < num; i++) {
53080+ curgid = (int)gidlist[i];
53081+ if (real == curgid)
53082+ realok = 1;
53083+ if (effective == curgid)
53084+ effectiveok = 1;
53085+ if (fs == curgid)
53086+ fsok = 1;
53087+ }
53088+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
53089+ for (i = 0; i < num; i++) {
53090+ curgid = (int)gidlist[i];
53091+ if (real == curgid)
53092+ break;
53093+ if (effective == curgid)
53094+ break;
53095+ if (fs == curgid)
53096+ break;
53097+ }
53098+ /* not in deny list */
53099+ if (i == num) {
53100+ realok = 1;
53101+ effectiveok = 1;
53102+ fsok = 1;
53103+ }
53104+ }
53105+
53106+ if (realok && effectiveok && fsok)
53107+ return 0;
53108+ else {
53109+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53110+ return 1;
53111+ }
53112+}
53113+
53114+void
53115+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53116+{
53117+ struct acl_role_label *role = task->role;
53118+ struct acl_subject_label *subj = NULL;
53119+ struct acl_object_label *obj;
53120+ struct file *filp;
53121+
53122+ if (unlikely(!(gr_status & GR_READY)))
53123+ return;
53124+
53125+ filp = task->exec_file;
53126+
53127+ /* kernel process, we'll give them the kernel role */
53128+ if (unlikely(!filp)) {
53129+ task->role = kernel_role;
53130+ task->acl = kernel_role->root_label;
53131+ return;
53132+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53133+ role = lookup_acl_role_label(task, uid, gid);
53134+
53135+ /* perform subject lookup in possibly new role
53136+ we can use this result below in the case where role == task->role
53137+ */
53138+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53139+
53140+ /* if we changed uid/gid, but result in the same role
53141+ and are using inheritance, don't lose the inherited subject
53142+ if current subject is other than what normal lookup
53143+ would result in, we arrived via inheritance, don't
53144+ lose subject
53145+ */
53146+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53147+ (subj == task->acl)))
53148+ task->acl = subj;
53149+
53150+ task->role = role;
53151+
53152+ task->is_writable = 0;
53153+
53154+ /* ignore additional mmap checks for processes that are writable
53155+ by the default ACL */
53156+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53157+ if (unlikely(obj->mode & GR_WRITE))
53158+ task->is_writable = 1;
53159+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53160+ if (unlikely(obj->mode & GR_WRITE))
53161+ task->is_writable = 1;
53162+
53163+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53164+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53165+#endif
53166+
53167+ gr_set_proc_res(task);
53168+
53169+ return;
53170+}
53171+
53172+int
53173+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53174+ const int unsafe_share)
53175+{
53176+ struct task_struct *task = current;
53177+ struct acl_subject_label *newacl;
53178+ struct acl_object_label *obj;
53179+ __u32 retmode;
53180+
53181+ if (unlikely(!(gr_status & GR_READY)))
53182+ return 0;
53183+
53184+ newacl = chk_subj_label(dentry, mnt, task->role);
53185+
53186+ task_lock(task);
53187+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53188+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53189+ !(task->role->roletype & GR_ROLE_GOD) &&
53190+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53191+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53192+ task_unlock(task);
53193+ if (unsafe_share)
53194+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53195+ else
53196+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53197+ return -EACCES;
53198+ }
53199+ task_unlock(task);
53200+
53201+ obj = chk_obj_label(dentry, mnt, task->acl);
53202+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53203+
53204+ if (!(task->acl->mode & GR_INHERITLEARN) &&
53205+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53206+ if (obj->nested)
53207+ task->acl = obj->nested;
53208+ else
53209+ task->acl = newacl;
53210+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53211+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53212+
53213+ task->is_writable = 0;
53214+
53215+ /* ignore additional mmap checks for processes that are writable
53216+ by the default ACL */
53217+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
53218+ if (unlikely(obj->mode & GR_WRITE))
53219+ task->is_writable = 1;
53220+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
53221+ if (unlikely(obj->mode & GR_WRITE))
53222+ task->is_writable = 1;
53223+
53224+ gr_set_proc_res(task);
53225+
53226+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53227+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53228+#endif
53229+ return 0;
53230+}
53231+
53232+/* always called with valid inodev ptr */
53233+static void
53234+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53235+{
53236+ struct acl_object_label *matchpo;
53237+ struct acl_subject_label *matchps;
53238+ struct acl_subject_label *subj;
53239+ struct acl_role_label *role;
53240+ unsigned int x;
53241+
53242+ FOR_EACH_ROLE_START(role)
53243+ FOR_EACH_SUBJECT_START(role, subj, x)
53244+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53245+ matchpo->mode |= GR_DELETED;
53246+ FOR_EACH_SUBJECT_END(subj,x)
53247+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53248+ if (subj->inode == ino && subj->device == dev)
53249+ subj->mode |= GR_DELETED;
53250+ FOR_EACH_NESTED_SUBJECT_END(subj)
53251+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53252+ matchps->mode |= GR_DELETED;
53253+ FOR_EACH_ROLE_END(role)
53254+
53255+ inodev->nentry->deleted = 1;
53256+
53257+ return;
53258+}
53259+
53260+void
53261+gr_handle_delete(const ino_t ino, const dev_t dev)
53262+{
53263+ struct inodev_entry *inodev;
53264+
53265+ if (unlikely(!(gr_status & GR_READY)))
53266+ return;
53267+
53268+ write_lock(&gr_inode_lock);
53269+ inodev = lookup_inodev_entry(ino, dev);
53270+ if (inodev != NULL)
53271+ do_handle_delete(inodev, ino, dev);
53272+ write_unlock(&gr_inode_lock);
53273+
53274+ return;
53275+}
53276+
53277+static void
53278+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53279+ const ino_t newinode, const dev_t newdevice,
53280+ struct acl_subject_label *subj)
53281+{
53282+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53283+ struct acl_object_label *match;
53284+
53285+ match = subj->obj_hash[index];
53286+
53287+ while (match && (match->inode != oldinode ||
53288+ match->device != olddevice ||
53289+ !(match->mode & GR_DELETED)))
53290+ match = match->next;
53291+
53292+ if (match && (match->inode == oldinode)
53293+ && (match->device == olddevice)
53294+ && (match->mode & GR_DELETED)) {
53295+ if (match->prev == NULL) {
53296+ subj->obj_hash[index] = match->next;
53297+ if (match->next != NULL)
53298+ match->next->prev = NULL;
53299+ } else {
53300+ match->prev->next = match->next;
53301+ if (match->next != NULL)
53302+ match->next->prev = match->prev;
53303+ }
53304+ match->prev = NULL;
53305+ match->next = NULL;
53306+ match->inode = newinode;
53307+ match->device = newdevice;
53308+ match->mode &= ~GR_DELETED;
53309+
53310+ insert_acl_obj_label(match, subj);
53311+ }
53312+
53313+ return;
53314+}
53315+
53316+static void
53317+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53318+ const ino_t newinode, const dev_t newdevice,
53319+ struct acl_role_label *role)
53320+{
53321+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53322+ struct acl_subject_label *match;
53323+
53324+ match = role->subj_hash[index];
53325+
53326+ while (match && (match->inode != oldinode ||
53327+ match->device != olddevice ||
53328+ !(match->mode & GR_DELETED)))
53329+ match = match->next;
53330+
53331+ if (match && (match->inode == oldinode)
53332+ && (match->device == olddevice)
53333+ && (match->mode & GR_DELETED)) {
53334+ if (match->prev == NULL) {
53335+ role->subj_hash[index] = match->next;
53336+ if (match->next != NULL)
53337+ match->next->prev = NULL;
53338+ } else {
53339+ match->prev->next = match->next;
53340+ if (match->next != NULL)
53341+ match->next->prev = match->prev;
53342+ }
53343+ match->prev = NULL;
53344+ match->next = NULL;
53345+ match->inode = newinode;
53346+ match->device = newdevice;
53347+ match->mode &= ~GR_DELETED;
53348+
53349+ insert_acl_subj_label(match, role);
53350+ }
53351+
53352+ return;
53353+}
53354+
53355+static void
53356+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53357+ const ino_t newinode, const dev_t newdevice)
53358+{
53359+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53360+ struct inodev_entry *match;
53361+
53362+ match = inodev_set.i_hash[index];
53363+
53364+ while (match && (match->nentry->inode != oldinode ||
53365+ match->nentry->device != olddevice || !match->nentry->deleted))
53366+ match = match->next;
53367+
53368+ if (match && (match->nentry->inode == oldinode)
53369+ && (match->nentry->device == olddevice) &&
53370+ match->nentry->deleted) {
53371+ if (match->prev == NULL) {
53372+ inodev_set.i_hash[index] = match->next;
53373+ if (match->next != NULL)
53374+ match->next->prev = NULL;
53375+ } else {
53376+ match->prev->next = match->next;
53377+ if (match->next != NULL)
53378+ match->next->prev = match->prev;
53379+ }
53380+ match->prev = NULL;
53381+ match->next = NULL;
53382+ match->nentry->inode = newinode;
53383+ match->nentry->device = newdevice;
53384+ match->nentry->deleted = 0;
53385+
53386+ insert_inodev_entry(match);
53387+ }
53388+
53389+ return;
53390+}
53391+
53392+static void
53393+__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
53394+{
53395+ struct acl_subject_label *subj;
53396+ struct acl_role_label *role;
53397+ unsigned int x;
53398+
53399+ FOR_EACH_ROLE_START(role)
53400+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
53401+
53402+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53403+ if ((subj->inode == ino) && (subj->device == dev)) {
53404+ subj->inode = ino;
53405+ subj->device = dev;
53406+ }
53407+ FOR_EACH_NESTED_SUBJECT_END(subj)
53408+ FOR_EACH_SUBJECT_START(role, subj, x)
53409+ update_acl_obj_label(matchn->inode, matchn->device,
53410+ ino, dev, subj);
53411+ FOR_EACH_SUBJECT_END(subj,x)
53412+ FOR_EACH_ROLE_END(role)
53413+
53414+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
53415+
53416+ return;
53417+}
53418+
53419+static void
53420+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
53421+ const struct vfsmount *mnt)
53422+{
53423+ ino_t ino = dentry->d_inode->i_ino;
53424+ dev_t dev = __get_dev(dentry);
53425+
53426+ __do_handle_create(matchn, ino, dev);
53427+
53428+ return;
53429+}
53430+
53431+void
53432+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
53433+{
53434+ struct name_entry *matchn;
53435+
53436+ if (unlikely(!(gr_status & GR_READY)))
53437+ return;
53438+
53439+ preempt_disable();
53440+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
53441+
53442+ if (unlikely((unsigned long)matchn)) {
53443+ write_lock(&gr_inode_lock);
53444+ do_handle_create(matchn, dentry, mnt);
53445+ write_unlock(&gr_inode_lock);
53446+ }
53447+ preempt_enable();
53448+
53449+ return;
53450+}
53451+
53452+void
53453+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
53454+{
53455+ struct name_entry *matchn;
53456+
53457+ if (unlikely(!(gr_status & GR_READY)))
53458+ return;
53459+
53460+ preempt_disable();
53461+ matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
53462+
53463+ if (unlikely((unsigned long)matchn)) {
53464+ write_lock(&gr_inode_lock);
53465+ __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
53466+ write_unlock(&gr_inode_lock);
53467+ }
53468+ preempt_enable();
53469+
53470+ return;
53471+}
53472+
53473+void
53474+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
53475+ struct dentry *old_dentry,
53476+ struct dentry *new_dentry,
53477+ struct vfsmount *mnt, const __u8 replace)
53478+{
53479+ struct name_entry *matchn;
53480+ struct inodev_entry *inodev;
53481+ struct inode *inode = new_dentry->d_inode;
53482+ ino_t old_ino = old_dentry->d_inode->i_ino;
53483+ dev_t old_dev = __get_dev(old_dentry);
53484+
53485+ /* vfs_rename swaps the name and parent link for old_dentry and
53486+ new_dentry
53487+ at this point, old_dentry has the new name, parent link, and inode
53488+ for the renamed file
53489+ if a file is being replaced by a rename, new_dentry has the inode
53490+ and name for the replaced file
53491+ */
53492+
53493+ if (unlikely(!(gr_status & GR_READY)))
53494+ return;
53495+
53496+ preempt_disable();
53497+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
53498+
53499+ /* we wouldn't have to check d_inode if it weren't for
53500+ NFS silly-renaming
53501+ */
53502+
53503+ write_lock(&gr_inode_lock);
53504+ if (unlikely(replace && inode)) {
53505+ ino_t new_ino = inode->i_ino;
53506+ dev_t new_dev = __get_dev(new_dentry);
53507+
53508+ inodev = lookup_inodev_entry(new_ino, new_dev);
53509+ if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
53510+ do_handle_delete(inodev, new_ino, new_dev);
53511+ }
53512+
53513+ inodev = lookup_inodev_entry(old_ino, old_dev);
53514+ if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
53515+ do_handle_delete(inodev, old_ino, old_dev);
53516+
53517+ if (unlikely((unsigned long)matchn))
53518+ do_handle_create(matchn, old_dentry, mnt);
53519+
53520+ write_unlock(&gr_inode_lock);
53521+ preempt_enable();
53522+
53523+ return;
53524+}
53525+
53526+static int
53527+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
53528+ unsigned char **sum)
53529+{
53530+ struct acl_role_label *r;
53531+ struct role_allowed_ip *ipp;
53532+ struct role_transition *trans;
53533+ unsigned int i;
53534+ int found = 0;
53535+ u32 curr_ip = current->signal->curr_ip;
53536+
53537+ current->signal->saved_ip = curr_ip;
53538+
53539+ /* check transition table */
53540+
53541+ for (trans = current->role->transitions; trans; trans = trans->next) {
53542+ if (!strcmp(rolename, trans->rolename)) {
53543+ found = 1;
53544+ break;
53545+ }
53546+ }
53547+
53548+ if (!found)
53549+ return 0;
53550+
53551+ /* handle special roles that do not require authentication
53552+ and check ip */
53553+
53554+ FOR_EACH_ROLE_START(r)
53555+ if (!strcmp(rolename, r->rolename) &&
53556+ (r->roletype & GR_ROLE_SPECIAL)) {
53557+ found = 0;
53558+ if (r->allowed_ips != NULL) {
53559+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
53560+ if ((ntohl(curr_ip) & ipp->netmask) ==
53561+ (ntohl(ipp->addr) & ipp->netmask))
53562+ found = 1;
53563+ }
53564+ } else
53565+ found = 2;
53566+ if (!found)
53567+ return 0;
53568+
53569+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
53570+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
53571+ *salt = NULL;
53572+ *sum = NULL;
53573+ return 1;
53574+ }
53575+ }
53576+ FOR_EACH_ROLE_END(r)
53577+
53578+ for (i = 0; i < num_sprole_pws; i++) {
53579+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
53580+ *salt = acl_special_roles[i]->salt;
53581+ *sum = acl_special_roles[i]->sum;
53582+ return 1;
53583+ }
53584+ }
53585+
53586+ return 0;
53587+}
53588+
53589+static void
53590+assign_special_role(char *rolename)
53591+{
53592+ struct acl_object_label *obj;
53593+ struct acl_role_label *r;
53594+ struct acl_role_label *assigned = NULL;
53595+ struct task_struct *tsk;
53596+ struct file *filp;
53597+
53598+ FOR_EACH_ROLE_START(r)
53599+ if (!strcmp(rolename, r->rolename) &&
53600+ (r->roletype & GR_ROLE_SPECIAL)) {
53601+ assigned = r;
53602+ break;
53603+ }
53604+ FOR_EACH_ROLE_END(r)
53605+
53606+ if (!assigned)
53607+ return;
53608+
53609+ read_lock(&tasklist_lock);
53610+ read_lock(&grsec_exec_file_lock);
53611+
53612+ tsk = current->real_parent;
53613+ if (tsk == NULL)
53614+ goto out_unlock;
53615+
53616+ filp = tsk->exec_file;
53617+ if (filp == NULL)
53618+ goto out_unlock;
53619+
53620+ tsk->is_writable = 0;
53621+
53622+ tsk->acl_sp_role = 1;
53623+ tsk->acl_role_id = ++acl_sp_role_value;
53624+ tsk->role = assigned;
53625+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
53626+
53627+ /* ignore additional mmap checks for processes that are writable
53628+ by the default ACL */
53629+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53630+ if (unlikely(obj->mode & GR_WRITE))
53631+ tsk->is_writable = 1;
53632+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
53633+ if (unlikely(obj->mode & GR_WRITE))
53634+ tsk->is_writable = 1;
53635+
53636+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53637+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
53638+#endif
53639+
53640+out_unlock:
53641+ read_unlock(&grsec_exec_file_lock);
53642+ read_unlock(&tasklist_lock);
53643+ return;
53644+}
53645+
53646+int gr_check_secure_terminal(struct task_struct *task)
53647+{
53648+ struct task_struct *p, *p2, *p3;
53649+ struct files_struct *files;
53650+ struct fdtable *fdt;
53651+ struct file *our_file = NULL, *file;
53652+ int i;
53653+
53654+ if (task->signal->tty == NULL)
53655+ return 1;
53656+
53657+ files = get_files_struct(task);
53658+ if (files != NULL) {
53659+ rcu_read_lock();
53660+ fdt = files_fdtable(files);
53661+ for (i=0; i < fdt->max_fds; i++) {
53662+ file = fcheck_files(files, i);
53663+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
53664+ get_file(file);
53665+ our_file = file;
53666+ }
53667+ }
53668+ rcu_read_unlock();
53669+ put_files_struct(files);
53670+ }
53671+
53672+ if (our_file == NULL)
53673+ return 1;
53674+
53675+ read_lock(&tasklist_lock);
53676+ do_each_thread(p2, p) {
53677+ files = get_files_struct(p);
53678+ if (files == NULL ||
53679+ (p->signal && p->signal->tty == task->signal->tty)) {
53680+ if (files != NULL)
53681+ put_files_struct(files);
53682+ continue;
53683+ }
53684+ rcu_read_lock();
53685+ fdt = files_fdtable(files);
53686+ for (i=0; i < fdt->max_fds; i++) {
53687+ file = fcheck_files(files, i);
53688+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
53689+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
53690+ p3 = task;
53691+ while (p3->pid > 0) {
53692+ if (p3 == p)
53693+ break;
53694+ p3 = p3->real_parent;
53695+ }
53696+ if (p3 == p)
53697+ break;
53698+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
53699+ gr_handle_alertkill(p);
53700+ rcu_read_unlock();
53701+ put_files_struct(files);
53702+ read_unlock(&tasklist_lock);
53703+ fput(our_file);
53704+ return 0;
53705+ }
53706+ }
53707+ rcu_read_unlock();
53708+ put_files_struct(files);
53709+ } while_each_thread(p2, p);
53710+ read_unlock(&tasklist_lock);
53711+
53712+ fput(our_file);
53713+ return 1;
53714+}
53715+
53716+ssize_t
53717+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
53718+{
53719+ struct gr_arg_wrapper uwrap;
53720+ unsigned char *sprole_salt = NULL;
53721+ unsigned char *sprole_sum = NULL;
53722+ int error = sizeof (struct gr_arg_wrapper);
53723+ int error2 = 0;
53724+
53725+ mutex_lock(&gr_dev_mutex);
53726+
53727+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
53728+ error = -EPERM;
53729+ goto out;
53730+ }
53731+
53732+ if (count != sizeof (struct gr_arg_wrapper)) {
53733+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
53734+ error = -EINVAL;
53735+ goto out;
53736+ }
53737+
53738+
53739+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
53740+ gr_auth_expires = 0;
53741+ gr_auth_attempts = 0;
53742+ }
53743+
53744+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
53745+ error = -EFAULT;
53746+ goto out;
53747+ }
53748+
53749+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
53750+ error = -EINVAL;
53751+ goto out;
53752+ }
53753+
53754+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
53755+ error = -EFAULT;
53756+ goto out;
53757+ }
53758+
53759+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53760+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53761+ time_after(gr_auth_expires, get_seconds())) {
53762+ error = -EBUSY;
53763+ goto out;
53764+ }
53765+
53766+ /* if non-root trying to do anything other than use a special role,
53767+ do not attempt authentication, do not count towards authentication
53768+ locking
53769+ */
53770+
53771+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
53772+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53773+ current_uid()) {
53774+ error = -EPERM;
53775+ goto out;
53776+ }
53777+
53778+ /* ensure pw and special role name are null terminated */
53779+
53780+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
53781+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
53782+
53783+ /* Okay.
53784+ * We have our enough of the argument structure..(we have yet
53785+ * to copy_from_user the tables themselves) . Copy the tables
53786+ * only if we need them, i.e. for loading operations. */
53787+
53788+ switch (gr_usermode->mode) {
53789+ case GR_STATUS:
53790+ if (gr_status & GR_READY) {
53791+ error = 1;
53792+ if (!gr_check_secure_terminal(current))
53793+ error = 3;
53794+ } else
53795+ error = 2;
53796+ goto out;
53797+ case GR_SHUTDOWN:
53798+ if ((gr_status & GR_READY)
53799+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53800+ pax_open_kernel();
53801+ gr_status &= ~GR_READY;
53802+ pax_close_kernel();
53803+
53804+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
53805+ free_variables();
53806+ memset(gr_usermode, 0, sizeof (struct gr_arg));
53807+ memset(gr_system_salt, 0, GR_SALT_LEN);
53808+ memset(gr_system_sum, 0, GR_SHA_LEN);
53809+ } else if (gr_status & GR_READY) {
53810+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
53811+ error = -EPERM;
53812+ } else {
53813+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
53814+ error = -EAGAIN;
53815+ }
53816+ break;
53817+ case GR_ENABLE:
53818+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
53819+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
53820+ else {
53821+ if (gr_status & GR_READY)
53822+ error = -EAGAIN;
53823+ else
53824+ error = error2;
53825+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
53826+ }
53827+ break;
53828+ case GR_RELOAD:
53829+ if (!(gr_status & GR_READY)) {
53830+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
53831+ error = -EAGAIN;
53832+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53833+ preempt_disable();
53834+
53835+ pax_open_kernel();
53836+ gr_status &= ~GR_READY;
53837+ pax_close_kernel();
53838+
53839+ free_variables();
53840+ if (!(error2 = gracl_init(gr_usermode))) {
53841+ preempt_enable();
53842+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
53843+ } else {
53844+ preempt_enable();
53845+ error = error2;
53846+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53847+ }
53848+ } else {
53849+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53850+ error = -EPERM;
53851+ }
53852+ break;
53853+ case GR_SEGVMOD:
53854+ if (unlikely(!(gr_status & GR_READY))) {
53855+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
53856+ error = -EAGAIN;
53857+ break;
53858+ }
53859+
53860+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53861+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
53862+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
53863+ struct acl_subject_label *segvacl;
53864+ segvacl =
53865+ lookup_acl_subj_label(gr_usermode->segv_inode,
53866+ gr_usermode->segv_device,
53867+ current->role);
53868+ if (segvacl) {
53869+ segvacl->crashes = 0;
53870+ segvacl->expires = 0;
53871+ }
53872+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
53873+ gr_remove_uid(gr_usermode->segv_uid);
53874+ }
53875+ } else {
53876+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
53877+ error = -EPERM;
53878+ }
53879+ break;
53880+ case GR_SPROLE:
53881+ case GR_SPROLEPAM:
53882+ if (unlikely(!(gr_status & GR_READY))) {
53883+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
53884+ error = -EAGAIN;
53885+ break;
53886+ }
53887+
53888+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
53889+ current->role->expires = 0;
53890+ current->role->auth_attempts = 0;
53891+ }
53892+
53893+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53894+ time_after(current->role->expires, get_seconds())) {
53895+ error = -EBUSY;
53896+ goto out;
53897+ }
53898+
53899+ if (lookup_special_role_auth
53900+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
53901+ && ((!sprole_salt && !sprole_sum)
53902+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
53903+ char *p = "";
53904+ assign_special_role(gr_usermode->sp_role);
53905+ read_lock(&tasklist_lock);
53906+ if (current->real_parent)
53907+ p = current->real_parent->role->rolename;
53908+ read_unlock(&tasklist_lock);
53909+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
53910+ p, acl_sp_role_value);
53911+ } else {
53912+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
53913+ error = -EPERM;
53914+ if(!(current->role->auth_attempts++))
53915+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
53916+
53917+ goto out;
53918+ }
53919+ break;
53920+ case GR_UNSPROLE:
53921+ if (unlikely(!(gr_status & GR_READY))) {
53922+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
53923+ error = -EAGAIN;
53924+ break;
53925+ }
53926+
53927+ if (current->role->roletype & GR_ROLE_SPECIAL) {
53928+ char *p = "";
53929+ int i = 0;
53930+
53931+ read_lock(&tasklist_lock);
53932+ if (current->real_parent) {
53933+ p = current->real_parent->role->rolename;
53934+ i = current->real_parent->acl_role_id;
53935+ }
53936+ read_unlock(&tasklist_lock);
53937+
53938+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
53939+ gr_set_acls(1);
53940+ } else {
53941+ error = -EPERM;
53942+ goto out;
53943+ }
53944+ break;
53945+ default:
53946+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
53947+ error = -EINVAL;
53948+ break;
53949+ }
53950+
53951+ if (error != -EPERM)
53952+ goto out;
53953+
53954+ if(!(gr_auth_attempts++))
53955+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
53956+
53957+ out:
53958+ mutex_unlock(&gr_dev_mutex);
53959+ return error;
53960+}
53961+
53962+/* must be called with
53963+ rcu_read_lock();
53964+ read_lock(&tasklist_lock);
53965+ read_lock(&grsec_exec_file_lock);
53966+*/
53967+int gr_apply_subject_to_task(struct task_struct *task)
53968+{
53969+ struct acl_object_label *obj;
53970+ char *tmpname;
53971+ struct acl_subject_label *tmpsubj;
53972+ struct file *filp;
53973+ struct name_entry *nmatch;
53974+
53975+ filp = task->exec_file;
53976+ if (filp == NULL)
53977+ return 0;
53978+
53979+ /* the following is to apply the correct subject
53980+ on binaries running when the RBAC system
53981+ is enabled, when the binaries have been
53982+ replaced or deleted since their execution
53983+ -----
53984+ when the RBAC system starts, the inode/dev
53985+ from exec_file will be one the RBAC system
53986+ is unaware of. It only knows the inode/dev
53987+ of the present file on disk, or the absence
53988+ of it.
53989+ */
53990+ preempt_disable();
53991+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
53992+
53993+ nmatch = lookup_name_entry(tmpname);
53994+ preempt_enable();
53995+ tmpsubj = NULL;
53996+ if (nmatch) {
53997+ if (nmatch->deleted)
53998+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
53999+ else
54000+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54001+ if (tmpsubj != NULL)
54002+ task->acl = tmpsubj;
54003+ }
54004+ if (tmpsubj == NULL)
54005+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54006+ task->role);
54007+ if (task->acl) {
54008+ task->is_writable = 0;
54009+ /* ignore additional mmap checks for processes that are writable
54010+ by the default ACL */
54011+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54012+ if (unlikely(obj->mode & GR_WRITE))
54013+ task->is_writable = 1;
54014+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54015+ if (unlikely(obj->mode & GR_WRITE))
54016+ task->is_writable = 1;
54017+
54018+ gr_set_proc_res(task);
54019+
54020+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54021+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54022+#endif
54023+ } else {
54024+ return 1;
54025+ }
54026+
54027+ return 0;
54028+}
54029+
54030+int
54031+gr_set_acls(const int type)
54032+{
54033+ struct task_struct *task, *task2;
54034+ struct acl_role_label *role = current->role;
54035+ __u16 acl_role_id = current->acl_role_id;
54036+ const struct cred *cred;
54037+ int ret;
54038+
54039+ rcu_read_lock();
54040+ read_lock(&tasklist_lock);
54041+ read_lock(&grsec_exec_file_lock);
54042+ do_each_thread(task2, task) {
54043+ /* check to see if we're called from the exit handler,
54044+ if so, only replace ACLs that have inherited the admin
54045+ ACL */
54046+
54047+ if (type && (task->role != role ||
54048+ task->acl_role_id != acl_role_id))
54049+ continue;
54050+
54051+ task->acl_role_id = 0;
54052+ task->acl_sp_role = 0;
54053+
54054+ if (task->exec_file) {
54055+ cred = __task_cred(task);
54056+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54057+ ret = gr_apply_subject_to_task(task);
54058+ if (ret) {
54059+ read_unlock(&grsec_exec_file_lock);
54060+ read_unlock(&tasklist_lock);
54061+ rcu_read_unlock();
54062+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54063+ return ret;
54064+ }
54065+ } else {
54066+ // it's a kernel process
54067+ task->role = kernel_role;
54068+ task->acl = kernel_role->root_label;
54069+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54070+ task->acl->mode &= ~GR_PROCFIND;
54071+#endif
54072+ }
54073+ } while_each_thread(task2, task);
54074+ read_unlock(&grsec_exec_file_lock);
54075+ read_unlock(&tasklist_lock);
54076+ rcu_read_unlock();
54077+
54078+ return 0;
54079+}
54080+
54081+void
54082+gr_learn_resource(const struct task_struct *task,
54083+ const int res, const unsigned long wanted, const int gt)
54084+{
54085+ struct acl_subject_label *acl;
54086+ const struct cred *cred;
54087+
54088+ if (unlikely((gr_status & GR_READY) &&
54089+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54090+ goto skip_reslog;
54091+
54092+#ifdef CONFIG_GRKERNSEC_RESLOG
54093+ gr_log_resource(task, res, wanted, gt);
54094+#endif
54095+ skip_reslog:
54096+
54097+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54098+ return;
54099+
54100+ acl = task->acl;
54101+
54102+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54103+ !(acl->resmask & (1 << (unsigned short) res))))
54104+ return;
54105+
54106+ if (wanted >= acl->res[res].rlim_cur) {
54107+ unsigned long res_add;
54108+
54109+ res_add = wanted;
54110+ switch (res) {
54111+ case RLIMIT_CPU:
54112+ res_add += GR_RLIM_CPU_BUMP;
54113+ break;
54114+ case RLIMIT_FSIZE:
54115+ res_add += GR_RLIM_FSIZE_BUMP;
54116+ break;
54117+ case RLIMIT_DATA:
54118+ res_add += GR_RLIM_DATA_BUMP;
54119+ break;
54120+ case RLIMIT_STACK:
54121+ res_add += GR_RLIM_STACK_BUMP;
54122+ break;
54123+ case RLIMIT_CORE:
54124+ res_add += GR_RLIM_CORE_BUMP;
54125+ break;
54126+ case RLIMIT_RSS:
54127+ res_add += GR_RLIM_RSS_BUMP;
54128+ break;
54129+ case RLIMIT_NPROC:
54130+ res_add += GR_RLIM_NPROC_BUMP;
54131+ break;
54132+ case RLIMIT_NOFILE:
54133+ res_add += GR_RLIM_NOFILE_BUMP;
54134+ break;
54135+ case RLIMIT_MEMLOCK:
54136+ res_add += GR_RLIM_MEMLOCK_BUMP;
54137+ break;
54138+ case RLIMIT_AS:
54139+ res_add += GR_RLIM_AS_BUMP;
54140+ break;
54141+ case RLIMIT_LOCKS:
54142+ res_add += GR_RLIM_LOCKS_BUMP;
54143+ break;
54144+ case RLIMIT_SIGPENDING:
54145+ res_add += GR_RLIM_SIGPENDING_BUMP;
54146+ break;
54147+ case RLIMIT_MSGQUEUE:
54148+ res_add += GR_RLIM_MSGQUEUE_BUMP;
54149+ break;
54150+ case RLIMIT_NICE:
54151+ res_add += GR_RLIM_NICE_BUMP;
54152+ break;
54153+ case RLIMIT_RTPRIO:
54154+ res_add += GR_RLIM_RTPRIO_BUMP;
54155+ break;
54156+ case RLIMIT_RTTIME:
54157+ res_add += GR_RLIM_RTTIME_BUMP;
54158+ break;
54159+ }
54160+
54161+ acl->res[res].rlim_cur = res_add;
54162+
54163+ if (wanted > acl->res[res].rlim_max)
54164+ acl->res[res].rlim_max = res_add;
54165+
54166+ /* only log the subject filename, since resource logging is supported for
54167+ single-subject learning only */
54168+ rcu_read_lock();
54169+ cred = __task_cred(task);
54170+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54171+ task->role->roletype, cred->uid, cred->gid, acl->filename,
54172+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54173+ "", (unsigned long) res, &task->signal->saved_ip);
54174+ rcu_read_unlock();
54175+ }
54176+
54177+ return;
54178+}
54179+
54180+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54181+void
54182+pax_set_initial_flags(struct linux_binprm *bprm)
54183+{
54184+ struct task_struct *task = current;
54185+ struct acl_subject_label *proc;
54186+ unsigned long flags;
54187+
54188+ if (unlikely(!(gr_status & GR_READY)))
54189+ return;
54190+
54191+ flags = pax_get_flags(task);
54192+
54193+ proc = task->acl;
54194+
54195+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54196+ flags &= ~MF_PAX_PAGEEXEC;
54197+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54198+ flags &= ~MF_PAX_SEGMEXEC;
54199+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54200+ flags &= ~MF_PAX_RANDMMAP;
54201+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54202+ flags &= ~MF_PAX_EMUTRAMP;
54203+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54204+ flags &= ~MF_PAX_MPROTECT;
54205+
54206+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54207+ flags |= MF_PAX_PAGEEXEC;
54208+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54209+ flags |= MF_PAX_SEGMEXEC;
54210+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54211+ flags |= MF_PAX_RANDMMAP;
54212+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54213+ flags |= MF_PAX_EMUTRAMP;
54214+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54215+ flags |= MF_PAX_MPROTECT;
54216+
54217+ pax_set_flags(task, flags);
54218+
54219+ return;
54220+}
54221+#endif
54222+
54223+#ifdef CONFIG_SYSCTL
54224+/* Eric Biederman likes breaking userland ABI and every inode-based security
54225+ system to save 35kb of memory */
54226+
54227+/* we modify the passed in filename, but adjust it back before returning */
54228+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54229+{
54230+ struct name_entry *nmatch;
54231+ char *p, *lastp = NULL;
54232+ struct acl_object_label *obj = NULL, *tmp;
54233+ struct acl_subject_label *tmpsubj;
54234+ char c = '\0';
54235+
54236+ read_lock(&gr_inode_lock);
54237+
54238+ p = name + len - 1;
54239+ do {
54240+ nmatch = lookup_name_entry(name);
54241+ if (lastp != NULL)
54242+ *lastp = c;
54243+
54244+ if (nmatch == NULL)
54245+ goto next_component;
54246+ tmpsubj = current->acl;
54247+ do {
54248+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54249+ if (obj != NULL) {
54250+ tmp = obj->globbed;
54251+ while (tmp) {
54252+ if (!glob_match(tmp->filename, name)) {
54253+ obj = tmp;
54254+ goto found_obj;
54255+ }
54256+ tmp = tmp->next;
54257+ }
54258+ goto found_obj;
54259+ }
54260+ } while ((tmpsubj = tmpsubj->parent_subject));
54261+next_component:
54262+ /* end case */
54263+ if (p == name)
54264+ break;
54265+
54266+ while (*p != '/')
54267+ p--;
54268+ if (p == name)
54269+ lastp = p + 1;
54270+ else {
54271+ lastp = p;
54272+ p--;
54273+ }
54274+ c = *lastp;
54275+ *lastp = '\0';
54276+ } while (1);
54277+found_obj:
54278+ read_unlock(&gr_inode_lock);
54279+ /* obj returned will always be non-null */
54280+ return obj;
54281+}
54282+
54283+/* returns 0 when allowing, non-zero on error
54284+ op of 0 is used for readdir, so we don't log the names of hidden files
54285+*/
54286+__u32
54287+gr_handle_sysctl(const struct ctl_table *table, const int op)
54288+{
54289+ struct ctl_table *tmp;
54290+ const char *proc_sys = "/proc/sys";
54291+ char *path;
54292+ struct acl_object_label *obj;
54293+ unsigned short len = 0, pos = 0, depth = 0, i;
54294+ __u32 err = 0;
54295+ __u32 mode = 0;
54296+
54297+ if (unlikely(!(gr_status & GR_READY)))
54298+ return 0;
54299+
54300+ /* for now, ignore operations on non-sysctl entries if it's not a
54301+ readdir*/
54302+ if (table->child != NULL && op != 0)
54303+ return 0;
54304+
54305+ mode |= GR_FIND;
54306+ /* it's only a read if it's an entry, read on dirs is for readdir */
54307+ if (op & MAY_READ)
54308+ mode |= GR_READ;
54309+ if (op & MAY_WRITE)
54310+ mode |= GR_WRITE;
54311+
54312+ preempt_disable();
54313+
54314+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54315+
54316+ /* it's only a read/write if it's an actual entry, not a dir
54317+ (which are opened for readdir)
54318+ */
54319+
54320+ /* convert the requested sysctl entry into a pathname */
54321+
54322+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54323+ len += strlen(tmp->procname);
54324+ len++;
54325+ depth++;
54326+ }
54327+
54328+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54329+ /* deny */
54330+ goto out;
54331+ }
54332+
54333+ memset(path, 0, PAGE_SIZE);
54334+
54335+ memcpy(path, proc_sys, strlen(proc_sys));
54336+
54337+ pos += strlen(proc_sys);
54338+
54339+ for (; depth > 0; depth--) {
54340+ path[pos] = '/';
54341+ pos++;
54342+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54343+ if (depth == i) {
54344+ memcpy(path + pos, tmp->procname,
54345+ strlen(tmp->procname));
54346+ pos += strlen(tmp->procname);
54347+ }
54348+ i++;
54349+ }
54350+ }
54351+
54352+ obj = gr_lookup_by_name(path, pos);
54353+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
54354+
54355+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
54356+ ((err & mode) != mode))) {
54357+ __u32 new_mode = mode;
54358+
54359+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54360+
54361+ err = 0;
54362+ gr_log_learn_sysctl(path, new_mode);
54363+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
54364+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
54365+ err = -ENOENT;
54366+ } else if (!(err & GR_FIND)) {
54367+ err = -ENOENT;
54368+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
54369+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
54370+ path, (mode & GR_READ) ? " reading" : "",
54371+ (mode & GR_WRITE) ? " writing" : "");
54372+ err = -EACCES;
54373+ } else if ((err & mode) != mode) {
54374+ err = -EACCES;
54375+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
54376+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
54377+ path, (mode & GR_READ) ? " reading" : "",
54378+ (mode & GR_WRITE) ? " writing" : "");
54379+ err = 0;
54380+ } else
54381+ err = 0;
54382+
54383+ out:
54384+ preempt_enable();
54385+
54386+ return err;
54387+}
54388+#endif
54389+
54390+int
54391+gr_handle_proc_ptrace(struct task_struct *task)
54392+{
54393+ struct file *filp;
54394+ struct task_struct *tmp = task;
54395+ struct task_struct *curtemp = current;
54396+ __u32 retmode;
54397+
54398+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54399+ if (unlikely(!(gr_status & GR_READY)))
54400+ return 0;
54401+#endif
54402+
54403+ read_lock(&tasklist_lock);
54404+ read_lock(&grsec_exec_file_lock);
54405+ filp = task->exec_file;
54406+
54407+ while (tmp->pid > 0) {
54408+ if (tmp == curtemp)
54409+ break;
54410+ tmp = tmp->real_parent;
54411+ }
54412+
54413+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54414+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54415+ read_unlock(&grsec_exec_file_lock);
54416+ read_unlock(&tasklist_lock);
54417+ return 1;
54418+ }
54419+
54420+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54421+ if (!(gr_status & GR_READY)) {
54422+ read_unlock(&grsec_exec_file_lock);
54423+ read_unlock(&tasklist_lock);
54424+ return 0;
54425+ }
54426+#endif
54427+
54428+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
54429+ read_unlock(&grsec_exec_file_lock);
54430+ read_unlock(&tasklist_lock);
54431+
54432+ if (retmode & GR_NOPTRACE)
54433+ return 1;
54434+
54435+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
54436+ && (current->acl != task->acl || (current->acl != current->role->root_label
54437+ && current->pid != task->pid)))
54438+ return 1;
54439+
54440+ return 0;
54441+}
54442+
54443+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
54444+{
54445+ if (unlikely(!(gr_status & GR_READY)))
54446+ return;
54447+
54448+ if (!(current->role->roletype & GR_ROLE_GOD))
54449+ return;
54450+
54451+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
54452+ p->role->rolename, gr_task_roletype_to_char(p),
54453+ p->acl->filename);
54454+}
54455+
54456+int
54457+gr_handle_ptrace(struct task_struct *task, const long request)
54458+{
54459+ struct task_struct *tmp = task;
54460+ struct task_struct *curtemp = current;
54461+ __u32 retmode;
54462+
54463+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54464+ if (unlikely(!(gr_status & GR_READY)))
54465+ return 0;
54466+#endif
54467+
54468+ read_lock(&tasklist_lock);
54469+ while (tmp->pid > 0) {
54470+ if (tmp == curtemp)
54471+ break;
54472+ tmp = tmp->real_parent;
54473+ }
54474+
54475+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54476+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
54477+ read_unlock(&tasklist_lock);
54478+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54479+ return 1;
54480+ }
54481+ read_unlock(&tasklist_lock);
54482+
54483+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54484+ if (!(gr_status & GR_READY))
54485+ return 0;
54486+#endif
54487+
54488+ read_lock(&grsec_exec_file_lock);
54489+ if (unlikely(!task->exec_file)) {
54490+ read_unlock(&grsec_exec_file_lock);
54491+ return 0;
54492+ }
54493+
54494+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
54495+ read_unlock(&grsec_exec_file_lock);
54496+
54497+ if (retmode & GR_NOPTRACE) {
54498+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54499+ return 1;
54500+ }
54501+
54502+ if (retmode & GR_PTRACERD) {
54503+ switch (request) {
54504+ case PTRACE_SEIZE:
54505+ case PTRACE_POKETEXT:
54506+ case PTRACE_POKEDATA:
54507+ case PTRACE_POKEUSR:
54508+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
54509+ case PTRACE_SETREGS:
54510+ case PTRACE_SETFPREGS:
54511+#endif
54512+#ifdef CONFIG_X86
54513+ case PTRACE_SETFPXREGS:
54514+#endif
54515+#ifdef CONFIG_ALTIVEC
54516+ case PTRACE_SETVRREGS:
54517+#endif
54518+ return 1;
54519+ default:
54520+ return 0;
54521+ }
54522+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
54523+ !(current->role->roletype & GR_ROLE_GOD) &&
54524+ (current->acl != task->acl)) {
54525+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54526+ return 1;
54527+ }
54528+
54529+ return 0;
54530+}
54531+
54532+static int is_writable_mmap(const struct file *filp)
54533+{
54534+ struct task_struct *task = current;
54535+ struct acl_object_label *obj, *obj2;
54536+
54537+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
54538+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
54539+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54540+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
54541+ task->role->root_label);
54542+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
54543+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
54544+ return 1;
54545+ }
54546+ }
54547+ return 0;
54548+}
54549+
54550+int
54551+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
54552+{
54553+ __u32 mode;
54554+
54555+ if (unlikely(!file || !(prot & PROT_EXEC)))
54556+ return 1;
54557+
54558+ if (is_writable_mmap(file))
54559+ return 0;
54560+
54561+ mode =
54562+ gr_search_file(file->f_path.dentry,
54563+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54564+ file->f_path.mnt);
54565+
54566+ if (!gr_tpe_allow(file))
54567+ return 0;
54568+
54569+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54570+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54571+ return 0;
54572+ } else if (unlikely(!(mode & GR_EXEC))) {
54573+ return 0;
54574+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54575+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54576+ return 1;
54577+ }
54578+
54579+ return 1;
54580+}
54581+
54582+int
54583+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
54584+{
54585+ __u32 mode;
54586+
54587+ if (unlikely(!file || !(prot & PROT_EXEC)))
54588+ return 1;
54589+
54590+ if (is_writable_mmap(file))
54591+ return 0;
54592+
54593+ mode =
54594+ gr_search_file(file->f_path.dentry,
54595+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54596+ file->f_path.mnt);
54597+
54598+ if (!gr_tpe_allow(file))
54599+ return 0;
54600+
54601+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54602+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54603+ return 0;
54604+ } else if (unlikely(!(mode & GR_EXEC))) {
54605+ return 0;
54606+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54607+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54608+ return 1;
54609+ }
54610+
54611+ return 1;
54612+}
54613+
54614+void
54615+gr_acl_handle_psacct(struct task_struct *task, const long code)
54616+{
54617+ unsigned long runtime;
54618+ unsigned long cputime;
54619+ unsigned int wday, cday;
54620+ __u8 whr, chr;
54621+ __u8 wmin, cmin;
54622+ __u8 wsec, csec;
54623+ struct timespec timeval;
54624+
54625+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
54626+ !(task->acl->mode & GR_PROCACCT)))
54627+ return;
54628+
54629+ do_posix_clock_monotonic_gettime(&timeval);
54630+ runtime = timeval.tv_sec - task->start_time.tv_sec;
54631+ wday = runtime / (3600 * 24);
54632+ runtime -= wday * (3600 * 24);
54633+ whr = runtime / 3600;
54634+ runtime -= whr * 3600;
54635+ wmin = runtime / 60;
54636+ runtime -= wmin * 60;
54637+ wsec = runtime;
54638+
54639+ cputime = (task->utime + task->stime) / HZ;
54640+ cday = cputime / (3600 * 24);
54641+ cputime -= cday * (3600 * 24);
54642+ chr = cputime / 3600;
54643+ cputime -= chr * 3600;
54644+ cmin = cputime / 60;
54645+ cputime -= cmin * 60;
54646+ csec = cputime;
54647+
54648+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
54649+
54650+ return;
54651+}
54652+
54653+void gr_set_kernel_label(struct task_struct *task)
54654+{
54655+ if (gr_status & GR_READY) {
54656+ task->role = kernel_role;
54657+ task->acl = kernel_role->root_label;
54658+ }
54659+ return;
54660+}
54661+
54662+#ifdef CONFIG_TASKSTATS
54663+int gr_is_taskstats_denied(int pid)
54664+{
54665+ struct task_struct *task;
54666+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54667+ const struct cred *cred;
54668+#endif
54669+ int ret = 0;
54670+
54671+ /* restrict taskstats viewing to un-chrooted root users
54672+ who have the 'view' subject flag if the RBAC system is enabled
54673+ */
54674+
54675+ rcu_read_lock();
54676+ read_lock(&tasklist_lock);
54677+ task = find_task_by_vpid(pid);
54678+ if (task) {
54679+#ifdef CONFIG_GRKERNSEC_CHROOT
54680+ if (proc_is_chrooted(task))
54681+ ret = -EACCES;
54682+#endif
54683+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54684+ cred = __task_cred(task);
54685+#ifdef CONFIG_GRKERNSEC_PROC_USER
54686+ if (cred->uid != 0)
54687+ ret = -EACCES;
54688+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54689+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
54690+ ret = -EACCES;
54691+#endif
54692+#endif
54693+ if (gr_status & GR_READY) {
54694+ if (!(task->acl->mode & GR_VIEW))
54695+ ret = -EACCES;
54696+ }
54697+ } else
54698+ ret = -ENOENT;
54699+
54700+ read_unlock(&tasklist_lock);
54701+ rcu_read_unlock();
54702+
54703+ return ret;
54704+}
54705+#endif
54706+
54707+/* AUXV entries are filled via a descendant of search_binary_handler
54708+ after we've already applied the subject for the target
54709+*/
54710+int gr_acl_enable_at_secure(void)
54711+{
54712+ if (unlikely(!(gr_status & GR_READY)))
54713+ return 0;
54714+
54715+ if (current->acl->mode & GR_ATSECURE)
54716+ return 1;
54717+
54718+ return 0;
54719+}
54720+
54721+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
54722+{
54723+ struct task_struct *task = current;
54724+ struct dentry *dentry = file->f_path.dentry;
54725+ struct vfsmount *mnt = file->f_path.mnt;
54726+ struct acl_object_label *obj, *tmp;
54727+ struct acl_subject_label *subj;
54728+ unsigned int bufsize;
54729+ int is_not_root;
54730+ char *path;
54731+ dev_t dev = __get_dev(dentry);
54732+
54733+ if (unlikely(!(gr_status & GR_READY)))
54734+ return 1;
54735+
54736+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
54737+ return 1;
54738+
54739+ /* ignore Eric Biederman */
54740+ if (IS_PRIVATE(dentry->d_inode))
54741+ return 1;
54742+
54743+ subj = task->acl;
54744+ do {
54745+ obj = lookup_acl_obj_label(ino, dev, subj);
54746+ if (obj != NULL)
54747+ return (obj->mode & GR_FIND) ? 1 : 0;
54748+ } while ((subj = subj->parent_subject));
54749+
54750+ /* this is purely an optimization since we're looking for an object
54751+ for the directory we're doing a readdir on
54752+ if it's possible for any globbed object to match the entry we're
54753+ filling into the directory, then the object we find here will be
54754+ an anchor point with attached globbed objects
54755+ */
54756+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
54757+ if (obj->globbed == NULL)
54758+ return (obj->mode & GR_FIND) ? 1 : 0;
54759+
54760+ is_not_root = ((obj->filename[0] == '/') &&
54761+ (obj->filename[1] == '\0')) ? 0 : 1;
54762+ bufsize = PAGE_SIZE - namelen - is_not_root;
54763+
54764+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
54765+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
54766+ return 1;
54767+
54768+ preempt_disable();
54769+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
54770+ bufsize);
54771+
54772+ bufsize = strlen(path);
54773+
54774+ /* if base is "/", don't append an additional slash */
54775+ if (is_not_root)
54776+ *(path + bufsize) = '/';
54777+ memcpy(path + bufsize + is_not_root, name, namelen);
54778+ *(path + bufsize + namelen + is_not_root) = '\0';
54779+
54780+ tmp = obj->globbed;
54781+ while (tmp) {
54782+ if (!glob_match(tmp->filename, path)) {
54783+ preempt_enable();
54784+ return (tmp->mode & GR_FIND) ? 1 : 0;
54785+ }
54786+ tmp = tmp->next;
54787+ }
54788+ preempt_enable();
54789+ return (obj->mode & GR_FIND) ? 1 : 0;
54790+}
54791+
54792+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
54793+EXPORT_SYMBOL(gr_acl_is_enabled);
54794+#endif
54795+EXPORT_SYMBOL(gr_learn_resource);
54796+EXPORT_SYMBOL(gr_set_kernel_label);
54797+#ifdef CONFIG_SECURITY
54798+EXPORT_SYMBOL(gr_check_user_change);
54799+EXPORT_SYMBOL(gr_check_group_change);
54800+#endif
54801+
54802diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
54803new file mode 100644
54804index 0000000..34fefda
54805--- /dev/null
54806+++ b/grsecurity/gracl_alloc.c
54807@@ -0,0 +1,105 @@
54808+#include <linux/kernel.h>
54809+#include <linux/mm.h>
54810+#include <linux/slab.h>
54811+#include <linux/vmalloc.h>
54812+#include <linux/gracl.h>
54813+#include <linux/grsecurity.h>
54814+
54815+static unsigned long alloc_stack_next = 1;
54816+static unsigned long alloc_stack_size = 1;
54817+static void **alloc_stack;
54818+
54819+static __inline__ int
54820+alloc_pop(void)
54821+{
54822+ if (alloc_stack_next == 1)
54823+ return 0;
54824+
54825+ kfree(alloc_stack[alloc_stack_next - 2]);
54826+
54827+ alloc_stack_next--;
54828+
54829+ return 1;
54830+}
54831+
54832+static __inline__ int
54833+alloc_push(void *buf)
54834+{
54835+ if (alloc_stack_next >= alloc_stack_size)
54836+ return 1;
54837+
54838+ alloc_stack[alloc_stack_next - 1] = buf;
54839+
54840+ alloc_stack_next++;
54841+
54842+ return 0;
54843+}
54844+
54845+void *
54846+acl_alloc(unsigned long len)
54847+{
54848+ void *ret = NULL;
54849+
54850+ if (!len || len > PAGE_SIZE)
54851+ goto out;
54852+
54853+ ret = kmalloc(len, GFP_KERNEL);
54854+
54855+ if (ret) {
54856+ if (alloc_push(ret)) {
54857+ kfree(ret);
54858+ ret = NULL;
54859+ }
54860+ }
54861+
54862+out:
54863+ return ret;
54864+}
54865+
54866+void *
54867+acl_alloc_num(unsigned long num, unsigned long len)
54868+{
54869+ if (!len || (num > (PAGE_SIZE / len)))
54870+ return NULL;
54871+
54872+ return acl_alloc(num * len);
54873+}
54874+
54875+void
54876+acl_free_all(void)
54877+{
54878+ if (gr_acl_is_enabled() || !alloc_stack)
54879+ return;
54880+
54881+ while (alloc_pop()) ;
54882+
54883+ if (alloc_stack) {
54884+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
54885+ kfree(alloc_stack);
54886+ else
54887+ vfree(alloc_stack);
54888+ }
54889+
54890+ alloc_stack = NULL;
54891+ alloc_stack_size = 1;
54892+ alloc_stack_next = 1;
54893+
54894+ return;
54895+}
54896+
54897+int
54898+acl_alloc_stack_init(unsigned long size)
54899+{
54900+ if ((size * sizeof (void *)) <= PAGE_SIZE)
54901+ alloc_stack =
54902+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
54903+ else
54904+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
54905+
54906+ alloc_stack_size = size;
54907+
54908+ if (!alloc_stack)
54909+ return 0;
54910+ else
54911+ return 1;
54912+}
54913diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
54914new file mode 100644
54915index 0000000..955ddfb
54916--- /dev/null
54917+++ b/grsecurity/gracl_cap.c
54918@@ -0,0 +1,101 @@
54919+#include <linux/kernel.h>
54920+#include <linux/module.h>
54921+#include <linux/sched.h>
54922+#include <linux/gracl.h>
54923+#include <linux/grsecurity.h>
54924+#include <linux/grinternal.h>
54925+
54926+extern const char *captab_log[];
54927+extern int captab_log_entries;
54928+
54929+int
54930+gr_acl_is_capable(const int cap)
54931+{
54932+ struct task_struct *task = current;
54933+ const struct cred *cred = current_cred();
54934+ struct acl_subject_label *curracl;
54935+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
54936+ kernel_cap_t cap_audit = __cap_empty_set;
54937+
54938+ if (!gr_acl_is_enabled())
54939+ return 1;
54940+
54941+ curracl = task->acl;
54942+
54943+ cap_drop = curracl->cap_lower;
54944+ cap_mask = curracl->cap_mask;
54945+ cap_audit = curracl->cap_invert_audit;
54946+
54947+ while ((curracl = curracl->parent_subject)) {
54948+ /* if the cap isn't specified in the current computed mask but is specified in the
54949+ current level subject, and is lowered in the current level subject, then add
54950+ it to the set of dropped capabilities
54951+ otherwise, add the current level subject's mask to the current computed mask
54952+ */
54953+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
54954+ cap_raise(cap_mask, cap);
54955+ if (cap_raised(curracl->cap_lower, cap))
54956+ cap_raise(cap_drop, cap);
54957+ if (cap_raised(curracl->cap_invert_audit, cap))
54958+ cap_raise(cap_audit, cap);
54959+ }
54960+ }
54961+
54962+ if (!cap_raised(cap_drop, cap)) {
54963+ if (cap_raised(cap_audit, cap))
54964+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
54965+ return 1;
54966+ }
54967+
54968+ curracl = task->acl;
54969+
54970+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
54971+ && cap_raised(cred->cap_effective, cap)) {
54972+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54973+ task->role->roletype, cred->uid,
54974+ cred->gid, task->exec_file ?
54975+ gr_to_filename(task->exec_file->f_path.dentry,
54976+ task->exec_file->f_path.mnt) : curracl->filename,
54977+ curracl->filename, 0UL,
54978+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
54979+ return 1;
54980+ }
54981+
54982+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
54983+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
54984+ return 0;
54985+}
54986+
54987+int
54988+gr_acl_is_capable_nolog(const int cap)
54989+{
54990+ struct acl_subject_label *curracl;
54991+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
54992+
54993+ if (!gr_acl_is_enabled())
54994+ return 1;
54995+
54996+ curracl = current->acl;
54997+
54998+ cap_drop = curracl->cap_lower;
54999+ cap_mask = curracl->cap_mask;
55000+
55001+ while ((curracl = curracl->parent_subject)) {
55002+ /* if the cap isn't specified in the current computed mask but is specified in the
55003+ current level subject, and is lowered in the current level subject, then add
55004+ it to the set of dropped capabilities
55005+ otherwise, add the current level subject's mask to the current computed mask
55006+ */
55007+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55008+ cap_raise(cap_mask, cap);
55009+ if (cap_raised(curracl->cap_lower, cap))
55010+ cap_raise(cap_drop, cap);
55011+ }
55012+ }
55013+
55014+ if (!cap_raised(cap_drop, cap))
55015+ return 1;
55016+
55017+ return 0;
55018+}
55019+
55020diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
55021new file mode 100644
55022index 0000000..4eda5c3
55023--- /dev/null
55024+++ b/grsecurity/gracl_fs.c
55025@@ -0,0 +1,433 @@
55026+#include <linux/kernel.h>
55027+#include <linux/sched.h>
55028+#include <linux/types.h>
55029+#include <linux/fs.h>
55030+#include <linux/file.h>
55031+#include <linux/stat.h>
55032+#include <linux/grsecurity.h>
55033+#include <linux/grinternal.h>
55034+#include <linux/gracl.h>
55035+
55036+__u32
55037+gr_acl_handle_hidden_file(const struct dentry * dentry,
55038+ const struct vfsmount * mnt)
55039+{
55040+ __u32 mode;
55041+
55042+ if (unlikely(!dentry->d_inode))
55043+ return GR_FIND;
55044+
55045+ mode =
55046+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55047+
55048+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55049+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55050+ return mode;
55051+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55052+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55053+ return 0;
55054+ } else if (unlikely(!(mode & GR_FIND)))
55055+ return 0;
55056+
55057+ return GR_FIND;
55058+}
55059+
55060+__u32
55061+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55062+ int acc_mode)
55063+{
55064+ __u32 reqmode = GR_FIND;
55065+ __u32 mode;
55066+
55067+ if (unlikely(!dentry->d_inode))
55068+ return reqmode;
55069+
55070+ if (acc_mode & MAY_APPEND)
55071+ reqmode |= GR_APPEND;
55072+ else if (acc_mode & MAY_WRITE)
55073+ reqmode |= GR_WRITE;
55074+ if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
55075+ reqmode |= GR_READ;
55076+
55077+ mode =
55078+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55079+ mnt);
55080+
55081+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55082+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55083+ reqmode & GR_READ ? " reading" : "",
55084+ reqmode & GR_WRITE ? " writing" : reqmode &
55085+ GR_APPEND ? " appending" : "");
55086+ return reqmode;
55087+ } else
55088+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55089+ {
55090+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55091+ reqmode & GR_READ ? " reading" : "",
55092+ reqmode & GR_WRITE ? " writing" : reqmode &
55093+ GR_APPEND ? " appending" : "");
55094+ return 0;
55095+ } else if (unlikely((mode & reqmode) != reqmode))
55096+ return 0;
55097+
55098+ return reqmode;
55099+}
55100+
55101+__u32
55102+gr_acl_handle_creat(const struct dentry * dentry,
55103+ const struct dentry * p_dentry,
55104+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
55105+ const int imode)
55106+{
55107+ __u32 reqmode = GR_WRITE | GR_CREATE;
55108+ __u32 mode;
55109+
55110+ if (acc_mode & MAY_APPEND)
55111+ reqmode |= GR_APPEND;
55112+ // if a directory was required or the directory already exists, then
55113+ // don't count this open as a read
55114+ if ((acc_mode & MAY_READ) &&
55115+ !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
55116+ reqmode |= GR_READ;
55117+ if ((open_flags & O_CREAT) && (imode & (S_ISUID | S_ISGID)))
55118+ reqmode |= GR_SETID;
55119+
55120+ mode =
55121+ gr_check_create(dentry, p_dentry, p_mnt,
55122+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55123+
55124+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55125+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55126+ reqmode & GR_READ ? " reading" : "",
55127+ reqmode & GR_WRITE ? " writing" : reqmode &
55128+ GR_APPEND ? " appending" : "");
55129+ return reqmode;
55130+ } else
55131+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55132+ {
55133+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55134+ reqmode & GR_READ ? " reading" : "",
55135+ reqmode & GR_WRITE ? " writing" : reqmode &
55136+ GR_APPEND ? " appending" : "");
55137+ return 0;
55138+ } else if (unlikely((mode & reqmode) != reqmode))
55139+ return 0;
55140+
55141+ return reqmode;
55142+}
55143+
55144+__u32
55145+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55146+ const int fmode)
55147+{
55148+ __u32 mode, reqmode = GR_FIND;
55149+
55150+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55151+ reqmode |= GR_EXEC;
55152+ if (fmode & S_IWOTH)
55153+ reqmode |= GR_WRITE;
55154+ if (fmode & S_IROTH)
55155+ reqmode |= GR_READ;
55156+
55157+ mode =
55158+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55159+ mnt);
55160+
55161+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55162+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55163+ reqmode & GR_READ ? " reading" : "",
55164+ reqmode & GR_WRITE ? " writing" : "",
55165+ reqmode & GR_EXEC ? " executing" : "");
55166+ return reqmode;
55167+ } else
55168+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55169+ {
55170+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55171+ reqmode & GR_READ ? " reading" : "",
55172+ reqmode & GR_WRITE ? " writing" : "",
55173+ reqmode & GR_EXEC ? " executing" : "");
55174+ return 0;
55175+ } else if (unlikely((mode & reqmode) != reqmode))
55176+ return 0;
55177+
55178+ return reqmode;
55179+}
55180+
55181+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55182+{
55183+ __u32 mode;
55184+
55185+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55186+
55187+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55188+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55189+ return mode;
55190+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55191+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55192+ return 0;
55193+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55194+ return 0;
55195+
55196+ return (reqmode);
55197+}
55198+
55199+__u32
55200+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55201+{
55202+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55203+}
55204+
55205+__u32
55206+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55207+{
55208+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55209+}
55210+
55211+__u32
55212+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55213+{
55214+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55215+}
55216+
55217+__u32
55218+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55219+{
55220+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55221+}
55222+
55223+__u32
55224+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55225+ mode_t mode)
55226+{
55227+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55228+ return 1;
55229+
55230+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55231+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55232+ GR_FCHMOD_ACL_MSG);
55233+ } else {
55234+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55235+ }
55236+}
55237+
55238+__u32
55239+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55240+ mode_t mode)
55241+{
55242+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55243+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55244+ GR_CHMOD_ACL_MSG);
55245+ } else {
55246+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55247+ }
55248+}
55249+
55250+__u32
55251+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55252+{
55253+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55254+}
55255+
55256+__u32
55257+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55258+{
55259+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55260+}
55261+
55262+__u32
55263+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55264+{
55265+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55266+}
55267+
55268+__u32
55269+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55270+{
55271+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55272+ GR_UNIXCONNECT_ACL_MSG);
55273+}
55274+
55275+/* hardlinks require at minimum create and link permission,
55276+ any additional privilege required is based on the
55277+ privilege of the file being linked to
55278+*/
55279+__u32
55280+gr_acl_handle_link(const struct dentry * new_dentry,
55281+ const struct dentry * parent_dentry,
55282+ const struct vfsmount * parent_mnt,
55283+ const struct dentry * old_dentry,
55284+ const struct vfsmount * old_mnt, const char *to)
55285+{
55286+ __u32 mode;
55287+ __u32 needmode = GR_CREATE | GR_LINK;
55288+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55289+
55290+ mode =
55291+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55292+ old_mnt);
55293+
55294+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55295+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55296+ return mode;
55297+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55298+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55299+ return 0;
55300+ } else if (unlikely((mode & needmode) != needmode))
55301+ return 0;
55302+
55303+ return 1;
55304+}
55305+
55306+__u32
55307+gr_acl_handle_symlink(const struct dentry * new_dentry,
55308+ const struct dentry * parent_dentry,
55309+ const struct vfsmount * parent_mnt, const char *from)
55310+{
55311+ __u32 needmode = GR_WRITE | GR_CREATE;
55312+ __u32 mode;
55313+
55314+ mode =
55315+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
55316+ GR_CREATE | GR_AUDIT_CREATE |
55317+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55318+
55319+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55320+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55321+ return mode;
55322+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55323+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55324+ return 0;
55325+ } else if (unlikely((mode & needmode) != needmode))
55326+ return 0;
55327+
55328+ return (GR_WRITE | GR_CREATE);
55329+}
55330+
55331+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55332+{
55333+ __u32 mode;
55334+
55335+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55336+
55337+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55338+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55339+ return mode;
55340+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55341+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55342+ return 0;
55343+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55344+ return 0;
55345+
55346+ return (reqmode);
55347+}
55348+
55349+__u32
55350+gr_acl_handle_mknod(const struct dentry * new_dentry,
55351+ const struct dentry * parent_dentry,
55352+ const struct vfsmount * parent_mnt,
55353+ const int mode)
55354+{
55355+ __u32 reqmode = GR_WRITE | GR_CREATE;
55356+ if (unlikely(mode & (S_ISUID | S_ISGID)))
55357+ reqmode |= GR_SETID;
55358+
55359+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55360+ reqmode, GR_MKNOD_ACL_MSG);
55361+}
55362+
55363+__u32
55364+gr_acl_handle_mkdir(const struct dentry *new_dentry,
55365+ const struct dentry *parent_dentry,
55366+ const struct vfsmount *parent_mnt)
55367+{
55368+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55369+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55370+}
55371+
55372+#define RENAME_CHECK_SUCCESS(old, new) \
55373+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55374+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55375+
55376+int
55377+gr_acl_handle_rename(struct dentry *new_dentry,
55378+ struct dentry *parent_dentry,
55379+ const struct vfsmount *parent_mnt,
55380+ struct dentry *old_dentry,
55381+ struct inode *old_parent_inode,
55382+ struct vfsmount *old_mnt, const char *newname)
55383+{
55384+ __u32 comp1, comp2;
55385+ int error = 0;
55386+
55387+ if (unlikely(!gr_acl_is_enabled()))
55388+ return 0;
55389+
55390+ if (!new_dentry->d_inode) {
55391+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55392+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55393+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55394+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55395+ GR_DELETE | GR_AUDIT_DELETE |
55396+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55397+ GR_SUPPRESS, old_mnt);
55398+ } else {
55399+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55400+ GR_CREATE | GR_DELETE |
55401+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55402+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55403+ GR_SUPPRESS, parent_mnt);
55404+ comp2 =
55405+ gr_search_file(old_dentry,
55406+ GR_READ | GR_WRITE | GR_AUDIT_READ |
55407+ GR_DELETE | GR_AUDIT_DELETE |
55408+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55409+ }
55410+
55411+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55412+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55413+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55414+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55415+ && !(comp2 & GR_SUPPRESS)) {
55416+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55417+ error = -EACCES;
55418+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55419+ error = -EACCES;
55420+
55421+ return error;
55422+}
55423+
55424+void
55425+gr_acl_handle_exit(void)
55426+{
55427+ u16 id;
55428+ char *rolename;
55429+ struct file *exec_file;
55430+
55431+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55432+ !(current->role->roletype & GR_ROLE_PERSIST))) {
55433+ id = current->acl_role_id;
55434+ rolename = current->role->rolename;
55435+ gr_set_acls(1);
55436+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55437+ }
55438+
55439+ write_lock(&grsec_exec_file_lock);
55440+ exec_file = current->exec_file;
55441+ current->exec_file = NULL;
55442+ write_unlock(&grsec_exec_file_lock);
55443+
55444+ if (exec_file)
55445+ fput(exec_file);
55446+}
55447+
55448+int
55449+gr_acl_handle_procpidmem(const struct task_struct *task)
55450+{
55451+ if (unlikely(!gr_acl_is_enabled()))
55452+ return 0;
55453+
55454+ if (task != current && task->acl->mode & GR_PROTPROCFD)
55455+ return -EACCES;
55456+
55457+ return 0;
55458+}
55459diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
55460new file mode 100644
55461index 0000000..17050ca
55462--- /dev/null
55463+++ b/grsecurity/gracl_ip.c
55464@@ -0,0 +1,381 @@
55465+#include <linux/kernel.h>
55466+#include <asm/uaccess.h>
55467+#include <asm/errno.h>
55468+#include <net/sock.h>
55469+#include <linux/file.h>
55470+#include <linux/fs.h>
55471+#include <linux/net.h>
55472+#include <linux/in.h>
55473+#include <linux/skbuff.h>
55474+#include <linux/ip.h>
55475+#include <linux/udp.h>
55476+#include <linux/types.h>
55477+#include <linux/sched.h>
55478+#include <linux/netdevice.h>
55479+#include <linux/inetdevice.h>
55480+#include <linux/gracl.h>
55481+#include <linux/grsecurity.h>
55482+#include <linux/grinternal.h>
55483+
55484+#define GR_BIND 0x01
55485+#define GR_CONNECT 0x02
55486+#define GR_INVERT 0x04
55487+#define GR_BINDOVERRIDE 0x08
55488+#define GR_CONNECTOVERRIDE 0x10
55489+#define GR_SOCK_FAMILY 0x20
55490+
55491+static const char * gr_protocols[IPPROTO_MAX] = {
55492+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55493+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55494+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55495+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55496+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55497+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55498+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55499+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55500+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
55501+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
55502+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
55503+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
55504+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
55505+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
55506+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
55507+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
55508+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
55509+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
55510+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
55511+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
55512+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
55513+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
55514+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
55515+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
55516+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
55517+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
55518+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
55519+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
55520+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
55521+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
55522+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
55523+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
55524+ };
55525+
55526+static const char * gr_socktypes[SOCK_MAX] = {
55527+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
55528+ "unknown:7", "unknown:8", "unknown:9", "packet"
55529+ };
55530+
55531+static const char * gr_sockfamilies[AF_MAX+1] = {
55532+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
55533+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
55534+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
55535+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
55536+ };
55537+
55538+const char *
55539+gr_proto_to_name(unsigned char proto)
55540+{
55541+ return gr_protocols[proto];
55542+}
55543+
55544+const char *
55545+gr_socktype_to_name(unsigned char type)
55546+{
55547+ return gr_socktypes[type];
55548+}
55549+
55550+const char *
55551+gr_sockfamily_to_name(unsigned char family)
55552+{
55553+ return gr_sockfamilies[family];
55554+}
55555+
55556+int
55557+gr_search_socket(const int domain, const int type, const int protocol)
55558+{
55559+ struct acl_subject_label *curr;
55560+ const struct cred *cred = current_cred();
55561+
55562+ if (unlikely(!gr_acl_is_enabled()))
55563+ goto exit;
55564+
55565+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
55566+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
55567+ goto exit; // let the kernel handle it
55568+
55569+ curr = current->acl;
55570+
55571+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
55572+ /* the family is allowed, if this is PF_INET allow it only if
55573+ the extra sock type/protocol checks pass */
55574+ if (domain == PF_INET)
55575+ goto inet_check;
55576+ goto exit;
55577+ } else {
55578+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55579+ __u32 fakeip = 0;
55580+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55581+ current->role->roletype, cred->uid,
55582+ cred->gid, current->exec_file ?
55583+ gr_to_filename(current->exec_file->f_path.dentry,
55584+ current->exec_file->f_path.mnt) :
55585+ curr->filename, curr->filename,
55586+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
55587+ &current->signal->saved_ip);
55588+ goto exit;
55589+ }
55590+ goto exit_fail;
55591+ }
55592+
55593+inet_check:
55594+ /* the rest of this checking is for IPv4 only */
55595+ if (!curr->ips)
55596+ goto exit;
55597+
55598+ if ((curr->ip_type & (1 << type)) &&
55599+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
55600+ goto exit;
55601+
55602+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55603+ /* we don't place acls on raw sockets , and sometimes
55604+ dgram/ip sockets are opened for ioctl and not
55605+ bind/connect, so we'll fake a bind learn log */
55606+ if (type == SOCK_RAW || type == SOCK_PACKET) {
55607+ __u32 fakeip = 0;
55608+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55609+ current->role->roletype, cred->uid,
55610+ cred->gid, current->exec_file ?
55611+ gr_to_filename(current->exec_file->f_path.dentry,
55612+ current->exec_file->f_path.mnt) :
55613+ curr->filename, curr->filename,
55614+ &fakeip, 0, type,
55615+ protocol, GR_CONNECT, &current->signal->saved_ip);
55616+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
55617+ __u32 fakeip = 0;
55618+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55619+ current->role->roletype, cred->uid,
55620+ cred->gid, current->exec_file ?
55621+ gr_to_filename(current->exec_file->f_path.dentry,
55622+ current->exec_file->f_path.mnt) :
55623+ curr->filename, curr->filename,
55624+ &fakeip, 0, type,
55625+ protocol, GR_BIND, &current->signal->saved_ip);
55626+ }
55627+ /* we'll log when they use connect or bind */
55628+ goto exit;
55629+ }
55630+
55631+exit_fail:
55632+ if (domain == PF_INET)
55633+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
55634+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
55635+ else
55636+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
55637+ gr_socktype_to_name(type), protocol);
55638+
55639+ return 0;
55640+exit:
55641+ return 1;
55642+}
55643+
55644+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
55645+{
55646+ if ((ip->mode & mode) &&
55647+ (ip_port >= ip->low) &&
55648+ (ip_port <= ip->high) &&
55649+ ((ntohl(ip_addr) & our_netmask) ==
55650+ (ntohl(our_addr) & our_netmask))
55651+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
55652+ && (ip->type & (1 << type))) {
55653+ if (ip->mode & GR_INVERT)
55654+ return 2; // specifically denied
55655+ else
55656+ return 1; // allowed
55657+ }
55658+
55659+ return 0; // not specifically allowed, may continue parsing
55660+}
55661+
55662+static int
55663+gr_search_connectbind(const int full_mode, struct sock *sk,
55664+ struct sockaddr_in *addr, const int type)
55665+{
55666+ char iface[IFNAMSIZ] = {0};
55667+ struct acl_subject_label *curr;
55668+ struct acl_ip_label *ip;
55669+ struct inet_sock *isk;
55670+ struct net_device *dev;
55671+ struct in_device *idev;
55672+ unsigned long i;
55673+ int ret;
55674+ int mode = full_mode & (GR_BIND | GR_CONNECT);
55675+ __u32 ip_addr = 0;
55676+ __u32 our_addr;
55677+ __u32 our_netmask;
55678+ char *p;
55679+ __u16 ip_port = 0;
55680+ const struct cred *cred = current_cred();
55681+
55682+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
55683+ return 0;
55684+
55685+ curr = current->acl;
55686+ isk = inet_sk(sk);
55687+
55688+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
55689+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
55690+ addr->sin_addr.s_addr = curr->inaddr_any_override;
55691+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
55692+ struct sockaddr_in saddr;
55693+ int err;
55694+
55695+ saddr.sin_family = AF_INET;
55696+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
55697+ saddr.sin_port = isk->inet_sport;
55698+
55699+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55700+ if (err)
55701+ return err;
55702+
55703+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55704+ if (err)
55705+ return err;
55706+ }
55707+
55708+ if (!curr->ips)
55709+ return 0;
55710+
55711+ ip_addr = addr->sin_addr.s_addr;
55712+ ip_port = ntohs(addr->sin_port);
55713+
55714+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55715+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55716+ current->role->roletype, cred->uid,
55717+ cred->gid, current->exec_file ?
55718+ gr_to_filename(current->exec_file->f_path.dentry,
55719+ current->exec_file->f_path.mnt) :
55720+ curr->filename, curr->filename,
55721+ &ip_addr, ip_port, type,
55722+ sk->sk_protocol, mode, &current->signal->saved_ip);
55723+ return 0;
55724+ }
55725+
55726+ for (i = 0; i < curr->ip_num; i++) {
55727+ ip = *(curr->ips + i);
55728+ if (ip->iface != NULL) {
55729+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
55730+ p = strchr(iface, ':');
55731+ if (p != NULL)
55732+ *p = '\0';
55733+ dev = dev_get_by_name(sock_net(sk), iface);
55734+ if (dev == NULL)
55735+ continue;
55736+ idev = in_dev_get(dev);
55737+ if (idev == NULL) {
55738+ dev_put(dev);
55739+ continue;
55740+ }
55741+ rcu_read_lock();
55742+ for_ifa(idev) {
55743+ if (!strcmp(ip->iface, ifa->ifa_label)) {
55744+ our_addr = ifa->ifa_address;
55745+ our_netmask = 0xffffffff;
55746+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55747+ if (ret == 1) {
55748+ rcu_read_unlock();
55749+ in_dev_put(idev);
55750+ dev_put(dev);
55751+ return 0;
55752+ } else if (ret == 2) {
55753+ rcu_read_unlock();
55754+ in_dev_put(idev);
55755+ dev_put(dev);
55756+ goto denied;
55757+ }
55758+ }
55759+ } endfor_ifa(idev);
55760+ rcu_read_unlock();
55761+ in_dev_put(idev);
55762+ dev_put(dev);
55763+ } else {
55764+ our_addr = ip->addr;
55765+ our_netmask = ip->netmask;
55766+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55767+ if (ret == 1)
55768+ return 0;
55769+ else if (ret == 2)
55770+ goto denied;
55771+ }
55772+ }
55773+
55774+denied:
55775+ if (mode == GR_BIND)
55776+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55777+ else if (mode == GR_CONNECT)
55778+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55779+
55780+ return -EACCES;
55781+}
55782+
55783+int
55784+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
55785+{
55786+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
55787+}
55788+
55789+int
55790+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
55791+{
55792+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
55793+}
55794+
55795+int gr_search_listen(struct socket *sock)
55796+{
55797+ struct sock *sk = sock->sk;
55798+ struct sockaddr_in addr;
55799+
55800+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
55801+ addr.sin_port = inet_sk(sk)->inet_sport;
55802+
55803+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55804+}
55805+
55806+int gr_search_accept(struct socket *sock)
55807+{
55808+ struct sock *sk = sock->sk;
55809+ struct sockaddr_in addr;
55810+
55811+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
55812+ addr.sin_port = inet_sk(sk)->inet_sport;
55813+
55814+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55815+}
55816+
55817+int
55818+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
55819+{
55820+ if (addr)
55821+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
55822+ else {
55823+ struct sockaddr_in sin;
55824+ const struct inet_sock *inet = inet_sk(sk);
55825+
55826+ sin.sin_addr.s_addr = inet->inet_daddr;
55827+ sin.sin_port = inet->inet_dport;
55828+
55829+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55830+ }
55831+}
55832+
55833+int
55834+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
55835+{
55836+ struct sockaddr_in sin;
55837+
55838+ if (unlikely(skb->len < sizeof (struct udphdr)))
55839+ return 0; // skip this packet
55840+
55841+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
55842+ sin.sin_port = udp_hdr(skb)->source;
55843+
55844+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55845+}
55846diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
55847new file mode 100644
55848index 0000000..25f54ef
55849--- /dev/null
55850+++ b/grsecurity/gracl_learn.c
55851@@ -0,0 +1,207 @@
55852+#include <linux/kernel.h>
55853+#include <linux/mm.h>
55854+#include <linux/sched.h>
55855+#include <linux/poll.h>
55856+#include <linux/string.h>
55857+#include <linux/file.h>
55858+#include <linux/types.h>
55859+#include <linux/vmalloc.h>
55860+#include <linux/grinternal.h>
55861+
55862+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
55863+ size_t count, loff_t *ppos);
55864+extern int gr_acl_is_enabled(void);
55865+
55866+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
55867+static int gr_learn_attached;
55868+
55869+/* use a 512k buffer */
55870+#define LEARN_BUFFER_SIZE (512 * 1024)
55871+
55872+static DEFINE_SPINLOCK(gr_learn_lock);
55873+static DEFINE_MUTEX(gr_learn_user_mutex);
55874+
55875+/* we need to maintain two buffers, so that the kernel context of grlearn
55876+ uses a semaphore around the userspace copying, and the other kernel contexts
55877+ use a spinlock when copying into the buffer, since they cannot sleep
55878+*/
55879+static char *learn_buffer;
55880+static char *learn_buffer_user;
55881+static int learn_buffer_len;
55882+static int learn_buffer_user_len;
55883+
55884+static ssize_t
55885+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
55886+{
55887+ DECLARE_WAITQUEUE(wait, current);
55888+ ssize_t retval = 0;
55889+
55890+ add_wait_queue(&learn_wait, &wait);
55891+ set_current_state(TASK_INTERRUPTIBLE);
55892+ do {
55893+ mutex_lock(&gr_learn_user_mutex);
55894+ spin_lock(&gr_learn_lock);
55895+ if (learn_buffer_len)
55896+ break;
55897+ spin_unlock(&gr_learn_lock);
55898+ mutex_unlock(&gr_learn_user_mutex);
55899+ if (file->f_flags & O_NONBLOCK) {
55900+ retval = -EAGAIN;
55901+ goto out;
55902+ }
55903+ if (signal_pending(current)) {
55904+ retval = -ERESTARTSYS;
55905+ goto out;
55906+ }
55907+
55908+ schedule();
55909+ } while (1);
55910+
55911+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
55912+ learn_buffer_user_len = learn_buffer_len;
55913+ retval = learn_buffer_len;
55914+ learn_buffer_len = 0;
55915+
55916+ spin_unlock(&gr_learn_lock);
55917+
55918+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
55919+ retval = -EFAULT;
55920+
55921+ mutex_unlock(&gr_learn_user_mutex);
55922+out:
55923+ set_current_state(TASK_RUNNING);
55924+ remove_wait_queue(&learn_wait, &wait);
55925+ return retval;
55926+}
55927+
55928+static unsigned int
55929+poll_learn(struct file * file, poll_table * wait)
55930+{
55931+ poll_wait(file, &learn_wait, wait);
55932+
55933+ if (learn_buffer_len)
55934+ return (POLLIN | POLLRDNORM);
55935+
55936+ return 0;
55937+}
55938+
55939+void
55940+gr_clear_learn_entries(void)
55941+{
55942+ char *tmp;
55943+
55944+ mutex_lock(&gr_learn_user_mutex);
55945+ spin_lock(&gr_learn_lock);
55946+ tmp = learn_buffer;
55947+ learn_buffer = NULL;
55948+ spin_unlock(&gr_learn_lock);
55949+ if (tmp)
55950+ vfree(tmp);
55951+ if (learn_buffer_user != NULL) {
55952+ vfree(learn_buffer_user);
55953+ learn_buffer_user = NULL;
55954+ }
55955+ learn_buffer_len = 0;
55956+ mutex_unlock(&gr_learn_user_mutex);
55957+
55958+ return;
55959+}
55960+
55961+void
55962+gr_add_learn_entry(const char *fmt, ...)
55963+{
55964+ va_list args;
55965+ unsigned int len;
55966+
55967+ if (!gr_learn_attached)
55968+ return;
55969+
55970+ spin_lock(&gr_learn_lock);
55971+
55972+ /* leave a gap at the end so we know when it's "full" but don't have to
55973+ compute the exact length of the string we're trying to append
55974+ */
55975+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
55976+ spin_unlock(&gr_learn_lock);
55977+ wake_up_interruptible(&learn_wait);
55978+ return;
55979+ }
55980+ if (learn_buffer == NULL) {
55981+ spin_unlock(&gr_learn_lock);
55982+ return;
55983+ }
55984+
55985+ va_start(args, fmt);
55986+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
55987+ va_end(args);
55988+
55989+ learn_buffer_len += len + 1;
55990+
55991+ spin_unlock(&gr_learn_lock);
55992+ wake_up_interruptible(&learn_wait);
55993+
55994+ return;
55995+}
55996+
55997+static int
55998+open_learn(struct inode *inode, struct file *file)
55999+{
56000+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56001+ return -EBUSY;
56002+ if (file->f_mode & FMODE_READ) {
56003+ int retval = 0;
56004+ mutex_lock(&gr_learn_user_mutex);
56005+ if (learn_buffer == NULL)
56006+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56007+ if (learn_buffer_user == NULL)
56008+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56009+ if (learn_buffer == NULL) {
56010+ retval = -ENOMEM;
56011+ goto out_error;
56012+ }
56013+ if (learn_buffer_user == NULL) {
56014+ retval = -ENOMEM;
56015+ goto out_error;
56016+ }
56017+ learn_buffer_len = 0;
56018+ learn_buffer_user_len = 0;
56019+ gr_learn_attached = 1;
56020+out_error:
56021+ mutex_unlock(&gr_learn_user_mutex);
56022+ return retval;
56023+ }
56024+ return 0;
56025+}
56026+
56027+static int
56028+close_learn(struct inode *inode, struct file *file)
56029+{
56030+ if (file->f_mode & FMODE_READ) {
56031+ char *tmp = NULL;
56032+ mutex_lock(&gr_learn_user_mutex);
56033+ spin_lock(&gr_learn_lock);
56034+ tmp = learn_buffer;
56035+ learn_buffer = NULL;
56036+ spin_unlock(&gr_learn_lock);
56037+ if (tmp)
56038+ vfree(tmp);
56039+ if (learn_buffer_user != NULL) {
56040+ vfree(learn_buffer_user);
56041+ learn_buffer_user = NULL;
56042+ }
56043+ learn_buffer_len = 0;
56044+ learn_buffer_user_len = 0;
56045+ gr_learn_attached = 0;
56046+ mutex_unlock(&gr_learn_user_mutex);
56047+ }
56048+
56049+ return 0;
56050+}
56051+
56052+const struct file_operations grsec_fops = {
56053+ .read = read_learn,
56054+ .write = write_grsec_handler,
56055+ .open = open_learn,
56056+ .release = close_learn,
56057+ .poll = poll_learn,
56058+};
56059diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
56060new file mode 100644
56061index 0000000..39645c9
56062--- /dev/null
56063+++ b/grsecurity/gracl_res.c
56064@@ -0,0 +1,68 @@
56065+#include <linux/kernel.h>
56066+#include <linux/sched.h>
56067+#include <linux/gracl.h>
56068+#include <linux/grinternal.h>
56069+
56070+static const char *restab_log[] = {
56071+ [RLIMIT_CPU] = "RLIMIT_CPU",
56072+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56073+ [RLIMIT_DATA] = "RLIMIT_DATA",
56074+ [RLIMIT_STACK] = "RLIMIT_STACK",
56075+ [RLIMIT_CORE] = "RLIMIT_CORE",
56076+ [RLIMIT_RSS] = "RLIMIT_RSS",
56077+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56078+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56079+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56080+ [RLIMIT_AS] = "RLIMIT_AS",
56081+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56082+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56083+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56084+ [RLIMIT_NICE] = "RLIMIT_NICE",
56085+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56086+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56087+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56088+};
56089+
56090+void
56091+gr_log_resource(const struct task_struct *task,
56092+ const int res, const unsigned long wanted, const int gt)
56093+{
56094+ const struct cred *cred;
56095+ unsigned long rlim;
56096+
56097+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56098+ return;
56099+
56100+ // not yet supported resource
56101+ if (unlikely(!restab_log[res]))
56102+ return;
56103+
56104+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56105+ rlim = task_rlimit_max(task, res);
56106+ else
56107+ rlim = task_rlimit(task, res);
56108+
56109+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56110+ return;
56111+
56112+ rcu_read_lock();
56113+ cred = __task_cred(task);
56114+
56115+ if (res == RLIMIT_NPROC &&
56116+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56117+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56118+ goto out_rcu_unlock;
56119+ else if (res == RLIMIT_MEMLOCK &&
56120+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56121+ goto out_rcu_unlock;
56122+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56123+ goto out_rcu_unlock;
56124+ rcu_read_unlock();
56125+
56126+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56127+
56128+ return;
56129+out_rcu_unlock:
56130+ rcu_read_unlock();
56131+ return;
56132+}
56133diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
56134new file mode 100644
56135index 0000000..5556be3
56136--- /dev/null
56137+++ b/grsecurity/gracl_segv.c
56138@@ -0,0 +1,299 @@
56139+#include <linux/kernel.h>
56140+#include <linux/mm.h>
56141+#include <asm/uaccess.h>
56142+#include <asm/errno.h>
56143+#include <asm/mman.h>
56144+#include <net/sock.h>
56145+#include <linux/file.h>
56146+#include <linux/fs.h>
56147+#include <linux/net.h>
56148+#include <linux/in.h>
56149+#include <linux/slab.h>
56150+#include <linux/types.h>
56151+#include <linux/sched.h>
56152+#include <linux/timer.h>
56153+#include <linux/gracl.h>
56154+#include <linux/grsecurity.h>
56155+#include <linux/grinternal.h>
56156+
56157+static struct crash_uid *uid_set;
56158+static unsigned short uid_used;
56159+static DEFINE_SPINLOCK(gr_uid_lock);
56160+extern rwlock_t gr_inode_lock;
56161+extern struct acl_subject_label *
56162+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56163+ struct acl_role_label *role);
56164+
56165+#ifdef CONFIG_BTRFS_FS
56166+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56167+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56168+#endif
56169+
56170+static inline dev_t __get_dev(const struct dentry *dentry)
56171+{
56172+#ifdef CONFIG_BTRFS_FS
56173+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56174+ return get_btrfs_dev_from_inode(dentry->d_inode);
56175+ else
56176+#endif
56177+ return dentry->d_inode->i_sb->s_dev;
56178+}
56179+
56180+int
56181+gr_init_uidset(void)
56182+{
56183+ uid_set =
56184+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56185+ uid_used = 0;
56186+
56187+ return uid_set ? 1 : 0;
56188+}
56189+
56190+void
56191+gr_free_uidset(void)
56192+{
56193+ if (uid_set)
56194+ kfree(uid_set);
56195+
56196+ return;
56197+}
56198+
56199+int
56200+gr_find_uid(const uid_t uid)
56201+{
56202+ struct crash_uid *tmp = uid_set;
56203+ uid_t buid;
56204+ int low = 0, high = uid_used - 1, mid;
56205+
56206+ while (high >= low) {
56207+ mid = (low + high) >> 1;
56208+ buid = tmp[mid].uid;
56209+ if (buid == uid)
56210+ return mid;
56211+ if (buid > uid)
56212+ high = mid - 1;
56213+ if (buid < uid)
56214+ low = mid + 1;
56215+ }
56216+
56217+ return -1;
56218+}
56219+
56220+static __inline__ void
56221+gr_insertsort(void)
56222+{
56223+ unsigned short i, j;
56224+ struct crash_uid index;
56225+
56226+ for (i = 1; i < uid_used; i++) {
56227+ index = uid_set[i];
56228+ j = i;
56229+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56230+ uid_set[j] = uid_set[j - 1];
56231+ j--;
56232+ }
56233+ uid_set[j] = index;
56234+ }
56235+
56236+ return;
56237+}
56238+
56239+static __inline__ void
56240+gr_insert_uid(const uid_t uid, const unsigned long expires)
56241+{
56242+ int loc;
56243+
56244+ if (uid_used == GR_UIDTABLE_MAX)
56245+ return;
56246+
56247+ loc = gr_find_uid(uid);
56248+
56249+ if (loc >= 0) {
56250+ uid_set[loc].expires = expires;
56251+ return;
56252+ }
56253+
56254+ uid_set[uid_used].uid = uid;
56255+ uid_set[uid_used].expires = expires;
56256+ uid_used++;
56257+
56258+ gr_insertsort();
56259+
56260+ return;
56261+}
56262+
56263+void
56264+gr_remove_uid(const unsigned short loc)
56265+{
56266+ unsigned short i;
56267+
56268+ for (i = loc + 1; i < uid_used; i++)
56269+ uid_set[i - 1] = uid_set[i];
56270+
56271+ uid_used--;
56272+
56273+ return;
56274+}
56275+
56276+int
56277+gr_check_crash_uid(const uid_t uid)
56278+{
56279+ int loc;
56280+ int ret = 0;
56281+
56282+ if (unlikely(!gr_acl_is_enabled()))
56283+ return 0;
56284+
56285+ spin_lock(&gr_uid_lock);
56286+ loc = gr_find_uid(uid);
56287+
56288+ if (loc < 0)
56289+ goto out_unlock;
56290+
56291+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
56292+ gr_remove_uid(loc);
56293+ else
56294+ ret = 1;
56295+
56296+out_unlock:
56297+ spin_unlock(&gr_uid_lock);
56298+ return ret;
56299+}
56300+
56301+static __inline__ int
56302+proc_is_setxid(const struct cred *cred)
56303+{
56304+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
56305+ cred->uid != cred->fsuid)
56306+ return 1;
56307+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56308+ cred->gid != cred->fsgid)
56309+ return 1;
56310+
56311+ return 0;
56312+}
56313+
56314+extern int gr_fake_force_sig(int sig, struct task_struct *t);
56315+
56316+void
56317+gr_handle_crash(struct task_struct *task, const int sig)
56318+{
56319+ struct acl_subject_label *curr;
56320+ struct task_struct *tsk, *tsk2;
56321+ const struct cred *cred;
56322+ const struct cred *cred2;
56323+
56324+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56325+ return;
56326+
56327+ if (unlikely(!gr_acl_is_enabled()))
56328+ return;
56329+
56330+ curr = task->acl;
56331+
56332+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
56333+ return;
56334+
56335+ if (time_before_eq(curr->expires, get_seconds())) {
56336+ curr->expires = 0;
56337+ curr->crashes = 0;
56338+ }
56339+
56340+ curr->crashes++;
56341+
56342+ if (!curr->expires)
56343+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56344+
56345+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56346+ time_after(curr->expires, get_seconds())) {
56347+ rcu_read_lock();
56348+ cred = __task_cred(task);
56349+ if (cred->uid && proc_is_setxid(cred)) {
56350+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56351+ spin_lock(&gr_uid_lock);
56352+ gr_insert_uid(cred->uid, curr->expires);
56353+ spin_unlock(&gr_uid_lock);
56354+ curr->expires = 0;
56355+ curr->crashes = 0;
56356+ read_lock(&tasklist_lock);
56357+ do_each_thread(tsk2, tsk) {
56358+ cred2 = __task_cred(tsk);
56359+ if (tsk != task && cred2->uid == cred->uid)
56360+ gr_fake_force_sig(SIGKILL, tsk);
56361+ } while_each_thread(tsk2, tsk);
56362+ read_unlock(&tasklist_lock);
56363+ } else {
56364+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56365+ read_lock(&tasklist_lock);
56366+ read_lock(&grsec_exec_file_lock);
56367+ do_each_thread(tsk2, tsk) {
56368+ if (likely(tsk != task)) {
56369+ // if this thread has the same subject as the one that triggered
56370+ // RES_CRASH and it's the same binary, kill it
56371+ if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
56372+ gr_fake_force_sig(SIGKILL, tsk);
56373+ }
56374+ } while_each_thread(tsk2, tsk);
56375+ read_unlock(&grsec_exec_file_lock);
56376+ read_unlock(&tasklist_lock);
56377+ }
56378+ rcu_read_unlock();
56379+ }
56380+
56381+ return;
56382+}
56383+
56384+int
56385+gr_check_crash_exec(const struct file *filp)
56386+{
56387+ struct acl_subject_label *curr;
56388+
56389+ if (unlikely(!gr_acl_is_enabled()))
56390+ return 0;
56391+
56392+ read_lock(&gr_inode_lock);
56393+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56394+ __get_dev(filp->f_path.dentry),
56395+ current->role);
56396+ read_unlock(&gr_inode_lock);
56397+
56398+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56399+ (!curr->crashes && !curr->expires))
56400+ return 0;
56401+
56402+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56403+ time_after(curr->expires, get_seconds()))
56404+ return 1;
56405+ else if (time_before_eq(curr->expires, get_seconds())) {
56406+ curr->crashes = 0;
56407+ curr->expires = 0;
56408+ }
56409+
56410+ return 0;
56411+}
56412+
56413+void
56414+gr_handle_alertkill(struct task_struct *task)
56415+{
56416+ struct acl_subject_label *curracl;
56417+ __u32 curr_ip;
56418+ struct task_struct *p, *p2;
56419+
56420+ if (unlikely(!gr_acl_is_enabled()))
56421+ return;
56422+
56423+ curracl = task->acl;
56424+ curr_ip = task->signal->curr_ip;
56425+
56426+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56427+ read_lock(&tasklist_lock);
56428+ do_each_thread(p2, p) {
56429+ if (p->signal->curr_ip == curr_ip)
56430+ gr_fake_force_sig(SIGKILL, p);
56431+ } while_each_thread(p2, p);
56432+ read_unlock(&tasklist_lock);
56433+ } else if (curracl->mode & GR_KILLPROC)
56434+ gr_fake_force_sig(SIGKILL, task);
56435+
56436+ return;
56437+}
56438diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
56439new file mode 100644
56440index 0000000..9d83a69
56441--- /dev/null
56442+++ b/grsecurity/gracl_shm.c
56443@@ -0,0 +1,40 @@
56444+#include <linux/kernel.h>
56445+#include <linux/mm.h>
56446+#include <linux/sched.h>
56447+#include <linux/file.h>
56448+#include <linux/ipc.h>
56449+#include <linux/gracl.h>
56450+#include <linux/grsecurity.h>
56451+#include <linux/grinternal.h>
56452+
56453+int
56454+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56455+ const time_t shm_createtime, const uid_t cuid, const int shmid)
56456+{
56457+ struct task_struct *task;
56458+
56459+ if (!gr_acl_is_enabled())
56460+ return 1;
56461+
56462+ rcu_read_lock();
56463+ read_lock(&tasklist_lock);
56464+
56465+ task = find_task_by_vpid(shm_cprid);
56466+
56467+ if (unlikely(!task))
56468+ task = find_task_by_vpid(shm_lapid);
56469+
56470+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56471+ (task->pid == shm_lapid)) &&
56472+ (task->acl->mode & GR_PROTSHM) &&
56473+ (task->acl != current->acl))) {
56474+ read_unlock(&tasklist_lock);
56475+ rcu_read_unlock();
56476+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56477+ return 0;
56478+ }
56479+ read_unlock(&tasklist_lock);
56480+ rcu_read_unlock();
56481+
56482+ return 1;
56483+}
56484diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
56485new file mode 100644
56486index 0000000..bc0be01
56487--- /dev/null
56488+++ b/grsecurity/grsec_chdir.c
56489@@ -0,0 +1,19 @@
56490+#include <linux/kernel.h>
56491+#include <linux/sched.h>
56492+#include <linux/fs.h>
56493+#include <linux/file.h>
56494+#include <linux/grsecurity.h>
56495+#include <linux/grinternal.h>
56496+
56497+void
56498+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56499+{
56500+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56501+ if ((grsec_enable_chdir && grsec_enable_group &&
56502+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56503+ !grsec_enable_group)) {
56504+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56505+ }
56506+#endif
56507+ return;
56508+}
56509diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
56510new file mode 100644
56511index 0000000..a2dc675
56512--- /dev/null
56513+++ b/grsecurity/grsec_chroot.c
56514@@ -0,0 +1,351 @@
56515+#include <linux/kernel.h>
56516+#include <linux/module.h>
56517+#include <linux/sched.h>
56518+#include <linux/file.h>
56519+#include <linux/fs.h>
56520+#include <linux/mount.h>
56521+#include <linux/types.h>
56522+#include <linux/pid_namespace.h>
56523+#include <linux/grsecurity.h>
56524+#include <linux/grinternal.h>
56525+
56526+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
56527+{
56528+#ifdef CONFIG_GRKERNSEC
56529+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
56530+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
56531+ task->gr_is_chrooted = 1;
56532+ else
56533+ task->gr_is_chrooted = 0;
56534+
56535+ task->gr_chroot_dentry = path->dentry;
56536+#endif
56537+ return;
56538+}
56539+
56540+void gr_clear_chroot_entries(struct task_struct *task)
56541+{
56542+#ifdef CONFIG_GRKERNSEC
56543+ task->gr_is_chrooted = 0;
56544+ task->gr_chroot_dentry = NULL;
56545+#endif
56546+ return;
56547+}
56548+
56549+int
56550+gr_handle_chroot_unix(const pid_t pid)
56551+{
56552+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
56553+ struct task_struct *p;
56554+
56555+ if (unlikely(!grsec_enable_chroot_unix))
56556+ return 1;
56557+
56558+ if (likely(!proc_is_chrooted(current)))
56559+ return 1;
56560+
56561+ rcu_read_lock();
56562+ read_lock(&tasklist_lock);
56563+ p = find_task_by_vpid_unrestricted(pid);
56564+ if (unlikely(p && !have_same_root(current, p))) {
56565+ read_unlock(&tasklist_lock);
56566+ rcu_read_unlock();
56567+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
56568+ return 0;
56569+ }
56570+ read_unlock(&tasklist_lock);
56571+ rcu_read_unlock();
56572+#endif
56573+ return 1;
56574+}
56575+
56576+int
56577+gr_handle_chroot_nice(void)
56578+{
56579+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56580+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
56581+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
56582+ return -EPERM;
56583+ }
56584+#endif
56585+ return 0;
56586+}
56587+
56588+int
56589+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
56590+{
56591+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56592+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
56593+ && proc_is_chrooted(current)) {
56594+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
56595+ return -EACCES;
56596+ }
56597+#endif
56598+ return 0;
56599+}
56600+
56601+int
56602+gr_handle_chroot_rawio(const struct inode *inode)
56603+{
56604+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56605+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
56606+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
56607+ return 1;
56608+#endif
56609+ return 0;
56610+}
56611+
56612+int
56613+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
56614+{
56615+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56616+ struct task_struct *p;
56617+ int ret = 0;
56618+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
56619+ return ret;
56620+
56621+ read_lock(&tasklist_lock);
56622+ do_each_pid_task(pid, type, p) {
56623+ if (!have_same_root(current, p)) {
56624+ ret = 1;
56625+ goto out;
56626+ }
56627+ } while_each_pid_task(pid, type, p);
56628+out:
56629+ read_unlock(&tasklist_lock);
56630+ return ret;
56631+#endif
56632+ return 0;
56633+}
56634+
56635+int
56636+gr_pid_is_chrooted(struct task_struct *p)
56637+{
56638+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56639+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
56640+ return 0;
56641+
56642+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
56643+ !have_same_root(current, p)) {
56644+ return 1;
56645+ }
56646+#endif
56647+ return 0;
56648+}
56649+
56650+EXPORT_SYMBOL(gr_pid_is_chrooted);
56651+
56652+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
56653+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
56654+{
56655+ struct path path, currentroot;
56656+ int ret = 0;
56657+
56658+ path.dentry = (struct dentry *)u_dentry;
56659+ path.mnt = (struct vfsmount *)u_mnt;
56660+ get_fs_root(current->fs, &currentroot);
56661+ if (path_is_under(&path, &currentroot))
56662+ ret = 1;
56663+ path_put(&currentroot);
56664+
56665+ return ret;
56666+}
56667+#endif
56668+
56669+int
56670+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
56671+{
56672+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
56673+ if (!grsec_enable_chroot_fchdir)
56674+ return 1;
56675+
56676+ if (!proc_is_chrooted(current))
56677+ return 1;
56678+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
56679+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
56680+ return 0;
56681+ }
56682+#endif
56683+ return 1;
56684+}
56685+
56686+int
56687+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56688+ const time_t shm_createtime)
56689+{
56690+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
56691+ struct task_struct *p;
56692+ time_t starttime;
56693+
56694+ if (unlikely(!grsec_enable_chroot_shmat))
56695+ return 1;
56696+
56697+ if (likely(!proc_is_chrooted(current)))
56698+ return 1;
56699+
56700+ rcu_read_lock();
56701+ read_lock(&tasklist_lock);
56702+
56703+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
56704+ starttime = p->start_time.tv_sec;
56705+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
56706+ if (have_same_root(current, p)) {
56707+ goto allow;
56708+ } else {
56709+ read_unlock(&tasklist_lock);
56710+ rcu_read_unlock();
56711+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56712+ return 0;
56713+ }
56714+ }
56715+ /* creator exited, pid reuse, fall through to next check */
56716+ }
56717+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
56718+ if (unlikely(!have_same_root(current, p))) {
56719+ read_unlock(&tasklist_lock);
56720+ rcu_read_unlock();
56721+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56722+ return 0;
56723+ }
56724+ }
56725+
56726+allow:
56727+ read_unlock(&tasklist_lock);
56728+ rcu_read_unlock();
56729+#endif
56730+ return 1;
56731+}
56732+
56733+void
56734+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
56735+{
56736+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
56737+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
56738+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
56739+#endif
56740+ return;
56741+}
56742+
56743+int
56744+gr_handle_chroot_mknod(const struct dentry *dentry,
56745+ const struct vfsmount *mnt, const int mode)
56746+{
56747+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
56748+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
56749+ proc_is_chrooted(current)) {
56750+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
56751+ return -EPERM;
56752+ }
56753+#endif
56754+ return 0;
56755+}
56756+
56757+int
56758+gr_handle_chroot_mount(const struct dentry *dentry,
56759+ const struct vfsmount *mnt, const char *dev_name)
56760+{
56761+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
56762+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
56763+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
56764+ return -EPERM;
56765+ }
56766+#endif
56767+ return 0;
56768+}
56769+
56770+int
56771+gr_handle_chroot_pivot(void)
56772+{
56773+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
56774+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
56775+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
56776+ return -EPERM;
56777+ }
56778+#endif
56779+ return 0;
56780+}
56781+
56782+int
56783+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
56784+{
56785+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
56786+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
56787+ !gr_is_outside_chroot(dentry, mnt)) {
56788+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
56789+ return -EPERM;
56790+ }
56791+#endif
56792+ return 0;
56793+}
56794+
56795+extern const char *captab_log[];
56796+extern int captab_log_entries;
56797+
56798+int
56799+gr_chroot_is_capable(const int cap)
56800+{
56801+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56802+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56803+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56804+ if (cap_raised(chroot_caps, cap)) {
56805+ const struct cred *creds = current_cred();
56806+ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
56807+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
56808+ }
56809+ return 0;
56810+ }
56811+ }
56812+#endif
56813+ return 1;
56814+}
56815+
56816+int
56817+gr_chroot_is_capable_nolog(const int cap)
56818+{
56819+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56820+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56821+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56822+ if (cap_raised(chroot_caps, cap)) {
56823+ return 0;
56824+ }
56825+ }
56826+#endif
56827+ return 1;
56828+}
56829+
56830+int
56831+gr_handle_chroot_sysctl(const int op)
56832+{
56833+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
56834+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
56835+ proc_is_chrooted(current))
56836+ return -EACCES;
56837+#endif
56838+ return 0;
56839+}
56840+
56841+void
56842+gr_handle_chroot_chdir(struct path *path)
56843+{
56844+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
56845+ if (grsec_enable_chroot_chdir)
56846+ set_fs_pwd(current->fs, path);
56847+#endif
56848+ return;
56849+}
56850+
56851+int
56852+gr_handle_chroot_chmod(const struct dentry *dentry,
56853+ const struct vfsmount *mnt, const int mode)
56854+{
56855+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
56856+ /* allow chmod +s on directories, but not files */
56857+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
56858+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
56859+ proc_is_chrooted(current)) {
56860+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
56861+ return -EPERM;
56862+ }
56863+#endif
56864+ return 0;
56865+}
56866diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
56867new file mode 100644
56868index 0000000..d81a586
56869--- /dev/null
56870+++ b/grsecurity/grsec_disabled.c
56871@@ -0,0 +1,439 @@
56872+#include <linux/kernel.h>
56873+#include <linux/module.h>
56874+#include <linux/sched.h>
56875+#include <linux/file.h>
56876+#include <linux/fs.h>
56877+#include <linux/kdev_t.h>
56878+#include <linux/net.h>
56879+#include <linux/in.h>
56880+#include <linux/ip.h>
56881+#include <linux/skbuff.h>
56882+#include <linux/sysctl.h>
56883+
56884+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
56885+void
56886+pax_set_initial_flags(struct linux_binprm *bprm)
56887+{
56888+ return;
56889+}
56890+#endif
56891+
56892+#ifdef CONFIG_SYSCTL
56893+__u32
56894+gr_handle_sysctl(const struct ctl_table * table, const int op)
56895+{
56896+ return 0;
56897+}
56898+#endif
56899+
56900+#ifdef CONFIG_TASKSTATS
56901+int gr_is_taskstats_denied(int pid)
56902+{
56903+ return 0;
56904+}
56905+#endif
56906+
56907+int
56908+gr_acl_is_enabled(void)
56909+{
56910+ return 0;
56911+}
56912+
56913+void
56914+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
56915+{
56916+ return;
56917+}
56918+
56919+int
56920+gr_handle_rawio(const struct inode *inode)
56921+{
56922+ return 0;
56923+}
56924+
56925+void
56926+gr_acl_handle_psacct(struct task_struct *task, const long code)
56927+{
56928+ return;
56929+}
56930+
56931+int
56932+gr_handle_ptrace(struct task_struct *task, const long request)
56933+{
56934+ return 0;
56935+}
56936+
56937+int
56938+gr_handle_proc_ptrace(struct task_struct *task)
56939+{
56940+ return 0;
56941+}
56942+
56943+void
56944+gr_learn_resource(const struct task_struct *task,
56945+ const int res, const unsigned long wanted, const int gt)
56946+{
56947+ return;
56948+}
56949+
56950+int
56951+gr_set_acls(const int type)
56952+{
56953+ return 0;
56954+}
56955+
56956+int
56957+gr_check_hidden_task(const struct task_struct *tsk)
56958+{
56959+ return 0;
56960+}
56961+
56962+int
56963+gr_check_protected_task(const struct task_struct *task)
56964+{
56965+ return 0;
56966+}
56967+
56968+int
56969+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
56970+{
56971+ return 0;
56972+}
56973+
56974+void
56975+gr_copy_label(struct task_struct *tsk)
56976+{
56977+ return;
56978+}
56979+
56980+void
56981+gr_set_pax_flags(struct task_struct *task)
56982+{
56983+ return;
56984+}
56985+
56986+int
56987+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
56988+ const int unsafe_share)
56989+{
56990+ return 0;
56991+}
56992+
56993+void
56994+gr_handle_delete(const ino_t ino, const dev_t dev)
56995+{
56996+ return;
56997+}
56998+
56999+void
57000+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57001+{
57002+ return;
57003+}
57004+
57005+void
57006+gr_handle_crash(struct task_struct *task, const int sig)
57007+{
57008+ return;
57009+}
57010+
57011+int
57012+gr_check_crash_exec(const struct file *filp)
57013+{
57014+ return 0;
57015+}
57016+
57017+int
57018+gr_check_crash_uid(const uid_t uid)
57019+{
57020+ return 0;
57021+}
57022+
57023+void
57024+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57025+ struct dentry *old_dentry,
57026+ struct dentry *new_dentry,
57027+ struct vfsmount *mnt, const __u8 replace)
57028+{
57029+ return;
57030+}
57031+
57032+int
57033+gr_search_socket(const int family, const int type, const int protocol)
57034+{
57035+ return 1;
57036+}
57037+
57038+int
57039+gr_search_connectbind(const int mode, const struct socket *sock,
57040+ const struct sockaddr_in *addr)
57041+{
57042+ return 0;
57043+}
57044+
57045+void
57046+gr_handle_alertkill(struct task_struct *task)
57047+{
57048+ return;
57049+}
57050+
57051+__u32
57052+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57053+{
57054+ return 1;
57055+}
57056+
57057+__u32
57058+gr_acl_handle_hidden_file(const struct dentry * dentry,
57059+ const struct vfsmount * mnt)
57060+{
57061+ return 1;
57062+}
57063+
57064+__u32
57065+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57066+ int acc_mode)
57067+{
57068+ return 1;
57069+}
57070+
57071+__u32
57072+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57073+{
57074+ return 1;
57075+}
57076+
57077+__u32
57078+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57079+{
57080+ return 1;
57081+}
57082+
57083+int
57084+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57085+ unsigned int *vm_flags)
57086+{
57087+ return 1;
57088+}
57089+
57090+__u32
57091+gr_acl_handle_truncate(const struct dentry * dentry,
57092+ const struct vfsmount * mnt)
57093+{
57094+ return 1;
57095+}
57096+
57097+__u32
57098+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57099+{
57100+ return 1;
57101+}
57102+
57103+__u32
57104+gr_acl_handle_access(const struct dentry * dentry,
57105+ const struct vfsmount * mnt, const int fmode)
57106+{
57107+ return 1;
57108+}
57109+
57110+__u32
57111+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57112+ mode_t mode)
57113+{
57114+ return 1;
57115+}
57116+
57117+__u32
57118+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57119+ mode_t mode)
57120+{
57121+ return 1;
57122+}
57123+
57124+__u32
57125+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57126+{
57127+ return 1;
57128+}
57129+
57130+__u32
57131+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57132+{
57133+ return 1;
57134+}
57135+
57136+void
57137+grsecurity_init(void)
57138+{
57139+ return;
57140+}
57141+
57142+__u32
57143+gr_acl_handle_mknod(const struct dentry * new_dentry,
57144+ const struct dentry * parent_dentry,
57145+ const struct vfsmount * parent_mnt,
57146+ const int mode)
57147+{
57148+ return 1;
57149+}
57150+
57151+__u32
57152+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57153+ const struct dentry * parent_dentry,
57154+ const struct vfsmount * parent_mnt)
57155+{
57156+ return 1;
57157+}
57158+
57159+__u32
57160+gr_acl_handle_symlink(const struct dentry * new_dentry,
57161+ const struct dentry * parent_dentry,
57162+ const struct vfsmount * parent_mnt, const char *from)
57163+{
57164+ return 1;
57165+}
57166+
57167+__u32
57168+gr_acl_handle_link(const struct dentry * new_dentry,
57169+ const struct dentry * parent_dentry,
57170+ const struct vfsmount * parent_mnt,
57171+ const struct dentry * old_dentry,
57172+ const struct vfsmount * old_mnt, const char *to)
57173+{
57174+ return 1;
57175+}
57176+
57177+int
57178+gr_acl_handle_rename(const struct dentry *new_dentry,
57179+ const struct dentry *parent_dentry,
57180+ const struct vfsmount *parent_mnt,
57181+ const struct dentry *old_dentry,
57182+ const struct inode *old_parent_inode,
57183+ const struct vfsmount *old_mnt, const char *newname)
57184+{
57185+ return 0;
57186+}
57187+
57188+int
57189+gr_acl_handle_filldir(const struct file *file, const char *name,
57190+ const int namelen, const ino_t ino)
57191+{
57192+ return 1;
57193+}
57194+
57195+int
57196+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57197+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57198+{
57199+ return 1;
57200+}
57201+
57202+int
57203+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57204+{
57205+ return 0;
57206+}
57207+
57208+int
57209+gr_search_accept(const struct socket *sock)
57210+{
57211+ return 0;
57212+}
57213+
57214+int
57215+gr_search_listen(const struct socket *sock)
57216+{
57217+ return 0;
57218+}
57219+
57220+int
57221+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57222+{
57223+ return 0;
57224+}
57225+
57226+__u32
57227+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57228+{
57229+ return 1;
57230+}
57231+
57232+__u32
57233+gr_acl_handle_creat(const struct dentry * dentry,
57234+ const struct dentry * p_dentry,
57235+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
57236+ const int imode)
57237+{
57238+ return 1;
57239+}
57240+
57241+void
57242+gr_acl_handle_exit(void)
57243+{
57244+ return;
57245+}
57246+
57247+int
57248+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57249+{
57250+ return 1;
57251+}
57252+
57253+void
57254+gr_set_role_label(const uid_t uid, const gid_t gid)
57255+{
57256+ return;
57257+}
57258+
57259+int
57260+gr_acl_handle_procpidmem(const struct task_struct *task)
57261+{
57262+ return 0;
57263+}
57264+
57265+int
57266+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57267+{
57268+ return 0;
57269+}
57270+
57271+int
57272+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57273+{
57274+ return 0;
57275+}
57276+
57277+void
57278+gr_set_kernel_label(struct task_struct *task)
57279+{
57280+ return;
57281+}
57282+
57283+int
57284+gr_check_user_change(int real, int effective, int fs)
57285+{
57286+ return 0;
57287+}
57288+
57289+int
57290+gr_check_group_change(int real, int effective, int fs)
57291+{
57292+ return 0;
57293+}
57294+
57295+int gr_acl_enable_at_secure(void)
57296+{
57297+ return 0;
57298+}
57299+
57300+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57301+{
57302+ return dentry->d_inode->i_sb->s_dev;
57303+}
57304+
57305+EXPORT_SYMBOL(gr_learn_resource);
57306+EXPORT_SYMBOL(gr_set_kernel_label);
57307+#ifdef CONFIG_SECURITY
57308+EXPORT_SYMBOL(gr_check_user_change);
57309+EXPORT_SYMBOL(gr_check_group_change);
57310+#endif
57311diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
57312new file mode 100644
57313index 0000000..2b05ada
57314--- /dev/null
57315+++ b/grsecurity/grsec_exec.c
57316@@ -0,0 +1,146 @@
57317+#include <linux/kernel.h>
57318+#include <linux/sched.h>
57319+#include <linux/file.h>
57320+#include <linux/binfmts.h>
57321+#include <linux/fs.h>
57322+#include <linux/types.h>
57323+#include <linux/grdefs.h>
57324+#include <linux/grsecurity.h>
57325+#include <linux/grinternal.h>
57326+#include <linux/capability.h>
57327+#include <linux/module.h>
57328+
57329+#include <asm/uaccess.h>
57330+
57331+#ifdef CONFIG_GRKERNSEC_EXECLOG
57332+static char gr_exec_arg_buf[132];
57333+static DEFINE_MUTEX(gr_exec_arg_mutex);
57334+#endif
57335+
57336+extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
57337+
57338+void
57339+gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
57340+{
57341+#ifdef CONFIG_GRKERNSEC_EXECLOG
57342+ char *grarg = gr_exec_arg_buf;
57343+ unsigned int i, x, execlen = 0;
57344+ char c;
57345+
57346+ if (!((grsec_enable_execlog && grsec_enable_group &&
57347+ in_group_p(grsec_audit_gid))
57348+ || (grsec_enable_execlog && !grsec_enable_group)))
57349+ return;
57350+
57351+ mutex_lock(&gr_exec_arg_mutex);
57352+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57353+
57354+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57355+ const char __user *p;
57356+ unsigned int len;
57357+
57358+ p = get_user_arg_ptr(argv, i);
57359+ if (IS_ERR(p))
57360+ goto log;
57361+
57362+ len = strnlen_user(p, 128 - execlen);
57363+ if (len > 128 - execlen)
57364+ len = 128 - execlen;
57365+ else if (len > 0)
57366+ len--;
57367+ if (copy_from_user(grarg + execlen, p, len))
57368+ goto log;
57369+
57370+ /* rewrite unprintable characters */
57371+ for (x = 0; x < len; x++) {
57372+ c = *(grarg + execlen + x);
57373+ if (c < 32 || c > 126)
57374+ *(grarg + execlen + x) = ' ';
57375+ }
57376+
57377+ execlen += len;
57378+ *(grarg + execlen) = ' ';
57379+ *(grarg + execlen + 1) = '\0';
57380+ execlen++;
57381+ }
57382+
57383+ log:
57384+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57385+ bprm->file->f_path.mnt, grarg);
57386+ mutex_unlock(&gr_exec_arg_mutex);
57387+#endif
57388+ return;
57389+}
57390+
57391+#ifdef CONFIG_GRKERNSEC
57392+extern int gr_acl_is_capable(const int cap);
57393+extern int gr_acl_is_capable_nolog(const int cap);
57394+extern int gr_chroot_is_capable(const int cap);
57395+extern int gr_chroot_is_capable_nolog(const int cap);
57396+#endif
57397+
57398+const char *captab_log[] = {
57399+ "CAP_CHOWN",
57400+ "CAP_DAC_OVERRIDE",
57401+ "CAP_DAC_READ_SEARCH",
57402+ "CAP_FOWNER",
57403+ "CAP_FSETID",
57404+ "CAP_KILL",
57405+ "CAP_SETGID",
57406+ "CAP_SETUID",
57407+ "CAP_SETPCAP",
57408+ "CAP_LINUX_IMMUTABLE",
57409+ "CAP_NET_BIND_SERVICE",
57410+ "CAP_NET_BROADCAST",
57411+ "CAP_NET_ADMIN",
57412+ "CAP_NET_RAW",
57413+ "CAP_IPC_LOCK",
57414+ "CAP_IPC_OWNER",
57415+ "CAP_SYS_MODULE",
57416+ "CAP_SYS_RAWIO",
57417+ "CAP_SYS_CHROOT",
57418+ "CAP_SYS_PTRACE",
57419+ "CAP_SYS_PACCT",
57420+ "CAP_SYS_ADMIN",
57421+ "CAP_SYS_BOOT",
57422+ "CAP_SYS_NICE",
57423+ "CAP_SYS_RESOURCE",
57424+ "CAP_SYS_TIME",
57425+ "CAP_SYS_TTY_CONFIG",
57426+ "CAP_MKNOD",
57427+ "CAP_LEASE",
57428+ "CAP_AUDIT_WRITE",
57429+ "CAP_AUDIT_CONTROL",
57430+ "CAP_SETFCAP",
57431+ "CAP_MAC_OVERRIDE",
57432+ "CAP_MAC_ADMIN",
57433+ "CAP_SYSLOG",
57434+ "CAP_WAKE_ALARM"
57435+};
57436+
57437+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
57438+
57439+int gr_is_capable(const int cap)
57440+{
57441+#ifdef CONFIG_GRKERNSEC
57442+ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
57443+ return 1;
57444+ return 0;
57445+#else
57446+ return 1;
57447+#endif
57448+}
57449+
57450+int gr_is_capable_nolog(const int cap)
57451+{
57452+#ifdef CONFIG_GRKERNSEC
57453+ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
57454+ return 1;
57455+ return 0;
57456+#else
57457+ return 1;
57458+#endif
57459+}
57460+
57461+EXPORT_SYMBOL(gr_is_capable);
57462+EXPORT_SYMBOL(gr_is_capable_nolog);
57463diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
57464new file mode 100644
57465index 0000000..d3ee748
57466--- /dev/null
57467+++ b/grsecurity/grsec_fifo.c
57468@@ -0,0 +1,24 @@
57469+#include <linux/kernel.h>
57470+#include <linux/sched.h>
57471+#include <linux/fs.h>
57472+#include <linux/file.h>
57473+#include <linux/grinternal.h>
57474+
57475+int
57476+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
57477+ const struct dentry *dir, const int flag, const int acc_mode)
57478+{
57479+#ifdef CONFIG_GRKERNSEC_FIFO
57480+ const struct cred *cred = current_cred();
57481+
57482+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
57483+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
57484+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
57485+ (cred->fsuid != dentry->d_inode->i_uid)) {
57486+ if (!inode_permission(dentry->d_inode, acc_mode))
57487+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
57488+ return -EACCES;
57489+ }
57490+#endif
57491+ return 0;
57492+}
57493diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
57494new file mode 100644
57495index 0000000..8ca18bf
57496--- /dev/null
57497+++ b/grsecurity/grsec_fork.c
57498@@ -0,0 +1,23 @@
57499+#include <linux/kernel.h>
57500+#include <linux/sched.h>
57501+#include <linux/grsecurity.h>
57502+#include <linux/grinternal.h>
57503+#include <linux/errno.h>
57504+
57505+void
57506+gr_log_forkfail(const int retval)
57507+{
57508+#ifdef CONFIG_GRKERNSEC_FORKFAIL
57509+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
57510+ switch (retval) {
57511+ case -EAGAIN:
57512+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
57513+ break;
57514+ case -ENOMEM:
57515+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
57516+ break;
57517+ }
57518+ }
57519+#endif
57520+ return;
57521+}
57522diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
57523new file mode 100644
57524index 0000000..cb8e5a1
57525--- /dev/null
57526+++ b/grsecurity/grsec_init.c
57527@@ -0,0 +1,273 @@
57528+#include <linux/kernel.h>
57529+#include <linux/sched.h>
57530+#include <linux/mm.h>
57531+#include <linux/gracl.h>
57532+#include <linux/slab.h>
57533+#include <linux/vmalloc.h>
57534+#include <linux/percpu.h>
57535+#include <linux/module.h>
57536+
57537+int grsec_enable_setxid;
57538+int grsec_enable_brute;
57539+int grsec_enable_link;
57540+int grsec_enable_dmesg;
57541+int grsec_enable_harden_ptrace;
57542+int grsec_enable_fifo;
57543+int grsec_enable_execlog;
57544+int grsec_enable_signal;
57545+int grsec_enable_forkfail;
57546+int grsec_enable_audit_ptrace;
57547+int grsec_enable_time;
57548+int grsec_enable_audit_textrel;
57549+int grsec_enable_group;
57550+int grsec_audit_gid;
57551+int grsec_enable_chdir;
57552+int grsec_enable_mount;
57553+int grsec_enable_rofs;
57554+int grsec_enable_chroot_findtask;
57555+int grsec_enable_chroot_mount;
57556+int grsec_enable_chroot_shmat;
57557+int grsec_enable_chroot_fchdir;
57558+int grsec_enable_chroot_double;
57559+int grsec_enable_chroot_pivot;
57560+int grsec_enable_chroot_chdir;
57561+int grsec_enable_chroot_chmod;
57562+int grsec_enable_chroot_mknod;
57563+int grsec_enable_chroot_nice;
57564+int grsec_enable_chroot_execlog;
57565+int grsec_enable_chroot_caps;
57566+int grsec_enable_chroot_sysctl;
57567+int grsec_enable_chroot_unix;
57568+int grsec_enable_tpe;
57569+int grsec_tpe_gid;
57570+int grsec_enable_blackhole;
57571+#ifdef CONFIG_IPV6_MODULE
57572+EXPORT_SYMBOL(grsec_enable_blackhole);
57573+#endif
57574+int grsec_lastack_retries;
57575+int grsec_enable_tpe_all;
57576+int grsec_enable_tpe_invert;
57577+int grsec_enable_socket_all;
57578+int grsec_socket_all_gid;
57579+int grsec_enable_socket_client;
57580+int grsec_socket_client_gid;
57581+int grsec_enable_socket_server;
57582+int grsec_socket_server_gid;
57583+int grsec_resource_logging;
57584+int grsec_disable_privio;
57585+int grsec_enable_log_rwxmaps;
57586+int grsec_lock;
57587+
57588+DEFINE_SPINLOCK(grsec_alert_lock);
57589+unsigned long grsec_alert_wtime = 0;
57590+unsigned long grsec_alert_fyet = 0;
57591+
57592+DEFINE_SPINLOCK(grsec_audit_lock);
57593+
57594+DEFINE_RWLOCK(grsec_exec_file_lock);
57595+
57596+char *gr_shared_page[4];
57597+
57598+char *gr_alert_log_fmt;
57599+char *gr_audit_log_fmt;
57600+char *gr_alert_log_buf;
57601+char *gr_audit_log_buf;
57602+
57603+extern struct gr_arg *gr_usermode;
57604+extern unsigned char *gr_system_salt;
57605+extern unsigned char *gr_system_sum;
57606+
57607+void __init
57608+grsecurity_init(void)
57609+{
57610+ int j;
57611+ /* create the per-cpu shared pages */
57612+
57613+#ifdef CONFIG_X86
57614+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
57615+#endif
57616+
57617+ for (j = 0; j < 4; j++) {
57618+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
57619+ if (gr_shared_page[j] == NULL) {
57620+ panic("Unable to allocate grsecurity shared page");
57621+ return;
57622+ }
57623+ }
57624+
57625+ /* allocate log buffers */
57626+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
57627+ if (!gr_alert_log_fmt) {
57628+ panic("Unable to allocate grsecurity alert log format buffer");
57629+ return;
57630+ }
57631+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
57632+ if (!gr_audit_log_fmt) {
57633+ panic("Unable to allocate grsecurity audit log format buffer");
57634+ return;
57635+ }
57636+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57637+ if (!gr_alert_log_buf) {
57638+ panic("Unable to allocate grsecurity alert log buffer");
57639+ return;
57640+ }
57641+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57642+ if (!gr_audit_log_buf) {
57643+ panic("Unable to allocate grsecurity audit log buffer");
57644+ return;
57645+ }
57646+
57647+ /* allocate memory for authentication structure */
57648+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
57649+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
57650+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
57651+
57652+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
57653+ panic("Unable to allocate grsecurity authentication structure");
57654+ return;
57655+ }
57656+
57657+
57658+#ifdef CONFIG_GRKERNSEC_IO
57659+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
57660+ grsec_disable_privio = 1;
57661+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57662+ grsec_disable_privio = 1;
57663+#else
57664+ grsec_disable_privio = 0;
57665+#endif
57666+#endif
57667+
57668+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
57669+ /* for backward compatibility, tpe_invert always defaults to on if
57670+ enabled in the kernel
57671+ */
57672+ grsec_enable_tpe_invert = 1;
57673+#endif
57674+
57675+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57676+#ifndef CONFIG_GRKERNSEC_SYSCTL
57677+ grsec_lock = 1;
57678+#endif
57679+
57680+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
57681+ grsec_enable_audit_textrel = 1;
57682+#endif
57683+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
57684+ grsec_enable_log_rwxmaps = 1;
57685+#endif
57686+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
57687+ grsec_enable_group = 1;
57688+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
57689+#endif
57690+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57691+ grsec_enable_chdir = 1;
57692+#endif
57693+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
57694+ grsec_enable_harden_ptrace = 1;
57695+#endif
57696+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
57697+ grsec_enable_mount = 1;
57698+#endif
57699+#ifdef CONFIG_GRKERNSEC_LINK
57700+ grsec_enable_link = 1;
57701+#endif
57702+#ifdef CONFIG_GRKERNSEC_BRUTE
57703+ grsec_enable_brute = 1;
57704+#endif
57705+#ifdef CONFIG_GRKERNSEC_DMESG
57706+ grsec_enable_dmesg = 1;
57707+#endif
57708+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
57709+ grsec_enable_blackhole = 1;
57710+ grsec_lastack_retries = 4;
57711+#endif
57712+#ifdef CONFIG_GRKERNSEC_FIFO
57713+ grsec_enable_fifo = 1;
57714+#endif
57715+#ifdef CONFIG_GRKERNSEC_EXECLOG
57716+ grsec_enable_execlog = 1;
57717+#endif
57718+#ifdef CONFIG_GRKERNSEC_SETXID
57719+ grsec_enable_setxid = 1;
57720+#endif
57721+#ifdef CONFIG_GRKERNSEC_SIGNAL
57722+ grsec_enable_signal = 1;
57723+#endif
57724+#ifdef CONFIG_GRKERNSEC_FORKFAIL
57725+ grsec_enable_forkfail = 1;
57726+#endif
57727+#ifdef CONFIG_GRKERNSEC_TIME
57728+ grsec_enable_time = 1;
57729+#endif
57730+#ifdef CONFIG_GRKERNSEC_RESLOG
57731+ grsec_resource_logging = 1;
57732+#endif
57733+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57734+ grsec_enable_chroot_findtask = 1;
57735+#endif
57736+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57737+ grsec_enable_chroot_unix = 1;
57738+#endif
57739+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57740+ grsec_enable_chroot_mount = 1;
57741+#endif
57742+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57743+ grsec_enable_chroot_fchdir = 1;
57744+#endif
57745+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57746+ grsec_enable_chroot_shmat = 1;
57747+#endif
57748+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
57749+ grsec_enable_audit_ptrace = 1;
57750+#endif
57751+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57752+ grsec_enable_chroot_double = 1;
57753+#endif
57754+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57755+ grsec_enable_chroot_pivot = 1;
57756+#endif
57757+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57758+ grsec_enable_chroot_chdir = 1;
57759+#endif
57760+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57761+ grsec_enable_chroot_chmod = 1;
57762+#endif
57763+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57764+ grsec_enable_chroot_mknod = 1;
57765+#endif
57766+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57767+ grsec_enable_chroot_nice = 1;
57768+#endif
57769+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57770+ grsec_enable_chroot_execlog = 1;
57771+#endif
57772+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57773+ grsec_enable_chroot_caps = 1;
57774+#endif
57775+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57776+ grsec_enable_chroot_sysctl = 1;
57777+#endif
57778+#ifdef CONFIG_GRKERNSEC_TPE
57779+ grsec_enable_tpe = 1;
57780+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
57781+#ifdef CONFIG_GRKERNSEC_TPE_ALL
57782+ grsec_enable_tpe_all = 1;
57783+#endif
57784+#endif
57785+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
57786+ grsec_enable_socket_all = 1;
57787+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
57788+#endif
57789+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
57790+ grsec_enable_socket_client = 1;
57791+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
57792+#endif
57793+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57794+ grsec_enable_socket_server = 1;
57795+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
57796+#endif
57797+#endif
57798+
57799+ return;
57800+}
57801diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
57802new file mode 100644
57803index 0000000..3efe141
57804--- /dev/null
57805+++ b/grsecurity/grsec_link.c
57806@@ -0,0 +1,43 @@
57807+#include <linux/kernel.h>
57808+#include <linux/sched.h>
57809+#include <linux/fs.h>
57810+#include <linux/file.h>
57811+#include <linux/grinternal.h>
57812+
57813+int
57814+gr_handle_follow_link(const struct inode *parent,
57815+ const struct inode *inode,
57816+ const struct dentry *dentry, const struct vfsmount *mnt)
57817+{
57818+#ifdef CONFIG_GRKERNSEC_LINK
57819+ const struct cred *cred = current_cred();
57820+
57821+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
57822+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
57823+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
57824+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
57825+ return -EACCES;
57826+ }
57827+#endif
57828+ return 0;
57829+}
57830+
57831+int
57832+gr_handle_hardlink(const struct dentry *dentry,
57833+ const struct vfsmount *mnt,
57834+ struct inode *inode, const int mode, const char *to)
57835+{
57836+#ifdef CONFIG_GRKERNSEC_LINK
57837+ const struct cred *cred = current_cred();
57838+
57839+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
57840+ (!S_ISREG(mode) || (mode & S_ISUID) ||
57841+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
57842+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
57843+ !capable(CAP_FOWNER) && cred->uid) {
57844+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
57845+ return -EPERM;
57846+ }
57847+#endif
57848+ return 0;
57849+}
57850diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
57851new file mode 100644
57852index 0000000..a45d2e9
57853--- /dev/null
57854+++ b/grsecurity/grsec_log.c
57855@@ -0,0 +1,322 @@
57856+#include <linux/kernel.h>
57857+#include <linux/sched.h>
57858+#include <linux/file.h>
57859+#include <linux/tty.h>
57860+#include <linux/fs.h>
57861+#include <linux/grinternal.h>
57862+
57863+#ifdef CONFIG_TREE_PREEMPT_RCU
57864+#define DISABLE_PREEMPT() preempt_disable()
57865+#define ENABLE_PREEMPT() preempt_enable()
57866+#else
57867+#define DISABLE_PREEMPT()
57868+#define ENABLE_PREEMPT()
57869+#endif
57870+
57871+#define BEGIN_LOCKS(x) \
57872+ DISABLE_PREEMPT(); \
57873+ rcu_read_lock(); \
57874+ read_lock(&tasklist_lock); \
57875+ read_lock(&grsec_exec_file_lock); \
57876+ if (x != GR_DO_AUDIT) \
57877+ spin_lock(&grsec_alert_lock); \
57878+ else \
57879+ spin_lock(&grsec_audit_lock)
57880+
57881+#define END_LOCKS(x) \
57882+ if (x != GR_DO_AUDIT) \
57883+ spin_unlock(&grsec_alert_lock); \
57884+ else \
57885+ spin_unlock(&grsec_audit_lock); \
57886+ read_unlock(&grsec_exec_file_lock); \
57887+ read_unlock(&tasklist_lock); \
57888+ rcu_read_unlock(); \
57889+ ENABLE_PREEMPT(); \
57890+ if (x == GR_DONT_AUDIT) \
57891+ gr_handle_alertkill(current)
57892+
57893+enum {
57894+ FLOODING,
57895+ NO_FLOODING
57896+};
57897+
57898+extern char *gr_alert_log_fmt;
57899+extern char *gr_audit_log_fmt;
57900+extern char *gr_alert_log_buf;
57901+extern char *gr_audit_log_buf;
57902+
57903+static int gr_log_start(int audit)
57904+{
57905+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
57906+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
57907+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57908+#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
57909+ unsigned long curr_secs = get_seconds();
57910+
57911+ if (audit == GR_DO_AUDIT)
57912+ goto set_fmt;
57913+
57914+ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
57915+ grsec_alert_wtime = curr_secs;
57916+ grsec_alert_fyet = 0;
57917+ } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
57918+ && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
57919+ grsec_alert_fyet++;
57920+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
57921+ grsec_alert_wtime = curr_secs;
57922+ grsec_alert_fyet++;
57923+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
57924+ return FLOODING;
57925+ }
57926+ else return FLOODING;
57927+
57928+set_fmt:
57929+#endif
57930+ memset(buf, 0, PAGE_SIZE);
57931+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
57932+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
57933+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
57934+ } else if (current->signal->curr_ip) {
57935+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
57936+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
57937+ } else if (gr_acl_is_enabled()) {
57938+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
57939+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
57940+ } else {
57941+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
57942+ strcpy(buf, fmt);
57943+ }
57944+
57945+ return NO_FLOODING;
57946+}
57947+
57948+static void gr_log_middle(int audit, const char *msg, va_list ap)
57949+ __attribute__ ((format (printf, 2, 0)));
57950+
57951+static void gr_log_middle(int audit, const char *msg, va_list ap)
57952+{
57953+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57954+ unsigned int len = strlen(buf);
57955+
57956+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
57957+
57958+ return;
57959+}
57960+
57961+static void gr_log_middle_varargs(int audit, const char *msg, ...)
57962+ __attribute__ ((format (printf, 2, 3)));
57963+
57964+static void gr_log_middle_varargs(int audit, const char *msg, ...)
57965+{
57966+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57967+ unsigned int len = strlen(buf);
57968+ va_list ap;
57969+
57970+ va_start(ap, msg);
57971+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
57972+ va_end(ap);
57973+
57974+ return;
57975+}
57976+
57977+static void gr_log_end(int audit, int append_default)
57978+{
57979+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57980+
57981+ if (append_default) {
57982+ unsigned int len = strlen(buf);
57983+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
57984+ }
57985+
57986+ printk("%s\n", buf);
57987+
57988+ return;
57989+}
57990+
57991+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
57992+{
57993+ int logtype;
57994+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
57995+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
57996+ void *voidptr = NULL;
57997+ int num1 = 0, num2 = 0;
57998+ unsigned long ulong1 = 0, ulong2 = 0;
57999+ struct dentry *dentry = NULL;
58000+ struct vfsmount *mnt = NULL;
58001+ struct file *file = NULL;
58002+ struct task_struct *task = NULL;
58003+ const struct cred *cred, *pcred;
58004+ va_list ap;
58005+
58006+ BEGIN_LOCKS(audit);
58007+ logtype = gr_log_start(audit);
58008+ if (logtype == FLOODING) {
58009+ END_LOCKS(audit);
58010+ return;
58011+ }
58012+ va_start(ap, argtypes);
58013+ switch (argtypes) {
58014+ case GR_TTYSNIFF:
58015+ task = va_arg(ap, struct task_struct *);
58016+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58017+ break;
58018+ case GR_SYSCTL_HIDDEN:
58019+ str1 = va_arg(ap, char *);
58020+ gr_log_middle_varargs(audit, msg, result, str1);
58021+ break;
58022+ case GR_RBAC:
58023+ dentry = va_arg(ap, struct dentry *);
58024+ mnt = va_arg(ap, struct vfsmount *);
58025+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58026+ break;
58027+ case GR_RBAC_STR:
58028+ dentry = va_arg(ap, struct dentry *);
58029+ mnt = va_arg(ap, struct vfsmount *);
58030+ str1 = va_arg(ap, char *);
58031+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58032+ break;
58033+ case GR_STR_RBAC:
58034+ str1 = va_arg(ap, char *);
58035+ dentry = va_arg(ap, struct dentry *);
58036+ mnt = va_arg(ap, struct vfsmount *);
58037+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58038+ break;
58039+ case GR_RBAC_MODE2:
58040+ dentry = va_arg(ap, struct dentry *);
58041+ mnt = va_arg(ap, struct vfsmount *);
58042+ str1 = va_arg(ap, char *);
58043+ str2 = va_arg(ap, char *);
58044+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58045+ break;
58046+ case GR_RBAC_MODE3:
58047+ dentry = va_arg(ap, struct dentry *);
58048+ mnt = va_arg(ap, struct vfsmount *);
58049+ str1 = va_arg(ap, char *);
58050+ str2 = va_arg(ap, char *);
58051+ str3 = va_arg(ap, char *);
58052+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58053+ break;
58054+ case GR_FILENAME:
58055+ dentry = va_arg(ap, struct dentry *);
58056+ mnt = va_arg(ap, struct vfsmount *);
58057+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58058+ break;
58059+ case GR_STR_FILENAME:
58060+ str1 = va_arg(ap, char *);
58061+ dentry = va_arg(ap, struct dentry *);
58062+ mnt = va_arg(ap, struct vfsmount *);
58063+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58064+ break;
58065+ case GR_FILENAME_STR:
58066+ dentry = va_arg(ap, struct dentry *);
58067+ mnt = va_arg(ap, struct vfsmount *);
58068+ str1 = va_arg(ap, char *);
58069+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58070+ break;
58071+ case GR_FILENAME_TWO_INT:
58072+ dentry = va_arg(ap, struct dentry *);
58073+ mnt = va_arg(ap, struct vfsmount *);
58074+ num1 = va_arg(ap, int);
58075+ num2 = va_arg(ap, int);
58076+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58077+ break;
58078+ case GR_FILENAME_TWO_INT_STR:
58079+ dentry = va_arg(ap, struct dentry *);
58080+ mnt = va_arg(ap, struct vfsmount *);
58081+ num1 = va_arg(ap, int);
58082+ num2 = va_arg(ap, int);
58083+ str1 = va_arg(ap, char *);
58084+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58085+ break;
58086+ case GR_TEXTREL:
58087+ file = va_arg(ap, struct file *);
58088+ ulong1 = va_arg(ap, unsigned long);
58089+ ulong2 = va_arg(ap, unsigned long);
58090+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58091+ break;
58092+ case GR_PTRACE:
58093+ task = va_arg(ap, struct task_struct *);
58094+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58095+ break;
58096+ case GR_RESOURCE:
58097+ task = va_arg(ap, struct task_struct *);
58098+ cred = __task_cred(task);
58099+ pcred = __task_cred(task->real_parent);
58100+ ulong1 = va_arg(ap, unsigned long);
58101+ str1 = va_arg(ap, char *);
58102+ ulong2 = va_arg(ap, unsigned long);
58103+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58104+ break;
58105+ case GR_CAP:
58106+ task = va_arg(ap, struct task_struct *);
58107+ cred = __task_cred(task);
58108+ pcred = __task_cred(task->real_parent);
58109+ str1 = va_arg(ap, char *);
58110+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58111+ break;
58112+ case GR_SIG:
58113+ str1 = va_arg(ap, char *);
58114+ voidptr = va_arg(ap, void *);
58115+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58116+ break;
58117+ case GR_SIG2:
58118+ task = va_arg(ap, struct task_struct *);
58119+ cred = __task_cred(task);
58120+ pcred = __task_cred(task->real_parent);
58121+ num1 = va_arg(ap, int);
58122+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58123+ break;
58124+ case GR_CRASH1:
58125+ task = va_arg(ap, struct task_struct *);
58126+ cred = __task_cred(task);
58127+ pcred = __task_cred(task->real_parent);
58128+ ulong1 = va_arg(ap, unsigned long);
58129+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58130+ break;
58131+ case GR_CRASH2:
58132+ task = va_arg(ap, struct task_struct *);
58133+ cred = __task_cred(task);
58134+ pcred = __task_cred(task->real_parent);
58135+ ulong1 = va_arg(ap, unsigned long);
58136+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58137+ break;
58138+ case GR_RWXMAP:
58139+ file = va_arg(ap, struct file *);
58140+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58141+ break;
58142+ case GR_PSACCT:
58143+ {
58144+ unsigned int wday, cday;
58145+ __u8 whr, chr;
58146+ __u8 wmin, cmin;
58147+ __u8 wsec, csec;
58148+ char cur_tty[64] = { 0 };
58149+ char parent_tty[64] = { 0 };
58150+
58151+ task = va_arg(ap, struct task_struct *);
58152+ wday = va_arg(ap, unsigned int);
58153+ cday = va_arg(ap, unsigned int);
58154+ whr = va_arg(ap, int);
58155+ chr = va_arg(ap, int);
58156+ wmin = va_arg(ap, int);
58157+ cmin = va_arg(ap, int);
58158+ wsec = va_arg(ap, int);
58159+ csec = va_arg(ap, int);
58160+ ulong1 = va_arg(ap, unsigned long);
58161+ cred = __task_cred(task);
58162+ pcred = __task_cred(task->real_parent);
58163+
58164+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58165+ }
58166+ break;
58167+ default:
58168+ gr_log_middle(audit, msg, ap);
58169+ }
58170+ va_end(ap);
58171+ // these don't need DEFAULTSECARGS printed on the end
58172+ if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
58173+ gr_log_end(audit, 0);
58174+ else
58175+ gr_log_end(audit, 1);
58176+ END_LOCKS(audit);
58177+}
58178diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
58179new file mode 100644
58180index 0000000..6c0416b
58181--- /dev/null
58182+++ b/grsecurity/grsec_mem.c
58183@@ -0,0 +1,33 @@
58184+#include <linux/kernel.h>
58185+#include <linux/sched.h>
58186+#include <linux/mm.h>
58187+#include <linux/mman.h>
58188+#include <linux/grinternal.h>
58189+
58190+void
58191+gr_handle_ioperm(void)
58192+{
58193+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58194+ return;
58195+}
58196+
58197+void
58198+gr_handle_iopl(void)
58199+{
58200+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58201+ return;
58202+}
58203+
58204+void
58205+gr_handle_mem_readwrite(u64 from, u64 to)
58206+{
58207+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58208+ return;
58209+}
58210+
58211+void
58212+gr_handle_vm86(void)
58213+{
58214+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58215+ return;
58216+}
58217diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
58218new file mode 100644
58219index 0000000..2131422
58220--- /dev/null
58221+++ b/grsecurity/grsec_mount.c
58222@@ -0,0 +1,62 @@
58223+#include <linux/kernel.h>
58224+#include <linux/sched.h>
58225+#include <linux/mount.h>
58226+#include <linux/grsecurity.h>
58227+#include <linux/grinternal.h>
58228+
58229+void
58230+gr_log_remount(const char *devname, const int retval)
58231+{
58232+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58233+ if (grsec_enable_mount && (retval >= 0))
58234+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58235+#endif
58236+ return;
58237+}
58238+
58239+void
58240+gr_log_unmount(const char *devname, const int retval)
58241+{
58242+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58243+ if (grsec_enable_mount && (retval >= 0))
58244+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58245+#endif
58246+ return;
58247+}
58248+
58249+void
58250+gr_log_mount(const char *from, const char *to, const int retval)
58251+{
58252+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58253+ if (grsec_enable_mount && (retval >= 0))
58254+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
58255+#endif
58256+ return;
58257+}
58258+
58259+int
58260+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58261+{
58262+#ifdef CONFIG_GRKERNSEC_ROFS
58263+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58264+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58265+ return -EPERM;
58266+ } else
58267+ return 0;
58268+#endif
58269+ return 0;
58270+}
58271+
58272+int
58273+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58274+{
58275+#ifdef CONFIG_GRKERNSEC_ROFS
58276+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58277+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58278+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58279+ return -EPERM;
58280+ } else
58281+ return 0;
58282+#endif
58283+ return 0;
58284+}
58285diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
58286new file mode 100644
58287index 0000000..a3b12a0
58288--- /dev/null
58289+++ b/grsecurity/grsec_pax.c
58290@@ -0,0 +1,36 @@
58291+#include <linux/kernel.h>
58292+#include <linux/sched.h>
58293+#include <linux/mm.h>
58294+#include <linux/file.h>
58295+#include <linux/grinternal.h>
58296+#include <linux/grsecurity.h>
58297+
58298+void
58299+gr_log_textrel(struct vm_area_struct * vma)
58300+{
58301+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58302+ if (grsec_enable_audit_textrel)
58303+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58304+#endif
58305+ return;
58306+}
58307+
58308+void
58309+gr_log_rwxmmap(struct file *file)
58310+{
58311+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58312+ if (grsec_enable_log_rwxmaps)
58313+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58314+#endif
58315+ return;
58316+}
58317+
58318+void
58319+gr_log_rwxmprotect(struct file *file)
58320+{
58321+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58322+ if (grsec_enable_log_rwxmaps)
58323+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58324+#endif
58325+ return;
58326+}
58327diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
58328new file mode 100644
58329index 0000000..472c1d6
58330--- /dev/null
58331+++ b/grsecurity/grsec_ptrace.c
58332@@ -0,0 +1,14 @@
58333+#include <linux/kernel.h>
58334+#include <linux/sched.h>
58335+#include <linux/grinternal.h>
58336+#include <linux/grsecurity.h>
58337+
58338+void
58339+gr_audit_ptrace(struct task_struct *task)
58340+{
58341+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58342+ if (grsec_enable_audit_ptrace)
58343+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58344+#endif
58345+ return;
58346+}
58347diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
58348new file mode 100644
58349index 0000000..cf090b3
58350--- /dev/null
58351+++ b/grsecurity/grsec_sig.c
58352@@ -0,0 +1,206 @@
58353+#include <linux/kernel.h>
58354+#include <linux/sched.h>
58355+#include <linux/delay.h>
58356+#include <linux/grsecurity.h>
58357+#include <linux/grinternal.h>
58358+#include <linux/hardirq.h>
58359+
58360+char *signames[] = {
58361+ [SIGSEGV] = "Segmentation fault",
58362+ [SIGILL] = "Illegal instruction",
58363+ [SIGABRT] = "Abort",
58364+ [SIGBUS] = "Invalid alignment/Bus error"
58365+};
58366+
58367+void
58368+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58369+{
58370+#ifdef CONFIG_GRKERNSEC_SIGNAL
58371+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58372+ (sig == SIGABRT) || (sig == SIGBUS))) {
58373+ if (t->pid == current->pid) {
58374+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58375+ } else {
58376+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58377+ }
58378+ }
58379+#endif
58380+ return;
58381+}
58382+
58383+int
58384+gr_handle_signal(const struct task_struct *p, const int sig)
58385+{
58386+#ifdef CONFIG_GRKERNSEC
58387+ if (current->pid > 1 && gr_check_protected_task(p)) {
58388+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58389+ return -EPERM;
58390+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58391+ return -EPERM;
58392+ }
58393+#endif
58394+ return 0;
58395+}
58396+
58397+#ifdef CONFIG_GRKERNSEC
58398+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58399+
58400+int gr_fake_force_sig(int sig, struct task_struct *t)
58401+{
58402+ unsigned long int flags;
58403+ int ret, blocked, ignored;
58404+ struct k_sigaction *action;
58405+
58406+ spin_lock_irqsave(&t->sighand->siglock, flags);
58407+ action = &t->sighand->action[sig-1];
58408+ ignored = action->sa.sa_handler == SIG_IGN;
58409+ blocked = sigismember(&t->blocked, sig);
58410+ if (blocked || ignored) {
58411+ action->sa.sa_handler = SIG_DFL;
58412+ if (blocked) {
58413+ sigdelset(&t->blocked, sig);
58414+ recalc_sigpending_and_wake(t);
58415+ }
58416+ }
58417+ if (action->sa.sa_handler == SIG_DFL)
58418+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
58419+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58420+
58421+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
58422+
58423+ return ret;
58424+}
58425+#endif
58426+
58427+#ifdef CONFIG_GRKERNSEC_BRUTE
58428+#define GR_USER_BAN_TIME (15 * 60)
58429+
58430+static int __get_dumpable(unsigned long mm_flags)
58431+{
58432+ int ret;
58433+
58434+ ret = mm_flags & MMF_DUMPABLE_MASK;
58435+ return (ret >= 2) ? 2 : ret;
58436+}
58437+#endif
58438+
58439+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58440+{
58441+#ifdef CONFIG_GRKERNSEC_BRUTE
58442+ uid_t uid = 0;
58443+
58444+ if (!grsec_enable_brute)
58445+ return;
58446+
58447+ rcu_read_lock();
58448+ read_lock(&tasklist_lock);
58449+ read_lock(&grsec_exec_file_lock);
58450+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58451+ p->real_parent->brute = 1;
58452+ else {
58453+ const struct cred *cred = __task_cred(p), *cred2;
58454+ struct task_struct *tsk, *tsk2;
58455+
58456+ if (!__get_dumpable(mm_flags) && cred->uid) {
58457+ struct user_struct *user;
58458+
58459+ uid = cred->uid;
58460+
58461+ /* this is put upon execution past expiration */
58462+ user = find_user(uid);
58463+ if (user == NULL)
58464+ goto unlock;
58465+ user->banned = 1;
58466+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
58467+ if (user->ban_expires == ~0UL)
58468+ user->ban_expires--;
58469+
58470+ do_each_thread(tsk2, tsk) {
58471+ cred2 = __task_cred(tsk);
58472+ if (tsk != p && cred2->uid == uid)
58473+ gr_fake_force_sig(SIGKILL, tsk);
58474+ } while_each_thread(tsk2, tsk);
58475+ }
58476+ }
58477+unlock:
58478+ read_unlock(&grsec_exec_file_lock);
58479+ read_unlock(&tasklist_lock);
58480+ rcu_read_unlock();
58481+
58482+ if (uid)
58483+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
58484+
58485+#endif
58486+ return;
58487+}
58488+
58489+void gr_handle_brute_check(void)
58490+{
58491+#ifdef CONFIG_GRKERNSEC_BRUTE
58492+ if (current->brute)
58493+ msleep(30 * 1000);
58494+#endif
58495+ return;
58496+}
58497+
58498+void gr_handle_kernel_exploit(void)
58499+{
58500+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
58501+ const struct cred *cred;
58502+ struct task_struct *tsk, *tsk2;
58503+ struct user_struct *user;
58504+ uid_t uid;
58505+
58506+ if (in_irq() || in_serving_softirq() || in_nmi())
58507+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
58508+
58509+ uid = current_uid();
58510+
58511+ if (uid == 0)
58512+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
58513+ else {
58514+ /* kill all the processes of this user, hold a reference
58515+ to their creds struct, and prevent them from creating
58516+ another process until system reset
58517+ */
58518+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
58519+ /* we intentionally leak this ref */
58520+ user = get_uid(current->cred->user);
58521+ if (user) {
58522+ user->banned = 1;
58523+ user->ban_expires = ~0UL;
58524+ }
58525+
58526+ read_lock(&tasklist_lock);
58527+ do_each_thread(tsk2, tsk) {
58528+ cred = __task_cred(tsk);
58529+ if (cred->uid == uid)
58530+ gr_fake_force_sig(SIGKILL, tsk);
58531+ } while_each_thread(tsk2, tsk);
58532+ read_unlock(&tasklist_lock);
58533+ }
58534+#endif
58535+}
58536+
58537+int __gr_process_user_ban(struct user_struct *user)
58538+{
58539+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58540+ if (unlikely(user->banned)) {
58541+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
58542+ user->banned = 0;
58543+ user->ban_expires = 0;
58544+ free_uid(user);
58545+ } else
58546+ return -EPERM;
58547+ }
58548+#endif
58549+ return 0;
58550+}
58551+
58552+int gr_process_user_ban(void)
58553+{
58554+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58555+ return __gr_process_user_ban(current->cred->user);
58556+#endif
58557+ return 0;
58558+}
58559diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
58560new file mode 100644
58561index 0000000..4030d57
58562--- /dev/null
58563+++ b/grsecurity/grsec_sock.c
58564@@ -0,0 +1,244 @@
58565+#include <linux/kernel.h>
58566+#include <linux/module.h>
58567+#include <linux/sched.h>
58568+#include <linux/file.h>
58569+#include <linux/net.h>
58570+#include <linux/in.h>
58571+#include <linux/ip.h>
58572+#include <net/sock.h>
58573+#include <net/inet_sock.h>
58574+#include <linux/grsecurity.h>
58575+#include <linux/grinternal.h>
58576+#include <linux/gracl.h>
58577+
58578+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
58579+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
58580+
58581+EXPORT_SYMBOL(gr_search_udp_recvmsg);
58582+EXPORT_SYMBOL(gr_search_udp_sendmsg);
58583+
58584+#ifdef CONFIG_UNIX_MODULE
58585+EXPORT_SYMBOL(gr_acl_handle_unix);
58586+EXPORT_SYMBOL(gr_acl_handle_mknod);
58587+EXPORT_SYMBOL(gr_handle_chroot_unix);
58588+EXPORT_SYMBOL(gr_handle_create);
58589+#endif
58590+
58591+#ifdef CONFIG_GRKERNSEC
58592+#define gr_conn_table_size 32749
58593+struct conn_table_entry {
58594+ struct conn_table_entry *next;
58595+ struct signal_struct *sig;
58596+};
58597+
58598+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
58599+DEFINE_SPINLOCK(gr_conn_table_lock);
58600+
58601+extern const char * gr_socktype_to_name(unsigned char type);
58602+extern const char * gr_proto_to_name(unsigned char proto);
58603+extern const char * gr_sockfamily_to_name(unsigned char family);
58604+
58605+static __inline__ int
58606+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
58607+{
58608+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
58609+}
58610+
58611+static __inline__ int
58612+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
58613+ __u16 sport, __u16 dport)
58614+{
58615+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
58616+ sig->gr_sport == sport && sig->gr_dport == dport))
58617+ return 1;
58618+ else
58619+ return 0;
58620+}
58621+
58622+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
58623+{
58624+ struct conn_table_entry **match;
58625+ unsigned int index;
58626+
58627+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58628+ sig->gr_sport, sig->gr_dport,
58629+ gr_conn_table_size);
58630+
58631+ newent->sig = sig;
58632+
58633+ match = &gr_conn_table[index];
58634+ newent->next = *match;
58635+ *match = newent;
58636+
58637+ return;
58638+}
58639+
58640+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
58641+{
58642+ struct conn_table_entry *match, *last = NULL;
58643+ unsigned int index;
58644+
58645+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58646+ sig->gr_sport, sig->gr_dport,
58647+ gr_conn_table_size);
58648+
58649+ match = gr_conn_table[index];
58650+ while (match && !conn_match(match->sig,
58651+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
58652+ sig->gr_dport)) {
58653+ last = match;
58654+ match = match->next;
58655+ }
58656+
58657+ if (match) {
58658+ if (last)
58659+ last->next = match->next;
58660+ else
58661+ gr_conn_table[index] = NULL;
58662+ kfree(match);
58663+ }
58664+
58665+ return;
58666+}
58667+
58668+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
58669+ __u16 sport, __u16 dport)
58670+{
58671+ struct conn_table_entry *match;
58672+ unsigned int index;
58673+
58674+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
58675+
58676+ match = gr_conn_table[index];
58677+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
58678+ match = match->next;
58679+
58680+ if (match)
58681+ return match->sig;
58682+ else
58683+ return NULL;
58684+}
58685+
58686+#endif
58687+
58688+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
58689+{
58690+#ifdef CONFIG_GRKERNSEC
58691+ struct signal_struct *sig = task->signal;
58692+ struct conn_table_entry *newent;
58693+
58694+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
58695+ if (newent == NULL)
58696+ return;
58697+ /* no bh lock needed since we are called with bh disabled */
58698+ spin_lock(&gr_conn_table_lock);
58699+ gr_del_task_from_ip_table_nolock(sig);
58700+ sig->gr_saddr = inet->inet_rcv_saddr;
58701+ sig->gr_daddr = inet->inet_daddr;
58702+ sig->gr_sport = inet->inet_sport;
58703+ sig->gr_dport = inet->inet_dport;
58704+ gr_add_to_task_ip_table_nolock(sig, newent);
58705+ spin_unlock(&gr_conn_table_lock);
58706+#endif
58707+ return;
58708+}
58709+
58710+void gr_del_task_from_ip_table(struct task_struct *task)
58711+{
58712+#ifdef CONFIG_GRKERNSEC
58713+ spin_lock_bh(&gr_conn_table_lock);
58714+ gr_del_task_from_ip_table_nolock(task->signal);
58715+ spin_unlock_bh(&gr_conn_table_lock);
58716+#endif
58717+ return;
58718+}
58719+
58720+void
58721+gr_attach_curr_ip(const struct sock *sk)
58722+{
58723+#ifdef CONFIG_GRKERNSEC
58724+ struct signal_struct *p, *set;
58725+ const struct inet_sock *inet = inet_sk(sk);
58726+
58727+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
58728+ return;
58729+
58730+ set = current->signal;
58731+
58732+ spin_lock_bh(&gr_conn_table_lock);
58733+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
58734+ inet->inet_dport, inet->inet_sport);
58735+ if (unlikely(p != NULL)) {
58736+ set->curr_ip = p->curr_ip;
58737+ set->used_accept = 1;
58738+ gr_del_task_from_ip_table_nolock(p);
58739+ spin_unlock_bh(&gr_conn_table_lock);
58740+ return;
58741+ }
58742+ spin_unlock_bh(&gr_conn_table_lock);
58743+
58744+ set->curr_ip = inet->inet_daddr;
58745+ set->used_accept = 1;
58746+#endif
58747+ return;
58748+}
58749+
58750+int
58751+gr_handle_sock_all(const int family, const int type, const int protocol)
58752+{
58753+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58754+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
58755+ (family != AF_UNIX)) {
58756+ if (family == AF_INET)
58757+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
58758+ else
58759+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
58760+ return -EACCES;
58761+ }
58762+#endif
58763+ return 0;
58764+}
58765+
58766+int
58767+gr_handle_sock_server(const struct sockaddr *sck)
58768+{
58769+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58770+ if (grsec_enable_socket_server &&
58771+ in_group_p(grsec_socket_server_gid) &&
58772+ sck && (sck->sa_family != AF_UNIX) &&
58773+ (sck->sa_family != AF_LOCAL)) {
58774+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58775+ return -EACCES;
58776+ }
58777+#endif
58778+ return 0;
58779+}
58780+
58781+int
58782+gr_handle_sock_server_other(const struct sock *sck)
58783+{
58784+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58785+ if (grsec_enable_socket_server &&
58786+ in_group_p(grsec_socket_server_gid) &&
58787+ sck && (sck->sk_family != AF_UNIX) &&
58788+ (sck->sk_family != AF_LOCAL)) {
58789+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58790+ return -EACCES;
58791+ }
58792+#endif
58793+ return 0;
58794+}
58795+
58796+int
58797+gr_handle_sock_client(const struct sockaddr *sck)
58798+{
58799+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58800+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
58801+ sck && (sck->sa_family != AF_UNIX) &&
58802+ (sck->sa_family != AF_LOCAL)) {
58803+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
58804+ return -EACCES;
58805+ }
58806+#endif
58807+ return 0;
58808+}
58809diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
58810new file mode 100644
58811index 0000000..bceef2f
58812--- /dev/null
58813+++ b/grsecurity/grsec_sysctl.c
58814@@ -0,0 +1,442 @@
58815+#include <linux/kernel.h>
58816+#include <linux/sched.h>
58817+#include <linux/sysctl.h>
58818+#include <linux/grsecurity.h>
58819+#include <linux/grinternal.h>
58820+
58821+int
58822+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
58823+{
58824+#ifdef CONFIG_GRKERNSEC_SYSCTL
58825+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
58826+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
58827+ return -EACCES;
58828+ }
58829+#endif
58830+ return 0;
58831+}
58832+
58833+#ifdef CONFIG_GRKERNSEC_ROFS
58834+static int __maybe_unused one = 1;
58835+#endif
58836+
58837+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
58838+struct ctl_table grsecurity_table[] = {
58839+#ifdef CONFIG_GRKERNSEC_SYSCTL
58840+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
58841+#ifdef CONFIG_GRKERNSEC_IO
58842+ {
58843+ .procname = "disable_priv_io",
58844+ .data = &grsec_disable_privio,
58845+ .maxlen = sizeof(int),
58846+ .mode = 0600,
58847+ .proc_handler = &proc_dointvec,
58848+ },
58849+#endif
58850+#endif
58851+#ifdef CONFIG_GRKERNSEC_LINK
58852+ {
58853+ .procname = "linking_restrictions",
58854+ .data = &grsec_enable_link,
58855+ .maxlen = sizeof(int),
58856+ .mode = 0600,
58857+ .proc_handler = &proc_dointvec,
58858+ },
58859+#endif
58860+#ifdef CONFIG_GRKERNSEC_BRUTE
58861+ {
58862+ .procname = "deter_bruteforce",
58863+ .data = &grsec_enable_brute,
58864+ .maxlen = sizeof(int),
58865+ .mode = 0600,
58866+ .proc_handler = &proc_dointvec,
58867+ },
58868+#endif
58869+#ifdef CONFIG_GRKERNSEC_FIFO
58870+ {
58871+ .procname = "fifo_restrictions",
58872+ .data = &grsec_enable_fifo,
58873+ .maxlen = sizeof(int),
58874+ .mode = 0600,
58875+ .proc_handler = &proc_dointvec,
58876+ },
58877+#endif
58878+#ifdef CONFIG_GRKERNSEC_SETXID
58879+ {
58880+ .procname = "consistent_setxid",
58881+ .data = &grsec_enable_setxid,
58882+ .maxlen = sizeof(int),
58883+ .mode = 0600,
58884+ .proc_handler = &proc_dointvec,
58885+ },
58886+#endif
58887+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58888+ {
58889+ .procname = "ip_blackhole",
58890+ .data = &grsec_enable_blackhole,
58891+ .maxlen = sizeof(int),
58892+ .mode = 0600,
58893+ .proc_handler = &proc_dointvec,
58894+ },
58895+ {
58896+ .procname = "lastack_retries",
58897+ .data = &grsec_lastack_retries,
58898+ .maxlen = sizeof(int),
58899+ .mode = 0600,
58900+ .proc_handler = &proc_dointvec,
58901+ },
58902+#endif
58903+#ifdef CONFIG_GRKERNSEC_EXECLOG
58904+ {
58905+ .procname = "exec_logging",
58906+ .data = &grsec_enable_execlog,
58907+ .maxlen = sizeof(int),
58908+ .mode = 0600,
58909+ .proc_handler = &proc_dointvec,
58910+ },
58911+#endif
58912+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58913+ {
58914+ .procname = "rwxmap_logging",
58915+ .data = &grsec_enable_log_rwxmaps,
58916+ .maxlen = sizeof(int),
58917+ .mode = 0600,
58918+ .proc_handler = &proc_dointvec,
58919+ },
58920+#endif
58921+#ifdef CONFIG_GRKERNSEC_SIGNAL
58922+ {
58923+ .procname = "signal_logging",
58924+ .data = &grsec_enable_signal,
58925+ .maxlen = sizeof(int),
58926+ .mode = 0600,
58927+ .proc_handler = &proc_dointvec,
58928+ },
58929+#endif
58930+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58931+ {
58932+ .procname = "forkfail_logging",
58933+ .data = &grsec_enable_forkfail,
58934+ .maxlen = sizeof(int),
58935+ .mode = 0600,
58936+ .proc_handler = &proc_dointvec,
58937+ },
58938+#endif
58939+#ifdef CONFIG_GRKERNSEC_TIME
58940+ {
58941+ .procname = "timechange_logging",
58942+ .data = &grsec_enable_time,
58943+ .maxlen = sizeof(int),
58944+ .mode = 0600,
58945+ .proc_handler = &proc_dointvec,
58946+ },
58947+#endif
58948+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58949+ {
58950+ .procname = "chroot_deny_shmat",
58951+ .data = &grsec_enable_chroot_shmat,
58952+ .maxlen = sizeof(int),
58953+ .mode = 0600,
58954+ .proc_handler = &proc_dointvec,
58955+ },
58956+#endif
58957+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58958+ {
58959+ .procname = "chroot_deny_unix",
58960+ .data = &grsec_enable_chroot_unix,
58961+ .maxlen = sizeof(int),
58962+ .mode = 0600,
58963+ .proc_handler = &proc_dointvec,
58964+ },
58965+#endif
58966+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58967+ {
58968+ .procname = "chroot_deny_mount",
58969+ .data = &grsec_enable_chroot_mount,
58970+ .maxlen = sizeof(int),
58971+ .mode = 0600,
58972+ .proc_handler = &proc_dointvec,
58973+ },
58974+#endif
58975+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58976+ {
58977+ .procname = "chroot_deny_fchdir",
58978+ .data = &grsec_enable_chroot_fchdir,
58979+ .maxlen = sizeof(int),
58980+ .mode = 0600,
58981+ .proc_handler = &proc_dointvec,
58982+ },
58983+#endif
58984+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58985+ {
58986+ .procname = "chroot_deny_chroot",
58987+ .data = &grsec_enable_chroot_double,
58988+ .maxlen = sizeof(int),
58989+ .mode = 0600,
58990+ .proc_handler = &proc_dointvec,
58991+ },
58992+#endif
58993+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58994+ {
58995+ .procname = "chroot_deny_pivot",
58996+ .data = &grsec_enable_chroot_pivot,
58997+ .maxlen = sizeof(int),
58998+ .mode = 0600,
58999+ .proc_handler = &proc_dointvec,
59000+ },
59001+#endif
59002+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59003+ {
59004+ .procname = "chroot_enforce_chdir",
59005+ .data = &grsec_enable_chroot_chdir,
59006+ .maxlen = sizeof(int),
59007+ .mode = 0600,
59008+ .proc_handler = &proc_dointvec,
59009+ },
59010+#endif
59011+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59012+ {
59013+ .procname = "chroot_deny_chmod",
59014+ .data = &grsec_enable_chroot_chmod,
59015+ .maxlen = sizeof(int),
59016+ .mode = 0600,
59017+ .proc_handler = &proc_dointvec,
59018+ },
59019+#endif
59020+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59021+ {
59022+ .procname = "chroot_deny_mknod",
59023+ .data = &grsec_enable_chroot_mknod,
59024+ .maxlen = sizeof(int),
59025+ .mode = 0600,
59026+ .proc_handler = &proc_dointvec,
59027+ },
59028+#endif
59029+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59030+ {
59031+ .procname = "chroot_restrict_nice",
59032+ .data = &grsec_enable_chroot_nice,
59033+ .maxlen = sizeof(int),
59034+ .mode = 0600,
59035+ .proc_handler = &proc_dointvec,
59036+ },
59037+#endif
59038+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59039+ {
59040+ .procname = "chroot_execlog",
59041+ .data = &grsec_enable_chroot_execlog,
59042+ .maxlen = sizeof(int),
59043+ .mode = 0600,
59044+ .proc_handler = &proc_dointvec,
59045+ },
59046+#endif
59047+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59048+ {
59049+ .procname = "chroot_caps",
59050+ .data = &grsec_enable_chroot_caps,
59051+ .maxlen = sizeof(int),
59052+ .mode = 0600,
59053+ .proc_handler = &proc_dointvec,
59054+ },
59055+#endif
59056+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59057+ {
59058+ .procname = "chroot_deny_sysctl",
59059+ .data = &grsec_enable_chroot_sysctl,
59060+ .maxlen = sizeof(int),
59061+ .mode = 0600,
59062+ .proc_handler = &proc_dointvec,
59063+ },
59064+#endif
59065+#ifdef CONFIG_GRKERNSEC_TPE
59066+ {
59067+ .procname = "tpe",
59068+ .data = &grsec_enable_tpe,
59069+ .maxlen = sizeof(int),
59070+ .mode = 0600,
59071+ .proc_handler = &proc_dointvec,
59072+ },
59073+ {
59074+ .procname = "tpe_gid",
59075+ .data = &grsec_tpe_gid,
59076+ .maxlen = sizeof(int),
59077+ .mode = 0600,
59078+ .proc_handler = &proc_dointvec,
59079+ },
59080+#endif
59081+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59082+ {
59083+ .procname = "tpe_invert",
59084+ .data = &grsec_enable_tpe_invert,
59085+ .maxlen = sizeof(int),
59086+ .mode = 0600,
59087+ .proc_handler = &proc_dointvec,
59088+ },
59089+#endif
59090+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59091+ {
59092+ .procname = "tpe_restrict_all",
59093+ .data = &grsec_enable_tpe_all,
59094+ .maxlen = sizeof(int),
59095+ .mode = 0600,
59096+ .proc_handler = &proc_dointvec,
59097+ },
59098+#endif
59099+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59100+ {
59101+ .procname = "socket_all",
59102+ .data = &grsec_enable_socket_all,
59103+ .maxlen = sizeof(int),
59104+ .mode = 0600,
59105+ .proc_handler = &proc_dointvec,
59106+ },
59107+ {
59108+ .procname = "socket_all_gid",
59109+ .data = &grsec_socket_all_gid,
59110+ .maxlen = sizeof(int),
59111+ .mode = 0600,
59112+ .proc_handler = &proc_dointvec,
59113+ },
59114+#endif
59115+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59116+ {
59117+ .procname = "socket_client",
59118+ .data = &grsec_enable_socket_client,
59119+ .maxlen = sizeof(int),
59120+ .mode = 0600,
59121+ .proc_handler = &proc_dointvec,
59122+ },
59123+ {
59124+ .procname = "socket_client_gid",
59125+ .data = &grsec_socket_client_gid,
59126+ .maxlen = sizeof(int),
59127+ .mode = 0600,
59128+ .proc_handler = &proc_dointvec,
59129+ },
59130+#endif
59131+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59132+ {
59133+ .procname = "socket_server",
59134+ .data = &grsec_enable_socket_server,
59135+ .maxlen = sizeof(int),
59136+ .mode = 0600,
59137+ .proc_handler = &proc_dointvec,
59138+ },
59139+ {
59140+ .procname = "socket_server_gid",
59141+ .data = &grsec_socket_server_gid,
59142+ .maxlen = sizeof(int),
59143+ .mode = 0600,
59144+ .proc_handler = &proc_dointvec,
59145+ },
59146+#endif
59147+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59148+ {
59149+ .procname = "audit_group",
59150+ .data = &grsec_enable_group,
59151+ .maxlen = sizeof(int),
59152+ .mode = 0600,
59153+ .proc_handler = &proc_dointvec,
59154+ },
59155+ {
59156+ .procname = "audit_gid",
59157+ .data = &grsec_audit_gid,
59158+ .maxlen = sizeof(int),
59159+ .mode = 0600,
59160+ .proc_handler = &proc_dointvec,
59161+ },
59162+#endif
59163+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59164+ {
59165+ .procname = "audit_chdir",
59166+ .data = &grsec_enable_chdir,
59167+ .maxlen = sizeof(int),
59168+ .mode = 0600,
59169+ .proc_handler = &proc_dointvec,
59170+ },
59171+#endif
59172+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59173+ {
59174+ .procname = "audit_mount",
59175+ .data = &grsec_enable_mount,
59176+ .maxlen = sizeof(int),
59177+ .mode = 0600,
59178+ .proc_handler = &proc_dointvec,
59179+ },
59180+#endif
59181+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59182+ {
59183+ .procname = "audit_textrel",
59184+ .data = &grsec_enable_audit_textrel,
59185+ .maxlen = sizeof(int),
59186+ .mode = 0600,
59187+ .proc_handler = &proc_dointvec,
59188+ },
59189+#endif
59190+#ifdef CONFIG_GRKERNSEC_DMESG
59191+ {
59192+ .procname = "dmesg",
59193+ .data = &grsec_enable_dmesg,
59194+ .maxlen = sizeof(int),
59195+ .mode = 0600,
59196+ .proc_handler = &proc_dointvec,
59197+ },
59198+#endif
59199+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59200+ {
59201+ .procname = "chroot_findtask",
59202+ .data = &grsec_enable_chroot_findtask,
59203+ .maxlen = sizeof(int),
59204+ .mode = 0600,
59205+ .proc_handler = &proc_dointvec,
59206+ },
59207+#endif
59208+#ifdef CONFIG_GRKERNSEC_RESLOG
59209+ {
59210+ .procname = "resource_logging",
59211+ .data = &grsec_resource_logging,
59212+ .maxlen = sizeof(int),
59213+ .mode = 0600,
59214+ .proc_handler = &proc_dointvec,
59215+ },
59216+#endif
59217+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59218+ {
59219+ .procname = "audit_ptrace",
59220+ .data = &grsec_enable_audit_ptrace,
59221+ .maxlen = sizeof(int),
59222+ .mode = 0600,
59223+ .proc_handler = &proc_dointvec,
59224+ },
59225+#endif
59226+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59227+ {
59228+ .procname = "harden_ptrace",
59229+ .data = &grsec_enable_harden_ptrace,
59230+ .maxlen = sizeof(int),
59231+ .mode = 0600,
59232+ .proc_handler = &proc_dointvec,
59233+ },
59234+#endif
59235+ {
59236+ .procname = "grsec_lock",
59237+ .data = &grsec_lock,
59238+ .maxlen = sizeof(int),
59239+ .mode = 0600,
59240+ .proc_handler = &proc_dointvec,
59241+ },
59242+#endif
59243+#ifdef CONFIG_GRKERNSEC_ROFS
59244+ {
59245+ .procname = "romount_protect",
59246+ .data = &grsec_enable_rofs,
59247+ .maxlen = sizeof(int),
59248+ .mode = 0600,
59249+ .proc_handler = &proc_dointvec_minmax,
59250+ .extra1 = &one,
59251+ .extra2 = &one,
59252+ },
59253+#endif
59254+ { }
59255+};
59256+#endif
59257diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
59258new file mode 100644
59259index 0000000..0dc13c3
59260--- /dev/null
59261+++ b/grsecurity/grsec_time.c
59262@@ -0,0 +1,16 @@
59263+#include <linux/kernel.h>
59264+#include <linux/sched.h>
59265+#include <linux/grinternal.h>
59266+#include <linux/module.h>
59267+
59268+void
59269+gr_log_timechange(void)
59270+{
59271+#ifdef CONFIG_GRKERNSEC_TIME
59272+ if (grsec_enable_time)
59273+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59274+#endif
59275+ return;
59276+}
59277+
59278+EXPORT_SYMBOL(gr_log_timechange);
59279diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
59280new file mode 100644
59281index 0000000..4a78774
59282--- /dev/null
59283+++ b/grsecurity/grsec_tpe.c
59284@@ -0,0 +1,39 @@
59285+#include <linux/kernel.h>
59286+#include <linux/sched.h>
59287+#include <linux/file.h>
59288+#include <linux/fs.h>
59289+#include <linux/grinternal.h>
59290+
59291+extern int gr_acl_tpe_check(void);
59292+
59293+int
59294+gr_tpe_allow(const struct file *file)
59295+{
59296+#ifdef CONFIG_GRKERNSEC
59297+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59298+ const struct cred *cred = current_cred();
59299+
59300+ if (cred->uid && ((grsec_enable_tpe &&
59301+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59302+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59303+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59304+#else
59305+ in_group_p(grsec_tpe_gid)
59306+#endif
59307+ ) || gr_acl_tpe_check()) &&
59308+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59309+ (inode->i_mode & S_IWOTH))))) {
59310+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59311+ return 0;
59312+ }
59313+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59314+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59315+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59316+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59317+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59318+ return 0;
59319+ }
59320+#endif
59321+#endif
59322+ return 1;
59323+}
59324diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
59325new file mode 100644
59326index 0000000..9f7b1ac
59327--- /dev/null
59328+++ b/grsecurity/grsum.c
59329@@ -0,0 +1,61 @@
59330+#include <linux/err.h>
59331+#include <linux/kernel.h>
59332+#include <linux/sched.h>
59333+#include <linux/mm.h>
59334+#include <linux/scatterlist.h>
59335+#include <linux/crypto.h>
59336+#include <linux/gracl.h>
59337+
59338+
59339+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59340+#error "crypto and sha256 must be built into the kernel"
59341+#endif
59342+
59343+int
59344+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59345+{
59346+ char *p;
59347+ struct crypto_hash *tfm;
59348+ struct hash_desc desc;
59349+ struct scatterlist sg;
59350+ unsigned char temp_sum[GR_SHA_LEN];
59351+ volatile int retval = 0;
59352+ volatile int dummy = 0;
59353+ unsigned int i;
59354+
59355+ sg_init_table(&sg, 1);
59356+
59357+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59358+ if (IS_ERR(tfm)) {
59359+ /* should never happen, since sha256 should be built in */
59360+ return 1;
59361+ }
59362+
59363+ desc.tfm = tfm;
59364+ desc.flags = 0;
59365+
59366+ crypto_hash_init(&desc);
59367+
59368+ p = salt;
59369+ sg_set_buf(&sg, p, GR_SALT_LEN);
59370+ crypto_hash_update(&desc, &sg, sg.length);
59371+
59372+ p = entry->pw;
59373+ sg_set_buf(&sg, p, strlen(p));
59374+
59375+ crypto_hash_update(&desc, &sg, sg.length);
59376+
59377+ crypto_hash_final(&desc, temp_sum);
59378+
59379+ memset(entry->pw, 0, GR_PW_LEN);
59380+
59381+ for (i = 0; i < GR_SHA_LEN; i++)
59382+ if (sum[i] != temp_sum[i])
59383+ retval = 1;
59384+ else
59385+ dummy = 1; // waste a cycle
59386+
59387+ crypto_free_hash(tfm);
59388+
59389+ return retval;
59390+}
59391diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
59392index 6cd5b64..f620d2d 100644
59393--- a/include/acpi/acpi_bus.h
59394+++ b/include/acpi/acpi_bus.h
59395@@ -107,7 +107,7 @@ struct acpi_device_ops {
59396 acpi_op_bind bind;
59397 acpi_op_unbind unbind;
59398 acpi_op_notify notify;
59399-};
59400+} __no_const;
59401
59402 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
59403
59404diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
59405index b7babf0..71e4e74 100644
59406--- a/include/asm-generic/atomic-long.h
59407+++ b/include/asm-generic/atomic-long.h
59408@@ -22,6 +22,12 @@
59409
59410 typedef atomic64_t atomic_long_t;
59411
59412+#ifdef CONFIG_PAX_REFCOUNT
59413+typedef atomic64_unchecked_t atomic_long_unchecked_t;
59414+#else
59415+typedef atomic64_t atomic_long_unchecked_t;
59416+#endif
59417+
59418 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
59419
59420 static inline long atomic_long_read(atomic_long_t *l)
59421@@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
59422 return (long)atomic64_read(v);
59423 }
59424
59425+#ifdef CONFIG_PAX_REFCOUNT
59426+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59427+{
59428+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59429+
59430+ return (long)atomic64_read_unchecked(v);
59431+}
59432+#endif
59433+
59434 static inline void atomic_long_set(atomic_long_t *l, long i)
59435 {
59436 atomic64_t *v = (atomic64_t *)l;
59437@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
59438 atomic64_set(v, i);
59439 }
59440
59441+#ifdef CONFIG_PAX_REFCOUNT
59442+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59443+{
59444+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59445+
59446+ atomic64_set_unchecked(v, i);
59447+}
59448+#endif
59449+
59450 static inline void atomic_long_inc(atomic_long_t *l)
59451 {
59452 atomic64_t *v = (atomic64_t *)l;
59453@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
59454 atomic64_inc(v);
59455 }
59456
59457+#ifdef CONFIG_PAX_REFCOUNT
59458+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59459+{
59460+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59461+
59462+ atomic64_inc_unchecked(v);
59463+}
59464+#endif
59465+
59466 static inline void atomic_long_dec(atomic_long_t *l)
59467 {
59468 atomic64_t *v = (atomic64_t *)l;
59469@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
59470 atomic64_dec(v);
59471 }
59472
59473+#ifdef CONFIG_PAX_REFCOUNT
59474+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59475+{
59476+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59477+
59478+ atomic64_dec_unchecked(v);
59479+}
59480+#endif
59481+
59482 static inline void atomic_long_add(long i, atomic_long_t *l)
59483 {
59484 atomic64_t *v = (atomic64_t *)l;
59485@@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
59486 atomic64_add(i, v);
59487 }
59488
59489+#ifdef CONFIG_PAX_REFCOUNT
59490+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59491+{
59492+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59493+
59494+ atomic64_add_unchecked(i, v);
59495+}
59496+#endif
59497+
59498 static inline void atomic_long_sub(long i, atomic_long_t *l)
59499 {
59500 atomic64_t *v = (atomic64_t *)l;
59501@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
59502 atomic64_sub(i, v);
59503 }
59504
59505+#ifdef CONFIG_PAX_REFCOUNT
59506+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
59507+{
59508+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59509+
59510+ atomic64_sub_unchecked(i, v);
59511+}
59512+#endif
59513+
59514 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
59515 {
59516 atomic64_t *v = (atomic64_t *)l;
59517@@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
59518 return (long)atomic64_inc_return(v);
59519 }
59520
59521+#ifdef CONFIG_PAX_REFCOUNT
59522+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59523+{
59524+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59525+
59526+ return (long)atomic64_inc_return_unchecked(v);
59527+}
59528+#endif
59529+
59530 static inline long atomic_long_dec_return(atomic_long_t *l)
59531 {
59532 atomic64_t *v = (atomic64_t *)l;
59533@@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
59534
59535 typedef atomic_t atomic_long_t;
59536
59537+#ifdef CONFIG_PAX_REFCOUNT
59538+typedef atomic_unchecked_t atomic_long_unchecked_t;
59539+#else
59540+typedef atomic_t atomic_long_unchecked_t;
59541+#endif
59542+
59543 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
59544 static inline long atomic_long_read(atomic_long_t *l)
59545 {
59546@@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
59547 return (long)atomic_read(v);
59548 }
59549
59550+#ifdef CONFIG_PAX_REFCOUNT
59551+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59552+{
59553+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59554+
59555+ return (long)atomic_read_unchecked(v);
59556+}
59557+#endif
59558+
59559 static inline void atomic_long_set(atomic_long_t *l, long i)
59560 {
59561 atomic_t *v = (atomic_t *)l;
59562@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
59563 atomic_set(v, i);
59564 }
59565
59566+#ifdef CONFIG_PAX_REFCOUNT
59567+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59568+{
59569+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59570+
59571+ atomic_set_unchecked(v, i);
59572+}
59573+#endif
59574+
59575 static inline void atomic_long_inc(atomic_long_t *l)
59576 {
59577 atomic_t *v = (atomic_t *)l;
59578@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
59579 atomic_inc(v);
59580 }
59581
59582+#ifdef CONFIG_PAX_REFCOUNT
59583+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59584+{
59585+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59586+
59587+ atomic_inc_unchecked(v);
59588+}
59589+#endif
59590+
59591 static inline void atomic_long_dec(atomic_long_t *l)
59592 {
59593 atomic_t *v = (atomic_t *)l;
59594@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
59595 atomic_dec(v);
59596 }
59597
59598+#ifdef CONFIG_PAX_REFCOUNT
59599+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59600+{
59601+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59602+
59603+ atomic_dec_unchecked(v);
59604+}
59605+#endif
59606+
59607 static inline void atomic_long_add(long i, atomic_long_t *l)
59608 {
59609 atomic_t *v = (atomic_t *)l;
59610@@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
59611 atomic_add(i, v);
59612 }
59613
59614+#ifdef CONFIG_PAX_REFCOUNT
59615+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59616+{
59617+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59618+
59619+ atomic_add_unchecked(i, v);
59620+}
59621+#endif
59622+
59623 static inline void atomic_long_sub(long i, atomic_long_t *l)
59624 {
59625 atomic_t *v = (atomic_t *)l;
59626@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
59627 atomic_sub(i, v);
59628 }
59629
59630+#ifdef CONFIG_PAX_REFCOUNT
59631+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
59632+{
59633+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59634+
59635+ atomic_sub_unchecked(i, v);
59636+}
59637+#endif
59638+
59639 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
59640 {
59641 atomic_t *v = (atomic_t *)l;
59642@@ -232,6 +361,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
59643 return (long)atomic_inc_return(v);
59644 }
59645
59646+#ifdef CONFIG_PAX_REFCOUNT
59647+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59648+{
59649+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59650+
59651+ return (long)atomic_inc_return_unchecked(v);
59652+}
59653+#endif
59654+
59655 static inline long atomic_long_dec_return(atomic_long_t *l)
59656 {
59657 atomic_t *v = (atomic_t *)l;
59658@@ -255,4 +393,49 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
59659
59660 #endif /* BITS_PER_LONG == 64 */
59661
59662+#ifdef CONFIG_PAX_REFCOUNT
59663+static inline void pax_refcount_needs_these_functions(void)
59664+{
59665+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
59666+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
59667+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
59668+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
59669+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
59670+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
59671+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
59672+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
59673+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
59674+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
59675+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
59676+
59677+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
59678+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
59679+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
59680+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
59681+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
59682+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
59683+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
59684+}
59685+#else
59686+#define atomic_read_unchecked(v) atomic_read(v)
59687+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
59688+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
59689+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
59690+#define atomic_inc_unchecked(v) atomic_inc(v)
59691+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
59692+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
59693+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
59694+#define atomic_dec_unchecked(v) atomic_dec(v)
59695+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
59696+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
59697+
59698+#define atomic_long_read_unchecked(v) atomic_long_read(v)
59699+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
59700+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
59701+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
59702+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
59703+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
59704+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
59705+#endif
59706+
59707 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
59708diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
59709index b18ce4f..2ee2843 100644
59710--- a/include/asm-generic/atomic64.h
59711+++ b/include/asm-generic/atomic64.h
59712@@ -16,6 +16,8 @@ typedef struct {
59713 long long counter;
59714 } atomic64_t;
59715
59716+typedef atomic64_t atomic64_unchecked_t;
59717+
59718 #define ATOMIC64_INIT(i) { (i) }
59719
59720 extern long long atomic64_read(const atomic64_t *v);
59721@@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
59722 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
59723 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
59724
59725+#define atomic64_read_unchecked(v) atomic64_read(v)
59726+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
59727+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
59728+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
59729+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
59730+#define atomic64_inc_unchecked(v) atomic64_inc(v)
59731+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
59732+#define atomic64_dec_unchecked(v) atomic64_dec(v)
59733+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
59734+
59735 #endif /* _ASM_GENERIC_ATOMIC64_H */
59736diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
59737index 1bfcfe5..e04c5c9 100644
59738--- a/include/asm-generic/cache.h
59739+++ b/include/asm-generic/cache.h
59740@@ -6,7 +6,7 @@
59741 * cache lines need to provide their own cache.h.
59742 */
59743
59744-#define L1_CACHE_SHIFT 5
59745-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
59746+#define L1_CACHE_SHIFT 5UL
59747+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
59748
59749 #endif /* __ASM_GENERIC_CACHE_H */
59750diff --git a/include/asm-generic/int-l64.h b/include/asm-generic/int-l64.h
59751index 1ca3efc..e3dc852 100644
59752--- a/include/asm-generic/int-l64.h
59753+++ b/include/asm-generic/int-l64.h
59754@@ -46,6 +46,8 @@ typedef unsigned int u32;
59755 typedef signed long s64;
59756 typedef unsigned long u64;
59757
59758+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
59759+
59760 #define S8_C(x) x
59761 #define U8_C(x) x ## U
59762 #define S16_C(x) x
59763diff --git a/include/asm-generic/int-ll64.h b/include/asm-generic/int-ll64.h
59764index f394147..b6152b9 100644
59765--- a/include/asm-generic/int-ll64.h
59766+++ b/include/asm-generic/int-ll64.h
59767@@ -51,6 +51,8 @@ typedef unsigned int u32;
59768 typedef signed long long s64;
59769 typedef unsigned long long u64;
59770
59771+typedef unsigned long long intoverflow_t;
59772+
59773 #define S8_C(x) x
59774 #define U8_C(x) x ## U
59775 #define S16_C(x) x
59776diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
59777index 0232ccb..13d9165 100644
59778--- a/include/asm-generic/kmap_types.h
59779+++ b/include/asm-generic/kmap_types.h
59780@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
59781 KMAP_D(17) KM_NMI,
59782 KMAP_D(18) KM_NMI_PTE,
59783 KMAP_D(19) KM_KDB,
59784+KMAP_D(20) KM_CLEARPAGE,
59785 /*
59786 * Remember to update debug_kmap_atomic() when adding new kmap types!
59787 */
59788-KMAP_D(20) KM_TYPE_NR
59789+KMAP_D(21) KM_TYPE_NR
59790 };
59791
59792 #undef KMAP_D
59793diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
59794index 725612b..9cc513a 100644
59795--- a/include/asm-generic/pgtable-nopmd.h
59796+++ b/include/asm-generic/pgtable-nopmd.h
59797@@ -1,14 +1,19 @@
59798 #ifndef _PGTABLE_NOPMD_H
59799 #define _PGTABLE_NOPMD_H
59800
59801-#ifndef __ASSEMBLY__
59802-
59803 #include <asm-generic/pgtable-nopud.h>
59804
59805-struct mm_struct;
59806-
59807 #define __PAGETABLE_PMD_FOLDED
59808
59809+#define PMD_SHIFT PUD_SHIFT
59810+#define PTRS_PER_PMD 1
59811+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
59812+#define PMD_MASK (~(PMD_SIZE-1))
59813+
59814+#ifndef __ASSEMBLY__
59815+
59816+struct mm_struct;
59817+
59818 /*
59819 * Having the pmd type consist of a pud gets the size right, and allows
59820 * us to conceptually access the pud entry that this pmd is folded into
59821@@ -16,11 +21,6 @@ struct mm_struct;
59822 */
59823 typedef struct { pud_t pud; } pmd_t;
59824
59825-#define PMD_SHIFT PUD_SHIFT
59826-#define PTRS_PER_PMD 1
59827-#define PMD_SIZE (1UL << PMD_SHIFT)
59828-#define PMD_MASK (~(PMD_SIZE-1))
59829-
59830 /*
59831 * The "pud_xxx()" functions here are trivial for a folded two-level
59832 * setup: the pmd is never bad, and a pmd always exists (as it's folded
59833diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
59834index 810431d..ccc3638 100644
59835--- a/include/asm-generic/pgtable-nopud.h
59836+++ b/include/asm-generic/pgtable-nopud.h
59837@@ -1,10 +1,15 @@
59838 #ifndef _PGTABLE_NOPUD_H
59839 #define _PGTABLE_NOPUD_H
59840
59841-#ifndef __ASSEMBLY__
59842-
59843 #define __PAGETABLE_PUD_FOLDED
59844
59845+#define PUD_SHIFT PGDIR_SHIFT
59846+#define PTRS_PER_PUD 1
59847+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
59848+#define PUD_MASK (~(PUD_SIZE-1))
59849+
59850+#ifndef __ASSEMBLY__
59851+
59852 /*
59853 * Having the pud type consist of a pgd gets the size right, and allows
59854 * us to conceptually access the pgd entry that this pud is folded into
59855@@ -12,11 +17,6 @@
59856 */
59857 typedef struct { pgd_t pgd; } pud_t;
59858
59859-#define PUD_SHIFT PGDIR_SHIFT
59860-#define PTRS_PER_PUD 1
59861-#define PUD_SIZE (1UL << PUD_SHIFT)
59862-#define PUD_MASK (~(PUD_SIZE-1))
59863-
59864 /*
59865 * The "pgd_xxx()" functions here are trivial for a folded two-level
59866 * setup: the pud is never bad, and a pud always exists (as it's folded
59867diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
59868index 76bff2b..c7a14e2 100644
59869--- a/include/asm-generic/pgtable.h
59870+++ b/include/asm-generic/pgtable.h
59871@@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd)
59872 #endif /* __HAVE_ARCH_PMD_WRITE */
59873 #endif
59874
59875+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
59876+static inline unsigned long pax_open_kernel(void) { return 0; }
59877+#endif
59878+
59879+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
59880+static inline unsigned long pax_close_kernel(void) { return 0; }
59881+#endif
59882+
59883 #endif /* !__ASSEMBLY__ */
59884
59885 #endif /* _ASM_GENERIC_PGTABLE_H */
59886diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
59887index db22d13..1f2e3e1 100644
59888--- a/include/asm-generic/vmlinux.lds.h
59889+++ b/include/asm-generic/vmlinux.lds.h
59890@@ -217,6 +217,7 @@
59891 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
59892 VMLINUX_SYMBOL(__start_rodata) = .; \
59893 *(.rodata) *(.rodata.*) \
59894+ *(.data..read_only) \
59895 *(__vermagic) /* Kernel version magic */ \
59896 . = ALIGN(8); \
59897 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
59898@@ -723,17 +724,18 @@
59899 * section in the linker script will go there too. @phdr should have
59900 * a leading colon.
59901 *
59902- * Note that this macros defines __per_cpu_load as an absolute symbol.
59903+ * Note that this macros defines per_cpu_load as an absolute symbol.
59904 * If there is no need to put the percpu section at a predetermined
59905 * address, use PERCPU_SECTION.
59906 */
59907 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
59908- VMLINUX_SYMBOL(__per_cpu_load) = .; \
59909- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
59910+ per_cpu_load = .; \
59911+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
59912 - LOAD_OFFSET) { \
59913+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
59914 PERCPU_INPUT(cacheline) \
59915 } phdr \
59916- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
59917+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
59918
59919 /**
59920 * PERCPU_SECTION - define output section for percpu area, simple version
59921diff --git a/include/drm/drmP.h b/include/drm/drmP.h
59922index 9b7c2bb..76b7d1e 100644
59923--- a/include/drm/drmP.h
59924+++ b/include/drm/drmP.h
59925@@ -73,6 +73,7 @@
59926 #include <linux/workqueue.h>
59927 #include <linux/poll.h>
59928 #include <asm/pgalloc.h>
59929+#include <asm/local.h>
59930 #include "drm.h"
59931
59932 #include <linux/idr.h>
59933@@ -1035,7 +1036,7 @@ struct drm_device {
59934
59935 /** \name Usage Counters */
59936 /*@{ */
59937- int open_count; /**< Outstanding files open */
59938+ local_t open_count; /**< Outstanding files open */
59939 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
59940 atomic_t vma_count; /**< Outstanding vma areas open */
59941 int buf_use; /**< Buffers in use -- cannot alloc */
59942@@ -1046,7 +1047,7 @@ struct drm_device {
59943 /*@{ */
59944 unsigned long counters;
59945 enum drm_stat_type types[15];
59946- atomic_t counts[15];
59947+ atomic_unchecked_t counts[15];
59948 /*@} */
59949
59950 struct list_head filelist;
59951diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
59952index 73b0712..0b7ef2f 100644
59953--- a/include/drm/drm_crtc_helper.h
59954+++ b/include/drm/drm_crtc_helper.h
59955@@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
59956
59957 /* disable crtc when not in use - more explicit than dpms off */
59958 void (*disable)(struct drm_crtc *crtc);
59959-};
59960+} __no_const;
59961
59962 struct drm_encoder_helper_funcs {
59963 void (*dpms)(struct drm_encoder *encoder, int mode);
59964@@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
59965 struct drm_connector *connector);
59966 /* disable encoder when not in use - more explicit than dpms off */
59967 void (*disable)(struct drm_encoder *encoder);
59968-};
59969+} __no_const;
59970
59971 struct drm_connector_helper_funcs {
59972 int (*get_modes)(struct drm_connector *connector);
59973diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
59974index 26c1f78..6722682 100644
59975--- a/include/drm/ttm/ttm_memory.h
59976+++ b/include/drm/ttm/ttm_memory.h
59977@@ -47,7 +47,7 @@
59978
59979 struct ttm_mem_shrink {
59980 int (*do_shrink) (struct ttm_mem_shrink *);
59981-};
59982+} __no_const;
59983
59984 /**
59985 * struct ttm_mem_global - Global memory accounting structure.
59986diff --git a/include/linux/a.out.h b/include/linux/a.out.h
59987index e86dfca..40cc55f 100644
59988--- a/include/linux/a.out.h
59989+++ b/include/linux/a.out.h
59990@@ -39,6 +39,14 @@ enum machine_type {
59991 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
59992 };
59993
59994+/* Constants for the N_FLAGS field */
59995+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
59996+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
59997+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
59998+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
59999+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60000+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60001+
60002 #if !defined (N_MAGIC)
60003 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
60004 #endif
60005diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
60006index 49a83ca..df96b54 100644
60007--- a/include/linux/atmdev.h
60008+++ b/include/linux/atmdev.h
60009@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
60010 #endif
60011
60012 struct k_atm_aal_stats {
60013-#define __HANDLE_ITEM(i) atomic_t i
60014+#define __HANDLE_ITEM(i) atomic_unchecked_t i
60015 __AAL_STAT_ITEMS
60016 #undef __HANDLE_ITEM
60017 };
60018diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
60019index fd88a39..f4d0bad 100644
60020--- a/include/linux/binfmts.h
60021+++ b/include/linux/binfmts.h
60022@@ -88,6 +88,7 @@ struct linux_binfmt {
60023 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
60024 int (*load_shlib)(struct file *);
60025 int (*core_dump)(struct coredump_params *cprm);
60026+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
60027 unsigned long min_coredump; /* minimal dump size */
60028 };
60029
60030diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
60031index 7fbaa91..5e6a460 100644
60032--- a/include/linux/blkdev.h
60033+++ b/include/linux/blkdev.h
60034@@ -1321,7 +1321,7 @@ struct block_device_operations {
60035 /* this callback is with swap_lock and sometimes page table lock held */
60036 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
60037 struct module *owner;
60038-};
60039+} __do_const;
60040
60041 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
60042 unsigned long);
60043diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
60044index 8e9e4bc..88bd457 100644
60045--- a/include/linux/blktrace_api.h
60046+++ b/include/linux/blktrace_api.h
60047@@ -162,7 +162,7 @@ struct blk_trace {
60048 struct dentry *dir;
60049 struct dentry *dropped_file;
60050 struct dentry *msg_file;
60051- atomic_t dropped;
60052+ atomic_unchecked_t dropped;
60053 };
60054
60055 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
60056diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
60057index 83195fb..0b0f77d 100644
60058--- a/include/linux/byteorder/little_endian.h
60059+++ b/include/linux/byteorder/little_endian.h
60060@@ -42,51 +42,51 @@
60061
60062 static inline __le64 __cpu_to_le64p(const __u64 *p)
60063 {
60064- return (__force __le64)*p;
60065+ return (__force const __le64)*p;
60066 }
60067 static inline __u64 __le64_to_cpup(const __le64 *p)
60068 {
60069- return (__force __u64)*p;
60070+ return (__force const __u64)*p;
60071 }
60072 static inline __le32 __cpu_to_le32p(const __u32 *p)
60073 {
60074- return (__force __le32)*p;
60075+ return (__force const __le32)*p;
60076 }
60077 static inline __u32 __le32_to_cpup(const __le32 *p)
60078 {
60079- return (__force __u32)*p;
60080+ return (__force const __u32)*p;
60081 }
60082 static inline __le16 __cpu_to_le16p(const __u16 *p)
60083 {
60084- return (__force __le16)*p;
60085+ return (__force const __le16)*p;
60086 }
60087 static inline __u16 __le16_to_cpup(const __le16 *p)
60088 {
60089- return (__force __u16)*p;
60090+ return (__force const __u16)*p;
60091 }
60092 static inline __be64 __cpu_to_be64p(const __u64 *p)
60093 {
60094- return (__force __be64)__swab64p(p);
60095+ return (__force const __be64)__swab64p(p);
60096 }
60097 static inline __u64 __be64_to_cpup(const __be64 *p)
60098 {
60099- return __swab64p((__u64 *)p);
60100+ return __swab64p((const __u64 *)p);
60101 }
60102 static inline __be32 __cpu_to_be32p(const __u32 *p)
60103 {
60104- return (__force __be32)__swab32p(p);
60105+ return (__force const __be32)__swab32p(p);
60106 }
60107 static inline __u32 __be32_to_cpup(const __be32 *p)
60108 {
60109- return __swab32p((__u32 *)p);
60110+ return __swab32p((const __u32 *)p);
60111 }
60112 static inline __be16 __cpu_to_be16p(const __u16 *p)
60113 {
60114- return (__force __be16)__swab16p(p);
60115+ return (__force const __be16)__swab16p(p);
60116 }
60117 static inline __u16 __be16_to_cpup(const __be16 *p)
60118 {
60119- return __swab16p((__u16 *)p);
60120+ return __swab16p((const __u16 *)p);
60121 }
60122 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
60123 #define __le64_to_cpus(x) do { (void)(x); } while (0)
60124diff --git a/include/linux/cache.h b/include/linux/cache.h
60125index 4c57065..4307975 100644
60126--- a/include/linux/cache.h
60127+++ b/include/linux/cache.h
60128@@ -16,6 +16,10 @@
60129 #define __read_mostly
60130 #endif
60131
60132+#ifndef __read_only
60133+#define __read_only __read_mostly
60134+#endif
60135+
60136 #ifndef ____cacheline_aligned
60137 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
60138 #endif
60139diff --git a/include/linux/capability.h b/include/linux/capability.h
60140index c421123..e343179 100644
60141--- a/include/linux/capability.h
60142+++ b/include/linux/capability.h
60143@@ -547,6 +547,9 @@ extern bool capable(int cap);
60144 extern bool ns_capable(struct user_namespace *ns, int cap);
60145 extern bool task_ns_capable(struct task_struct *t, int cap);
60146 extern bool nsown_capable(int cap);
60147+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
60148+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
60149+extern bool capable_nolog(int cap);
60150
60151 /* audit system wants to get cap info from files as well */
60152 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
60153diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
60154index 04ffb2e..6799180 100644
60155--- a/include/linux/cleancache.h
60156+++ b/include/linux/cleancache.h
60157@@ -31,7 +31,7 @@ struct cleancache_ops {
60158 void (*flush_page)(int, struct cleancache_filekey, pgoff_t);
60159 void (*flush_inode)(int, struct cleancache_filekey);
60160 void (*flush_fs)(int);
60161-};
60162+} __no_const;
60163
60164 extern struct cleancache_ops
60165 cleancache_register_ops(struct cleancache_ops *ops);
60166diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
60167index dfadc96..c0e70c1 100644
60168--- a/include/linux/compiler-gcc4.h
60169+++ b/include/linux/compiler-gcc4.h
60170@@ -31,6 +31,12 @@
60171
60172
60173 #if __GNUC_MINOR__ >= 5
60174+
60175+#ifdef CONSTIFY_PLUGIN
60176+#define __no_const __attribute__((no_const))
60177+#define __do_const __attribute__((do_const))
60178+#endif
60179+
60180 /*
60181 * Mark a position in code as unreachable. This can be used to
60182 * suppress control flow warnings after asm blocks that transfer
60183@@ -46,6 +52,11 @@
60184 #define __noclone __attribute__((__noclone__))
60185
60186 #endif
60187+
60188+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
60189+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
60190+#define __bos0(ptr) __bos((ptr), 0)
60191+#define __bos1(ptr) __bos((ptr), 1)
60192 #endif
60193
60194 #if __GNUC_MINOR__ > 0
60195diff --git a/include/linux/compiler.h b/include/linux/compiler.h
60196index 320d6c9..8573a1c 100644
60197--- a/include/linux/compiler.h
60198+++ b/include/linux/compiler.h
60199@@ -5,31 +5,62 @@
60200
60201 #ifdef __CHECKER__
60202 # define __user __attribute__((noderef, address_space(1)))
60203+# define __force_user __force __user
60204 # define __kernel __attribute__((address_space(0)))
60205+# define __force_kernel __force __kernel
60206 # define __safe __attribute__((safe))
60207 # define __force __attribute__((force))
60208 # define __nocast __attribute__((nocast))
60209 # define __iomem __attribute__((noderef, address_space(2)))
60210+# define __force_iomem __force __iomem
60211 # define __acquires(x) __attribute__((context(x,0,1)))
60212 # define __releases(x) __attribute__((context(x,1,0)))
60213 # define __acquire(x) __context__(x,1)
60214 # define __release(x) __context__(x,-1)
60215 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
60216 # define __percpu __attribute__((noderef, address_space(3)))
60217+# define __force_percpu __force __percpu
60218 #ifdef CONFIG_SPARSE_RCU_POINTER
60219 # define __rcu __attribute__((noderef, address_space(4)))
60220+# define __force_rcu __force __rcu
60221 #else
60222 # define __rcu
60223+# define __force_rcu
60224 #endif
60225 extern void __chk_user_ptr(const volatile void __user *);
60226 extern void __chk_io_ptr(const volatile void __iomem *);
60227+#elif defined(CHECKER_PLUGIN)
60228+//# define __user
60229+//# define __force_user
60230+//# define __kernel
60231+//# define __force_kernel
60232+# define __safe
60233+# define __force
60234+# define __nocast
60235+# define __iomem
60236+# define __force_iomem
60237+# define __chk_user_ptr(x) (void)0
60238+# define __chk_io_ptr(x) (void)0
60239+# define __builtin_warning(x, y...) (1)
60240+# define __acquires(x)
60241+# define __releases(x)
60242+# define __acquire(x) (void)0
60243+# define __release(x) (void)0
60244+# define __cond_lock(x,c) (c)
60245+# define __percpu
60246+# define __force_percpu
60247+# define __rcu
60248+# define __force_rcu
60249 #else
60250 # define __user
60251+# define __force_user
60252 # define __kernel
60253+# define __force_kernel
60254 # define __safe
60255 # define __force
60256 # define __nocast
60257 # define __iomem
60258+# define __force_iomem
60259 # define __chk_user_ptr(x) (void)0
60260 # define __chk_io_ptr(x) (void)0
60261 # define __builtin_warning(x, y...) (1)
60262@@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile void __iomem *);
60263 # define __release(x) (void)0
60264 # define __cond_lock(x,c) (c)
60265 # define __percpu
60266+# define __force_percpu
60267 # define __rcu
60268+# define __force_rcu
60269 #endif
60270
60271 #ifdef __KERNEL__
60272@@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60273 # define __attribute_const__ /* unimplemented */
60274 #endif
60275
60276+#ifndef __no_const
60277+# define __no_const
60278+#endif
60279+
60280+#ifndef __do_const
60281+# define __do_const
60282+#endif
60283+
60284 /*
60285 * Tell gcc if a function is cold. The compiler will assume any path
60286 * directly leading to the call is unlikely.
60287@@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60288 #define __cold
60289 #endif
60290
60291+#ifndef __alloc_size
60292+#define __alloc_size(...)
60293+#endif
60294+
60295+#ifndef __bos
60296+#define __bos(ptr, arg)
60297+#endif
60298+
60299+#ifndef __bos0
60300+#define __bos0(ptr)
60301+#endif
60302+
60303+#ifndef __bos1
60304+#define __bos1(ptr)
60305+#endif
60306+
60307 /* Simple shorthand for a section definition */
60308 #ifndef __section
60309 # define __section(S) __attribute__ ((__section__(#S)))
60310@@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60311 * use is to mediate communication between process-level code and irq/NMI
60312 * handlers, all running on the same CPU.
60313 */
60314-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
60315+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
60316+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
60317
60318 #endif /* __LINUX_COMPILER_H */
60319diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
60320index e9eaec5..bfeb9bb 100644
60321--- a/include/linux/cpuset.h
60322+++ b/include/linux/cpuset.h
60323@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void)
60324 * nodemask.
60325 */
60326 smp_mb();
60327- --ACCESS_ONCE(current->mems_allowed_change_disable);
60328+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
60329 }
60330
60331 static inline void set_mems_allowed(nodemask_t nodemask)
60332diff --git a/include/linux/crypto.h b/include/linux/crypto.h
60333index e5e468e..f079672 100644
60334--- a/include/linux/crypto.h
60335+++ b/include/linux/crypto.h
60336@@ -361,7 +361,7 @@ struct cipher_tfm {
60337 const u8 *key, unsigned int keylen);
60338 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60339 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60340-};
60341+} __no_const;
60342
60343 struct hash_tfm {
60344 int (*init)(struct hash_desc *desc);
60345@@ -382,13 +382,13 @@ struct compress_tfm {
60346 int (*cot_decompress)(struct crypto_tfm *tfm,
60347 const u8 *src, unsigned int slen,
60348 u8 *dst, unsigned int *dlen);
60349-};
60350+} __no_const;
60351
60352 struct rng_tfm {
60353 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
60354 unsigned int dlen);
60355 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
60356-};
60357+} __no_const;
60358
60359 #define crt_ablkcipher crt_u.ablkcipher
60360 #define crt_aead crt_u.aead
60361diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
60362index 7925bf0..d5143d2 100644
60363--- a/include/linux/decompress/mm.h
60364+++ b/include/linux/decompress/mm.h
60365@@ -77,7 +77,7 @@ static void free(void *where)
60366 * warnings when not needed (indeed large_malloc / large_free are not
60367 * needed by inflate */
60368
60369-#define malloc(a) kmalloc(a, GFP_KERNEL)
60370+#define malloc(a) kmalloc((a), GFP_KERNEL)
60371 #define free(a) kfree(a)
60372
60373 #define large_malloc(a) vmalloc(a)
60374diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
60375index 347fdc3..cd01657 100644
60376--- a/include/linux/dma-mapping.h
60377+++ b/include/linux/dma-mapping.h
60378@@ -42,7 +42,7 @@ struct dma_map_ops {
60379 int (*dma_supported)(struct device *dev, u64 mask);
60380 int (*set_dma_mask)(struct device *dev, u64 mask);
60381 int is_phys;
60382-};
60383+} __do_const;
60384
60385 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
60386
60387diff --git a/include/linux/efi.h b/include/linux/efi.h
60388index 2362a0b..cfaf8fcc 100644
60389--- a/include/linux/efi.h
60390+++ b/include/linux/efi.h
60391@@ -446,7 +446,7 @@ struct efivar_operations {
60392 efi_get_variable_t *get_variable;
60393 efi_get_next_variable_t *get_next_variable;
60394 efi_set_variable_t *set_variable;
60395-};
60396+} __no_const;
60397
60398 struct efivars {
60399 /*
60400diff --git a/include/linux/elf.h b/include/linux/elf.h
60401index 110821c..cb14c08 100644
60402--- a/include/linux/elf.h
60403+++ b/include/linux/elf.h
60404@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
60405 #define PT_GNU_EH_FRAME 0x6474e550
60406
60407 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
60408+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
60409+
60410+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
60411+
60412+/* Constants for the e_flags field */
60413+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60414+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
60415+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
60416+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
60417+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60418+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60419
60420 /*
60421 * Extended Numbering
60422@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
60423 #define DT_DEBUG 21
60424 #define DT_TEXTREL 22
60425 #define DT_JMPREL 23
60426+#define DT_FLAGS 30
60427+ #define DF_TEXTREL 0x00000004
60428 #define DT_ENCODING 32
60429 #define OLD_DT_LOOS 0x60000000
60430 #define DT_LOOS 0x6000000d
60431@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
60432 #define PF_W 0x2
60433 #define PF_X 0x1
60434
60435+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
60436+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
60437+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
60438+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
60439+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
60440+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
60441+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
60442+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
60443+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
60444+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
60445+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
60446+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
60447+
60448 typedef struct elf32_phdr{
60449 Elf32_Word p_type;
60450 Elf32_Off p_offset;
60451@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
60452 #define EI_OSABI 7
60453 #define EI_PAD 8
60454
60455+#define EI_PAX 14
60456+
60457 #define ELFMAG0 0x7f /* EI_MAG */
60458 #define ELFMAG1 'E'
60459 #define ELFMAG2 'L'
60460@@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC [];
60461 #define elf_note elf32_note
60462 #define elf_addr_t Elf32_Off
60463 #define Elf_Half Elf32_Half
60464+#define elf_dyn Elf32_Dyn
60465
60466 #else
60467
60468@@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC [];
60469 #define elf_note elf64_note
60470 #define elf_addr_t Elf64_Off
60471 #define Elf_Half Elf64_Half
60472+#define elf_dyn Elf64_Dyn
60473
60474 #endif
60475
60476diff --git a/include/linux/filter.h b/include/linux/filter.h
60477index 741956f..f02f482 100644
60478--- a/include/linux/filter.h
60479+++ b/include/linux/filter.h
60480@@ -134,6 +134,7 @@ struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
60481
60482 struct sk_buff;
60483 struct sock;
60484+struct bpf_jit_work;
60485
60486 struct sk_filter
60487 {
60488@@ -141,6 +142,9 @@ struct sk_filter
60489 unsigned int len; /* Number of filter blocks */
60490 unsigned int (*bpf_func)(const struct sk_buff *skb,
60491 const struct sock_filter *filter);
60492+#ifdef CONFIG_BPF_JIT
60493+ struct bpf_jit_work *work;
60494+#endif
60495 struct rcu_head rcu;
60496 struct sock_filter insns[0];
60497 };
60498diff --git a/include/linux/firewire.h b/include/linux/firewire.h
60499index 84ccf8e..2e9b14c 100644
60500--- a/include/linux/firewire.h
60501+++ b/include/linux/firewire.h
60502@@ -428,7 +428,7 @@ struct fw_iso_context {
60503 union {
60504 fw_iso_callback_t sc;
60505 fw_iso_mc_callback_t mc;
60506- } callback;
60507+ } __no_const callback;
60508 void *callback_data;
60509 };
60510
60511diff --git a/include/linux/fs.h b/include/linux/fs.h
60512index cf7bc25..0d2babf 100644
60513--- a/include/linux/fs.h
60514+++ b/include/linux/fs.h
60515@@ -1588,7 +1588,8 @@ struct file_operations {
60516 int (*setlease)(struct file *, long, struct file_lock **);
60517 long (*fallocate)(struct file *file, int mode, loff_t offset,
60518 loff_t len);
60519-};
60520+} __do_const;
60521+typedef struct file_operations __no_const file_operations_no_const;
60522
60523 struct inode_operations {
60524 struct dentry * (*lookup) (struct inode *,struct dentry *, struct nameidata *);
60525diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
60526index 003dc0f..3c4ea97 100644
60527--- a/include/linux/fs_struct.h
60528+++ b/include/linux/fs_struct.h
60529@@ -6,7 +6,7 @@
60530 #include <linux/seqlock.h>
60531
60532 struct fs_struct {
60533- int users;
60534+ atomic_t users;
60535 spinlock_t lock;
60536 seqcount_t seq;
60537 int umask;
60538diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
60539index af095b5..cf1220c 100644
60540--- a/include/linux/fscache-cache.h
60541+++ b/include/linux/fscache-cache.h
60542@@ -102,7 +102,7 @@ struct fscache_operation {
60543 fscache_operation_release_t release;
60544 };
60545
60546-extern atomic_t fscache_op_debug_id;
60547+extern atomic_unchecked_t fscache_op_debug_id;
60548 extern void fscache_op_work_func(struct work_struct *work);
60549
60550 extern void fscache_enqueue_operation(struct fscache_operation *);
60551@@ -122,7 +122,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
60552 {
60553 INIT_WORK(&op->work, fscache_op_work_func);
60554 atomic_set(&op->usage, 1);
60555- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
60556+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
60557 op->processor = processor;
60558 op->release = release;
60559 INIT_LIST_HEAD(&op->pend_link);
60560diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
60561index 2a53f10..0187fdf 100644
60562--- a/include/linux/fsnotify.h
60563+++ b/include/linux/fsnotify.h
60564@@ -314,7 +314,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
60565 */
60566 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
60567 {
60568- return kstrdup(name, GFP_KERNEL);
60569+ return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
60570 }
60571
60572 /*
60573diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
60574index 96efa67..1261547 100644
60575--- a/include/linux/ftrace_event.h
60576+++ b/include/linux/ftrace_event.h
60577@@ -97,7 +97,7 @@ struct trace_event_functions {
60578 trace_print_func raw;
60579 trace_print_func hex;
60580 trace_print_func binary;
60581-};
60582+} __no_const;
60583
60584 struct trace_event {
60585 struct hlist_node node;
60586@@ -252,7 +252,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
60587 extern int trace_add_event_call(struct ftrace_event_call *call);
60588 extern void trace_remove_event_call(struct ftrace_event_call *call);
60589
60590-#define is_signed_type(type) (((type)(-1)) < 0)
60591+#define is_signed_type(type) (((type)(-1)) < (type)1)
60592
60593 int trace_set_clr_event(const char *system, const char *event, int set);
60594
60595diff --git a/include/linux/genhd.h b/include/linux/genhd.h
60596index 02fa469..a15f279 100644
60597--- a/include/linux/genhd.h
60598+++ b/include/linux/genhd.h
60599@@ -184,7 +184,7 @@ struct gendisk {
60600 struct kobject *slave_dir;
60601
60602 struct timer_rand_state *random;
60603- atomic_t sync_io; /* RAID */
60604+ atomic_unchecked_t sync_io; /* RAID */
60605 struct disk_events *ev;
60606 #ifdef CONFIG_BLK_DEV_INTEGRITY
60607 struct blk_integrity *integrity;
60608diff --git a/include/linux/gracl.h b/include/linux/gracl.h
60609new file mode 100644
60610index 0000000..0dc3943
60611--- /dev/null
60612+++ b/include/linux/gracl.h
60613@@ -0,0 +1,317 @@
60614+#ifndef GR_ACL_H
60615+#define GR_ACL_H
60616+
60617+#include <linux/grdefs.h>
60618+#include <linux/resource.h>
60619+#include <linux/capability.h>
60620+#include <linux/dcache.h>
60621+#include <asm/resource.h>
60622+
60623+/* Major status information */
60624+
60625+#define GR_VERSION "grsecurity 2.2.2"
60626+#define GRSECURITY_VERSION 0x2202
60627+
60628+enum {
60629+ GR_SHUTDOWN = 0,
60630+ GR_ENABLE = 1,
60631+ GR_SPROLE = 2,
60632+ GR_RELOAD = 3,
60633+ GR_SEGVMOD = 4,
60634+ GR_STATUS = 5,
60635+ GR_UNSPROLE = 6,
60636+ GR_PASSSET = 7,
60637+ GR_SPROLEPAM = 8,
60638+};
60639+
60640+/* Password setup definitions
60641+ * kernel/grhash.c */
60642+enum {
60643+ GR_PW_LEN = 128,
60644+ GR_SALT_LEN = 16,
60645+ GR_SHA_LEN = 32,
60646+};
60647+
60648+enum {
60649+ GR_SPROLE_LEN = 64,
60650+};
60651+
60652+enum {
60653+ GR_NO_GLOB = 0,
60654+ GR_REG_GLOB,
60655+ GR_CREATE_GLOB
60656+};
60657+
60658+#define GR_NLIMITS 32
60659+
60660+/* Begin Data Structures */
60661+
60662+struct sprole_pw {
60663+ unsigned char *rolename;
60664+ unsigned char salt[GR_SALT_LEN];
60665+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
60666+};
60667+
60668+struct name_entry {
60669+ __u32 key;
60670+ ino_t inode;
60671+ dev_t device;
60672+ char *name;
60673+ __u16 len;
60674+ __u8 deleted;
60675+ struct name_entry *prev;
60676+ struct name_entry *next;
60677+};
60678+
60679+struct inodev_entry {
60680+ struct name_entry *nentry;
60681+ struct inodev_entry *prev;
60682+ struct inodev_entry *next;
60683+};
60684+
60685+struct acl_role_db {
60686+ struct acl_role_label **r_hash;
60687+ __u32 r_size;
60688+};
60689+
60690+struct inodev_db {
60691+ struct inodev_entry **i_hash;
60692+ __u32 i_size;
60693+};
60694+
60695+struct name_db {
60696+ struct name_entry **n_hash;
60697+ __u32 n_size;
60698+};
60699+
60700+struct crash_uid {
60701+ uid_t uid;
60702+ unsigned long expires;
60703+};
60704+
60705+struct gr_hash_struct {
60706+ void **table;
60707+ void **nametable;
60708+ void *first;
60709+ __u32 table_size;
60710+ __u32 used_size;
60711+ int type;
60712+};
60713+
60714+/* Userspace Grsecurity ACL data structures */
60715+
60716+struct acl_subject_label {
60717+ char *filename;
60718+ ino_t inode;
60719+ dev_t device;
60720+ __u32 mode;
60721+ kernel_cap_t cap_mask;
60722+ kernel_cap_t cap_lower;
60723+ kernel_cap_t cap_invert_audit;
60724+
60725+ struct rlimit res[GR_NLIMITS];
60726+ __u32 resmask;
60727+
60728+ __u8 user_trans_type;
60729+ __u8 group_trans_type;
60730+ uid_t *user_transitions;
60731+ gid_t *group_transitions;
60732+ __u16 user_trans_num;
60733+ __u16 group_trans_num;
60734+
60735+ __u32 sock_families[2];
60736+ __u32 ip_proto[8];
60737+ __u32 ip_type;
60738+ struct acl_ip_label **ips;
60739+ __u32 ip_num;
60740+ __u32 inaddr_any_override;
60741+
60742+ __u32 crashes;
60743+ unsigned long expires;
60744+
60745+ struct acl_subject_label *parent_subject;
60746+ struct gr_hash_struct *hash;
60747+ struct acl_subject_label *prev;
60748+ struct acl_subject_label *next;
60749+
60750+ struct acl_object_label **obj_hash;
60751+ __u32 obj_hash_size;
60752+ __u16 pax_flags;
60753+};
60754+
60755+struct role_allowed_ip {
60756+ __u32 addr;
60757+ __u32 netmask;
60758+
60759+ struct role_allowed_ip *prev;
60760+ struct role_allowed_ip *next;
60761+};
60762+
60763+struct role_transition {
60764+ char *rolename;
60765+
60766+ struct role_transition *prev;
60767+ struct role_transition *next;
60768+};
60769+
60770+struct acl_role_label {
60771+ char *rolename;
60772+ uid_t uidgid;
60773+ __u16 roletype;
60774+
60775+ __u16 auth_attempts;
60776+ unsigned long expires;
60777+
60778+ struct acl_subject_label *root_label;
60779+ struct gr_hash_struct *hash;
60780+
60781+ struct acl_role_label *prev;
60782+ struct acl_role_label *next;
60783+
60784+ struct role_transition *transitions;
60785+ struct role_allowed_ip *allowed_ips;
60786+ uid_t *domain_children;
60787+ __u16 domain_child_num;
60788+
60789+ struct acl_subject_label **subj_hash;
60790+ __u32 subj_hash_size;
60791+};
60792+
60793+struct user_acl_role_db {
60794+ struct acl_role_label **r_table;
60795+ __u32 num_pointers; /* Number of allocations to track */
60796+ __u32 num_roles; /* Number of roles */
60797+ __u32 num_domain_children; /* Number of domain children */
60798+ __u32 num_subjects; /* Number of subjects */
60799+ __u32 num_objects; /* Number of objects */
60800+};
60801+
60802+struct acl_object_label {
60803+ char *filename;
60804+ ino_t inode;
60805+ dev_t device;
60806+ __u32 mode;
60807+
60808+ struct acl_subject_label *nested;
60809+ struct acl_object_label *globbed;
60810+
60811+ /* next two structures not used */
60812+
60813+ struct acl_object_label *prev;
60814+ struct acl_object_label *next;
60815+};
60816+
60817+struct acl_ip_label {
60818+ char *iface;
60819+ __u32 addr;
60820+ __u32 netmask;
60821+ __u16 low, high;
60822+ __u8 mode;
60823+ __u32 type;
60824+ __u32 proto[8];
60825+
60826+ /* next two structures not used */
60827+
60828+ struct acl_ip_label *prev;
60829+ struct acl_ip_label *next;
60830+};
60831+
60832+struct gr_arg {
60833+ struct user_acl_role_db role_db;
60834+ unsigned char pw[GR_PW_LEN];
60835+ unsigned char salt[GR_SALT_LEN];
60836+ unsigned char sum[GR_SHA_LEN];
60837+ unsigned char sp_role[GR_SPROLE_LEN];
60838+ struct sprole_pw *sprole_pws;
60839+ dev_t segv_device;
60840+ ino_t segv_inode;
60841+ uid_t segv_uid;
60842+ __u16 num_sprole_pws;
60843+ __u16 mode;
60844+};
60845+
60846+struct gr_arg_wrapper {
60847+ struct gr_arg *arg;
60848+ __u32 version;
60849+ __u32 size;
60850+};
60851+
60852+struct subject_map {
60853+ struct acl_subject_label *user;
60854+ struct acl_subject_label *kernel;
60855+ struct subject_map *prev;
60856+ struct subject_map *next;
60857+};
60858+
60859+struct acl_subj_map_db {
60860+ struct subject_map **s_hash;
60861+ __u32 s_size;
60862+};
60863+
60864+/* End Data Structures Section */
60865+
60866+/* Hash functions generated by empirical testing by Brad Spengler
60867+ Makes good use of the low bits of the inode. Generally 0-1 times
60868+ in loop for successful match. 0-3 for unsuccessful match.
60869+ Shift/add algorithm with modulus of table size and an XOR*/
60870+
60871+static __inline__ unsigned int
60872+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
60873+{
60874+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
60875+}
60876+
60877+ static __inline__ unsigned int
60878+shash(const struct acl_subject_label *userp, const unsigned int sz)
60879+{
60880+ return ((const unsigned long)userp % sz);
60881+}
60882+
60883+static __inline__ unsigned int
60884+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
60885+{
60886+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
60887+}
60888+
60889+static __inline__ unsigned int
60890+nhash(const char *name, const __u16 len, const unsigned int sz)
60891+{
60892+ return full_name_hash((const unsigned char *)name, len) % sz;
60893+}
60894+
60895+#define FOR_EACH_ROLE_START(role) \
60896+ role = role_list; \
60897+ while (role) {
60898+
60899+#define FOR_EACH_ROLE_END(role) \
60900+ role = role->prev; \
60901+ }
60902+
60903+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
60904+ subj = NULL; \
60905+ iter = 0; \
60906+ while (iter < role->subj_hash_size) { \
60907+ if (subj == NULL) \
60908+ subj = role->subj_hash[iter]; \
60909+ if (subj == NULL) { \
60910+ iter++; \
60911+ continue; \
60912+ }
60913+
60914+#define FOR_EACH_SUBJECT_END(subj,iter) \
60915+ subj = subj->next; \
60916+ if (subj == NULL) \
60917+ iter++; \
60918+ }
60919+
60920+
60921+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
60922+ subj = role->hash->first; \
60923+ while (subj != NULL) {
60924+
60925+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
60926+ subj = subj->next; \
60927+ }
60928+
60929+#endif
60930+
60931diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
60932new file mode 100644
60933index 0000000..323ecf2
60934--- /dev/null
60935+++ b/include/linux/gralloc.h
60936@@ -0,0 +1,9 @@
60937+#ifndef __GRALLOC_H
60938+#define __GRALLOC_H
60939+
60940+void acl_free_all(void);
60941+int acl_alloc_stack_init(unsigned long size);
60942+void *acl_alloc(unsigned long len);
60943+void *acl_alloc_num(unsigned long num, unsigned long len);
60944+
60945+#endif
60946diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
60947new file mode 100644
60948index 0000000..b30e9bc
60949--- /dev/null
60950+++ b/include/linux/grdefs.h
60951@@ -0,0 +1,140 @@
60952+#ifndef GRDEFS_H
60953+#define GRDEFS_H
60954+
60955+/* Begin grsecurity status declarations */
60956+
60957+enum {
60958+ GR_READY = 0x01,
60959+ GR_STATUS_INIT = 0x00 // disabled state
60960+};
60961+
60962+/* Begin ACL declarations */
60963+
60964+/* Role flags */
60965+
60966+enum {
60967+ GR_ROLE_USER = 0x0001,
60968+ GR_ROLE_GROUP = 0x0002,
60969+ GR_ROLE_DEFAULT = 0x0004,
60970+ GR_ROLE_SPECIAL = 0x0008,
60971+ GR_ROLE_AUTH = 0x0010,
60972+ GR_ROLE_NOPW = 0x0020,
60973+ GR_ROLE_GOD = 0x0040,
60974+ GR_ROLE_LEARN = 0x0080,
60975+ GR_ROLE_TPE = 0x0100,
60976+ GR_ROLE_DOMAIN = 0x0200,
60977+ GR_ROLE_PAM = 0x0400,
60978+ GR_ROLE_PERSIST = 0x0800
60979+};
60980+
60981+/* ACL Subject and Object mode flags */
60982+enum {
60983+ GR_DELETED = 0x80000000
60984+};
60985+
60986+/* ACL Object-only mode flags */
60987+enum {
60988+ GR_READ = 0x00000001,
60989+ GR_APPEND = 0x00000002,
60990+ GR_WRITE = 0x00000004,
60991+ GR_EXEC = 0x00000008,
60992+ GR_FIND = 0x00000010,
60993+ GR_INHERIT = 0x00000020,
60994+ GR_SETID = 0x00000040,
60995+ GR_CREATE = 0x00000080,
60996+ GR_DELETE = 0x00000100,
60997+ GR_LINK = 0x00000200,
60998+ GR_AUDIT_READ = 0x00000400,
60999+ GR_AUDIT_APPEND = 0x00000800,
61000+ GR_AUDIT_WRITE = 0x00001000,
61001+ GR_AUDIT_EXEC = 0x00002000,
61002+ GR_AUDIT_FIND = 0x00004000,
61003+ GR_AUDIT_INHERIT= 0x00008000,
61004+ GR_AUDIT_SETID = 0x00010000,
61005+ GR_AUDIT_CREATE = 0x00020000,
61006+ GR_AUDIT_DELETE = 0x00040000,
61007+ GR_AUDIT_LINK = 0x00080000,
61008+ GR_PTRACERD = 0x00100000,
61009+ GR_NOPTRACE = 0x00200000,
61010+ GR_SUPPRESS = 0x00400000,
61011+ GR_NOLEARN = 0x00800000,
61012+ GR_INIT_TRANSFER= 0x01000000
61013+};
61014+
61015+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
61016+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
61017+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
61018+
61019+/* ACL subject-only mode flags */
61020+enum {
61021+ GR_KILL = 0x00000001,
61022+ GR_VIEW = 0x00000002,
61023+ GR_PROTECTED = 0x00000004,
61024+ GR_LEARN = 0x00000008,
61025+ GR_OVERRIDE = 0x00000010,
61026+ /* just a placeholder, this mode is only used in userspace */
61027+ GR_DUMMY = 0x00000020,
61028+ GR_PROTSHM = 0x00000040,
61029+ GR_KILLPROC = 0x00000080,
61030+ GR_KILLIPPROC = 0x00000100,
61031+ /* just a placeholder, this mode is only used in userspace */
61032+ GR_NOTROJAN = 0x00000200,
61033+ GR_PROTPROCFD = 0x00000400,
61034+ GR_PROCACCT = 0x00000800,
61035+ GR_RELAXPTRACE = 0x00001000,
61036+ GR_NESTED = 0x00002000,
61037+ GR_INHERITLEARN = 0x00004000,
61038+ GR_PROCFIND = 0x00008000,
61039+ GR_POVERRIDE = 0x00010000,
61040+ GR_KERNELAUTH = 0x00020000,
61041+ GR_ATSECURE = 0x00040000,
61042+ GR_SHMEXEC = 0x00080000
61043+};
61044+
61045+enum {
61046+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
61047+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
61048+ GR_PAX_ENABLE_MPROTECT = 0x0004,
61049+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
61050+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
61051+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
61052+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
61053+ GR_PAX_DISABLE_MPROTECT = 0x0400,
61054+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
61055+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
61056+};
61057+
61058+enum {
61059+ GR_ID_USER = 0x01,
61060+ GR_ID_GROUP = 0x02,
61061+};
61062+
61063+enum {
61064+ GR_ID_ALLOW = 0x01,
61065+ GR_ID_DENY = 0x02,
61066+};
61067+
61068+#define GR_CRASH_RES 31
61069+#define GR_UIDTABLE_MAX 500
61070+
61071+/* begin resource learning section */
61072+enum {
61073+ GR_RLIM_CPU_BUMP = 60,
61074+ GR_RLIM_FSIZE_BUMP = 50000,
61075+ GR_RLIM_DATA_BUMP = 10000,
61076+ GR_RLIM_STACK_BUMP = 1000,
61077+ GR_RLIM_CORE_BUMP = 10000,
61078+ GR_RLIM_RSS_BUMP = 500000,
61079+ GR_RLIM_NPROC_BUMP = 1,
61080+ GR_RLIM_NOFILE_BUMP = 5,
61081+ GR_RLIM_MEMLOCK_BUMP = 50000,
61082+ GR_RLIM_AS_BUMP = 500000,
61083+ GR_RLIM_LOCKS_BUMP = 2,
61084+ GR_RLIM_SIGPENDING_BUMP = 5,
61085+ GR_RLIM_MSGQUEUE_BUMP = 10000,
61086+ GR_RLIM_NICE_BUMP = 1,
61087+ GR_RLIM_RTPRIO_BUMP = 1,
61088+ GR_RLIM_RTTIME_BUMP = 1000000
61089+};
61090+
61091+#endif
61092diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
61093new file mode 100644
61094index 0000000..60cda84
61095--- /dev/null
61096+++ b/include/linux/grinternal.h
61097@@ -0,0 +1,220 @@
61098+#ifndef __GRINTERNAL_H
61099+#define __GRINTERNAL_H
61100+
61101+#ifdef CONFIG_GRKERNSEC
61102+
61103+#include <linux/fs.h>
61104+#include <linux/mnt_namespace.h>
61105+#include <linux/nsproxy.h>
61106+#include <linux/gracl.h>
61107+#include <linux/grdefs.h>
61108+#include <linux/grmsg.h>
61109+
61110+void gr_add_learn_entry(const char *fmt, ...)
61111+ __attribute__ ((format (printf, 1, 2)));
61112+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
61113+ const struct vfsmount *mnt);
61114+__u32 gr_check_create(const struct dentry *new_dentry,
61115+ const struct dentry *parent,
61116+ const struct vfsmount *mnt, const __u32 mode);
61117+int gr_check_protected_task(const struct task_struct *task);
61118+__u32 to_gr_audit(const __u32 reqmode);
61119+int gr_set_acls(const int type);
61120+int gr_apply_subject_to_task(struct task_struct *task);
61121+int gr_acl_is_enabled(void);
61122+char gr_roletype_to_char(void);
61123+
61124+void gr_handle_alertkill(struct task_struct *task);
61125+char *gr_to_filename(const struct dentry *dentry,
61126+ const struct vfsmount *mnt);
61127+char *gr_to_filename1(const struct dentry *dentry,
61128+ const struct vfsmount *mnt);
61129+char *gr_to_filename2(const struct dentry *dentry,
61130+ const struct vfsmount *mnt);
61131+char *gr_to_filename3(const struct dentry *dentry,
61132+ const struct vfsmount *mnt);
61133+
61134+extern int grsec_enable_harden_ptrace;
61135+extern int grsec_enable_link;
61136+extern int grsec_enable_fifo;
61137+extern int grsec_enable_execve;
61138+extern int grsec_enable_shm;
61139+extern int grsec_enable_execlog;
61140+extern int grsec_enable_signal;
61141+extern int grsec_enable_audit_ptrace;
61142+extern int grsec_enable_forkfail;
61143+extern int grsec_enable_time;
61144+extern int grsec_enable_rofs;
61145+extern int grsec_enable_chroot_shmat;
61146+extern int grsec_enable_chroot_mount;
61147+extern int grsec_enable_chroot_double;
61148+extern int grsec_enable_chroot_pivot;
61149+extern int grsec_enable_chroot_chdir;
61150+extern int grsec_enable_chroot_chmod;
61151+extern int grsec_enable_chroot_mknod;
61152+extern int grsec_enable_chroot_fchdir;
61153+extern int grsec_enable_chroot_nice;
61154+extern int grsec_enable_chroot_execlog;
61155+extern int grsec_enable_chroot_caps;
61156+extern int grsec_enable_chroot_sysctl;
61157+extern int grsec_enable_chroot_unix;
61158+extern int grsec_enable_tpe;
61159+extern int grsec_tpe_gid;
61160+extern int grsec_enable_tpe_all;
61161+extern int grsec_enable_tpe_invert;
61162+extern int grsec_enable_socket_all;
61163+extern int grsec_socket_all_gid;
61164+extern int grsec_enable_socket_client;
61165+extern int grsec_socket_client_gid;
61166+extern int grsec_enable_socket_server;
61167+extern int grsec_socket_server_gid;
61168+extern int grsec_audit_gid;
61169+extern int grsec_enable_group;
61170+extern int grsec_enable_audit_textrel;
61171+extern int grsec_enable_log_rwxmaps;
61172+extern int grsec_enable_mount;
61173+extern int grsec_enable_chdir;
61174+extern int grsec_resource_logging;
61175+extern int grsec_enable_blackhole;
61176+extern int grsec_lastack_retries;
61177+extern int grsec_enable_brute;
61178+extern int grsec_lock;
61179+
61180+extern spinlock_t grsec_alert_lock;
61181+extern unsigned long grsec_alert_wtime;
61182+extern unsigned long grsec_alert_fyet;
61183+
61184+extern spinlock_t grsec_audit_lock;
61185+
61186+extern rwlock_t grsec_exec_file_lock;
61187+
61188+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
61189+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
61190+ (tsk)->exec_file->f_vfsmnt) : "/")
61191+
61192+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
61193+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
61194+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61195+
61196+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
61197+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
61198+ (tsk)->exec_file->f_vfsmnt) : "/")
61199+
61200+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
61201+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
61202+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61203+
61204+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
61205+
61206+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
61207+
61208+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
61209+ (task)->pid, (cred)->uid, \
61210+ (cred)->euid, (cred)->gid, (cred)->egid, \
61211+ gr_parent_task_fullpath(task), \
61212+ (task)->real_parent->comm, (task)->real_parent->pid, \
61213+ (pcred)->uid, (pcred)->euid, \
61214+ (pcred)->gid, (pcred)->egid
61215+
61216+#define GR_CHROOT_CAPS {{ \
61217+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
61218+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
61219+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
61220+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
61221+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
61222+ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
61223+ CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
61224+
61225+#define security_learn(normal_msg,args...) \
61226+({ \
61227+ read_lock(&grsec_exec_file_lock); \
61228+ gr_add_learn_entry(normal_msg "\n", ## args); \
61229+ read_unlock(&grsec_exec_file_lock); \
61230+})
61231+
61232+enum {
61233+ GR_DO_AUDIT,
61234+ GR_DONT_AUDIT,
61235+ /* used for non-audit messages that we shouldn't kill the task on */
61236+ GR_DONT_AUDIT_GOOD
61237+};
61238+
61239+enum {
61240+ GR_TTYSNIFF,
61241+ GR_RBAC,
61242+ GR_RBAC_STR,
61243+ GR_STR_RBAC,
61244+ GR_RBAC_MODE2,
61245+ GR_RBAC_MODE3,
61246+ GR_FILENAME,
61247+ GR_SYSCTL_HIDDEN,
61248+ GR_NOARGS,
61249+ GR_ONE_INT,
61250+ GR_ONE_INT_TWO_STR,
61251+ GR_ONE_STR,
61252+ GR_STR_INT,
61253+ GR_TWO_STR_INT,
61254+ GR_TWO_INT,
61255+ GR_TWO_U64,
61256+ GR_THREE_INT,
61257+ GR_FIVE_INT_TWO_STR,
61258+ GR_TWO_STR,
61259+ GR_THREE_STR,
61260+ GR_FOUR_STR,
61261+ GR_STR_FILENAME,
61262+ GR_FILENAME_STR,
61263+ GR_FILENAME_TWO_INT,
61264+ GR_FILENAME_TWO_INT_STR,
61265+ GR_TEXTREL,
61266+ GR_PTRACE,
61267+ GR_RESOURCE,
61268+ GR_CAP,
61269+ GR_SIG,
61270+ GR_SIG2,
61271+ GR_CRASH1,
61272+ GR_CRASH2,
61273+ GR_PSACCT,
61274+ GR_RWXMAP
61275+};
61276+
61277+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
61278+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
61279+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
61280+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
61281+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
61282+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
61283+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
61284+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
61285+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
61286+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
61287+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
61288+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
61289+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
61290+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
61291+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
61292+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
61293+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
61294+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
61295+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
61296+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
61297+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
61298+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
61299+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
61300+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
61301+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
61302+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
61303+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
61304+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
61305+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
61306+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
61307+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
61308+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
61309+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
61310+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
61311+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
61312+
61313+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
61314+
61315+#endif
61316+
61317+#endif
61318diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
61319new file mode 100644
61320index 0000000..9d5fd4a
61321--- /dev/null
61322+++ b/include/linux/grmsg.h
61323@@ -0,0 +1,108 @@
61324+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
61325+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
61326+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
61327+#define GR_STOPMOD_MSG "denied modification of module state by "
61328+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
61329+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
61330+#define GR_IOPERM_MSG "denied use of ioperm() by "
61331+#define GR_IOPL_MSG "denied use of iopl() by "
61332+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
61333+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
61334+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
61335+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
61336+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
61337+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
61338+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
61339+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
61340+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
61341+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
61342+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
61343+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
61344+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
61345+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
61346+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
61347+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
61348+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
61349+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
61350+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
61351+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
61352+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
61353+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
61354+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
61355+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
61356+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
61357+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
61358+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
61359+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
61360+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
61361+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
61362+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
61363+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
61364+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
61365+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
61366+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
61367+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
61368+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
61369+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
61370+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
61371+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
61372+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
61373+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
61374+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
61375+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
61376+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
61377+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
61378+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
61379+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
61380+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
61381+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
61382+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
61383+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
61384+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
61385+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
61386+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
61387+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
61388+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
61389+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
61390+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
61391+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
61392+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
61393+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
61394+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
61395+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
61396+#define GR_FAILFORK_MSG "failed fork with errno %s by "
61397+#define GR_NICE_CHROOT_MSG "denied priority change by "
61398+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
61399+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
61400+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
61401+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
61402+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
61403+#define GR_TIME_MSG "time set by "
61404+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
61405+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
61406+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
61407+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
61408+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
61409+#define GR_BIND_MSG "denied bind() by "
61410+#define GR_CONNECT_MSG "denied connect() by "
61411+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
61412+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
61413+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
61414+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
61415+#define GR_CAP_ACL_MSG "use of %s denied for "
61416+#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
61417+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
61418+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
61419+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
61420+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
61421+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
61422+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
61423+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
61424+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
61425+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
61426+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
61427+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
61428+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
61429+#define GR_VM86_MSG "denied use of vm86 by "
61430+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
61431+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
61432diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
61433new file mode 100644
61434index 0000000..4620f36
61435--- /dev/null
61436+++ b/include/linux/grsecurity.h
61437@@ -0,0 +1,231 @@
61438+#ifndef GR_SECURITY_H
61439+#define GR_SECURITY_H
61440+#include <linux/fs.h>
61441+#include <linux/fs_struct.h>
61442+#include <linux/binfmts.h>
61443+#include <linux/gracl.h>
61444+
61445+/* notify of brain-dead configs */
61446+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
61447+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
61448+#endif
61449+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
61450+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
61451+#endif
61452+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61453+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61454+#endif
61455+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61456+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61457+#endif
61458+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
61459+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
61460+#endif
61461+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
61462+#error "CONFIG_PAX enabled, but no PaX options are enabled."
61463+#endif
61464+
61465+#include <linux/compat.h>
61466+
61467+struct user_arg_ptr {
61468+#ifdef CONFIG_COMPAT
61469+ bool is_compat;
61470+#endif
61471+ union {
61472+ const char __user *const __user *native;
61473+#ifdef CONFIG_COMPAT
61474+ compat_uptr_t __user *compat;
61475+#endif
61476+ } ptr;
61477+};
61478+
61479+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
61480+void gr_handle_brute_check(void);
61481+void gr_handle_kernel_exploit(void);
61482+int gr_process_user_ban(void);
61483+
61484+char gr_roletype_to_char(void);
61485+
61486+int gr_acl_enable_at_secure(void);
61487+
61488+int gr_check_user_change(int real, int effective, int fs);
61489+int gr_check_group_change(int real, int effective, int fs);
61490+
61491+void gr_del_task_from_ip_table(struct task_struct *p);
61492+
61493+int gr_pid_is_chrooted(struct task_struct *p);
61494+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
61495+int gr_handle_chroot_nice(void);
61496+int gr_handle_chroot_sysctl(const int op);
61497+int gr_handle_chroot_setpriority(struct task_struct *p,
61498+ const int niceval);
61499+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
61500+int gr_handle_chroot_chroot(const struct dentry *dentry,
61501+ const struct vfsmount *mnt);
61502+void gr_handle_chroot_chdir(struct path *path);
61503+int gr_handle_chroot_chmod(const struct dentry *dentry,
61504+ const struct vfsmount *mnt, const int mode);
61505+int gr_handle_chroot_mknod(const struct dentry *dentry,
61506+ const struct vfsmount *mnt, const int mode);
61507+int gr_handle_chroot_mount(const struct dentry *dentry,
61508+ const struct vfsmount *mnt,
61509+ const char *dev_name);
61510+int gr_handle_chroot_pivot(void);
61511+int gr_handle_chroot_unix(const pid_t pid);
61512+
61513+int gr_handle_rawio(const struct inode *inode);
61514+
61515+void gr_handle_ioperm(void);
61516+void gr_handle_iopl(void);
61517+
61518+int gr_tpe_allow(const struct file *file);
61519+
61520+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
61521+void gr_clear_chroot_entries(struct task_struct *task);
61522+
61523+void gr_log_forkfail(const int retval);
61524+void gr_log_timechange(void);
61525+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
61526+void gr_log_chdir(const struct dentry *dentry,
61527+ const struct vfsmount *mnt);
61528+void gr_log_chroot_exec(const struct dentry *dentry,
61529+ const struct vfsmount *mnt);
61530+void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
61531+void gr_log_remount(const char *devname, const int retval);
61532+void gr_log_unmount(const char *devname, const int retval);
61533+void gr_log_mount(const char *from, const char *to, const int retval);
61534+void gr_log_textrel(struct vm_area_struct *vma);
61535+void gr_log_rwxmmap(struct file *file);
61536+void gr_log_rwxmprotect(struct file *file);
61537+
61538+int gr_handle_follow_link(const struct inode *parent,
61539+ const struct inode *inode,
61540+ const struct dentry *dentry,
61541+ const struct vfsmount *mnt);
61542+int gr_handle_fifo(const struct dentry *dentry,
61543+ const struct vfsmount *mnt,
61544+ const struct dentry *dir, const int flag,
61545+ const int acc_mode);
61546+int gr_handle_hardlink(const struct dentry *dentry,
61547+ const struct vfsmount *mnt,
61548+ struct inode *inode,
61549+ const int mode, const char *to);
61550+
61551+int gr_is_capable(const int cap);
61552+int gr_is_capable_nolog(const int cap);
61553+void gr_learn_resource(const struct task_struct *task, const int limit,
61554+ const unsigned long wanted, const int gt);
61555+void gr_copy_label(struct task_struct *tsk);
61556+void gr_handle_crash(struct task_struct *task, const int sig);
61557+int gr_handle_signal(const struct task_struct *p, const int sig);
61558+int gr_check_crash_uid(const uid_t uid);
61559+int gr_check_protected_task(const struct task_struct *task);
61560+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
61561+int gr_acl_handle_mmap(const struct file *file,
61562+ const unsigned long prot);
61563+int gr_acl_handle_mprotect(const struct file *file,
61564+ const unsigned long prot);
61565+int gr_check_hidden_task(const struct task_struct *tsk);
61566+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
61567+ const struct vfsmount *mnt);
61568+__u32 gr_acl_handle_utime(const struct dentry *dentry,
61569+ const struct vfsmount *mnt);
61570+__u32 gr_acl_handle_access(const struct dentry *dentry,
61571+ const struct vfsmount *mnt, const int fmode);
61572+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
61573+ const struct vfsmount *mnt, mode_t mode);
61574+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
61575+ const struct vfsmount *mnt, mode_t mode);
61576+__u32 gr_acl_handle_chown(const struct dentry *dentry,
61577+ const struct vfsmount *mnt);
61578+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
61579+ const struct vfsmount *mnt);
61580+int gr_handle_ptrace(struct task_struct *task, const long request);
61581+int gr_handle_proc_ptrace(struct task_struct *task);
61582+__u32 gr_acl_handle_execve(const struct dentry *dentry,
61583+ const struct vfsmount *mnt);
61584+int gr_check_crash_exec(const struct file *filp);
61585+int gr_acl_is_enabled(void);
61586+void gr_set_kernel_label(struct task_struct *task);
61587+void gr_set_role_label(struct task_struct *task, const uid_t uid,
61588+ const gid_t gid);
61589+int gr_set_proc_label(const struct dentry *dentry,
61590+ const struct vfsmount *mnt,
61591+ const int unsafe_share);
61592+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
61593+ const struct vfsmount *mnt);
61594+__u32 gr_acl_handle_open(const struct dentry *dentry,
61595+ const struct vfsmount *mnt, int acc_mode);
61596+__u32 gr_acl_handle_creat(const struct dentry *dentry,
61597+ const struct dentry *p_dentry,
61598+ const struct vfsmount *p_mnt,
61599+ int open_flags, int acc_mode, const int imode);
61600+void gr_handle_create(const struct dentry *dentry,
61601+ const struct vfsmount *mnt);
61602+void gr_handle_proc_create(const struct dentry *dentry,
61603+ const struct inode *inode);
61604+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
61605+ const struct dentry *parent_dentry,
61606+ const struct vfsmount *parent_mnt,
61607+ const int mode);
61608+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
61609+ const struct dentry *parent_dentry,
61610+ const struct vfsmount *parent_mnt);
61611+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
61612+ const struct vfsmount *mnt);
61613+void gr_handle_delete(const ino_t ino, const dev_t dev);
61614+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
61615+ const struct vfsmount *mnt);
61616+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
61617+ const struct dentry *parent_dentry,
61618+ const struct vfsmount *parent_mnt,
61619+ const char *from);
61620+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
61621+ const struct dentry *parent_dentry,
61622+ const struct vfsmount *parent_mnt,
61623+ const struct dentry *old_dentry,
61624+ const struct vfsmount *old_mnt, const char *to);
61625+int gr_acl_handle_rename(struct dentry *new_dentry,
61626+ struct dentry *parent_dentry,
61627+ const struct vfsmount *parent_mnt,
61628+ struct dentry *old_dentry,
61629+ struct inode *old_parent_inode,
61630+ struct vfsmount *old_mnt, const char *newname);
61631+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
61632+ struct dentry *old_dentry,
61633+ struct dentry *new_dentry,
61634+ struct vfsmount *mnt, const __u8 replace);
61635+__u32 gr_check_link(const struct dentry *new_dentry,
61636+ const struct dentry *parent_dentry,
61637+ const struct vfsmount *parent_mnt,
61638+ const struct dentry *old_dentry,
61639+ const struct vfsmount *old_mnt);
61640+int gr_acl_handle_filldir(const struct file *file, const char *name,
61641+ const unsigned int namelen, const ino_t ino);
61642+
61643+__u32 gr_acl_handle_unix(const struct dentry *dentry,
61644+ const struct vfsmount *mnt);
61645+void gr_acl_handle_exit(void);
61646+void gr_acl_handle_psacct(struct task_struct *task, const long code);
61647+int gr_acl_handle_procpidmem(const struct task_struct *task);
61648+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
61649+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
61650+void gr_audit_ptrace(struct task_struct *task);
61651+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
61652+
61653+#ifdef CONFIG_GRKERNSEC
61654+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
61655+void gr_handle_vm86(void);
61656+void gr_handle_mem_readwrite(u64 from, u64 to);
61657+
61658+extern int grsec_enable_dmesg;
61659+extern int grsec_disable_privio;
61660+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
61661+extern int grsec_enable_chroot_findtask;
61662+#endif
61663+#ifdef CONFIG_GRKERNSEC_SETXID
61664+extern int grsec_enable_setxid;
61665+#endif
61666+#endif
61667+
61668+#endif
61669diff --git a/include/linux/grsock.h b/include/linux/grsock.h
61670new file mode 100644
61671index 0000000..e7ffaaf
61672--- /dev/null
61673+++ b/include/linux/grsock.h
61674@@ -0,0 +1,19 @@
61675+#ifndef __GRSOCK_H
61676+#define __GRSOCK_H
61677+
61678+extern void gr_attach_curr_ip(const struct sock *sk);
61679+extern int gr_handle_sock_all(const int family, const int type,
61680+ const int protocol);
61681+extern int gr_handle_sock_server(const struct sockaddr *sck);
61682+extern int gr_handle_sock_server_other(const struct sock *sck);
61683+extern int gr_handle_sock_client(const struct sockaddr *sck);
61684+extern int gr_search_connect(struct socket * sock,
61685+ struct sockaddr_in * addr);
61686+extern int gr_search_bind(struct socket * sock,
61687+ struct sockaddr_in * addr);
61688+extern int gr_search_listen(struct socket * sock);
61689+extern int gr_search_accept(struct socket * sock);
61690+extern int gr_search_socket(const int domain, const int type,
61691+ const int protocol);
61692+
61693+#endif
61694diff --git a/include/linux/hid.h b/include/linux/hid.h
61695index 9cf8e7a..5ec94d0 100644
61696--- a/include/linux/hid.h
61697+++ b/include/linux/hid.h
61698@@ -676,7 +676,7 @@ struct hid_ll_driver {
61699 unsigned int code, int value);
61700
61701 int (*parse)(struct hid_device *hdev);
61702-};
61703+} __no_const;
61704
61705 #define PM_HINT_FULLON 1<<5
61706 #define PM_HINT_NORMAL 1<<1
61707diff --git a/include/linux/highmem.h b/include/linux/highmem.h
61708index 3a93f73..b19d0b3 100644
61709--- a/include/linux/highmem.h
61710+++ b/include/linux/highmem.h
61711@@ -185,6 +185,18 @@ static inline void clear_highpage(struct page *page)
61712 kunmap_atomic(kaddr, KM_USER0);
61713 }
61714
61715+static inline void sanitize_highpage(struct page *page)
61716+{
61717+ void *kaddr;
61718+ unsigned long flags;
61719+
61720+ local_irq_save(flags);
61721+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
61722+ clear_page(kaddr);
61723+ kunmap_atomic(kaddr, KM_CLEARPAGE);
61724+ local_irq_restore(flags);
61725+}
61726+
61727 static inline void zero_user_segments(struct page *page,
61728 unsigned start1, unsigned end1,
61729 unsigned start2, unsigned end2)
61730diff --git a/include/linux/i2c.h b/include/linux/i2c.h
61731index a6c652e..1f5878f 100644
61732--- a/include/linux/i2c.h
61733+++ b/include/linux/i2c.h
61734@@ -346,6 +346,7 @@ struct i2c_algorithm {
61735 /* To determine what the adapter supports */
61736 u32 (*functionality) (struct i2c_adapter *);
61737 };
61738+typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
61739
61740 /*
61741 * i2c_adapter is the structure used to identify a physical i2c bus along
61742diff --git a/include/linux/i2o.h b/include/linux/i2o.h
61743index a6deef4..c56a7f2 100644
61744--- a/include/linux/i2o.h
61745+++ b/include/linux/i2o.h
61746@@ -564,7 +564,7 @@ struct i2o_controller {
61747 struct i2o_device *exec; /* Executive */
61748 #if BITS_PER_LONG == 64
61749 spinlock_t context_list_lock; /* lock for context_list */
61750- atomic_t context_list_counter; /* needed for unique contexts */
61751+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
61752 struct list_head context_list; /* list of context id's
61753 and pointers */
61754 #endif
61755diff --git a/include/linux/init.h b/include/linux/init.h
61756index 9146f39..885354d 100644
61757--- a/include/linux/init.h
61758+++ b/include/linux/init.h
61759@@ -293,13 +293,13 @@ void __init parse_early_options(char *cmdline);
61760
61761 /* Each module must use one module_init(). */
61762 #define module_init(initfn) \
61763- static inline initcall_t __inittest(void) \
61764+ static inline __used initcall_t __inittest(void) \
61765 { return initfn; } \
61766 int init_module(void) __attribute__((alias(#initfn)));
61767
61768 /* This is only required if you want to be unloadable. */
61769 #define module_exit(exitfn) \
61770- static inline exitcall_t __exittest(void) \
61771+ static inline __used exitcall_t __exittest(void) \
61772 { return exitfn; } \
61773 void cleanup_module(void) __attribute__((alias(#exitfn)));
61774
61775diff --git a/include/linux/init_task.h b/include/linux/init_task.h
61776index d14e058..4162929 100644
61777--- a/include/linux/init_task.h
61778+++ b/include/linux/init_task.h
61779@@ -126,6 +126,12 @@ extern struct cred init_cred;
61780 # define INIT_PERF_EVENTS(tsk)
61781 #endif
61782
61783+#ifdef CONFIG_X86
61784+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
61785+#else
61786+#define INIT_TASK_THREAD_INFO
61787+#endif
61788+
61789 /*
61790 * INIT_TASK is used to set up the first task table, touch at
61791 * your own risk!. Base=0, limit=0x1fffff (=2MB)
61792@@ -164,6 +170,7 @@ extern struct cred init_cred;
61793 RCU_INIT_POINTER(.cred, &init_cred), \
61794 .comm = "swapper", \
61795 .thread = INIT_THREAD, \
61796+ INIT_TASK_THREAD_INFO \
61797 .fs = &init_fs, \
61798 .files = &init_files, \
61799 .signal = &init_signals, \
61800diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
61801index 9310c69..6ebb244 100644
61802--- a/include/linux/intel-iommu.h
61803+++ b/include/linux/intel-iommu.h
61804@@ -296,7 +296,7 @@ struct iommu_flush {
61805 u8 fm, u64 type);
61806 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
61807 unsigned int size_order, u64 type);
61808-};
61809+} __no_const;
61810
61811 enum {
61812 SR_DMAR_FECTL_REG,
61813diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
61814index f51a81b..adfcb44 100644
61815--- a/include/linux/interrupt.h
61816+++ b/include/linux/interrupt.h
61817@@ -425,7 +425,7 @@ enum
61818 /* map softirq index to softirq name. update 'softirq_to_name' in
61819 * kernel/softirq.c when adding a new softirq.
61820 */
61821-extern char *softirq_to_name[NR_SOFTIRQS];
61822+extern const char * const softirq_to_name[NR_SOFTIRQS];
61823
61824 /* softirq mask and active fields moved to irq_cpustat_t in
61825 * asm/hardirq.h to get better cache usage. KAO
61826@@ -433,12 +433,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
61827
61828 struct softirq_action
61829 {
61830- void (*action)(struct softirq_action *);
61831+ void (*action)(void);
61832 };
61833
61834 asmlinkage void do_softirq(void);
61835 asmlinkage void __do_softirq(void);
61836-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
61837+extern void open_softirq(int nr, void (*action)(void));
61838 extern void softirq_init(void);
61839 static inline void __raise_softirq_irqoff(unsigned int nr)
61840 {
61841diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
61842index 0df513b..fe901a2 100644
61843--- a/include/linux/kallsyms.h
61844+++ b/include/linux/kallsyms.h
61845@@ -15,7 +15,8 @@
61846
61847 struct module;
61848
61849-#ifdef CONFIG_KALLSYMS
61850+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
61851+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
61852 /* Lookup the address for a symbol. Returns 0 if not found. */
61853 unsigned long kallsyms_lookup_name(const char *name);
61854
61855@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
61856 /* Stupid that this does nothing, but I didn't create this mess. */
61857 #define __print_symbol(fmt, addr)
61858 #endif /*CONFIG_KALLSYMS*/
61859+#else /* when included by kallsyms.c, vsnprintf.c, or
61860+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
61861+extern void __print_symbol(const char *fmt, unsigned long address);
61862+extern int sprint_backtrace(char *buffer, unsigned long address);
61863+extern int sprint_symbol(char *buffer, unsigned long address);
61864+const char *kallsyms_lookup(unsigned long addr,
61865+ unsigned long *symbolsize,
61866+ unsigned long *offset,
61867+ char **modname, char *namebuf);
61868+#endif
61869
61870 /* This macro allows us to keep printk typechecking */
61871 static void __check_printsym_format(const char *fmt, ...)
61872diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
61873index fa39183..40160be 100644
61874--- a/include/linux/kgdb.h
61875+++ b/include/linux/kgdb.h
61876@@ -53,7 +53,7 @@ extern int kgdb_connected;
61877 extern int kgdb_io_module_registered;
61878
61879 extern atomic_t kgdb_setting_breakpoint;
61880-extern atomic_t kgdb_cpu_doing_single_step;
61881+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
61882
61883 extern struct task_struct *kgdb_usethread;
61884 extern struct task_struct *kgdb_contthread;
61885@@ -251,7 +251,7 @@ struct kgdb_arch {
61886 void (*disable_hw_break)(struct pt_regs *regs);
61887 void (*remove_all_hw_break)(void);
61888 void (*correct_hw_break)(void);
61889-};
61890+} __do_const;
61891
61892 /**
61893 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
61894@@ -276,7 +276,7 @@ struct kgdb_io {
61895 void (*pre_exception) (void);
61896 void (*post_exception) (void);
61897 int is_console;
61898-};
61899+} __do_const;
61900
61901 extern struct kgdb_arch arch_kgdb_ops;
61902
61903diff --git a/include/linux/kmod.h b/include/linux/kmod.h
61904index 0da38cf..d23f05f 100644
61905--- a/include/linux/kmod.h
61906+++ b/include/linux/kmod.h
61907@@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */
61908 * usually useless though. */
61909 extern int __request_module(bool wait, const char *name, ...) \
61910 __attribute__((format(printf, 2, 3)));
61911+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
61912+ __attribute__((format(printf, 3, 4)));
61913 #define request_module(mod...) __request_module(true, mod)
61914 #define request_module_nowait(mod...) __request_module(false, mod)
61915 #define try_then_request_module(x, mod...) \
61916diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
61917index eabb21a..3f030f4 100644
61918--- a/include/linux/kvm_host.h
61919+++ b/include/linux/kvm_host.h
61920@@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
61921 void vcpu_load(struct kvm_vcpu *vcpu);
61922 void vcpu_put(struct kvm_vcpu *vcpu);
61923
61924-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
61925+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
61926 struct module *module);
61927 void kvm_exit(void);
61928
61929@@ -454,7 +454,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
61930 struct kvm_guest_debug *dbg);
61931 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
61932
61933-int kvm_arch_init(void *opaque);
61934+int kvm_arch_init(const void *opaque);
61935 void kvm_arch_exit(void);
61936
61937 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
61938diff --git a/include/linux/libata.h b/include/linux/libata.h
61939index efd6f98..5f5fd37 100644
61940--- a/include/linux/libata.h
61941+++ b/include/linux/libata.h
61942@@ -909,7 +909,7 @@ struct ata_port_operations {
61943 * fields must be pointers.
61944 */
61945 const struct ata_port_operations *inherits;
61946-};
61947+} __do_const;
61948
61949 struct ata_port_info {
61950 unsigned long flags;
61951diff --git a/include/linux/mca.h b/include/linux/mca.h
61952index 3797270..7765ede 100644
61953--- a/include/linux/mca.h
61954+++ b/include/linux/mca.h
61955@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
61956 int region);
61957 void * (*mca_transform_memory)(struct mca_device *,
61958 void *memory);
61959-};
61960+} __no_const;
61961
61962 struct mca_bus {
61963 u64 default_dma_mask;
61964diff --git a/include/linux/memory.h b/include/linux/memory.h
61965index 935699b..11042cc 100644
61966--- a/include/linux/memory.h
61967+++ b/include/linux/memory.h
61968@@ -144,7 +144,7 @@ struct memory_accessor {
61969 size_t count);
61970 ssize_t (*write)(struct memory_accessor *, const char *buf,
61971 off_t offset, size_t count);
61972-};
61973+} __no_const;
61974
61975 /*
61976 * Kernel text modification mutex, used for code patching. Users of this lock
61977diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
61978index 896b5e4..1159ad0 100644
61979--- a/include/linux/mfd/abx500.h
61980+++ b/include/linux/mfd/abx500.h
61981@@ -234,6 +234,7 @@ struct abx500_ops {
61982 int (*event_registers_startup_state_get) (struct device *, u8 *);
61983 int (*startup_irq_enabled) (struct device *, unsigned int);
61984 };
61985+typedef struct abx500_ops __no_const abx500_ops_no_const;
61986
61987 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
61988 void abx500_remove_ops(struct device *dev);
61989diff --git a/include/linux/mm.h b/include/linux/mm.h
61990index fedc5f0..7cedb6d 100644
61991--- a/include/linux/mm.h
61992+++ b/include/linux/mm.h
61993@@ -114,7 +114,14 @@ extern unsigned int kobjsize(const void *objp);
61994
61995 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
61996 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
61997+
61998+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
61999+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
62000+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
62001+#else
62002 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
62003+#endif
62004+
62005 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
62006 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
62007
62008@@ -1011,34 +1018,6 @@ int set_page_dirty(struct page *page);
62009 int set_page_dirty_lock(struct page *page);
62010 int clear_page_dirty_for_io(struct page *page);
62011
62012-/* Is the vma a continuation of the stack vma above it? */
62013-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
62014-{
62015- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
62016-}
62017-
62018-static inline int stack_guard_page_start(struct vm_area_struct *vma,
62019- unsigned long addr)
62020-{
62021- return (vma->vm_flags & VM_GROWSDOWN) &&
62022- (vma->vm_start == addr) &&
62023- !vma_growsdown(vma->vm_prev, addr);
62024-}
62025-
62026-/* Is the vma a continuation of the stack vma below it? */
62027-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
62028-{
62029- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
62030-}
62031-
62032-static inline int stack_guard_page_end(struct vm_area_struct *vma,
62033- unsigned long addr)
62034-{
62035- return (vma->vm_flags & VM_GROWSUP) &&
62036- (vma->vm_end == addr) &&
62037- !vma_growsup(vma->vm_next, addr);
62038-}
62039-
62040 extern unsigned long move_page_tables(struct vm_area_struct *vma,
62041 unsigned long old_addr, struct vm_area_struct *new_vma,
62042 unsigned long new_addr, unsigned long len);
62043@@ -1133,6 +1112,15 @@ static inline void sync_mm_rss(struct task_struct *task, struct mm_struct *mm)
62044 }
62045 #endif
62046
62047+#ifdef CONFIG_MMU
62048+pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
62049+#else
62050+static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
62051+{
62052+ return __pgprot(0);
62053+}
62054+#endif
62055+
62056 int vma_wants_writenotify(struct vm_area_struct *vma);
62057
62058 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
62059@@ -1417,6 +1405,7 @@ out:
62060 }
62061
62062 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
62063+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
62064
62065 extern unsigned long do_brk(unsigned long, unsigned long);
62066
62067@@ -1474,6 +1463,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
62068 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
62069 struct vm_area_struct **pprev);
62070
62071+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
62072+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
62073+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
62074+
62075 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
62076 NULL if none. Assume start_addr < end_addr. */
62077 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
62078@@ -1490,15 +1483,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
62079 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
62080 }
62081
62082-#ifdef CONFIG_MMU
62083-pgprot_t vm_get_page_prot(unsigned long vm_flags);
62084-#else
62085-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
62086-{
62087- return __pgprot(0);
62088-}
62089-#endif
62090-
62091 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
62092 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
62093 unsigned long pfn, unsigned long size, pgprot_t);
62094@@ -1612,7 +1596,7 @@ extern int unpoison_memory(unsigned long pfn);
62095 extern int sysctl_memory_failure_early_kill;
62096 extern int sysctl_memory_failure_recovery;
62097 extern void shake_page(struct page *p, int access);
62098-extern atomic_long_t mce_bad_pages;
62099+extern atomic_long_unchecked_t mce_bad_pages;
62100 extern int soft_offline_page(struct page *page, int flags);
62101
62102 extern void dump_page(struct page *page);
62103@@ -1626,5 +1610,11 @@ extern void copy_user_huge_page(struct page *dst, struct page *src,
62104 unsigned int pages_per_huge_page);
62105 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
62106
62107+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
62108+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
62109+#else
62110+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
62111+#endif
62112+
62113 #endif /* __KERNEL__ */
62114 #endif /* _LINUX_MM_H */
62115diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
62116index 10a2f62..c8fa287 100644
62117--- a/include/linux/mm_types.h
62118+++ b/include/linux/mm_types.h
62119@@ -230,6 +230,8 @@ struct vm_area_struct {
62120 #ifdef CONFIG_NUMA
62121 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
62122 #endif
62123+
62124+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
62125 };
62126
62127 struct core_thread {
62128@@ -362,6 +364,24 @@ struct mm_struct {
62129 #ifdef CONFIG_CPUMASK_OFFSTACK
62130 struct cpumask cpumask_allocation;
62131 #endif
62132+
62133+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62134+ unsigned long pax_flags;
62135+#endif
62136+
62137+#ifdef CONFIG_PAX_DLRESOLVE
62138+ unsigned long call_dl_resolve;
62139+#endif
62140+
62141+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
62142+ unsigned long call_syscall;
62143+#endif
62144+
62145+#ifdef CONFIG_PAX_ASLR
62146+ unsigned long delta_mmap; /* randomized offset */
62147+ unsigned long delta_stack; /* randomized offset */
62148+#endif
62149+
62150 };
62151
62152 static inline void mm_init_cpumask(struct mm_struct *mm)
62153diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
62154index 1d1b1e1..2a13c78 100644
62155--- a/include/linux/mmu_notifier.h
62156+++ b/include/linux/mmu_notifier.h
62157@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
62158 */
62159 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
62160 ({ \
62161- pte_t __pte; \
62162+ pte_t ___pte; \
62163 struct vm_area_struct *___vma = __vma; \
62164 unsigned long ___address = __address; \
62165- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
62166+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
62167 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
62168- __pte; \
62169+ ___pte; \
62170 })
62171
62172 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
62173diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
62174index be1ac8d..26868ce 100644
62175--- a/include/linux/mmzone.h
62176+++ b/include/linux/mmzone.h
62177@@ -356,7 +356,7 @@ struct zone {
62178 unsigned long flags; /* zone flags, see below */
62179
62180 /* Zone statistics */
62181- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62182+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62183
62184 /*
62185 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
62186diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
62187index ae28e93..1ac2233 100644
62188--- a/include/linux/mod_devicetable.h
62189+++ b/include/linux/mod_devicetable.h
62190@@ -12,7 +12,7 @@
62191 typedef unsigned long kernel_ulong_t;
62192 #endif
62193
62194-#define PCI_ANY_ID (~0)
62195+#define PCI_ANY_ID ((__u16)~0)
62196
62197 struct pci_device_id {
62198 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
62199@@ -131,7 +131,7 @@ struct usb_device_id {
62200 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
62201 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
62202
62203-#define HID_ANY_ID (~0)
62204+#define HID_ANY_ID (~0U)
62205
62206 struct hid_device_id {
62207 __u16 bus;
62208diff --git a/include/linux/module.h b/include/linux/module.h
62209index 1c30087..fc2a442 100644
62210--- a/include/linux/module.h
62211+++ b/include/linux/module.h
62212@@ -16,6 +16,7 @@
62213 #include <linux/kobject.h>
62214 #include <linux/moduleparam.h>
62215 #include <linux/tracepoint.h>
62216+#include <linux/fs.h>
62217
62218 #include <linux/percpu.h>
62219 #include <asm/module.h>
62220@@ -327,19 +328,16 @@ struct module
62221 int (*init)(void);
62222
62223 /* If this is non-NULL, vfree after init() returns */
62224- void *module_init;
62225+ void *module_init_rx, *module_init_rw;
62226
62227 /* Here is the actual code + data, vfree'd on unload. */
62228- void *module_core;
62229+ void *module_core_rx, *module_core_rw;
62230
62231 /* Here are the sizes of the init and core sections */
62232- unsigned int init_size, core_size;
62233+ unsigned int init_size_rw, core_size_rw;
62234
62235 /* The size of the executable code in each section. */
62236- unsigned int init_text_size, core_text_size;
62237-
62238- /* Size of RO sections of the module (text+rodata) */
62239- unsigned int init_ro_size, core_ro_size;
62240+ unsigned int init_size_rx, core_size_rx;
62241
62242 /* Arch-specific module values */
62243 struct mod_arch_specific arch;
62244@@ -395,6 +393,10 @@ struct module
62245 #ifdef CONFIG_EVENT_TRACING
62246 struct ftrace_event_call **trace_events;
62247 unsigned int num_trace_events;
62248+ struct file_operations trace_id;
62249+ struct file_operations trace_enable;
62250+ struct file_operations trace_format;
62251+ struct file_operations trace_filter;
62252 #endif
62253 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
62254 unsigned int num_ftrace_callsites;
62255@@ -445,16 +447,46 @@ bool is_module_address(unsigned long addr);
62256 bool is_module_percpu_address(unsigned long addr);
62257 bool is_module_text_address(unsigned long addr);
62258
62259+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
62260+{
62261+
62262+#ifdef CONFIG_PAX_KERNEXEC
62263+ if (ktla_ktva(addr) >= (unsigned long)start &&
62264+ ktla_ktva(addr) < (unsigned long)start + size)
62265+ return 1;
62266+#endif
62267+
62268+ return ((void *)addr >= start && (void *)addr < start + size);
62269+}
62270+
62271+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
62272+{
62273+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
62274+}
62275+
62276+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
62277+{
62278+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
62279+}
62280+
62281+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
62282+{
62283+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
62284+}
62285+
62286+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
62287+{
62288+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
62289+}
62290+
62291 static inline int within_module_core(unsigned long addr, struct module *mod)
62292 {
62293- return (unsigned long)mod->module_core <= addr &&
62294- addr < (unsigned long)mod->module_core + mod->core_size;
62295+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
62296 }
62297
62298 static inline int within_module_init(unsigned long addr, struct module *mod)
62299 {
62300- return (unsigned long)mod->module_init <= addr &&
62301- addr < (unsigned long)mod->module_init + mod->init_size;
62302+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
62303 }
62304
62305 /* Search for module by name: must hold module_mutex. */
62306diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
62307index b2be02e..6a9fdb1 100644
62308--- a/include/linux/moduleloader.h
62309+++ b/include/linux/moduleloader.h
62310@@ -25,9 +25,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
62311 sections. Returns NULL on failure. */
62312 void *module_alloc(unsigned long size);
62313
62314+#ifdef CONFIG_PAX_KERNEXEC
62315+void *module_alloc_exec(unsigned long size);
62316+#else
62317+#define module_alloc_exec(x) module_alloc(x)
62318+#endif
62319+
62320 /* Free memory returned from module_alloc. */
62321 void module_free(struct module *mod, void *module_region);
62322
62323+#ifdef CONFIG_PAX_KERNEXEC
62324+void module_free_exec(struct module *mod, void *module_region);
62325+#else
62326+#define module_free_exec(x, y) module_free((x), (y))
62327+#endif
62328+
62329 /* Apply the given relocation to the (simplified) ELF. Return -error
62330 or 0. */
62331 int apply_relocate(Elf_Shdr *sechdrs,
62332diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
62333index ddaae98..3c70938 100644
62334--- a/include/linux/moduleparam.h
62335+++ b/include/linux/moduleparam.h
62336@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock(void)
62337 * @len is usually just sizeof(string).
62338 */
62339 #define module_param_string(name, string, len, perm) \
62340- static const struct kparam_string __param_string_##name \
62341+ static const struct kparam_string __param_string_##name __used \
62342 = { len, string }; \
62343 __module_param_call(MODULE_PARAM_PREFIX, name, \
62344 &param_ops_string, \
62345@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
62346 * module_param_named() for why this might be necessary.
62347 */
62348 #define module_param_array_named(name, array, type, nump, perm) \
62349- static const struct kparam_array __param_arr_##name \
62350+ static const struct kparam_array __param_arr_##name __used \
62351 = { .max = ARRAY_SIZE(array), .num = nump, \
62352 .ops = &param_ops_##type, \
62353 .elemsize = sizeof(array[0]), .elem = array }; \
62354diff --git a/include/linux/namei.h b/include/linux/namei.h
62355index ffc0213..2c1f2cb 100644
62356--- a/include/linux/namei.h
62357+++ b/include/linux/namei.h
62358@@ -24,7 +24,7 @@ struct nameidata {
62359 unsigned seq;
62360 int last_type;
62361 unsigned depth;
62362- char *saved_names[MAX_NESTED_LINKS + 1];
62363+ const char *saved_names[MAX_NESTED_LINKS + 1];
62364
62365 /* Intent data */
62366 union {
62367@@ -94,12 +94,12 @@ extern int follow_up(struct path *);
62368 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
62369 extern void unlock_rename(struct dentry *, struct dentry *);
62370
62371-static inline void nd_set_link(struct nameidata *nd, char *path)
62372+static inline void nd_set_link(struct nameidata *nd, const char *path)
62373 {
62374 nd->saved_names[nd->depth] = path;
62375 }
62376
62377-static inline char *nd_get_link(struct nameidata *nd)
62378+static inline const char *nd_get_link(const struct nameidata *nd)
62379 {
62380 return nd->saved_names[nd->depth];
62381 }
62382diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
62383index ddee79b..67af106 100644
62384--- a/include/linux/netdevice.h
62385+++ b/include/linux/netdevice.h
62386@@ -944,6 +944,7 @@ struct net_device_ops {
62387 int (*ndo_set_features)(struct net_device *dev,
62388 u32 features);
62389 };
62390+typedef struct net_device_ops __no_const net_device_ops_no_const;
62391
62392 /*
62393 * The DEVICE structure.
62394diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
62395new file mode 100644
62396index 0000000..33f4af8
62397--- /dev/null
62398+++ b/include/linux/netfilter/xt_gradm.h
62399@@ -0,0 +1,9 @@
62400+#ifndef _LINUX_NETFILTER_XT_GRADM_H
62401+#define _LINUX_NETFILTER_XT_GRADM_H 1
62402+
62403+struct xt_gradm_mtinfo {
62404+ __u16 flags;
62405+ __u16 invflags;
62406+};
62407+
62408+#endif
62409diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
62410index c65a18a..0c05f3a 100644
62411--- a/include/linux/of_pdt.h
62412+++ b/include/linux/of_pdt.h
62413@@ -32,7 +32,7 @@ struct of_pdt_ops {
62414
62415 /* return 0 on success; fill in 'len' with number of bytes in path */
62416 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
62417-};
62418+} __no_const;
62419
62420 extern void *prom_early_alloc(unsigned long size);
62421
62422diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
62423index 49c8727..34d2ae1 100644
62424--- a/include/linux/oprofile.h
62425+++ b/include/linux/oprofile.h
62426@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
62427 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
62428 char const * name, ulong * val);
62429
62430-/** Create a file for read-only access to an atomic_t. */
62431+/** Create a file for read-only access to an atomic_unchecked_t. */
62432 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
62433- char const * name, atomic_t * val);
62434+ char const * name, atomic_unchecked_t * val);
62435
62436 /** create a directory */
62437 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
62438diff --git a/include/linux/padata.h b/include/linux/padata.h
62439index 4633b2f..988bc08 100644
62440--- a/include/linux/padata.h
62441+++ b/include/linux/padata.h
62442@@ -129,7 +129,7 @@ struct parallel_data {
62443 struct padata_instance *pinst;
62444 struct padata_parallel_queue __percpu *pqueue;
62445 struct padata_serial_queue __percpu *squeue;
62446- atomic_t seq_nr;
62447+ atomic_unchecked_t seq_nr;
62448 atomic_t reorder_objects;
62449 atomic_t refcnt;
62450 unsigned int max_seq_nr;
62451diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
62452index c816075..cd28c4d 100644
62453--- a/include/linux/perf_event.h
62454+++ b/include/linux/perf_event.h
62455@@ -745,8 +745,8 @@ struct perf_event {
62456
62457 enum perf_event_active_state state;
62458 unsigned int attach_state;
62459- local64_t count;
62460- atomic64_t child_count;
62461+ local64_t count; /* PaX: fix it one day */
62462+ atomic64_unchecked_t child_count;
62463
62464 /*
62465 * These are the total time in nanoseconds that the event
62466@@ -797,8 +797,8 @@ struct perf_event {
62467 * These accumulate total time (in nanoseconds) that children
62468 * events have been enabled and running, respectively.
62469 */
62470- atomic64_t child_total_time_enabled;
62471- atomic64_t child_total_time_running;
62472+ atomic64_unchecked_t child_total_time_enabled;
62473+ atomic64_unchecked_t child_total_time_running;
62474
62475 /*
62476 * Protect attach/detach and child_list:
62477diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
62478index 77257c9..51d473a 100644
62479--- a/include/linux/pipe_fs_i.h
62480+++ b/include/linux/pipe_fs_i.h
62481@@ -46,9 +46,9 @@ struct pipe_buffer {
62482 struct pipe_inode_info {
62483 wait_queue_head_t wait;
62484 unsigned int nrbufs, curbuf, buffers;
62485- unsigned int readers;
62486- unsigned int writers;
62487- unsigned int waiting_writers;
62488+ atomic_t readers;
62489+ atomic_t writers;
62490+ atomic_t waiting_writers;
62491 unsigned int r_counter;
62492 unsigned int w_counter;
62493 struct page *tmp_page;
62494diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
62495index daac05d..c6802ce 100644
62496--- a/include/linux/pm_runtime.h
62497+++ b/include/linux/pm_runtime.h
62498@@ -99,7 +99,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
62499
62500 static inline void pm_runtime_mark_last_busy(struct device *dev)
62501 {
62502- ACCESS_ONCE(dev->power.last_busy) = jiffies;
62503+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
62504 }
62505
62506 #else /* !CONFIG_PM_RUNTIME */
62507diff --git a/include/linux/poison.h b/include/linux/poison.h
62508index 79159de..f1233a9 100644
62509--- a/include/linux/poison.h
62510+++ b/include/linux/poison.h
62511@@ -19,8 +19,8 @@
62512 * under normal circumstances, used to verify that nobody uses
62513 * non-initialized list entries.
62514 */
62515-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
62516-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
62517+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
62518+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
62519
62520 /********** include/linux/timer.h **********/
62521 /*
62522diff --git a/include/linux/preempt.h b/include/linux/preempt.h
62523index 58969b2..ead129b 100644
62524--- a/include/linux/preempt.h
62525+++ b/include/linux/preempt.h
62526@@ -123,7 +123,7 @@ struct preempt_ops {
62527 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
62528 void (*sched_out)(struct preempt_notifier *notifier,
62529 struct task_struct *next);
62530-};
62531+} __no_const;
62532
62533 /**
62534 * preempt_notifier - key for installing preemption notifiers
62535diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
62536index 643b96c..ef55a9c 100644
62537--- a/include/linux/proc_fs.h
62538+++ b/include/linux/proc_fs.h
62539@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
62540 return proc_create_data(name, mode, parent, proc_fops, NULL);
62541 }
62542
62543+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
62544+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
62545+{
62546+#ifdef CONFIG_GRKERNSEC_PROC_USER
62547+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
62548+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62549+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
62550+#else
62551+ return proc_create_data(name, mode, parent, proc_fops, NULL);
62552+#endif
62553+}
62554+
62555+
62556 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
62557 mode_t mode, struct proc_dir_entry *base,
62558 read_proc_t *read_proc, void * data)
62559@@ -258,7 +271,7 @@ union proc_op {
62560 int (*proc_show)(struct seq_file *m,
62561 struct pid_namespace *ns, struct pid *pid,
62562 struct task_struct *task);
62563-};
62564+} __no_const;
62565
62566 struct ctl_table_header;
62567 struct ctl_table;
62568diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
62569index 800f113..af90cc8 100644
62570--- a/include/linux/ptrace.h
62571+++ b/include/linux/ptrace.h
62572@@ -129,10 +129,10 @@ extern void __ptrace_unlink(struct task_struct *child);
62573 extern void exit_ptrace(struct task_struct *tracer);
62574 #define PTRACE_MODE_READ 1
62575 #define PTRACE_MODE_ATTACH 2
62576-/* Returns 0 on success, -errno on denial. */
62577-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
62578 /* Returns true on success, false on denial. */
62579 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
62580+/* Returns true on success, false on denial. */
62581+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
62582
62583 static inline int ptrace_reparented(struct task_struct *child)
62584 {
62585diff --git a/include/linux/random.h b/include/linux/random.h
62586index d13059f..2eaafaa 100644
62587--- a/include/linux/random.h
62588+++ b/include/linux/random.h
62589@@ -69,12 +69,17 @@ void srandom32(u32 seed);
62590
62591 u32 prandom32(struct rnd_state *);
62592
62593+static inline unsigned long pax_get_random_long(void)
62594+{
62595+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
62596+}
62597+
62598 /*
62599 * Handle minimum values for seeds
62600 */
62601 static inline u32 __seed(u32 x, u32 m)
62602 {
62603- return (x < m) ? x + m : x;
62604+ return (x <= m) ? x + m + 1 : x;
62605 }
62606
62607 /**
62608diff --git a/include/linux/reboot.h b/include/linux/reboot.h
62609index e0879a7..a12f962 100644
62610--- a/include/linux/reboot.h
62611+++ b/include/linux/reboot.h
62612@@ -52,9 +52,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
62613 * Architecture-specific implementations of sys_reboot commands.
62614 */
62615
62616-extern void machine_restart(char *cmd);
62617-extern void machine_halt(void);
62618-extern void machine_power_off(void);
62619+extern void machine_restart(char *cmd) __noreturn;
62620+extern void machine_halt(void) __noreturn;
62621+extern void machine_power_off(void) __noreturn;
62622
62623 extern void machine_shutdown(void);
62624 struct pt_regs;
62625@@ -65,9 +65,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
62626 */
62627
62628 extern void kernel_restart_prepare(char *cmd);
62629-extern void kernel_restart(char *cmd);
62630-extern void kernel_halt(void);
62631-extern void kernel_power_off(void);
62632+extern void kernel_restart(char *cmd) __noreturn;
62633+extern void kernel_halt(void) __noreturn;
62634+extern void kernel_power_off(void) __noreturn;
62635
62636 extern int C_A_D; /* for sysctl */
62637 void ctrl_alt_del(void);
62638@@ -81,7 +81,7 @@ extern int orderly_poweroff(bool force);
62639 * Emergency restart, callable from an interrupt handler.
62640 */
62641
62642-extern void emergency_restart(void);
62643+extern void emergency_restart(void) __noreturn;
62644 #include <asm/emergency-restart.h>
62645
62646 #endif
62647diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
62648index 96d465f..b084e05 100644
62649--- a/include/linux/reiserfs_fs.h
62650+++ b/include/linux/reiserfs_fs.h
62651@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
62652 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
62653
62654 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
62655-#define get_generation(s) atomic_read (&fs_generation(s))
62656+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
62657 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
62658 #define __fs_changed(gen,s) (gen != get_generation (s))
62659 #define fs_changed(gen,s) \
62660diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
62661index 52c83b6..18ed7eb 100644
62662--- a/include/linux/reiserfs_fs_sb.h
62663+++ b/include/linux/reiserfs_fs_sb.h
62664@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
62665 /* Comment? -Hans */
62666 wait_queue_head_t s_wait;
62667 /* To be obsoleted soon by per buffer seals.. -Hans */
62668- atomic_t s_generation_counter; // increased by one every time the
62669+ atomic_unchecked_t s_generation_counter; // increased by one every time the
62670 // tree gets re-balanced
62671 unsigned long s_properties; /* File system properties. Currently holds
62672 on-disk FS format */
62673diff --git a/include/linux/relay.h b/include/linux/relay.h
62674index 14a86bc..17d0700 100644
62675--- a/include/linux/relay.h
62676+++ b/include/linux/relay.h
62677@@ -159,7 +159,7 @@ struct rchan_callbacks
62678 * The callback should return 0 if successful, negative if not.
62679 */
62680 int (*remove_buf_file)(struct dentry *dentry);
62681-};
62682+} __no_const;
62683
62684 /*
62685 * CONFIG_RELAY kernel API, kernel/relay.c
62686diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
62687index c6c6084..5bf1212 100644
62688--- a/include/linux/rfkill.h
62689+++ b/include/linux/rfkill.h
62690@@ -147,6 +147,7 @@ struct rfkill_ops {
62691 void (*query)(struct rfkill *rfkill, void *data);
62692 int (*set_block)(void *data, bool blocked);
62693 };
62694+typedef struct rfkill_ops __no_const rfkill_ops_no_const;
62695
62696 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
62697 /**
62698diff --git a/include/linux/rmap.h b/include/linux/rmap.h
62699index 2148b12..519b820 100644
62700--- a/include/linux/rmap.h
62701+++ b/include/linux/rmap.h
62702@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struct anon_vma *anon_vma)
62703 void anon_vma_init(void); /* create anon_vma_cachep */
62704 int anon_vma_prepare(struct vm_area_struct *);
62705 void unlink_anon_vmas(struct vm_area_struct *);
62706-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
62707-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
62708+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
62709+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
62710 void __anon_vma_link(struct vm_area_struct *);
62711
62712 static inline void anon_vma_merge(struct vm_area_struct *vma,
62713diff --git a/include/linux/sched.h b/include/linux/sched.h
62714index 41d0237..5a64056 100644
62715--- a/include/linux/sched.h
62716+++ b/include/linux/sched.h
62717@@ -100,6 +100,7 @@ struct bio_list;
62718 struct fs_struct;
62719 struct perf_event_context;
62720 struct blk_plug;
62721+struct linux_binprm;
62722
62723 /*
62724 * List of flags we want to share for kernel threads,
62725@@ -380,10 +381,13 @@ struct user_namespace;
62726 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
62727
62728 extern int sysctl_max_map_count;
62729+extern unsigned long sysctl_heap_stack_gap;
62730
62731 #include <linux/aio.h>
62732
62733 #ifdef CONFIG_MMU
62734+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
62735+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
62736 extern void arch_pick_mmap_layout(struct mm_struct *mm);
62737 extern unsigned long
62738 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
62739@@ -629,6 +633,17 @@ struct signal_struct {
62740 #ifdef CONFIG_TASKSTATS
62741 struct taskstats *stats;
62742 #endif
62743+
62744+#ifdef CONFIG_GRKERNSEC
62745+ u32 curr_ip;
62746+ u32 saved_ip;
62747+ u32 gr_saddr;
62748+ u32 gr_daddr;
62749+ u16 gr_sport;
62750+ u16 gr_dport;
62751+ u8 used_accept:1;
62752+#endif
62753+
62754 #ifdef CONFIG_AUDIT
62755 unsigned audit_tty;
62756 struct tty_audit_buf *tty_audit_buf;
62757@@ -710,6 +725,11 @@ struct user_struct {
62758 struct key *session_keyring; /* UID's default session keyring */
62759 #endif
62760
62761+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
62762+ unsigned int banned;
62763+ unsigned long ban_expires;
62764+#endif
62765+
62766 /* Hash table maintenance information */
62767 struct hlist_node uidhash_node;
62768 uid_t uid;
62769@@ -1340,8 +1360,8 @@ struct task_struct {
62770 struct list_head thread_group;
62771
62772 struct completion *vfork_done; /* for vfork() */
62773- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
62774- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62775+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
62776+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62777
62778 cputime_t utime, stime, utimescaled, stimescaled;
62779 cputime_t gtime;
62780@@ -1357,13 +1377,6 @@ struct task_struct {
62781 struct task_cputime cputime_expires;
62782 struct list_head cpu_timers[3];
62783
62784-/* process credentials */
62785- const struct cred __rcu *real_cred; /* objective and real subjective task
62786- * credentials (COW) */
62787- const struct cred __rcu *cred; /* effective (overridable) subjective task
62788- * credentials (COW) */
62789- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62790-
62791 char comm[TASK_COMM_LEN]; /* executable name excluding path
62792 - access with [gs]et_task_comm (which lock
62793 it with task_lock())
62794@@ -1380,8 +1393,16 @@ struct task_struct {
62795 #endif
62796 /* CPU-specific state of this task */
62797 struct thread_struct thread;
62798+/* thread_info moved to task_struct */
62799+#ifdef CONFIG_X86
62800+ struct thread_info tinfo;
62801+#endif
62802 /* filesystem information */
62803 struct fs_struct *fs;
62804+
62805+ const struct cred __rcu *cred; /* effective (overridable) subjective task
62806+ * credentials (COW) */
62807+
62808 /* open file information */
62809 struct files_struct *files;
62810 /* namespaces */
62811@@ -1428,6 +1449,11 @@ struct task_struct {
62812 struct rt_mutex_waiter *pi_blocked_on;
62813 #endif
62814
62815+/* process credentials */
62816+ const struct cred __rcu *real_cred; /* objective and real subjective task
62817+ * credentials (COW) */
62818+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62819+
62820 #ifdef CONFIG_DEBUG_MUTEXES
62821 /* mutex deadlock detection */
62822 struct mutex_waiter *blocked_on;
62823@@ -1537,6 +1563,21 @@ struct task_struct {
62824 unsigned long default_timer_slack_ns;
62825
62826 struct list_head *scm_work_list;
62827+
62828+#ifdef CONFIG_GRKERNSEC
62829+ /* grsecurity */
62830+ struct dentry *gr_chroot_dentry;
62831+ struct acl_subject_label *acl;
62832+ struct acl_role_label *role;
62833+ struct file *exec_file;
62834+ u16 acl_role_id;
62835+ /* is this the task that authenticated to the special role */
62836+ u8 acl_sp_role;
62837+ u8 is_writable;
62838+ u8 brute;
62839+ u8 gr_is_chrooted;
62840+#endif
62841+
62842 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
62843 /* Index of current stored address in ret_stack */
62844 int curr_ret_stack;
62845@@ -1571,6 +1612,57 @@ struct task_struct {
62846 #endif
62847 };
62848
62849+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
62850+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
62851+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
62852+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
62853+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
62854+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
62855+
62856+#ifdef CONFIG_PAX_SOFTMODE
62857+extern int pax_softmode;
62858+#endif
62859+
62860+extern int pax_check_flags(unsigned long *);
62861+
62862+/* if tsk != current then task_lock must be held on it */
62863+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62864+static inline unsigned long pax_get_flags(struct task_struct *tsk)
62865+{
62866+ if (likely(tsk->mm))
62867+ return tsk->mm->pax_flags;
62868+ else
62869+ return 0UL;
62870+}
62871+
62872+/* if tsk != current then task_lock must be held on it */
62873+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
62874+{
62875+ if (likely(tsk->mm)) {
62876+ tsk->mm->pax_flags = flags;
62877+ return 0;
62878+ }
62879+ return -EINVAL;
62880+}
62881+#endif
62882+
62883+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
62884+extern void pax_set_initial_flags(struct linux_binprm *bprm);
62885+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
62886+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
62887+#endif
62888+
62889+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
62890+extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
62891+extern void pax_report_refcount_overflow(struct pt_regs *regs);
62892+extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
62893+
62894+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
62895+extern void pax_track_stack(void);
62896+#else
62897+static inline void pax_track_stack(void) {}
62898+#endif
62899+
62900 /* Future-safe accessor for struct task_struct's cpus_allowed. */
62901 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
62902
62903@@ -2074,7 +2166,9 @@ void yield(void);
62904 extern struct exec_domain default_exec_domain;
62905
62906 union thread_union {
62907+#ifndef CONFIG_X86
62908 struct thread_info thread_info;
62909+#endif
62910 unsigned long stack[THREAD_SIZE/sizeof(long)];
62911 };
62912
62913@@ -2107,6 +2201,7 @@ extern struct pid_namespace init_pid_ns;
62914 */
62915
62916 extern struct task_struct *find_task_by_vpid(pid_t nr);
62917+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
62918 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
62919 struct pid_namespace *ns);
62920
62921@@ -2243,7 +2338,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
62922 extern void exit_itimers(struct signal_struct *);
62923 extern void flush_itimer_signals(void);
62924
62925-extern NORET_TYPE void do_group_exit(int);
62926+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
62927
62928 extern void daemonize(const char *, ...);
62929 extern int allow_signal(int);
62930@@ -2408,13 +2503,17 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
62931
62932 #endif
62933
62934-static inline int object_is_on_stack(void *obj)
62935+static inline int object_starts_on_stack(void *obj)
62936 {
62937- void *stack = task_stack_page(current);
62938+ const void *stack = task_stack_page(current);
62939
62940 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
62941 }
62942
62943+#ifdef CONFIG_PAX_USERCOPY
62944+extern int object_is_on_stack(const void *obj, unsigned long len);
62945+#endif
62946+
62947 extern void thread_info_cache_init(void);
62948
62949 #ifdef CONFIG_DEBUG_STACK_USAGE
62950diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
62951index 899fbb4..1cb4138 100644
62952--- a/include/linux/screen_info.h
62953+++ b/include/linux/screen_info.h
62954@@ -43,7 +43,8 @@ struct screen_info {
62955 __u16 pages; /* 0x32 */
62956 __u16 vesa_attributes; /* 0x34 */
62957 __u32 capabilities; /* 0x36 */
62958- __u8 _reserved[6]; /* 0x3a */
62959+ __u16 vesapm_size; /* 0x3a */
62960+ __u8 _reserved[4]; /* 0x3c */
62961 } __attribute__((packed));
62962
62963 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
62964diff --git a/include/linux/security.h b/include/linux/security.h
62965index ebd2a53..2d949ae 100644
62966--- a/include/linux/security.h
62967+++ b/include/linux/security.h
62968@@ -36,6 +36,7 @@
62969 #include <linux/key.h>
62970 #include <linux/xfrm.h>
62971 #include <linux/slab.h>
62972+#include <linux/grsecurity.h>
62973 #include <net/flow.h>
62974
62975 /* Maximum number of letters for an LSM name string */
62976diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
62977index be720cd..a0e1b94 100644
62978--- a/include/linux/seq_file.h
62979+++ b/include/linux/seq_file.h
62980@@ -33,6 +33,7 @@ struct seq_operations {
62981 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
62982 int (*show) (struct seq_file *m, void *v);
62983 };
62984+typedef struct seq_operations __no_const seq_operations_no_const;
62985
62986 #define SEQ_SKIP 1
62987
62988diff --git a/include/linux/shm.h b/include/linux/shm.h
62989index 92808b8..c28cac4 100644
62990--- a/include/linux/shm.h
62991+++ b/include/linux/shm.h
62992@@ -98,6 +98,10 @@ struct shmid_kernel /* private to the kernel */
62993
62994 /* The task created the shm object. NULL if the task is dead. */
62995 struct task_struct *shm_creator;
62996+#ifdef CONFIG_GRKERNSEC
62997+ time_t shm_createtime;
62998+ pid_t shm_lapid;
62999+#endif
63000 };
63001
63002 /* shm_mode upper byte flags */
63003diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
63004index 0f96646..cfb757a 100644
63005--- a/include/linux/skbuff.h
63006+++ b/include/linux/skbuff.h
63007@@ -610,7 +610,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
63008 */
63009 static inline int skb_queue_empty(const struct sk_buff_head *list)
63010 {
63011- return list->next == (struct sk_buff *)list;
63012+ return list->next == (const struct sk_buff *)list;
63013 }
63014
63015 /**
63016@@ -623,7 +623,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
63017 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63018 const struct sk_buff *skb)
63019 {
63020- return skb->next == (struct sk_buff *)list;
63021+ return skb->next == (const struct sk_buff *)list;
63022 }
63023
63024 /**
63025@@ -636,7 +636,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63026 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
63027 const struct sk_buff *skb)
63028 {
63029- return skb->prev == (struct sk_buff *)list;
63030+ return skb->prev == (const struct sk_buff *)list;
63031 }
63032
63033 /**
63034@@ -1458,7 +1458,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
63035 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
63036 */
63037 #ifndef NET_SKB_PAD
63038-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
63039+#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
63040 #endif
63041
63042 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
63043diff --git a/include/linux/slab.h b/include/linux/slab.h
63044index 573c809..e84c132 100644
63045--- a/include/linux/slab.h
63046+++ b/include/linux/slab.h
63047@@ -11,12 +11,20 @@
63048
63049 #include <linux/gfp.h>
63050 #include <linux/types.h>
63051+#include <linux/err.h>
63052
63053 /*
63054 * Flags to pass to kmem_cache_create().
63055 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
63056 */
63057 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
63058+
63059+#ifdef CONFIG_PAX_USERCOPY
63060+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
63061+#else
63062+#define SLAB_USERCOPY 0x00000000UL
63063+#endif
63064+
63065 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
63066 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
63067 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
63068@@ -87,10 +95,13 @@
63069 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
63070 * Both make kfree a no-op.
63071 */
63072-#define ZERO_SIZE_PTR ((void *)16)
63073+#define ZERO_SIZE_PTR \
63074+({ \
63075+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
63076+ (void *)(-MAX_ERRNO-1L); \
63077+})
63078
63079-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
63080- (unsigned long)ZERO_SIZE_PTR)
63081+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
63082
63083 /*
63084 * struct kmem_cache related prototypes
63085@@ -161,6 +172,7 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
63086 void kfree(const void *);
63087 void kzfree(const void *);
63088 size_t ksize(const void *);
63089+void check_object_size(const void *ptr, unsigned long n, bool to);
63090
63091 /*
63092 * Allocator specific definitions. These are mainly used to establish optimized
63093@@ -353,4 +365,59 @@ static inline void *kzalloc_node(size_t size, gfp_t flags, int node)
63094
63095 void __init kmem_cache_init_late(void);
63096
63097+#define kmalloc(x, y) \
63098+({ \
63099+ void *___retval; \
63100+ intoverflow_t ___x = (intoverflow_t)x; \
63101+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
63102+ ___retval = NULL; \
63103+ else \
63104+ ___retval = kmalloc((size_t)___x, (y)); \
63105+ ___retval; \
63106+})
63107+
63108+#define kmalloc_node(x, y, z) \
63109+({ \
63110+ void *___retval; \
63111+ intoverflow_t ___x = (intoverflow_t)x; \
63112+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
63113+ ___retval = NULL; \
63114+ else \
63115+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
63116+ ___retval; \
63117+})
63118+
63119+#define kzalloc(x, y) \
63120+({ \
63121+ void *___retval; \
63122+ intoverflow_t ___x = (intoverflow_t)x; \
63123+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
63124+ ___retval = NULL; \
63125+ else \
63126+ ___retval = kzalloc((size_t)___x, (y)); \
63127+ ___retval; \
63128+})
63129+
63130+#define __krealloc(x, y, z) \
63131+({ \
63132+ void *___retval; \
63133+ intoverflow_t ___y = (intoverflow_t)y; \
63134+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
63135+ ___retval = NULL; \
63136+ else \
63137+ ___retval = __krealloc((x), (size_t)___y, (z)); \
63138+ ___retval; \
63139+})
63140+
63141+#define krealloc(x, y, z) \
63142+({ \
63143+ void *___retval; \
63144+ intoverflow_t ___y = (intoverflow_t)y; \
63145+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
63146+ ___retval = NULL; \
63147+ else \
63148+ ___retval = krealloc((x), (size_t)___y, (z)); \
63149+ ___retval; \
63150+})
63151+
63152 #endif /* _LINUX_SLAB_H */
63153diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
63154index d00e0ba..1b3bf7b 100644
63155--- a/include/linux/slab_def.h
63156+++ b/include/linux/slab_def.h
63157@@ -68,10 +68,10 @@ struct kmem_cache {
63158 unsigned long node_allocs;
63159 unsigned long node_frees;
63160 unsigned long node_overflow;
63161- atomic_t allochit;
63162- atomic_t allocmiss;
63163- atomic_t freehit;
63164- atomic_t freemiss;
63165+ atomic_unchecked_t allochit;
63166+ atomic_unchecked_t allocmiss;
63167+ atomic_unchecked_t freehit;
63168+ atomic_unchecked_t freemiss;
63169
63170 /*
63171 * If debugging is enabled, then the allocator can add additional
63172diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
63173index f58d641..c56bf9c 100644
63174--- a/include/linux/slub_def.h
63175+++ b/include/linux/slub_def.h
63176@@ -85,7 +85,7 @@ struct kmem_cache {
63177 struct kmem_cache_order_objects max;
63178 struct kmem_cache_order_objects min;
63179 gfp_t allocflags; /* gfp flags to use on each alloc */
63180- int refcount; /* Refcount for slab cache destroy */
63181+ atomic_t refcount; /* Refcount for slab cache destroy */
63182 void (*ctor)(void *);
63183 int inuse; /* Offset to metadata */
63184 int align; /* Alignment */
63185@@ -211,7 +211,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
63186 }
63187
63188 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
63189-void *__kmalloc(size_t size, gfp_t flags);
63190+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
63191
63192 static __always_inline void *
63193 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
63194diff --git a/include/linux/sonet.h b/include/linux/sonet.h
63195index de8832d..0147b46 100644
63196--- a/include/linux/sonet.h
63197+++ b/include/linux/sonet.h
63198@@ -61,7 +61,7 @@ struct sonet_stats {
63199 #include <linux/atomic.h>
63200
63201 struct k_sonet_stats {
63202-#define __HANDLE_ITEM(i) atomic_t i
63203+#define __HANDLE_ITEM(i) atomic_unchecked_t i
63204 __SONET_ITEMS
63205 #undef __HANDLE_ITEM
63206 };
63207diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
63208index db7bcaf..1aca77e 100644
63209--- a/include/linux/sunrpc/clnt.h
63210+++ b/include/linux/sunrpc/clnt.h
63211@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
63212 {
63213 switch (sap->sa_family) {
63214 case AF_INET:
63215- return ntohs(((struct sockaddr_in *)sap)->sin_port);
63216+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
63217 case AF_INET6:
63218- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
63219+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
63220 }
63221 return 0;
63222 }
63223@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
63224 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
63225 const struct sockaddr *src)
63226 {
63227- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
63228+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
63229 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
63230
63231 dsin->sin_family = ssin->sin_family;
63232@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
63233 if (sa->sa_family != AF_INET6)
63234 return 0;
63235
63236- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
63237+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
63238 }
63239
63240 #endif /* __KERNEL__ */
63241diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
63242index e775689..9e206d9 100644
63243--- a/include/linux/sunrpc/sched.h
63244+++ b/include/linux/sunrpc/sched.h
63245@@ -105,6 +105,7 @@ struct rpc_call_ops {
63246 void (*rpc_call_done)(struct rpc_task *, void *);
63247 void (*rpc_release)(void *);
63248 };
63249+typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
63250
63251 struct rpc_task_setup {
63252 struct rpc_task *task;
63253diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
63254index c14fe86..393245e 100644
63255--- a/include/linux/sunrpc/svc_rdma.h
63256+++ b/include/linux/sunrpc/svc_rdma.h
63257@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
63258 extern unsigned int svcrdma_max_requests;
63259 extern unsigned int svcrdma_max_req_size;
63260
63261-extern atomic_t rdma_stat_recv;
63262-extern atomic_t rdma_stat_read;
63263-extern atomic_t rdma_stat_write;
63264-extern atomic_t rdma_stat_sq_starve;
63265-extern atomic_t rdma_stat_rq_starve;
63266-extern atomic_t rdma_stat_rq_poll;
63267-extern atomic_t rdma_stat_rq_prod;
63268-extern atomic_t rdma_stat_sq_poll;
63269-extern atomic_t rdma_stat_sq_prod;
63270+extern atomic_unchecked_t rdma_stat_recv;
63271+extern atomic_unchecked_t rdma_stat_read;
63272+extern atomic_unchecked_t rdma_stat_write;
63273+extern atomic_unchecked_t rdma_stat_sq_starve;
63274+extern atomic_unchecked_t rdma_stat_rq_starve;
63275+extern atomic_unchecked_t rdma_stat_rq_poll;
63276+extern atomic_unchecked_t rdma_stat_rq_prod;
63277+extern atomic_unchecked_t rdma_stat_sq_poll;
63278+extern atomic_unchecked_t rdma_stat_sq_prod;
63279
63280 #define RPCRDMA_VERSION 1
63281
63282diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
63283index 11684d9..0d245eb 100644
63284--- a/include/linux/sysctl.h
63285+++ b/include/linux/sysctl.h
63286@@ -155,7 +155,11 @@ enum
63287 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
63288 };
63289
63290-
63291+#ifdef CONFIG_PAX_SOFTMODE
63292+enum {
63293+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
63294+};
63295+#endif
63296
63297 /* CTL_VM names: */
63298 enum
63299@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
63300
63301 extern int proc_dostring(struct ctl_table *, int,
63302 void __user *, size_t *, loff_t *);
63303+extern int proc_dostring_modpriv(struct ctl_table *, int,
63304+ void __user *, size_t *, loff_t *);
63305 extern int proc_dointvec(struct ctl_table *, int,
63306 void __user *, size_t *, loff_t *);
63307 extern int proc_dointvec_minmax(struct ctl_table *, int,
63308diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
63309index ff7dc08..893e1bd 100644
63310--- a/include/linux/tty_ldisc.h
63311+++ b/include/linux/tty_ldisc.h
63312@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
63313
63314 struct module *owner;
63315
63316- int refcount;
63317+ atomic_t refcount;
63318 };
63319
63320 struct tty_ldisc {
63321diff --git a/include/linux/types.h b/include/linux/types.h
63322index 176da8c..e45e473 100644
63323--- a/include/linux/types.h
63324+++ b/include/linux/types.h
63325@@ -213,10 +213,26 @@ typedef struct {
63326 int counter;
63327 } atomic_t;
63328
63329+#ifdef CONFIG_PAX_REFCOUNT
63330+typedef struct {
63331+ int counter;
63332+} atomic_unchecked_t;
63333+#else
63334+typedef atomic_t atomic_unchecked_t;
63335+#endif
63336+
63337 #ifdef CONFIG_64BIT
63338 typedef struct {
63339 long counter;
63340 } atomic64_t;
63341+
63342+#ifdef CONFIG_PAX_REFCOUNT
63343+typedef struct {
63344+ long counter;
63345+} atomic64_unchecked_t;
63346+#else
63347+typedef atomic64_t atomic64_unchecked_t;
63348+#endif
63349 #endif
63350
63351 struct list_head {
63352diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
63353index 5ca0951..ab496a5 100644
63354--- a/include/linux/uaccess.h
63355+++ b/include/linux/uaccess.h
63356@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
63357 long ret; \
63358 mm_segment_t old_fs = get_fs(); \
63359 \
63360- set_fs(KERNEL_DS); \
63361 pagefault_disable(); \
63362- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
63363- pagefault_enable(); \
63364+ set_fs(KERNEL_DS); \
63365+ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
63366 set_fs(old_fs); \
63367+ pagefault_enable(); \
63368 ret; \
63369 })
63370
63371diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
63372index 99c1b4d..bb94261 100644
63373--- a/include/linux/unaligned/access_ok.h
63374+++ b/include/linux/unaligned/access_ok.h
63375@@ -6,32 +6,32 @@
63376
63377 static inline u16 get_unaligned_le16(const void *p)
63378 {
63379- return le16_to_cpup((__le16 *)p);
63380+ return le16_to_cpup((const __le16 *)p);
63381 }
63382
63383 static inline u32 get_unaligned_le32(const void *p)
63384 {
63385- return le32_to_cpup((__le32 *)p);
63386+ return le32_to_cpup((const __le32 *)p);
63387 }
63388
63389 static inline u64 get_unaligned_le64(const void *p)
63390 {
63391- return le64_to_cpup((__le64 *)p);
63392+ return le64_to_cpup((const __le64 *)p);
63393 }
63394
63395 static inline u16 get_unaligned_be16(const void *p)
63396 {
63397- return be16_to_cpup((__be16 *)p);
63398+ return be16_to_cpup((const __be16 *)p);
63399 }
63400
63401 static inline u32 get_unaligned_be32(const void *p)
63402 {
63403- return be32_to_cpup((__be32 *)p);
63404+ return be32_to_cpup((const __be32 *)p);
63405 }
63406
63407 static inline u64 get_unaligned_be64(const void *p)
63408 {
63409- return be64_to_cpup((__be64 *)p);
63410+ return be64_to_cpup((const __be64 *)p);
63411 }
63412
63413 static inline void put_unaligned_le16(u16 val, void *p)
63414diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
63415index cf97b5b..40ebc87 100644
63416--- a/include/linux/vermagic.h
63417+++ b/include/linux/vermagic.h
63418@@ -26,9 +26,35 @@
63419 #define MODULE_ARCH_VERMAGIC ""
63420 #endif
63421
63422+#ifdef CONFIG_PAX_REFCOUNT
63423+#define MODULE_PAX_REFCOUNT "REFCOUNT "
63424+#else
63425+#define MODULE_PAX_REFCOUNT ""
63426+#endif
63427+
63428+#ifdef CONSTIFY_PLUGIN
63429+#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
63430+#else
63431+#define MODULE_CONSTIFY_PLUGIN ""
63432+#endif
63433+
63434+#ifdef STACKLEAK_PLUGIN
63435+#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
63436+#else
63437+#define MODULE_STACKLEAK_PLUGIN ""
63438+#endif
63439+
63440+#ifdef CONFIG_GRKERNSEC
63441+#define MODULE_GRSEC "GRSEC "
63442+#else
63443+#define MODULE_GRSEC ""
63444+#endif
63445+
63446 #define VERMAGIC_STRING \
63447 UTS_RELEASE " " \
63448 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
63449 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
63450- MODULE_ARCH_VERMAGIC
63451+ MODULE_ARCH_VERMAGIC \
63452+ MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
63453+ MODULE_GRSEC
63454
63455diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
63456index 687fb11..b342358 100644
63457--- a/include/linux/vmalloc.h
63458+++ b/include/linux/vmalloc.h
63459@@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
63460 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
63461 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
63462 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
63463+
63464+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
63465+#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
63466+#endif
63467+
63468 /* bits [20..32] reserved for arch specific ioremap internals */
63469
63470 /*
63471@@ -156,4 +161,103 @@ pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms)
63472 # endif
63473 #endif
63474
63475+#define vmalloc(x) \
63476+({ \
63477+ void *___retval; \
63478+ intoverflow_t ___x = (intoverflow_t)x; \
63479+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
63480+ ___retval = NULL; \
63481+ else \
63482+ ___retval = vmalloc((unsigned long)___x); \
63483+ ___retval; \
63484+})
63485+
63486+#define vzalloc(x) \
63487+({ \
63488+ void *___retval; \
63489+ intoverflow_t ___x = (intoverflow_t)x; \
63490+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
63491+ ___retval = NULL; \
63492+ else \
63493+ ___retval = vzalloc((unsigned long)___x); \
63494+ ___retval; \
63495+})
63496+
63497+#define __vmalloc(x, y, z) \
63498+({ \
63499+ void *___retval; \
63500+ intoverflow_t ___x = (intoverflow_t)x; \
63501+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
63502+ ___retval = NULL; \
63503+ else \
63504+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
63505+ ___retval; \
63506+})
63507+
63508+#define vmalloc_user(x) \
63509+({ \
63510+ void *___retval; \
63511+ intoverflow_t ___x = (intoverflow_t)x; \
63512+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
63513+ ___retval = NULL; \
63514+ else \
63515+ ___retval = vmalloc_user((unsigned long)___x); \
63516+ ___retval; \
63517+})
63518+
63519+#define vmalloc_exec(x) \
63520+({ \
63521+ void *___retval; \
63522+ intoverflow_t ___x = (intoverflow_t)x; \
63523+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
63524+ ___retval = NULL; \
63525+ else \
63526+ ___retval = vmalloc_exec((unsigned long)___x); \
63527+ ___retval; \
63528+})
63529+
63530+#define vmalloc_node(x, y) \
63531+({ \
63532+ void *___retval; \
63533+ intoverflow_t ___x = (intoverflow_t)x; \
63534+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
63535+ ___retval = NULL; \
63536+ else \
63537+ ___retval = vmalloc_node((unsigned long)___x, (y));\
63538+ ___retval; \
63539+})
63540+
63541+#define vzalloc_node(x, y) \
63542+({ \
63543+ void *___retval; \
63544+ intoverflow_t ___x = (intoverflow_t)x; \
63545+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
63546+ ___retval = NULL; \
63547+ else \
63548+ ___retval = vzalloc_node((unsigned long)___x, (y));\
63549+ ___retval; \
63550+})
63551+
63552+#define vmalloc_32(x) \
63553+({ \
63554+ void *___retval; \
63555+ intoverflow_t ___x = (intoverflow_t)x; \
63556+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
63557+ ___retval = NULL; \
63558+ else \
63559+ ___retval = vmalloc_32((unsigned long)___x); \
63560+ ___retval; \
63561+})
63562+
63563+#define vmalloc_32_user(x) \
63564+({ \
63565+void *___retval; \
63566+ intoverflow_t ___x = (intoverflow_t)x; \
63567+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
63568+ ___retval = NULL; \
63569+ else \
63570+ ___retval = vmalloc_32_user((unsigned long)___x);\
63571+ ___retval; \
63572+})
63573+
63574 #endif /* _LINUX_VMALLOC_H */
63575diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
63576index 65efb92..137adbb 100644
63577--- a/include/linux/vmstat.h
63578+++ b/include/linux/vmstat.h
63579@@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(int cpu)
63580 /*
63581 * Zone based page accounting with per cpu differentials.
63582 */
63583-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63584+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63585
63586 static inline void zone_page_state_add(long x, struct zone *zone,
63587 enum zone_stat_item item)
63588 {
63589- atomic_long_add(x, &zone->vm_stat[item]);
63590- atomic_long_add(x, &vm_stat[item]);
63591+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
63592+ atomic_long_add_unchecked(x, &vm_stat[item]);
63593 }
63594
63595 static inline unsigned long global_page_state(enum zone_stat_item item)
63596 {
63597- long x = atomic_long_read(&vm_stat[item]);
63598+ long x = atomic_long_read_unchecked(&vm_stat[item]);
63599 #ifdef CONFIG_SMP
63600 if (x < 0)
63601 x = 0;
63602@@ -109,7 +109,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
63603 static inline unsigned long zone_page_state(struct zone *zone,
63604 enum zone_stat_item item)
63605 {
63606- long x = atomic_long_read(&zone->vm_stat[item]);
63607+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63608 #ifdef CONFIG_SMP
63609 if (x < 0)
63610 x = 0;
63611@@ -126,7 +126,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
63612 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
63613 enum zone_stat_item item)
63614 {
63615- long x = atomic_long_read(&zone->vm_stat[item]);
63616+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63617
63618 #ifdef CONFIG_SMP
63619 int cpu;
63620@@ -221,8 +221,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
63621
63622 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
63623 {
63624- atomic_long_inc(&zone->vm_stat[item]);
63625- atomic_long_inc(&vm_stat[item]);
63626+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
63627+ atomic_long_inc_unchecked(&vm_stat[item]);
63628 }
63629
63630 static inline void __inc_zone_page_state(struct page *page,
63631@@ -233,8 +233,8 @@ static inline void __inc_zone_page_state(struct page *page,
63632
63633 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
63634 {
63635- atomic_long_dec(&zone->vm_stat[item]);
63636- atomic_long_dec(&vm_stat[item]);
63637+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
63638+ atomic_long_dec_unchecked(&vm_stat[item]);
63639 }
63640
63641 static inline void __dec_zone_page_state(struct page *page,
63642diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
63643index 4aeff96..b378cdc 100644
63644--- a/include/media/saa7146_vv.h
63645+++ b/include/media/saa7146_vv.h
63646@@ -163,7 +163,7 @@ struct saa7146_ext_vv
63647 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
63648
63649 /* the extension can override this */
63650- struct v4l2_ioctl_ops ops;
63651+ v4l2_ioctl_ops_no_const ops;
63652 /* pointer to the saa7146 core ops */
63653 const struct v4l2_ioctl_ops *core_ops;
63654
63655diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
63656index c7c40f1..4f01585 100644
63657--- a/include/media/v4l2-dev.h
63658+++ b/include/media/v4l2-dev.h
63659@@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_state *global, enum v4l2_priority local);
63660
63661
63662 struct v4l2_file_operations {
63663- struct module *owner;
63664+ struct module * const owner;
63665 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
63666 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
63667 unsigned int (*poll) (struct file *, struct poll_table_struct *);
63668@@ -68,6 +68,7 @@ struct v4l2_file_operations {
63669 int (*open) (struct file *);
63670 int (*release) (struct file *);
63671 };
63672+typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
63673
63674 /*
63675 * Newer version of video_device, handled by videodev2.c
63676diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
63677index dd9f1e7..8c4dd86 100644
63678--- a/include/media/v4l2-ioctl.h
63679+++ b/include/media/v4l2-ioctl.h
63680@@ -272,7 +272,7 @@ struct v4l2_ioctl_ops {
63681 long (*vidioc_default) (struct file *file, void *fh,
63682 bool valid_prio, int cmd, void *arg);
63683 };
63684-
63685+typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
63686
63687 /* v4l debugging and diagnostics */
63688
63689diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
63690index c5dedd8..a93b07b 100644
63691--- a/include/net/caif/caif_hsi.h
63692+++ b/include/net/caif/caif_hsi.h
63693@@ -94,7 +94,7 @@ struct cfhsi_drv {
63694 void (*rx_done_cb) (struct cfhsi_drv *drv);
63695 void (*wake_up_cb) (struct cfhsi_drv *drv);
63696 void (*wake_down_cb) (struct cfhsi_drv *drv);
63697-};
63698+} __no_const;
63699
63700 /* Structure implemented by HSI device. */
63701 struct cfhsi_dev {
63702diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
63703index 9e5425b..8136ffc 100644
63704--- a/include/net/caif/cfctrl.h
63705+++ b/include/net/caif/cfctrl.h
63706@@ -52,7 +52,7 @@ struct cfctrl_rsp {
63707 void (*radioset_rsp)(void);
63708 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
63709 struct cflayer *client_layer);
63710-};
63711+} __no_const;
63712
63713 /* Link Setup Parameters for CAIF-Links. */
63714 struct cfctrl_link_param {
63715@@ -101,8 +101,8 @@ struct cfctrl_request_info {
63716 struct cfctrl {
63717 struct cfsrvl serv;
63718 struct cfctrl_rsp res;
63719- atomic_t req_seq_no;
63720- atomic_t rsp_seq_no;
63721+ atomic_unchecked_t req_seq_no;
63722+ atomic_unchecked_t rsp_seq_no;
63723 struct list_head list;
63724 /* Protects from simultaneous access to first_req list */
63725 spinlock_t info_list_lock;
63726diff --git a/include/net/flow.h b/include/net/flow.h
63727index a094477..bc91db1 100644
63728--- a/include/net/flow.h
63729+++ b/include/net/flow.h
63730@@ -207,6 +207,6 @@ extern struct flow_cache_object *flow_cache_lookup(
63731 u8 dir, flow_resolve_t resolver, void *ctx);
63732
63733 extern void flow_cache_flush(void);
63734-extern atomic_t flow_cache_genid;
63735+extern atomic_unchecked_t flow_cache_genid;
63736
63737 #endif
63738diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
63739index e9ff3fc..9d3e5c7 100644
63740--- a/include/net/inetpeer.h
63741+++ b/include/net/inetpeer.h
63742@@ -48,8 +48,8 @@ struct inet_peer {
63743 */
63744 union {
63745 struct {
63746- atomic_t rid; /* Frag reception counter */
63747- atomic_t ip_id_count; /* IP ID for the next packet */
63748+ atomic_unchecked_t rid; /* Frag reception counter */
63749+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
63750 __u32 tcp_ts;
63751 __u32 tcp_ts_stamp;
63752 };
63753@@ -113,11 +113,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
63754 more++;
63755 inet_peer_refcheck(p);
63756 do {
63757- old = atomic_read(&p->ip_id_count);
63758+ old = atomic_read_unchecked(&p->ip_id_count);
63759 new = old + more;
63760 if (!new)
63761 new = 1;
63762- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
63763+ } while (atomic_cmpxchg_unchecked(&p->ip_id_count, old, new) != old);
63764 return new;
63765 }
63766
63767diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
63768index 10422ef..662570f 100644
63769--- a/include/net/ip_fib.h
63770+++ b/include/net/ip_fib.h
63771@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
63772
63773 #define FIB_RES_SADDR(net, res) \
63774 ((FIB_RES_NH(res).nh_saddr_genid == \
63775- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
63776+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
63777 FIB_RES_NH(res).nh_saddr : \
63778 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
63779 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
63780diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
63781index 8fa4430..05dd772 100644
63782--- a/include/net/ip_vs.h
63783+++ b/include/net/ip_vs.h
63784@@ -509,7 +509,7 @@ struct ip_vs_conn {
63785 struct ip_vs_conn *control; /* Master control connection */
63786 atomic_t n_control; /* Number of controlled ones */
63787 struct ip_vs_dest *dest; /* real server */
63788- atomic_t in_pkts; /* incoming packet counter */
63789+ atomic_unchecked_t in_pkts; /* incoming packet counter */
63790
63791 /* packet transmitter for different forwarding methods. If it
63792 mangles the packet, it must return NF_DROP or better NF_STOLEN,
63793@@ -647,7 +647,7 @@ struct ip_vs_dest {
63794 __be16 port; /* port number of the server */
63795 union nf_inet_addr addr; /* IP address of the server */
63796 volatile unsigned flags; /* dest status flags */
63797- atomic_t conn_flags; /* flags to copy to conn */
63798+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
63799 atomic_t weight; /* server weight */
63800
63801 atomic_t refcnt; /* reference counter */
63802diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
63803index 69b610a..fe3962c 100644
63804--- a/include/net/irda/ircomm_core.h
63805+++ b/include/net/irda/ircomm_core.h
63806@@ -51,7 +51,7 @@ typedef struct {
63807 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
63808 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
63809 struct ircomm_info *);
63810-} call_t;
63811+} __no_const call_t;
63812
63813 struct ircomm_cb {
63814 irda_queue_t queue;
63815diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
63816index 59ba38bc..d515662 100644
63817--- a/include/net/irda/ircomm_tty.h
63818+++ b/include/net/irda/ircomm_tty.h
63819@@ -35,6 +35,7 @@
63820 #include <linux/termios.h>
63821 #include <linux/timer.h>
63822 #include <linux/tty.h> /* struct tty_struct */
63823+#include <asm/local.h>
63824
63825 #include <net/irda/irias_object.h>
63826 #include <net/irda/ircomm_core.h>
63827@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
63828 unsigned short close_delay;
63829 unsigned short closing_wait; /* time to wait before closing */
63830
63831- int open_count;
63832- int blocked_open; /* # of blocked opens */
63833+ local_t open_count;
63834+ local_t blocked_open; /* # of blocked opens */
63835
63836 /* Protect concurent access to :
63837 * o self->open_count
63838diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
63839index f82a1e8..82d81e8 100644
63840--- a/include/net/iucv/af_iucv.h
63841+++ b/include/net/iucv/af_iucv.h
63842@@ -87,7 +87,7 @@ struct iucv_sock {
63843 struct iucv_sock_list {
63844 struct hlist_head head;
63845 rwlock_t lock;
63846- atomic_t autobind_name;
63847+ atomic_unchecked_t autobind_name;
63848 };
63849
63850 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
63851diff --git a/include/net/lapb.h b/include/net/lapb.h
63852index 96cb5dd..25e8d4f 100644
63853--- a/include/net/lapb.h
63854+++ b/include/net/lapb.h
63855@@ -95,7 +95,7 @@ struct lapb_cb {
63856 struct sk_buff_head write_queue;
63857 struct sk_buff_head ack_queue;
63858 unsigned char window;
63859- struct lapb_register_struct callbacks;
63860+ struct lapb_register_struct *callbacks;
63861
63862 /* FRMR control information */
63863 struct lapb_frame frmr_data;
63864diff --git a/include/net/neighbour.h b/include/net/neighbour.h
63865index 2720884..3aa5c25 100644
63866--- a/include/net/neighbour.h
63867+++ b/include/net/neighbour.h
63868@@ -122,7 +122,7 @@ struct neigh_ops {
63869 void (*error_report)(struct neighbour *, struct sk_buff *);
63870 int (*output)(struct neighbour *, struct sk_buff *);
63871 int (*connected_output)(struct neighbour *, struct sk_buff *);
63872-};
63873+} __do_const;
63874
63875 struct pneigh_entry {
63876 struct pneigh_entry *next;
63877diff --git a/include/net/netlink.h b/include/net/netlink.h
63878index 98c1854..d4add7b 100644
63879--- a/include/net/netlink.h
63880+++ b/include/net/netlink.h
63881@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
63882 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
63883 {
63884 if (mark)
63885- skb_trim(skb, (unsigned char *) mark - skb->data);
63886+ skb_trim(skb, (const unsigned char *) mark - skb->data);
63887 }
63888
63889 /**
63890diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
63891index d786b4f..4c3dd41 100644
63892--- a/include/net/netns/ipv4.h
63893+++ b/include/net/netns/ipv4.h
63894@@ -56,8 +56,8 @@ struct netns_ipv4 {
63895
63896 unsigned int sysctl_ping_group_range[2];
63897
63898- atomic_t rt_genid;
63899- atomic_t dev_addr_genid;
63900+ atomic_unchecked_t rt_genid;
63901+ atomic_unchecked_t dev_addr_genid;
63902
63903 #ifdef CONFIG_IP_MROUTE
63904 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
63905diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
63906index 6a72a58..e6a127d 100644
63907--- a/include/net/sctp/sctp.h
63908+++ b/include/net/sctp/sctp.h
63909@@ -318,9 +318,9 @@ do { \
63910
63911 #else /* SCTP_DEBUG */
63912
63913-#define SCTP_DEBUG_PRINTK(whatever...)
63914-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
63915-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
63916+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
63917+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
63918+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
63919 #define SCTP_ENABLE_DEBUG
63920 #define SCTP_DISABLE_DEBUG
63921 #define SCTP_ASSERT(expr, str, func)
63922diff --git a/include/net/sock.h b/include/net/sock.h
63923index 8e4062f..77b041e 100644
63924--- a/include/net/sock.h
63925+++ b/include/net/sock.h
63926@@ -278,7 +278,7 @@ struct sock {
63927 #ifdef CONFIG_RPS
63928 __u32 sk_rxhash;
63929 #endif
63930- atomic_t sk_drops;
63931+ atomic_unchecked_t sk_drops;
63932 int sk_rcvbuf;
63933
63934 struct sk_filter __rcu *sk_filter;
63935@@ -1391,7 +1391,7 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
63936 }
63937
63938 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
63939- char __user *from, char *to,
63940+ char __user *from, unsigned char *to,
63941 int copy, int offset)
63942 {
63943 if (skb->ip_summed == CHECKSUM_NONE) {
63944diff --git a/include/net/tcp.h b/include/net/tcp.h
63945index acc620a..f4d99c6 100644
63946--- a/include/net/tcp.h
63947+++ b/include/net/tcp.h
63948@@ -1401,8 +1401,8 @@ enum tcp_seq_states {
63949 struct tcp_seq_afinfo {
63950 char *name;
63951 sa_family_t family;
63952- struct file_operations seq_fops;
63953- struct seq_operations seq_ops;
63954+ file_operations_no_const seq_fops;
63955+ seq_operations_no_const seq_ops;
63956 };
63957
63958 struct tcp_iter_state {
63959diff --git a/include/net/udp.h b/include/net/udp.h
63960index 67ea6fc..e42aee8 100644
63961--- a/include/net/udp.h
63962+++ b/include/net/udp.h
63963@@ -234,8 +234,8 @@ struct udp_seq_afinfo {
63964 char *name;
63965 sa_family_t family;
63966 struct udp_table *udp_table;
63967- struct file_operations seq_fops;
63968- struct seq_operations seq_ops;
63969+ file_operations_no_const seq_fops;
63970+ seq_operations_no_const seq_ops;
63971 };
63972
63973 struct udp_iter_state {
63974diff --git a/include/net/xfrm.h b/include/net/xfrm.h
63975index b203e14..1df3991 100644
63976--- a/include/net/xfrm.h
63977+++ b/include/net/xfrm.h
63978@@ -505,7 +505,7 @@ struct xfrm_policy {
63979 struct timer_list timer;
63980
63981 struct flow_cache_object flo;
63982- atomic_t genid;
63983+ atomic_unchecked_t genid;
63984 u32 priority;
63985 u32 index;
63986 struct xfrm_mark mark;
63987diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
63988index 2d0191c..a55797d 100644
63989--- a/include/rdma/iw_cm.h
63990+++ b/include/rdma/iw_cm.h
63991@@ -120,7 +120,7 @@ struct iw_cm_verbs {
63992 int backlog);
63993
63994 int (*destroy_listen)(struct iw_cm_id *cm_id);
63995-};
63996+} __no_const;
63997
63998 /**
63999 * iw_create_cm_id - Create an IW CM identifier.
64000diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
64001index 7d96829..4ba78d3 100644
64002--- a/include/scsi/libfc.h
64003+++ b/include/scsi/libfc.h
64004@@ -758,6 +758,7 @@ struct libfc_function_template {
64005 */
64006 void (*disc_stop_final) (struct fc_lport *);
64007 };
64008+typedef struct libfc_function_template __no_const libfc_function_template_no_const;
64009
64010 /**
64011 * struct fc_disc - Discovery context
64012@@ -861,7 +862,7 @@ struct fc_lport {
64013 struct fc_vport *vport;
64014
64015 /* Operational Information */
64016- struct libfc_function_template tt;
64017+ libfc_function_template_no_const tt;
64018 u8 link_up;
64019 u8 qfull;
64020 enum fc_lport_state state;
64021diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
64022index d371c3c..e228a8c 100644
64023--- a/include/scsi/scsi_device.h
64024+++ b/include/scsi/scsi_device.h
64025@@ -161,9 +161,9 @@ struct scsi_device {
64026 unsigned int max_device_blocked; /* what device_blocked counts down from */
64027 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
64028
64029- atomic_t iorequest_cnt;
64030- atomic_t iodone_cnt;
64031- atomic_t ioerr_cnt;
64032+ atomic_unchecked_t iorequest_cnt;
64033+ atomic_unchecked_t iodone_cnt;
64034+ atomic_unchecked_t ioerr_cnt;
64035
64036 struct device sdev_gendev,
64037 sdev_dev;
64038diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
64039index 2a65167..91e01f8 100644
64040--- a/include/scsi/scsi_transport_fc.h
64041+++ b/include/scsi/scsi_transport_fc.h
64042@@ -711,7 +711,7 @@ struct fc_function_template {
64043 unsigned long show_host_system_hostname:1;
64044
64045 unsigned long disable_target_scan:1;
64046-};
64047+} __do_const;
64048
64049
64050 /**
64051diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
64052index 030b87c..98a6954 100644
64053--- a/include/sound/ak4xxx-adda.h
64054+++ b/include/sound/ak4xxx-adda.h
64055@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
64056 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
64057 unsigned char val);
64058 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
64059-};
64060+} __no_const;
64061
64062 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
64063
64064diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
64065index 8c05e47..2b5df97 100644
64066--- a/include/sound/hwdep.h
64067+++ b/include/sound/hwdep.h
64068@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
64069 struct snd_hwdep_dsp_status *status);
64070 int (*dsp_load)(struct snd_hwdep *hw,
64071 struct snd_hwdep_dsp_image *image);
64072-};
64073+} __no_const;
64074
64075 struct snd_hwdep {
64076 struct snd_card *card;
64077diff --git a/include/sound/info.h b/include/sound/info.h
64078index 4e94cf1..76748b1 100644
64079--- a/include/sound/info.h
64080+++ b/include/sound/info.h
64081@@ -44,7 +44,7 @@ struct snd_info_entry_text {
64082 struct snd_info_buffer *buffer);
64083 void (*write)(struct snd_info_entry *entry,
64084 struct snd_info_buffer *buffer);
64085-};
64086+} __no_const;
64087
64088 struct snd_info_entry_ops {
64089 int (*open)(struct snd_info_entry *entry,
64090diff --git a/include/sound/pcm.h b/include/sound/pcm.h
64091index 57e71fa..a2c7534 100644
64092--- a/include/sound/pcm.h
64093+++ b/include/sound/pcm.h
64094@@ -81,6 +81,7 @@ struct snd_pcm_ops {
64095 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
64096 int (*ack)(struct snd_pcm_substream *substream);
64097 };
64098+typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
64099
64100 /*
64101 *
64102diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
64103index af1b49e..a5d55a5 100644
64104--- a/include/sound/sb16_csp.h
64105+++ b/include/sound/sb16_csp.h
64106@@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
64107 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
64108 int (*csp_stop) (struct snd_sb_csp * p);
64109 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
64110-};
64111+} __no_const;
64112
64113 /*
64114 * CSP private data
64115diff --git a/include/sound/soc.h b/include/sound/soc.h
64116index aa19f5a..a5b8208 100644
64117--- a/include/sound/soc.h
64118+++ b/include/sound/soc.h
64119@@ -676,7 +676,7 @@ struct snd_soc_platform_driver {
64120 /* platform IO - used for platform DAPM */
64121 unsigned int (*read)(struct snd_soc_platform *, unsigned int);
64122 int (*write)(struct snd_soc_platform *, unsigned int, unsigned int);
64123-};
64124+} __do_const;
64125
64126 struct snd_soc_platform {
64127 const char *name;
64128diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
64129index 444cd6b..3327cc5 100644
64130--- a/include/sound/ymfpci.h
64131+++ b/include/sound/ymfpci.h
64132@@ -358,7 +358,7 @@ struct snd_ymfpci {
64133 spinlock_t reg_lock;
64134 spinlock_t voice_lock;
64135 wait_queue_head_t interrupt_sleep;
64136- atomic_t interrupt_sleep_count;
64137+ atomic_unchecked_t interrupt_sleep_count;
64138 struct snd_info_entry *proc_entry;
64139 const struct firmware *dsp_microcode;
64140 const struct firmware *controller_microcode;
64141diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
64142index 2704065..e10f3ef 100644
64143--- a/include/target/target_core_base.h
64144+++ b/include/target/target_core_base.h
64145@@ -356,7 +356,7 @@ struct t10_reservation_ops {
64146 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
64147 int (*t10_pr_register)(struct se_cmd *);
64148 int (*t10_pr_clear)(struct se_cmd *);
64149-};
64150+} __no_const;
64151
64152 struct t10_reservation {
64153 /* Reservation effects all target ports */
64154@@ -496,8 +496,8 @@ struct se_cmd {
64155 atomic_t t_task_cdbs_left;
64156 atomic_t t_task_cdbs_ex_left;
64157 atomic_t t_task_cdbs_timeout_left;
64158- atomic_t t_task_cdbs_sent;
64159- atomic_t t_transport_aborted;
64160+ atomic_unchecked_t t_task_cdbs_sent;
64161+ atomic_unchecked_t t_transport_aborted;
64162 atomic_t t_transport_active;
64163 atomic_t t_transport_complete;
64164 atomic_t t_transport_queue_active;
64165@@ -744,7 +744,7 @@ struct se_device {
64166 atomic_t active_cmds;
64167 atomic_t simple_cmds;
64168 atomic_t depth_left;
64169- atomic_t dev_ordered_id;
64170+ atomic_unchecked_t dev_ordered_id;
64171 atomic_t dev_tur_active;
64172 atomic_t execute_tasks;
64173 atomic_t dev_status_thr_count;
64174diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
64175index 1c09820..7f5ec79 100644
64176--- a/include/trace/events/irq.h
64177+++ b/include/trace/events/irq.h
64178@@ -36,7 +36,7 @@ struct softirq_action;
64179 */
64180 TRACE_EVENT(irq_handler_entry,
64181
64182- TP_PROTO(int irq, struct irqaction *action),
64183+ TP_PROTO(int irq, const struct irqaction *action),
64184
64185 TP_ARGS(irq, action),
64186
64187@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
64188 */
64189 TRACE_EVENT(irq_handler_exit,
64190
64191- TP_PROTO(int irq, struct irqaction *action, int ret),
64192+ TP_PROTO(int irq, const struct irqaction *action, int ret),
64193
64194 TP_ARGS(irq, action, ret),
64195
64196diff --git a/include/video/udlfb.h b/include/video/udlfb.h
64197index 69d485a..dd0bee7 100644
64198--- a/include/video/udlfb.h
64199+++ b/include/video/udlfb.h
64200@@ -51,10 +51,10 @@ struct dlfb_data {
64201 int base8;
64202 u32 pseudo_palette[256];
64203 /* blit-only rendering path metrics, exposed through sysfs */
64204- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
64205- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
64206- atomic_t bytes_sent; /* to usb, after compression including overhead */
64207- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
64208+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
64209+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
64210+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
64211+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
64212 };
64213
64214 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
64215diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
64216index 0993a22..32ba2fe 100644
64217--- a/include/video/uvesafb.h
64218+++ b/include/video/uvesafb.h
64219@@ -177,6 +177,7 @@ struct uvesafb_par {
64220 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
64221 u8 pmi_setpal; /* PMI for palette changes */
64222 u16 *pmi_base; /* protected mode interface location */
64223+ u8 *pmi_code; /* protected mode code location */
64224 void *pmi_start;
64225 void *pmi_pal;
64226 u8 *vbe_state_orig; /*
64227diff --git a/init/Kconfig b/init/Kconfig
64228index d627783..693a9f3 100644
64229--- a/init/Kconfig
64230+++ b/init/Kconfig
64231@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
64232
64233 config COMPAT_BRK
64234 bool "Disable heap randomization"
64235- default y
64236+ default n
64237 help
64238 Randomizing heap placement makes heap exploits harder, but it
64239 also breaks ancient binaries (including anything libc5 based).
64240diff --git a/init/do_mounts.c b/init/do_mounts.c
64241index c0851a8..4f8977d 100644
64242--- a/init/do_mounts.c
64243+++ b/init/do_mounts.c
64244@@ -287,11 +287,11 @@ static void __init get_fs_names(char *page)
64245
64246 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
64247 {
64248- int err = sys_mount(name, "/root", fs, flags, data);
64249+ int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
64250 if (err)
64251 return err;
64252
64253- sys_chdir((const char __user __force *)"/root");
64254+ sys_chdir((const char __force_user*)"/root");
64255 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
64256 printk(KERN_INFO
64257 "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
64258@@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...)
64259 va_start(args, fmt);
64260 vsprintf(buf, fmt, args);
64261 va_end(args);
64262- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
64263+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
64264 if (fd >= 0) {
64265 sys_ioctl(fd, FDEJECT, 0);
64266 sys_close(fd);
64267 }
64268 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
64269- fd = sys_open("/dev/console", O_RDWR, 0);
64270+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
64271 if (fd >= 0) {
64272 sys_ioctl(fd, TCGETS, (long)&termios);
64273 termios.c_lflag &= ~ICANON;
64274 sys_ioctl(fd, TCSETSF, (long)&termios);
64275- sys_read(fd, &c, 1);
64276+ sys_read(fd, (char __user *)&c, 1);
64277 termios.c_lflag |= ICANON;
64278 sys_ioctl(fd, TCSETSF, (long)&termios);
64279 sys_close(fd);
64280@@ -488,6 +488,6 @@ void __init prepare_namespace(void)
64281 mount_root();
64282 out:
64283 devtmpfs_mount("dev");
64284- sys_mount(".", "/", NULL, MS_MOVE, NULL);
64285- sys_chroot((const char __user __force *)".");
64286+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
64287+ sys_chroot((const char __force_user *)".");
64288 }
64289diff --git a/init/do_mounts.h b/init/do_mounts.h
64290index f5b978a..69dbfe8 100644
64291--- a/init/do_mounts.h
64292+++ b/init/do_mounts.h
64293@@ -15,15 +15,15 @@ extern int root_mountflags;
64294
64295 static inline int create_dev(char *name, dev_t dev)
64296 {
64297- sys_unlink(name);
64298- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
64299+ sys_unlink((char __force_user *)name);
64300+ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
64301 }
64302
64303 #if BITS_PER_LONG == 32
64304 static inline u32 bstat(char *name)
64305 {
64306 struct stat64 stat;
64307- if (sys_stat64(name, &stat) != 0)
64308+ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
64309 return 0;
64310 if (!S_ISBLK(stat.st_mode))
64311 return 0;
64312@@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
64313 static inline u32 bstat(char *name)
64314 {
64315 struct stat stat;
64316- if (sys_newstat(name, &stat) != 0)
64317+ if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
64318 return 0;
64319 if (!S_ISBLK(stat.st_mode))
64320 return 0;
64321diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
64322index 3098a38..253064e 100644
64323--- a/init/do_mounts_initrd.c
64324+++ b/init/do_mounts_initrd.c
64325@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
64326 create_dev("/dev/root.old", Root_RAM0);
64327 /* mount initrd on rootfs' /root */
64328 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
64329- sys_mkdir("/old", 0700);
64330- root_fd = sys_open("/", 0, 0);
64331- old_fd = sys_open("/old", 0, 0);
64332+ sys_mkdir((const char __force_user *)"/old", 0700);
64333+ root_fd = sys_open((const char __force_user *)"/", 0, 0);
64334+ old_fd = sys_open((const char __force_user *)"/old", 0, 0);
64335 /* move initrd over / and chdir/chroot in initrd root */
64336- sys_chdir("/root");
64337- sys_mount(".", "/", NULL, MS_MOVE, NULL);
64338- sys_chroot(".");
64339+ sys_chdir((const char __force_user *)"/root");
64340+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
64341+ sys_chroot((const char __force_user *)".");
64342
64343 /*
64344 * In case that a resume from disk is carried out by linuxrc or one of
64345@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
64346
64347 /* move initrd to rootfs' /old */
64348 sys_fchdir(old_fd);
64349- sys_mount("/", ".", NULL, MS_MOVE, NULL);
64350+ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
64351 /* switch root and cwd back to / of rootfs */
64352 sys_fchdir(root_fd);
64353- sys_chroot(".");
64354+ sys_chroot((const char __force_user *)".");
64355 sys_close(old_fd);
64356 sys_close(root_fd);
64357
64358 if (new_decode_dev(real_root_dev) == Root_RAM0) {
64359- sys_chdir("/old");
64360+ sys_chdir((const char __force_user *)"/old");
64361 return;
64362 }
64363
64364@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
64365 mount_root();
64366
64367 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
64368- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
64369+ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
64370 if (!error)
64371 printk("okay\n");
64372 else {
64373- int fd = sys_open("/dev/root.old", O_RDWR, 0);
64374+ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
64375 if (error == -ENOENT)
64376 printk("/initrd does not exist. Ignored.\n");
64377 else
64378 printk("failed\n");
64379 printk(KERN_NOTICE "Unmounting old root\n");
64380- sys_umount("/old", MNT_DETACH);
64381+ sys_umount((char __force_user *)"/old", MNT_DETACH);
64382 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
64383 if (fd < 0) {
64384 error = fd;
64385@@ -116,11 +116,11 @@ int __init initrd_load(void)
64386 * mounted in the normal path.
64387 */
64388 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
64389- sys_unlink("/initrd.image");
64390+ sys_unlink((const char __force_user *)"/initrd.image");
64391 handle_initrd();
64392 return 1;
64393 }
64394 }
64395- sys_unlink("/initrd.image");
64396+ sys_unlink((const char __force_user *)"/initrd.image");
64397 return 0;
64398 }
64399diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
64400index 32c4799..c27ee74 100644
64401--- a/init/do_mounts_md.c
64402+++ b/init/do_mounts_md.c
64403@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
64404 partitioned ? "_d" : "", minor,
64405 md_setup_args[ent].device_names);
64406
64407- fd = sys_open(name, 0, 0);
64408+ fd = sys_open((char __force_user *)name, 0, 0);
64409 if (fd < 0) {
64410 printk(KERN_ERR "md: open failed - cannot start "
64411 "array %s\n", name);
64412@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
64413 * array without it
64414 */
64415 sys_close(fd);
64416- fd = sys_open(name, 0, 0);
64417+ fd = sys_open((char __force_user *)name, 0, 0);
64418 sys_ioctl(fd, BLKRRPART, 0);
64419 }
64420 sys_close(fd);
64421@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
64422
64423 wait_for_device_probe();
64424
64425- fd = sys_open((const char __user __force *) "/dev/md0", 0, 0);
64426+ fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
64427 if (fd >= 0) {
64428 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
64429 sys_close(fd);
64430diff --git a/init/initramfs.c b/init/initramfs.c
64431index 2531811..040d4d4 100644
64432--- a/init/initramfs.c
64433+++ b/init/initramfs.c
64434@@ -74,7 +74,7 @@ static void __init free_hash(void)
64435 }
64436 }
64437
64438-static long __init do_utime(char __user *filename, time_t mtime)
64439+static long __init do_utime(__force char __user *filename, time_t mtime)
64440 {
64441 struct timespec t[2];
64442
64443@@ -109,7 +109,7 @@ static void __init dir_utime(void)
64444 struct dir_entry *de, *tmp;
64445 list_for_each_entry_safe(de, tmp, &dir_list, list) {
64446 list_del(&de->list);
64447- do_utime(de->name, de->mtime);
64448+ do_utime((char __force_user *)de->name, de->mtime);
64449 kfree(de->name);
64450 kfree(de);
64451 }
64452@@ -271,7 +271,7 @@ static int __init maybe_link(void)
64453 if (nlink >= 2) {
64454 char *old = find_link(major, minor, ino, mode, collected);
64455 if (old)
64456- return (sys_link(old, collected) < 0) ? -1 : 1;
64457+ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
64458 }
64459 return 0;
64460 }
64461@@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
64462 {
64463 struct stat st;
64464
64465- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
64466+ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
64467 if (S_ISDIR(st.st_mode))
64468- sys_rmdir(path);
64469+ sys_rmdir((char __force_user *)path);
64470 else
64471- sys_unlink(path);
64472+ sys_unlink((char __force_user *)path);
64473 }
64474 }
64475
64476@@ -305,7 +305,7 @@ static int __init do_name(void)
64477 int openflags = O_WRONLY|O_CREAT;
64478 if (ml != 1)
64479 openflags |= O_TRUNC;
64480- wfd = sys_open(collected, openflags, mode);
64481+ wfd = sys_open((char __force_user *)collected, openflags, mode);
64482
64483 if (wfd >= 0) {
64484 sys_fchown(wfd, uid, gid);
64485@@ -317,17 +317,17 @@ static int __init do_name(void)
64486 }
64487 }
64488 } else if (S_ISDIR(mode)) {
64489- sys_mkdir(collected, mode);
64490- sys_chown(collected, uid, gid);
64491- sys_chmod(collected, mode);
64492+ sys_mkdir((char __force_user *)collected, mode);
64493+ sys_chown((char __force_user *)collected, uid, gid);
64494+ sys_chmod((char __force_user *)collected, mode);
64495 dir_add(collected, mtime);
64496 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
64497 S_ISFIFO(mode) || S_ISSOCK(mode)) {
64498 if (maybe_link() == 0) {
64499- sys_mknod(collected, mode, rdev);
64500- sys_chown(collected, uid, gid);
64501- sys_chmod(collected, mode);
64502- do_utime(collected, mtime);
64503+ sys_mknod((char __force_user *)collected, mode, rdev);
64504+ sys_chown((char __force_user *)collected, uid, gid);
64505+ sys_chmod((char __force_user *)collected, mode);
64506+ do_utime((char __force_user *)collected, mtime);
64507 }
64508 }
64509 return 0;
64510@@ -336,15 +336,15 @@ static int __init do_name(void)
64511 static int __init do_copy(void)
64512 {
64513 if (count >= body_len) {
64514- sys_write(wfd, victim, body_len);
64515+ sys_write(wfd, (char __force_user *)victim, body_len);
64516 sys_close(wfd);
64517- do_utime(vcollected, mtime);
64518+ do_utime((char __force_user *)vcollected, mtime);
64519 kfree(vcollected);
64520 eat(body_len);
64521 state = SkipIt;
64522 return 0;
64523 } else {
64524- sys_write(wfd, victim, count);
64525+ sys_write(wfd, (char __force_user *)victim, count);
64526 body_len -= count;
64527 eat(count);
64528 return 1;
64529@@ -355,9 +355,9 @@ static int __init do_symlink(void)
64530 {
64531 collected[N_ALIGN(name_len) + body_len] = '\0';
64532 clean_path(collected, 0);
64533- sys_symlink(collected + N_ALIGN(name_len), collected);
64534- sys_lchown(collected, uid, gid);
64535- do_utime(collected, mtime);
64536+ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
64537+ sys_lchown((char __force_user *)collected, uid, gid);
64538+ do_utime((char __force_user *)collected, mtime);
64539 state = SkipIt;
64540 next_state = Reset;
64541 return 0;
64542diff --git a/init/main.c b/init/main.c
64543index 03b408d..5777f59 100644
64544--- a/init/main.c
64545+++ b/init/main.c
64546@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
64547 extern void tc_init(void);
64548 #endif
64549
64550+extern void grsecurity_init(void);
64551+
64552 /*
64553 * Debug helper: via this flag we know that we are in 'early bootup code'
64554 * where only the boot processor is running with IRQ disabled. This means
64555@@ -149,6 +151,49 @@ static int __init set_reset_devices(char *str)
64556
64557 __setup("reset_devices", set_reset_devices);
64558
64559+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
64560+extern char pax_enter_kernel_user[];
64561+extern char pax_exit_kernel_user[];
64562+extern pgdval_t clone_pgd_mask;
64563+#endif
64564+
64565+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
64566+static int __init setup_pax_nouderef(char *str)
64567+{
64568+#ifdef CONFIG_X86_32
64569+ unsigned int cpu;
64570+ struct desc_struct *gdt;
64571+
64572+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
64573+ gdt = get_cpu_gdt_table(cpu);
64574+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
64575+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
64576+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
64577+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
64578+ }
64579+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
64580+#else
64581+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
64582+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
64583+ clone_pgd_mask = ~(pgdval_t)0UL;
64584+#endif
64585+
64586+ return 0;
64587+}
64588+early_param("pax_nouderef", setup_pax_nouderef);
64589+#endif
64590+
64591+#ifdef CONFIG_PAX_SOFTMODE
64592+int pax_softmode;
64593+
64594+static int __init setup_pax_softmode(char *str)
64595+{
64596+ get_option(&str, &pax_softmode);
64597+ return 1;
64598+}
64599+__setup("pax_softmode=", setup_pax_softmode);
64600+#endif
64601+
64602 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
64603 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
64604 static const char *panic_later, *panic_param;
64605@@ -678,6 +723,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
64606 {
64607 int count = preempt_count();
64608 int ret;
64609+ const char *msg1 = "", *msg2 = "";
64610
64611 if (initcall_debug)
64612 ret = do_one_initcall_debug(fn);
64613@@ -690,15 +736,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
64614 sprintf(msgbuf, "error code %d ", ret);
64615
64616 if (preempt_count() != count) {
64617- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
64618+ msg1 = " preemption imbalance";
64619 preempt_count() = count;
64620 }
64621 if (irqs_disabled()) {
64622- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
64623+ msg2 = " disabled interrupts";
64624 local_irq_enable();
64625 }
64626- if (msgbuf[0]) {
64627- printk("initcall %pF returned with %s\n", fn, msgbuf);
64628+ if (msgbuf[0] || *msg1 || *msg2) {
64629+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
64630 }
64631
64632 return ret;
64633@@ -817,7 +863,7 @@ static int __init kernel_init(void * unused)
64634 do_basic_setup();
64635
64636 /* Open the /dev/console on the rootfs, this should never fail */
64637- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
64638+ if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
64639 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
64640
64641 (void) sys_dup(0);
64642@@ -830,11 +876,13 @@ static int __init kernel_init(void * unused)
64643 if (!ramdisk_execute_command)
64644 ramdisk_execute_command = "/init";
64645
64646- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
64647+ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
64648 ramdisk_execute_command = NULL;
64649 prepare_namespace();
64650 }
64651
64652+ grsecurity_init();
64653+
64654 /*
64655 * Ok, we have completed the initial bootup, and
64656 * we're essentially up and running. Get rid of the
64657diff --git a/ipc/mqueue.c b/ipc/mqueue.c
64658index ed049ea..6442f7f 100644
64659--- a/ipc/mqueue.c
64660+++ b/ipc/mqueue.c
64661@@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
64662 mq_bytes = (mq_msg_tblsz +
64663 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
64664
64665+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
64666 spin_lock(&mq_lock);
64667 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
64668 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
64669diff --git a/ipc/msg.c b/ipc/msg.c
64670index 7385de2..a8180e0 100644
64671--- a/ipc/msg.c
64672+++ b/ipc/msg.c
64673@@ -309,18 +309,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
64674 return security_msg_queue_associate(msq, msgflg);
64675 }
64676
64677+static struct ipc_ops msg_ops = {
64678+ .getnew = newque,
64679+ .associate = msg_security,
64680+ .more_checks = NULL
64681+};
64682+
64683 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
64684 {
64685 struct ipc_namespace *ns;
64686- struct ipc_ops msg_ops;
64687 struct ipc_params msg_params;
64688
64689 ns = current->nsproxy->ipc_ns;
64690
64691- msg_ops.getnew = newque;
64692- msg_ops.associate = msg_security;
64693- msg_ops.more_checks = NULL;
64694-
64695 msg_params.key = key;
64696 msg_params.flg = msgflg;
64697
64698diff --git a/ipc/sem.c b/ipc/sem.c
64699index c8e00f8..1135c4e 100644
64700--- a/ipc/sem.c
64701+++ b/ipc/sem.c
64702@@ -318,10 +318,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
64703 return 0;
64704 }
64705
64706+static struct ipc_ops sem_ops = {
64707+ .getnew = newary,
64708+ .associate = sem_security,
64709+ .more_checks = sem_more_checks
64710+};
64711+
64712 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64713 {
64714 struct ipc_namespace *ns;
64715- struct ipc_ops sem_ops;
64716 struct ipc_params sem_params;
64717
64718 ns = current->nsproxy->ipc_ns;
64719@@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64720 if (nsems < 0 || nsems > ns->sc_semmsl)
64721 return -EINVAL;
64722
64723- sem_ops.getnew = newary;
64724- sem_ops.associate = sem_security;
64725- sem_ops.more_checks = sem_more_checks;
64726-
64727 sem_params.key = key;
64728 sem_params.flg = semflg;
64729 sem_params.u.nsems = nsems;
64730@@ -848,6 +849,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
64731 int nsems;
64732 struct list_head tasks;
64733
64734+ pax_track_stack();
64735+
64736 sma = sem_lock_check(ns, semid);
64737 if (IS_ERR(sma))
64738 return PTR_ERR(sma);
64739@@ -1295,6 +1298,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
64740 struct ipc_namespace *ns;
64741 struct list_head tasks;
64742
64743+ pax_track_stack();
64744+
64745 ns = current->nsproxy->ipc_ns;
64746
64747 if (nsops < 1 || semid < 0)
64748diff --git a/ipc/shm.c b/ipc/shm.c
64749index 02ecf2c..c8f5627 100644
64750--- a/ipc/shm.c
64751+++ b/ipc/shm.c
64752@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
64753 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
64754 #endif
64755
64756+#ifdef CONFIG_GRKERNSEC
64757+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64758+ const time_t shm_createtime, const uid_t cuid,
64759+ const int shmid);
64760+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64761+ const time_t shm_createtime);
64762+#endif
64763+
64764 void shm_init_ns(struct ipc_namespace *ns)
64765 {
64766 ns->shm_ctlmax = SHMMAX;
64767@@ -508,6 +516,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
64768 shp->shm_lprid = 0;
64769 shp->shm_atim = shp->shm_dtim = 0;
64770 shp->shm_ctim = get_seconds();
64771+#ifdef CONFIG_GRKERNSEC
64772+ {
64773+ struct timespec timeval;
64774+ do_posix_clock_monotonic_gettime(&timeval);
64775+
64776+ shp->shm_createtime = timeval.tv_sec;
64777+ }
64778+#endif
64779 shp->shm_segsz = size;
64780 shp->shm_nattch = 0;
64781 shp->shm_file = file;
64782@@ -559,18 +575,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
64783 return 0;
64784 }
64785
64786+static struct ipc_ops shm_ops = {
64787+ .getnew = newseg,
64788+ .associate = shm_security,
64789+ .more_checks = shm_more_checks
64790+};
64791+
64792 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
64793 {
64794 struct ipc_namespace *ns;
64795- struct ipc_ops shm_ops;
64796 struct ipc_params shm_params;
64797
64798 ns = current->nsproxy->ipc_ns;
64799
64800- shm_ops.getnew = newseg;
64801- shm_ops.associate = shm_security;
64802- shm_ops.more_checks = shm_more_checks;
64803-
64804 shm_params.key = key;
64805 shm_params.flg = shmflg;
64806 shm_params.u.size = size;
64807@@ -870,8 +887,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
64808 case SHM_LOCK:
64809 case SHM_UNLOCK:
64810 {
64811- struct file *uninitialized_var(shm_file);
64812-
64813 lru_add_drain_all(); /* drain pagevecs to lru lists */
64814
64815 shp = shm_lock_check(ns, shmid);
64816@@ -1004,9 +1019,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
64817 if (err)
64818 goto out_unlock;
64819
64820+#ifdef CONFIG_GRKERNSEC
64821+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
64822+ shp->shm_perm.cuid, shmid) ||
64823+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
64824+ err = -EACCES;
64825+ goto out_unlock;
64826+ }
64827+#endif
64828+
64829 path = shp->shm_file->f_path;
64830 path_get(&path);
64831 shp->shm_nattch++;
64832+#ifdef CONFIG_GRKERNSEC
64833+ shp->shm_lapid = current->pid;
64834+#endif
64835 size = i_size_read(path.dentry->d_inode);
64836 shm_unlock(shp);
64837
64838diff --git a/kernel/acct.c b/kernel/acct.c
64839index fa7eb3d..7faf116 100644
64840--- a/kernel/acct.c
64841+++ b/kernel/acct.c
64842@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
64843 */
64844 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
64845 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
64846- file->f_op->write(file, (char *)&ac,
64847+ file->f_op->write(file, (char __force_user *)&ac,
64848 sizeof(acct_t), &file->f_pos);
64849 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
64850 set_fs(fs);
64851diff --git a/kernel/audit.c b/kernel/audit.c
64852index 0a1355c..dca420f 100644
64853--- a/kernel/audit.c
64854+++ b/kernel/audit.c
64855@@ -115,7 +115,7 @@ u32 audit_sig_sid = 0;
64856 3) suppressed due to audit_rate_limit
64857 4) suppressed due to audit_backlog_limit
64858 */
64859-static atomic_t audit_lost = ATOMIC_INIT(0);
64860+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
64861
64862 /* The netlink socket. */
64863 static struct sock *audit_sock;
64864@@ -237,7 +237,7 @@ void audit_log_lost(const char *message)
64865 unsigned long now;
64866 int print;
64867
64868- atomic_inc(&audit_lost);
64869+ atomic_inc_unchecked(&audit_lost);
64870
64871 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
64872
64873@@ -256,7 +256,7 @@ void audit_log_lost(const char *message)
64874 printk(KERN_WARNING
64875 "audit: audit_lost=%d audit_rate_limit=%d "
64876 "audit_backlog_limit=%d\n",
64877- atomic_read(&audit_lost),
64878+ atomic_read_unchecked(&audit_lost),
64879 audit_rate_limit,
64880 audit_backlog_limit);
64881 audit_panic(message);
64882@@ -689,7 +689,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
64883 status_set.pid = audit_pid;
64884 status_set.rate_limit = audit_rate_limit;
64885 status_set.backlog_limit = audit_backlog_limit;
64886- status_set.lost = atomic_read(&audit_lost);
64887+ status_set.lost = atomic_read_unchecked(&audit_lost);
64888 status_set.backlog = skb_queue_len(&audit_skb_queue);
64889 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
64890 &status_set, sizeof(status_set));
64891diff --git a/kernel/auditsc.c b/kernel/auditsc.c
64892index ce4b054..8139ed7 100644
64893--- a/kernel/auditsc.c
64894+++ b/kernel/auditsc.c
64895@@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
64896 }
64897
64898 /* global counter which is incremented every time something logs in */
64899-static atomic_t session_id = ATOMIC_INIT(0);
64900+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
64901
64902 /**
64903 * audit_set_loginuid - set a task's audit_context loginuid
64904@@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
64905 */
64906 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
64907 {
64908- unsigned int sessionid = atomic_inc_return(&session_id);
64909+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
64910 struct audit_context *context = task->audit_context;
64911
64912 if (context && context->in_syscall) {
64913diff --git a/kernel/capability.c b/kernel/capability.c
64914index 283c529..36ac81e 100644
64915--- a/kernel/capability.c
64916+++ b/kernel/capability.c
64917@@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
64918 * before modification is attempted and the application
64919 * fails.
64920 */
64921+ if (tocopy > ARRAY_SIZE(kdata))
64922+ return -EFAULT;
64923+
64924 if (copy_to_user(dataptr, kdata, tocopy
64925 * sizeof(struct __user_cap_data_struct))) {
64926 return -EFAULT;
64927@@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
64928 BUG();
64929 }
64930
64931- if (security_capable(ns, current_cred(), cap) == 0) {
64932+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
64933 current->flags |= PF_SUPERPRIV;
64934 return true;
64935 }
64936@@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *ns, int cap)
64937 }
64938 EXPORT_SYMBOL(ns_capable);
64939
64940+bool ns_capable_nolog(struct user_namespace *ns, int cap)
64941+{
64942+ if (unlikely(!cap_valid(cap))) {
64943+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
64944+ BUG();
64945+ }
64946+
64947+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
64948+ current->flags |= PF_SUPERPRIV;
64949+ return true;
64950+ }
64951+ return false;
64952+}
64953+EXPORT_SYMBOL(ns_capable_nolog);
64954+
64955+bool capable_nolog(int cap)
64956+{
64957+ return ns_capable_nolog(&init_user_ns, cap);
64958+}
64959+EXPORT_SYMBOL(capable_nolog);
64960+
64961 /**
64962 * task_ns_capable - Determine whether current task has a superior
64963 * capability targeted at a specific task's user namespace.
64964@@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct *t, int cap)
64965 }
64966 EXPORT_SYMBOL(task_ns_capable);
64967
64968+bool task_ns_capable_nolog(struct task_struct *t, int cap)
64969+{
64970+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
64971+}
64972+EXPORT_SYMBOL(task_ns_capable_nolog);
64973+
64974 /**
64975 * nsown_capable - Check superior capability to one's own user_ns
64976 * @cap: The capability in question
64977diff --git a/kernel/cgroup.c b/kernel/cgroup.c
64978index 1d2b6ce..87bf267 100644
64979--- a/kernel/cgroup.c
64980+++ b/kernel/cgroup.c
64981@@ -595,6 +595,8 @@ static struct css_set *find_css_set(
64982 struct hlist_head *hhead;
64983 struct cg_cgroup_link *link;
64984
64985+ pax_track_stack();
64986+
64987 /* First see if we already have a cgroup group that matches
64988 * the desired set */
64989 read_lock(&css_set_lock);
64990diff --git a/kernel/compat.c b/kernel/compat.c
64991index e2435ee..8e82199 100644
64992--- a/kernel/compat.c
64993+++ b/kernel/compat.c
64994@@ -13,6 +13,7 @@
64995
64996 #include <linux/linkage.h>
64997 #include <linux/compat.h>
64998+#include <linux/module.h>
64999 #include <linux/errno.h>
65000 #include <linux/time.h>
65001 #include <linux/signal.h>
65002@@ -167,7 +168,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
65003 mm_segment_t oldfs;
65004 long ret;
65005
65006- restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
65007+ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
65008 oldfs = get_fs();
65009 set_fs(KERNEL_DS);
65010 ret = hrtimer_nanosleep_restart(restart);
65011@@ -199,7 +200,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
65012 oldfs = get_fs();
65013 set_fs(KERNEL_DS);
65014 ret = hrtimer_nanosleep(&tu,
65015- rmtp ? (struct timespec __user *)&rmt : NULL,
65016+ rmtp ? (struct timespec __force_user *)&rmt : NULL,
65017 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
65018 set_fs(oldfs);
65019
65020@@ -308,7 +309,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
65021 mm_segment_t old_fs = get_fs();
65022
65023 set_fs(KERNEL_DS);
65024- ret = sys_sigpending((old_sigset_t __user *) &s);
65025+ ret = sys_sigpending((old_sigset_t __force_user *) &s);
65026 set_fs(old_fs);
65027 if (ret == 0)
65028 ret = put_user(s, set);
65029@@ -331,8 +332,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
65030 old_fs = get_fs();
65031 set_fs(KERNEL_DS);
65032 ret = sys_sigprocmask(how,
65033- set ? (old_sigset_t __user *) &s : NULL,
65034- oset ? (old_sigset_t __user *) &s : NULL);
65035+ set ? (old_sigset_t __force_user *) &s : NULL,
65036+ oset ? (old_sigset_t __force_user *) &s : NULL);
65037 set_fs(old_fs);
65038 if (ret == 0)
65039 if (oset)
65040@@ -369,7 +370,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
65041 mm_segment_t old_fs = get_fs();
65042
65043 set_fs(KERNEL_DS);
65044- ret = sys_old_getrlimit(resource, &r);
65045+ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
65046 set_fs(old_fs);
65047
65048 if (!ret) {
65049@@ -441,7 +442,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
65050 mm_segment_t old_fs = get_fs();
65051
65052 set_fs(KERNEL_DS);
65053- ret = sys_getrusage(who, (struct rusage __user *) &r);
65054+ ret = sys_getrusage(who, (struct rusage __force_user *) &r);
65055 set_fs(old_fs);
65056
65057 if (ret)
65058@@ -468,8 +469,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
65059 set_fs (KERNEL_DS);
65060 ret = sys_wait4(pid,
65061 (stat_addr ?
65062- (unsigned int __user *) &status : NULL),
65063- options, (struct rusage __user *) &r);
65064+ (unsigned int __force_user *) &status : NULL),
65065+ options, (struct rusage __force_user *) &r);
65066 set_fs (old_fs);
65067
65068 if (ret > 0) {
65069@@ -494,8 +495,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
65070 memset(&info, 0, sizeof(info));
65071
65072 set_fs(KERNEL_DS);
65073- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
65074- uru ? (struct rusage __user *)&ru : NULL);
65075+ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
65076+ uru ? (struct rusage __force_user *)&ru : NULL);
65077 set_fs(old_fs);
65078
65079 if ((ret < 0) || (info.si_signo == 0))
65080@@ -625,8 +626,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
65081 oldfs = get_fs();
65082 set_fs(KERNEL_DS);
65083 err = sys_timer_settime(timer_id, flags,
65084- (struct itimerspec __user *) &newts,
65085- (struct itimerspec __user *) &oldts);
65086+ (struct itimerspec __force_user *) &newts,
65087+ (struct itimerspec __force_user *) &oldts);
65088 set_fs(oldfs);
65089 if (!err && old && put_compat_itimerspec(old, &oldts))
65090 return -EFAULT;
65091@@ -643,7 +644,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
65092 oldfs = get_fs();
65093 set_fs(KERNEL_DS);
65094 err = sys_timer_gettime(timer_id,
65095- (struct itimerspec __user *) &ts);
65096+ (struct itimerspec __force_user *) &ts);
65097 set_fs(oldfs);
65098 if (!err && put_compat_itimerspec(setting, &ts))
65099 return -EFAULT;
65100@@ -662,7 +663,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
65101 oldfs = get_fs();
65102 set_fs(KERNEL_DS);
65103 err = sys_clock_settime(which_clock,
65104- (struct timespec __user *) &ts);
65105+ (struct timespec __force_user *) &ts);
65106 set_fs(oldfs);
65107 return err;
65108 }
65109@@ -677,7 +678,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
65110 oldfs = get_fs();
65111 set_fs(KERNEL_DS);
65112 err = sys_clock_gettime(which_clock,
65113- (struct timespec __user *) &ts);
65114+ (struct timespec __force_user *) &ts);
65115 set_fs(oldfs);
65116 if (!err && put_compat_timespec(&ts, tp))
65117 return -EFAULT;
65118@@ -697,7 +698,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
65119
65120 oldfs = get_fs();
65121 set_fs(KERNEL_DS);
65122- ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
65123+ ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
65124 set_fs(oldfs);
65125
65126 err = compat_put_timex(utp, &txc);
65127@@ -717,7 +718,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
65128 oldfs = get_fs();
65129 set_fs(KERNEL_DS);
65130 err = sys_clock_getres(which_clock,
65131- (struct timespec __user *) &ts);
65132+ (struct timespec __force_user *) &ts);
65133 set_fs(oldfs);
65134 if (!err && tp && put_compat_timespec(&ts, tp))
65135 return -EFAULT;
65136@@ -729,9 +730,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
65137 long err;
65138 mm_segment_t oldfs;
65139 struct timespec tu;
65140- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
65141+ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
65142
65143- restart->nanosleep.rmtp = (struct timespec __user *) &tu;
65144+ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
65145 oldfs = get_fs();
65146 set_fs(KERNEL_DS);
65147 err = clock_nanosleep_restart(restart);
65148@@ -763,8 +764,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
65149 oldfs = get_fs();
65150 set_fs(KERNEL_DS);
65151 err = sys_clock_nanosleep(which_clock, flags,
65152- (struct timespec __user *) &in,
65153- (struct timespec __user *) &out);
65154+ (struct timespec __force_user *) &in,
65155+ (struct timespec __force_user *) &out);
65156 set_fs(oldfs);
65157
65158 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
65159diff --git a/kernel/configs.c b/kernel/configs.c
65160index 42e8fa0..9e7406b 100644
65161--- a/kernel/configs.c
65162+++ b/kernel/configs.c
65163@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
65164 struct proc_dir_entry *entry;
65165
65166 /* create the current config file */
65167+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
65168+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
65169+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
65170+ &ikconfig_file_ops);
65171+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65172+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
65173+ &ikconfig_file_ops);
65174+#endif
65175+#else
65176 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
65177 &ikconfig_file_ops);
65178+#endif
65179+
65180 if (!entry)
65181 return -ENOMEM;
65182
65183diff --git a/kernel/cred.c b/kernel/cred.c
65184index 8ef31f5..d7d50d8 100644
65185--- a/kernel/cred.c
65186+++ b/kernel/cred.c
65187@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
65188 */
65189 void __put_cred(struct cred *cred)
65190 {
65191+ pax_track_stack();
65192+
65193 kdebug("__put_cred(%p{%d,%d})", cred,
65194 atomic_read(&cred->usage),
65195 read_cred_subscribers(cred));
65196@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
65197 {
65198 struct cred *cred;
65199
65200+ pax_track_stack();
65201+
65202 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
65203 atomic_read(&tsk->cred->usage),
65204 read_cred_subscribers(tsk->cred));
65205@@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct task_struct *task)
65206 {
65207 const struct cred *cred;
65208
65209+ pax_track_stack();
65210+
65211 rcu_read_lock();
65212
65213 do {
65214@@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
65215 {
65216 struct cred *new;
65217
65218+ pax_track_stack();
65219+
65220 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
65221 if (!new)
65222 return NULL;
65223@@ -281,12 +289,14 @@ error:
65224 *
65225 * Call commit_creds() or abort_creds() to clean up.
65226 */
65227-struct cred *prepare_creds(void)
65228+
65229+static struct cred *__prepare_creds(struct task_struct *task)
65230 {
65231- struct task_struct *task = current;
65232 const struct cred *old;
65233 struct cred *new;
65234
65235+ pax_track_stack();
65236+
65237 validate_process_creds();
65238
65239 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65240@@ -322,6 +332,11 @@ error:
65241 abort_creds(new);
65242 return NULL;
65243 }
65244+
65245+struct cred *prepare_creds(void)
65246+{
65247+ return __prepare_creds(current);
65248+}
65249 EXPORT_SYMBOL(prepare_creds);
65250
65251 /*
65252@@ -333,6 +348,8 @@ struct cred *prepare_exec_creds(void)
65253 struct thread_group_cred *tgcred = NULL;
65254 struct cred *new;
65255
65256+ pax_track_stack();
65257+
65258 #ifdef CONFIG_KEYS
65259 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
65260 if (!tgcred)
65261@@ -385,6 +402,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
65262 struct cred *new;
65263 int ret;
65264
65265+ pax_track_stack();
65266+
65267 if (
65268 #ifdef CONFIG_KEYS
65269 !p->cred->thread_keyring &&
65270@@ -470,11 +489,12 @@ error_put:
65271 * Always returns 0 thus allowing this function to be tail-called at the end
65272 * of, say, sys_setgid().
65273 */
65274-int commit_creds(struct cred *new)
65275+static int __commit_creds(struct task_struct *task, struct cred *new)
65276 {
65277- struct task_struct *task = current;
65278 const struct cred *old = task->real_cred;
65279
65280+ pax_track_stack();
65281+
65282 kdebug("commit_creds(%p{%d,%d})", new,
65283 atomic_read(&new->usage),
65284 read_cred_subscribers(new));
65285@@ -489,6 +509,8 @@ int commit_creds(struct cred *new)
65286
65287 get_cred(new); /* we will require a ref for the subj creds too */
65288
65289+ gr_set_role_label(task, new->uid, new->gid);
65290+
65291 /* dumpability changes */
65292 if (old->euid != new->euid ||
65293 old->egid != new->egid ||
65294@@ -538,6 +560,64 @@ int commit_creds(struct cred *new)
65295 put_cred(old);
65296 return 0;
65297 }
65298+
65299+int commit_creds(struct cred *new)
65300+{
65301+#ifdef CONFIG_GRKERNSEC_SETXID
65302+ struct task_struct *t;
65303+ struct cred *ncred;
65304+ const struct cred *old;
65305+
65306+ if (grsec_enable_setxid && !current_is_single_threaded() &&
65307+ !current_uid() && new->uid) {
65308+ rcu_read_lock();
65309+ read_lock(&tasklist_lock);
65310+ for (t = next_thread(current); t != current;
65311+ t = next_thread(t)) {
65312+ old = __task_cred(t);
65313+ if (old->uid)
65314+ continue;
65315+ ncred = __prepare_creds(t);
65316+ if (!ncred)
65317+ goto die;
65318+ // uids
65319+ ncred->uid = new->uid;
65320+ ncred->euid = new->euid;
65321+ ncred->suid = new->suid;
65322+ ncred->fsuid = new->fsuid;
65323+ // gids
65324+ ncred->gid = new->gid;
65325+ ncred->egid = new->egid;
65326+ ncred->sgid = new->sgid;
65327+ ncred->fsgid = new->fsgid;
65328+ // groups
65329+ if (set_groups(ncred, new->group_info) < 0) {
65330+ abort_creds(ncred);
65331+ goto die;
65332+ }
65333+ // caps
65334+ ncred->securebits = new->securebits;
65335+ ncred->cap_inheritable = new->cap_inheritable;
65336+ ncred->cap_permitted = new->cap_permitted;
65337+ ncred->cap_effective = new->cap_effective;
65338+ ncred->cap_bset = new->cap_bset;
65339+
65340+ __commit_creds(t, ncred);
65341+ }
65342+ read_unlock(&tasklist_lock);
65343+ rcu_read_unlock();
65344+ }
65345+#endif
65346+ return __commit_creds(current, new);
65347+#ifdef CONFIG_GRKERNSEC_SETXID
65348+die:
65349+ read_unlock(&tasklist_lock);
65350+ rcu_read_unlock();
65351+ abort_creds(new);
65352+ do_group_exit(SIGKILL);
65353+#endif
65354+}
65355+
65356 EXPORT_SYMBOL(commit_creds);
65357
65358 /**
65359@@ -549,6 +629,8 @@ EXPORT_SYMBOL(commit_creds);
65360 */
65361 void abort_creds(struct cred *new)
65362 {
65363+ pax_track_stack();
65364+
65365 kdebug("abort_creds(%p{%d,%d})", new,
65366 atomic_read(&new->usage),
65367 read_cred_subscribers(new));
65368@@ -572,6 +654,8 @@ const struct cred *override_creds(const struct cred *new)
65369 {
65370 const struct cred *old = current->cred;
65371
65372+ pax_track_stack();
65373+
65374 kdebug("override_creds(%p{%d,%d})", new,
65375 atomic_read(&new->usage),
65376 read_cred_subscribers(new));
65377@@ -601,6 +685,8 @@ void revert_creds(const struct cred *old)
65378 {
65379 const struct cred *override = current->cred;
65380
65381+ pax_track_stack();
65382+
65383 kdebug("revert_creds(%p{%d,%d})", old,
65384 atomic_read(&old->usage),
65385 read_cred_subscribers(old));
65386@@ -647,6 +733,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
65387 const struct cred *old;
65388 struct cred *new;
65389
65390+ pax_track_stack();
65391+
65392 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65393 if (!new)
65394 return NULL;
65395@@ -701,6 +789,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
65396 */
65397 int set_security_override(struct cred *new, u32 secid)
65398 {
65399+ pax_track_stack();
65400+
65401 return security_kernel_act_as(new, secid);
65402 }
65403 EXPORT_SYMBOL(set_security_override);
65404@@ -720,6 +810,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
65405 u32 secid;
65406 int ret;
65407
65408+ pax_track_stack();
65409+
65410 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
65411 if (ret < 0)
65412 return ret;
65413diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
65414index 0d7c087..01b8cef 100644
65415--- a/kernel/debug/debug_core.c
65416+++ b/kernel/debug/debug_core.c
65417@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
65418 */
65419 static atomic_t masters_in_kgdb;
65420 static atomic_t slaves_in_kgdb;
65421-static atomic_t kgdb_break_tasklet_var;
65422+static atomic_unchecked_t kgdb_break_tasklet_var;
65423 atomic_t kgdb_setting_breakpoint;
65424
65425 struct task_struct *kgdb_usethread;
65426@@ -129,7 +129,7 @@ int kgdb_single_step;
65427 static pid_t kgdb_sstep_pid;
65428
65429 /* to keep track of the CPU which is doing the single stepping*/
65430-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65431+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65432
65433 /*
65434 * If you are debugging a problem where roundup (the collection of
65435@@ -542,7 +542,7 @@ return_normal:
65436 * kernel will only try for the value of sstep_tries before
65437 * giving up and continuing on.
65438 */
65439- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
65440+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
65441 (kgdb_info[cpu].task &&
65442 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
65443 atomic_set(&kgdb_active, -1);
65444@@ -636,8 +636,8 @@ cpu_master_loop:
65445 }
65446
65447 kgdb_restore:
65448- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
65449- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
65450+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
65451+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
65452 if (kgdb_info[sstep_cpu].task)
65453 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
65454 else
65455@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(void)
65456 static void kgdb_tasklet_bpt(unsigned long ing)
65457 {
65458 kgdb_breakpoint();
65459- atomic_set(&kgdb_break_tasklet_var, 0);
65460+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
65461 }
65462
65463 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
65464
65465 void kgdb_schedule_breakpoint(void)
65466 {
65467- if (atomic_read(&kgdb_break_tasklet_var) ||
65468+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
65469 atomic_read(&kgdb_active) != -1 ||
65470 atomic_read(&kgdb_setting_breakpoint))
65471 return;
65472- atomic_inc(&kgdb_break_tasklet_var);
65473+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
65474 tasklet_schedule(&kgdb_tasklet_breakpoint);
65475 }
65476 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
65477diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
65478index 63786e7..0780cac 100644
65479--- a/kernel/debug/kdb/kdb_main.c
65480+++ b/kernel/debug/kdb/kdb_main.c
65481@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const char **argv)
65482 list_for_each_entry(mod, kdb_modules, list) {
65483
65484 kdb_printf("%-20s%8u 0x%p ", mod->name,
65485- mod->core_size, (void *)mod);
65486+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
65487 #ifdef CONFIG_MODULE_UNLOAD
65488 kdb_printf("%4d ", module_refcount(mod));
65489 #endif
65490@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const char **argv)
65491 kdb_printf(" (Loading)");
65492 else
65493 kdb_printf(" (Live)");
65494- kdb_printf(" 0x%p", mod->module_core);
65495+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
65496
65497 #ifdef CONFIG_MODULE_UNLOAD
65498 {
65499diff --git a/kernel/events/core.c b/kernel/events/core.c
65500index 0f85778..0d43716 100644
65501--- a/kernel/events/core.c
65502+++ b/kernel/events/core.c
65503@@ -172,7 +172,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
65504 return 0;
65505 }
65506
65507-static atomic64_t perf_event_id;
65508+static atomic64_unchecked_t perf_event_id;
65509
65510 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
65511 enum event_type_t event_type);
65512@@ -2535,7 +2535,7 @@ static void __perf_event_read(void *info)
65513
65514 static inline u64 perf_event_count(struct perf_event *event)
65515 {
65516- return local64_read(&event->count) + atomic64_read(&event->child_count);
65517+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
65518 }
65519
65520 static u64 perf_event_read(struct perf_event *event)
65521@@ -3060,9 +3060,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
65522 mutex_lock(&event->child_mutex);
65523 total += perf_event_read(event);
65524 *enabled += event->total_time_enabled +
65525- atomic64_read(&event->child_total_time_enabled);
65526+ atomic64_read_unchecked(&event->child_total_time_enabled);
65527 *running += event->total_time_running +
65528- atomic64_read(&event->child_total_time_running);
65529+ atomic64_read_unchecked(&event->child_total_time_running);
65530
65531 list_for_each_entry(child, &event->child_list, child_list) {
65532 total += perf_event_read(child);
65533@@ -3448,10 +3448,10 @@ void perf_event_update_userpage(struct perf_event *event)
65534 userpg->offset -= local64_read(&event->hw.prev_count);
65535
65536 userpg->time_enabled = enabled +
65537- atomic64_read(&event->child_total_time_enabled);
65538+ atomic64_read_unchecked(&event->child_total_time_enabled);
65539
65540 userpg->time_running = running +
65541- atomic64_read(&event->child_total_time_running);
65542+ atomic64_read_unchecked(&event->child_total_time_running);
65543
65544 barrier();
65545 ++userpg->lock;
65546@@ -3822,11 +3822,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
65547 values[n++] = perf_event_count(event);
65548 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
65549 values[n++] = enabled +
65550- atomic64_read(&event->child_total_time_enabled);
65551+ atomic64_read_unchecked(&event->child_total_time_enabled);
65552 }
65553 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
65554 values[n++] = running +
65555- atomic64_read(&event->child_total_time_running);
65556+ atomic64_read_unchecked(&event->child_total_time_running);
65557 }
65558 if (read_format & PERF_FORMAT_ID)
65559 values[n++] = primary_event_id(event);
65560@@ -4477,12 +4477,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
65561 * need to add enough zero bytes after the string to handle
65562 * the 64bit alignment we do later.
65563 */
65564- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
65565+ buf = kzalloc(PATH_MAX, GFP_KERNEL);
65566 if (!buf) {
65567 name = strncpy(tmp, "//enomem", sizeof(tmp));
65568 goto got_name;
65569 }
65570- name = d_path(&file->f_path, buf, PATH_MAX);
65571+ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
65572 if (IS_ERR(name)) {
65573 name = strncpy(tmp, "//toolong", sizeof(tmp));
65574 goto got_name;
65575@@ -5833,7 +5833,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
65576 event->parent = parent_event;
65577
65578 event->ns = get_pid_ns(current->nsproxy->pid_ns);
65579- event->id = atomic64_inc_return(&perf_event_id);
65580+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
65581
65582 event->state = PERF_EVENT_STATE_INACTIVE;
65583
65584@@ -6355,10 +6355,10 @@ static void sync_child_event(struct perf_event *child_event,
65585 /*
65586 * Add back the child's count to the parent's count:
65587 */
65588- atomic64_add(child_val, &parent_event->child_count);
65589- atomic64_add(child_event->total_time_enabled,
65590+ atomic64_add_unchecked(child_val, &parent_event->child_count);
65591+ atomic64_add_unchecked(child_event->total_time_enabled,
65592 &parent_event->child_total_time_enabled);
65593- atomic64_add(child_event->total_time_running,
65594+ atomic64_add_unchecked(child_event->total_time_running,
65595 &parent_event->child_total_time_running);
65596
65597 /*
65598diff --git a/kernel/exit.c b/kernel/exit.c
65599index 2913b35..4465c81 100644
65600--- a/kernel/exit.c
65601+++ b/kernel/exit.c
65602@@ -57,6 +57,10 @@
65603 #include <asm/pgtable.h>
65604 #include <asm/mmu_context.h>
65605
65606+#ifdef CONFIG_GRKERNSEC
65607+extern rwlock_t grsec_exec_file_lock;
65608+#endif
65609+
65610 static void exit_mm(struct task_struct * tsk);
65611
65612 static void __unhash_process(struct task_struct *p, bool group_dead)
65613@@ -168,6 +172,10 @@ void release_task(struct task_struct * p)
65614 struct task_struct *leader;
65615 int zap_leader;
65616 repeat:
65617+#ifdef CONFIG_NET
65618+ gr_del_task_from_ip_table(p);
65619+#endif
65620+
65621 /* don't need to get the RCU readlock here - the process is dead and
65622 * can't be modifying its own credentials. But shut RCU-lockdep up */
65623 rcu_read_lock();
65624@@ -380,7 +388,7 @@ int allow_signal(int sig)
65625 * know it'll be handled, so that they don't get converted to
65626 * SIGKILL or just silently dropped.
65627 */
65628- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
65629+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
65630 recalc_sigpending();
65631 spin_unlock_irq(&current->sighand->siglock);
65632 return 0;
65633@@ -416,6 +424,17 @@ void daemonize(const char *name, ...)
65634 vsnprintf(current->comm, sizeof(current->comm), name, args);
65635 va_end(args);
65636
65637+#ifdef CONFIG_GRKERNSEC
65638+ write_lock(&grsec_exec_file_lock);
65639+ if (current->exec_file) {
65640+ fput(current->exec_file);
65641+ current->exec_file = NULL;
65642+ }
65643+ write_unlock(&grsec_exec_file_lock);
65644+#endif
65645+
65646+ gr_set_kernel_label(current);
65647+
65648 /*
65649 * If we were started as result of loading a module, close all of the
65650 * user space pages. We don't need them, and if we didn't close them
65651@@ -895,6 +914,8 @@ NORET_TYPE void do_exit(long code)
65652 struct task_struct *tsk = current;
65653 int group_dead;
65654
65655+ set_fs(USER_DS);
65656+
65657 profile_task_exit(tsk);
65658
65659 WARN_ON(blk_needs_flush_plug(tsk));
65660@@ -911,7 +932,6 @@ NORET_TYPE void do_exit(long code)
65661 * mm_release()->clear_child_tid() from writing to a user-controlled
65662 * kernel address.
65663 */
65664- set_fs(USER_DS);
65665
65666 ptrace_event(PTRACE_EVENT_EXIT, code);
65667
65668@@ -973,6 +993,9 @@ NORET_TYPE void do_exit(long code)
65669 tsk->exit_code = code;
65670 taskstats_exit(tsk, group_dead);
65671
65672+ gr_acl_handle_psacct(tsk, code);
65673+ gr_acl_handle_exit();
65674+
65675 exit_mm(tsk);
65676
65677 if (group_dead)
65678diff --git a/kernel/fork.c b/kernel/fork.c
65679index 8e6b6f4..9dccf00 100644
65680--- a/kernel/fork.c
65681+++ b/kernel/fork.c
65682@@ -285,7 +285,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
65683 *stackend = STACK_END_MAGIC; /* for overflow detection */
65684
65685 #ifdef CONFIG_CC_STACKPROTECTOR
65686- tsk->stack_canary = get_random_int();
65687+ tsk->stack_canary = pax_get_random_long();
65688 #endif
65689
65690 /*
65691@@ -309,13 +309,77 @@ out:
65692 }
65693
65694 #ifdef CONFIG_MMU
65695+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
65696+{
65697+ struct vm_area_struct *tmp;
65698+ unsigned long charge;
65699+ struct mempolicy *pol;
65700+ struct file *file;
65701+
65702+ charge = 0;
65703+ if (mpnt->vm_flags & VM_ACCOUNT) {
65704+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
65705+ if (security_vm_enough_memory(len))
65706+ goto fail_nomem;
65707+ charge = len;
65708+ }
65709+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
65710+ if (!tmp)
65711+ goto fail_nomem;
65712+ *tmp = *mpnt;
65713+ tmp->vm_mm = mm;
65714+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
65715+ pol = mpol_dup(vma_policy(mpnt));
65716+ if (IS_ERR(pol))
65717+ goto fail_nomem_policy;
65718+ vma_set_policy(tmp, pol);
65719+ if (anon_vma_fork(tmp, mpnt))
65720+ goto fail_nomem_anon_vma_fork;
65721+ tmp->vm_flags &= ~VM_LOCKED;
65722+ tmp->vm_next = tmp->vm_prev = NULL;
65723+ tmp->vm_mirror = NULL;
65724+ file = tmp->vm_file;
65725+ if (file) {
65726+ struct inode *inode = file->f_path.dentry->d_inode;
65727+ struct address_space *mapping = file->f_mapping;
65728+
65729+ get_file(file);
65730+ if (tmp->vm_flags & VM_DENYWRITE)
65731+ atomic_dec(&inode->i_writecount);
65732+ mutex_lock(&mapping->i_mmap_mutex);
65733+ if (tmp->vm_flags & VM_SHARED)
65734+ mapping->i_mmap_writable++;
65735+ flush_dcache_mmap_lock(mapping);
65736+ /* insert tmp into the share list, just after mpnt */
65737+ vma_prio_tree_add(tmp, mpnt);
65738+ flush_dcache_mmap_unlock(mapping);
65739+ mutex_unlock(&mapping->i_mmap_mutex);
65740+ }
65741+
65742+ /*
65743+ * Clear hugetlb-related page reserves for children. This only
65744+ * affects MAP_PRIVATE mappings. Faults generated by the child
65745+ * are not guaranteed to succeed, even if read-only
65746+ */
65747+ if (is_vm_hugetlb_page(tmp))
65748+ reset_vma_resv_huge_pages(tmp);
65749+
65750+ return tmp;
65751+
65752+fail_nomem_anon_vma_fork:
65753+ mpol_put(pol);
65754+fail_nomem_policy:
65755+ kmem_cache_free(vm_area_cachep, tmp);
65756+fail_nomem:
65757+ vm_unacct_memory(charge);
65758+ return NULL;
65759+}
65760+
65761 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65762 {
65763 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
65764 struct rb_node **rb_link, *rb_parent;
65765 int retval;
65766- unsigned long charge;
65767- struct mempolicy *pol;
65768
65769 down_write(&oldmm->mmap_sem);
65770 flush_cache_dup_mm(oldmm);
65771@@ -327,8 +391,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65772 mm->locked_vm = 0;
65773 mm->mmap = NULL;
65774 mm->mmap_cache = NULL;
65775- mm->free_area_cache = oldmm->mmap_base;
65776- mm->cached_hole_size = ~0UL;
65777+ mm->free_area_cache = oldmm->free_area_cache;
65778+ mm->cached_hole_size = oldmm->cached_hole_size;
65779 mm->map_count = 0;
65780 cpumask_clear(mm_cpumask(mm));
65781 mm->mm_rb = RB_ROOT;
65782@@ -344,8 +408,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65783
65784 prev = NULL;
65785 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
65786- struct file *file;
65787-
65788 if (mpnt->vm_flags & VM_DONTCOPY) {
65789 long pages = vma_pages(mpnt);
65790 mm->total_vm -= pages;
65791@@ -353,53 +415,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65792 -pages);
65793 continue;
65794 }
65795- charge = 0;
65796- if (mpnt->vm_flags & VM_ACCOUNT) {
65797- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
65798- if (security_vm_enough_memory(len))
65799- goto fail_nomem;
65800- charge = len;
65801+ tmp = dup_vma(mm, mpnt);
65802+ if (!tmp) {
65803+ retval = -ENOMEM;
65804+ goto out;
65805 }
65806- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
65807- if (!tmp)
65808- goto fail_nomem;
65809- *tmp = *mpnt;
65810- INIT_LIST_HEAD(&tmp->anon_vma_chain);
65811- pol = mpol_dup(vma_policy(mpnt));
65812- retval = PTR_ERR(pol);
65813- if (IS_ERR(pol))
65814- goto fail_nomem_policy;
65815- vma_set_policy(tmp, pol);
65816- tmp->vm_mm = mm;
65817- if (anon_vma_fork(tmp, mpnt))
65818- goto fail_nomem_anon_vma_fork;
65819- tmp->vm_flags &= ~VM_LOCKED;
65820- tmp->vm_next = tmp->vm_prev = NULL;
65821- file = tmp->vm_file;
65822- if (file) {
65823- struct inode *inode = file->f_path.dentry->d_inode;
65824- struct address_space *mapping = file->f_mapping;
65825-
65826- get_file(file);
65827- if (tmp->vm_flags & VM_DENYWRITE)
65828- atomic_dec(&inode->i_writecount);
65829- mutex_lock(&mapping->i_mmap_mutex);
65830- if (tmp->vm_flags & VM_SHARED)
65831- mapping->i_mmap_writable++;
65832- flush_dcache_mmap_lock(mapping);
65833- /* insert tmp into the share list, just after mpnt */
65834- vma_prio_tree_add(tmp, mpnt);
65835- flush_dcache_mmap_unlock(mapping);
65836- mutex_unlock(&mapping->i_mmap_mutex);
65837- }
65838-
65839- /*
65840- * Clear hugetlb-related page reserves for children. This only
65841- * affects MAP_PRIVATE mappings. Faults generated by the child
65842- * are not guaranteed to succeed, even if read-only
65843- */
65844- if (is_vm_hugetlb_page(tmp))
65845- reset_vma_resv_huge_pages(tmp);
65846
65847 /*
65848 * Link in the new vma and copy the page table entries.
65849@@ -422,6 +442,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65850 if (retval)
65851 goto out;
65852 }
65853+
65854+#ifdef CONFIG_PAX_SEGMEXEC
65855+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
65856+ struct vm_area_struct *mpnt_m;
65857+
65858+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
65859+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
65860+
65861+ if (!mpnt->vm_mirror)
65862+ continue;
65863+
65864+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
65865+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
65866+ mpnt->vm_mirror = mpnt_m;
65867+ } else {
65868+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
65869+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
65870+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
65871+ mpnt->vm_mirror->vm_mirror = mpnt;
65872+ }
65873+ }
65874+ BUG_ON(mpnt_m);
65875+ }
65876+#endif
65877+
65878 /* a new mm has just been created */
65879 arch_dup_mmap(oldmm, mm);
65880 retval = 0;
65881@@ -430,14 +475,6 @@ out:
65882 flush_tlb_mm(oldmm);
65883 up_write(&oldmm->mmap_sem);
65884 return retval;
65885-fail_nomem_anon_vma_fork:
65886- mpol_put(pol);
65887-fail_nomem_policy:
65888- kmem_cache_free(vm_area_cachep, tmp);
65889-fail_nomem:
65890- retval = -ENOMEM;
65891- vm_unacct_memory(charge);
65892- goto out;
65893 }
65894
65895 static inline int mm_alloc_pgd(struct mm_struct *mm)
65896@@ -837,13 +874,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
65897 spin_unlock(&fs->lock);
65898 return -EAGAIN;
65899 }
65900- fs->users++;
65901+ atomic_inc(&fs->users);
65902 spin_unlock(&fs->lock);
65903 return 0;
65904 }
65905 tsk->fs = copy_fs_struct(fs);
65906 if (!tsk->fs)
65907 return -ENOMEM;
65908+ gr_set_chroot_entries(tsk, &tsk->fs->root);
65909 return 0;
65910 }
65911
65912@@ -1105,6 +1143,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
65913 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
65914 #endif
65915 retval = -EAGAIN;
65916+
65917+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
65918+
65919 if (atomic_read(&p->real_cred->user->processes) >=
65920 task_rlimit(p, RLIMIT_NPROC)) {
65921 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
65922@@ -1264,6 +1305,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
65923 if (clone_flags & CLONE_THREAD)
65924 p->tgid = current->tgid;
65925
65926+ gr_copy_label(p);
65927+
65928 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
65929 /*
65930 * Clear TID on mm_release()?
65931@@ -1428,6 +1471,8 @@ bad_fork_cleanup_count:
65932 bad_fork_free:
65933 free_task(p);
65934 fork_out:
65935+ gr_log_forkfail(retval);
65936+
65937 return ERR_PTR(retval);
65938 }
65939
65940@@ -1528,6 +1573,8 @@ long do_fork(unsigned long clone_flags,
65941 if (clone_flags & CLONE_PARENT_SETTID)
65942 put_user(nr, parent_tidptr);
65943
65944+ gr_handle_brute_check();
65945+
65946 if (clone_flags & CLONE_VFORK) {
65947 p->vfork_done = &vfork;
65948 init_completion(&vfork);
65949@@ -1637,7 +1684,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
65950 return 0;
65951
65952 /* don't need lock here; in the worst case we'll do useless copy */
65953- if (fs->users == 1)
65954+ if (atomic_read(&fs->users) == 1)
65955 return 0;
65956
65957 *new_fsp = copy_fs_struct(fs);
65958@@ -1726,7 +1773,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
65959 fs = current->fs;
65960 spin_lock(&fs->lock);
65961 current->fs = new_fs;
65962- if (--fs->users)
65963+ gr_set_chroot_entries(current, &current->fs->root);
65964+ if (atomic_dec_return(&fs->users))
65965 new_fs = NULL;
65966 else
65967 new_fs = fs;
65968diff --git a/kernel/futex.c b/kernel/futex.c
65969index 11cbe05..c5dab58 100644
65970--- a/kernel/futex.c
65971+++ b/kernel/futex.c
65972@@ -54,6 +54,7 @@
65973 #include <linux/mount.h>
65974 #include <linux/pagemap.h>
65975 #include <linux/syscalls.h>
65976+#include <linux/ptrace.h>
65977 #include <linux/signal.h>
65978 #include <linux/module.h>
65979 #include <linux/magic.h>
65980@@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
65981 struct page *page, *page_head;
65982 int err, ro = 0;
65983
65984+#ifdef CONFIG_PAX_SEGMEXEC
65985+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
65986+ return -EFAULT;
65987+#endif
65988+
65989 /*
65990 * The futex address must be "naturally" aligned.
65991 */
65992@@ -1863,6 +1869,8 @@ static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
65993 struct futex_q q = futex_q_init;
65994 int ret;
65995
65996+ pax_track_stack();
65997+
65998 if (!bitset)
65999 return -EINVAL;
66000 q.bitset = bitset;
66001@@ -2259,6 +2267,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
66002 struct futex_q q = futex_q_init;
66003 int res, ret;
66004
66005+ pax_track_stack();
66006+
66007 if (!bitset)
66008 return -EINVAL;
66009
66010@@ -2447,6 +2457,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
66011 if (!p)
66012 goto err_unlock;
66013 ret = -EPERM;
66014+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66015+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
66016+ goto err_unlock;
66017+#endif
66018 pcred = __task_cred(p);
66019 /* If victim is in different user_ns, then uids are not
66020 comparable, so we must have CAP_SYS_PTRACE */
66021@@ -2712,6 +2726,7 @@ static int __init futex_init(void)
66022 {
66023 u32 curval;
66024 int i;
66025+ mm_segment_t oldfs;
66026
66027 /*
66028 * This will fail and we want it. Some arch implementations do
66029@@ -2723,8 +2738,11 @@ static int __init futex_init(void)
66030 * implementation, the non-functional ones will return
66031 * -ENOSYS.
66032 */
66033+ oldfs = get_fs();
66034+ set_fs(USER_DS);
66035 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
66036 futex_cmpxchg_enabled = 1;
66037+ set_fs(oldfs);
66038
66039 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
66040 plist_head_init(&futex_queues[i].chain);
66041diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
66042index 5f9e689..582d46d 100644
66043--- a/kernel/futex_compat.c
66044+++ b/kernel/futex_compat.c
66045@@ -10,6 +10,7 @@
66046 #include <linux/compat.h>
66047 #include <linux/nsproxy.h>
66048 #include <linux/futex.h>
66049+#include <linux/ptrace.h>
66050
66051 #include <asm/uaccess.h>
66052
66053@@ -136,7 +137,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66054 {
66055 struct compat_robust_list_head __user *head;
66056 unsigned long ret;
66057- const struct cred *cred = current_cred(), *pcred;
66058+ const struct cred *cred = current_cred();
66059+ const struct cred *pcred;
66060
66061 if (!futex_cmpxchg_enabled)
66062 return -ENOSYS;
66063@@ -152,6 +154,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66064 if (!p)
66065 goto err_unlock;
66066 ret = -EPERM;
66067+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66068+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
66069+ goto err_unlock;
66070+#endif
66071 pcred = __task_cred(p);
66072 /* If victim is in different user_ns, then uids are not
66073 comparable, so we must have CAP_SYS_PTRACE */
66074diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
66075index 9b22d03..6295b62 100644
66076--- a/kernel/gcov/base.c
66077+++ b/kernel/gcov/base.c
66078@@ -102,11 +102,6 @@ void gcov_enable_events(void)
66079 }
66080
66081 #ifdef CONFIG_MODULES
66082-static inline int within(void *addr, void *start, unsigned long size)
66083-{
66084- return ((addr >= start) && (addr < start + size));
66085-}
66086-
66087 /* Update list and generate events when modules are unloaded. */
66088 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66089 void *data)
66090@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66091 prev = NULL;
66092 /* Remove entries located in module from linked list. */
66093 for (info = gcov_info_head; info; info = info->next) {
66094- if (within(info, mod->module_core, mod->core_size)) {
66095+ if (within_module_core_rw((unsigned long)info, mod)) {
66096 if (prev)
66097 prev->next = info->next;
66098 else
66099diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
66100index 2043c08..ec81a69 100644
66101--- a/kernel/hrtimer.c
66102+++ b/kernel/hrtimer.c
66103@@ -1393,7 +1393,7 @@ void hrtimer_peek_ahead_timers(void)
66104 local_irq_restore(flags);
66105 }
66106
66107-static void run_hrtimer_softirq(struct softirq_action *h)
66108+static void run_hrtimer_softirq(void)
66109 {
66110 hrtimer_peek_ahead_timers();
66111 }
66112diff --git a/kernel/jump_label.c b/kernel/jump_label.c
66113index e6f1f24..6c19597 100644
66114--- a/kernel/jump_label.c
66115+++ b/kernel/jump_label.c
66116@@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
66117
66118 size = (((unsigned long)stop - (unsigned long)start)
66119 / sizeof(struct jump_entry));
66120+ pax_open_kernel();
66121 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
66122+ pax_close_kernel();
66123 }
66124
66125 static void jump_label_update(struct jump_label_key *key, int enable);
66126@@ -298,10 +300,12 @@ static void jump_label_invalidate_module_init(struct module *mod)
66127 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
66128 struct jump_entry *iter;
66129
66130+ pax_open_kernel();
66131 for (iter = iter_start; iter < iter_stop; iter++) {
66132 if (within_module_init(iter->code, mod))
66133 iter->code = 0;
66134 }
66135+ pax_close_kernel();
66136 }
66137
66138 static int
66139diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
66140index 079f1d3..a407562 100644
66141--- a/kernel/kallsyms.c
66142+++ b/kernel/kallsyms.c
66143@@ -11,6 +11,9 @@
66144 * Changed the compression method from stem compression to "table lookup"
66145 * compression (see scripts/kallsyms.c for a more complete description)
66146 */
66147+#ifdef CONFIG_GRKERNSEC_HIDESYM
66148+#define __INCLUDED_BY_HIDESYM 1
66149+#endif
66150 #include <linux/kallsyms.h>
66151 #include <linux/module.h>
66152 #include <linux/init.h>
66153@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
66154
66155 static inline int is_kernel_inittext(unsigned long addr)
66156 {
66157+ if (system_state != SYSTEM_BOOTING)
66158+ return 0;
66159+
66160 if (addr >= (unsigned long)_sinittext
66161 && addr <= (unsigned long)_einittext)
66162 return 1;
66163 return 0;
66164 }
66165
66166+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66167+#ifdef CONFIG_MODULES
66168+static inline int is_module_text(unsigned long addr)
66169+{
66170+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
66171+ return 1;
66172+
66173+ addr = ktla_ktva(addr);
66174+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
66175+}
66176+#else
66177+static inline int is_module_text(unsigned long addr)
66178+{
66179+ return 0;
66180+}
66181+#endif
66182+#endif
66183+
66184 static inline int is_kernel_text(unsigned long addr)
66185 {
66186 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
66187@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigned long addr)
66188
66189 static inline int is_kernel(unsigned long addr)
66190 {
66191+
66192+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66193+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
66194+ return 1;
66195+
66196+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
66197+#else
66198 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
66199+#endif
66200+
66201 return 1;
66202 return in_gate_area_no_mm(addr);
66203 }
66204
66205 static int is_ksym_addr(unsigned long addr)
66206 {
66207+
66208+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66209+ if (is_module_text(addr))
66210+ return 0;
66211+#endif
66212+
66213 if (all_var)
66214 return is_kernel(addr);
66215
66216@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
66217
66218 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
66219 {
66220- iter->name[0] = '\0';
66221 iter->nameoff = get_symbol_offset(new_pos);
66222 iter->pos = new_pos;
66223 }
66224@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, void *p)
66225 {
66226 struct kallsym_iter *iter = m->private;
66227
66228+#ifdef CONFIG_GRKERNSEC_HIDESYM
66229+ if (current_uid())
66230+ return 0;
66231+#endif
66232+
66233 /* Some debugging symbols have no name. Ignore them. */
66234 if (!iter->name[0])
66235 return 0;
66236@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
66237 struct kallsym_iter *iter;
66238 int ret;
66239
66240- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
66241+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
66242 if (!iter)
66243 return -ENOMEM;
66244 reset_iter(iter, 0);
66245diff --git a/kernel/kexec.c b/kernel/kexec.c
66246index 296fbc8..84cb857 100644
66247--- a/kernel/kexec.c
66248+++ b/kernel/kexec.c
66249@@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
66250 unsigned long flags)
66251 {
66252 struct compat_kexec_segment in;
66253- struct kexec_segment out, __user *ksegments;
66254+ struct kexec_segment out;
66255+ struct kexec_segment __user *ksegments;
66256 unsigned long i, result;
66257
66258 /* Don't allow clients that don't understand the native
66259diff --git a/kernel/kmod.c b/kernel/kmod.c
66260index a4bea97..7a1ae9a 100644
66261--- a/kernel/kmod.c
66262+++ b/kernel/kmod.c
66263@@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
66264 * If module auto-loading support is disabled then this function
66265 * becomes a no-operation.
66266 */
66267-int __request_module(bool wait, const char *fmt, ...)
66268+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
66269 {
66270- va_list args;
66271 char module_name[MODULE_NAME_LEN];
66272 unsigned int max_modprobes;
66273 int ret;
66274- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
66275+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
66276 static char *envp[] = { "HOME=/",
66277 "TERM=linux",
66278 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
66279@@ -88,9 +87,7 @@ int __request_module(bool wait, const char *fmt, ...)
66280 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
66281 static int kmod_loop_msg;
66282
66283- va_start(args, fmt);
66284- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
66285- va_end(args);
66286+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
66287 if (ret >= MODULE_NAME_LEN)
66288 return -ENAMETOOLONG;
66289
66290@@ -98,6 +95,20 @@ int __request_module(bool wait, const char *fmt, ...)
66291 if (ret)
66292 return ret;
66293
66294+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66295+ if (!current_uid()) {
66296+ /* hack to workaround consolekit/udisks stupidity */
66297+ read_lock(&tasklist_lock);
66298+ if (!strcmp(current->comm, "mount") &&
66299+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
66300+ read_unlock(&tasklist_lock);
66301+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
66302+ return -EPERM;
66303+ }
66304+ read_unlock(&tasklist_lock);
66305+ }
66306+#endif
66307+
66308 /* If modprobe needs a service that is in a module, we get a recursive
66309 * loop. Limit the number of running kmod threads to max_threads/2 or
66310 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
66311@@ -133,6 +144,47 @@ int __request_module(bool wait, const char *fmt, ...)
66312 atomic_dec(&kmod_concurrent);
66313 return ret;
66314 }
66315+
66316+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
66317+{
66318+ va_list args;
66319+ int ret;
66320+
66321+ va_start(args, fmt);
66322+ ret = ____request_module(wait, module_param, fmt, args);
66323+ va_end(args);
66324+
66325+ return ret;
66326+}
66327+
66328+int __request_module(bool wait, const char *fmt, ...)
66329+{
66330+ va_list args;
66331+ int ret;
66332+
66333+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66334+ if (current_uid()) {
66335+ char module_param[MODULE_NAME_LEN];
66336+
66337+ memset(module_param, 0, sizeof(module_param));
66338+
66339+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
66340+
66341+ va_start(args, fmt);
66342+ ret = ____request_module(wait, module_param, fmt, args);
66343+ va_end(args);
66344+
66345+ return ret;
66346+ }
66347+#endif
66348+
66349+ va_start(args, fmt);
66350+ ret = ____request_module(wait, NULL, fmt, args);
66351+ va_end(args);
66352+
66353+ return ret;
66354+}
66355+
66356 EXPORT_SYMBOL(__request_module);
66357 #endif /* CONFIG_MODULES */
66358
66359@@ -222,7 +274,7 @@ static int wait_for_helper(void *data)
66360 *
66361 * Thus the __user pointer cast is valid here.
66362 */
66363- sys_wait4(pid, (int __user *)&ret, 0, NULL);
66364+ sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
66365
66366 /*
66367 * If ret is 0, either ____call_usermodehelper failed and the
66368diff --git a/kernel/kprobes.c b/kernel/kprobes.c
66369index b30fd54..11821ec 100644
66370--- a/kernel/kprobes.c
66371+++ b/kernel/kprobes.c
66372@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
66373 * kernel image and loaded module images reside. This is required
66374 * so x86_64 can correctly handle the %rip-relative fixups.
66375 */
66376- kip->insns = module_alloc(PAGE_SIZE);
66377+ kip->insns = module_alloc_exec(PAGE_SIZE);
66378 if (!kip->insns) {
66379 kfree(kip);
66380 return NULL;
66381@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
66382 */
66383 if (!list_is_singular(&kip->list)) {
66384 list_del(&kip->list);
66385- module_free(NULL, kip->insns);
66386+ module_free_exec(NULL, kip->insns);
66387 kfree(kip);
66388 }
66389 return 1;
66390@@ -1949,7 +1949,7 @@ static int __init init_kprobes(void)
66391 {
66392 int i, err = 0;
66393 unsigned long offset = 0, size = 0;
66394- char *modname, namebuf[128];
66395+ char *modname, namebuf[KSYM_NAME_LEN];
66396 const char *symbol_name;
66397 void *addr;
66398 struct kprobe_blackpoint *kb;
66399@@ -2075,7 +2075,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
66400 const char *sym = NULL;
66401 unsigned int i = *(loff_t *) v;
66402 unsigned long offset = 0;
66403- char *modname, namebuf[128];
66404+ char *modname, namebuf[KSYM_NAME_LEN];
66405
66406 head = &kprobe_table[i];
66407 preempt_disable();
66408diff --git a/kernel/lockdep.c b/kernel/lockdep.c
66409index 4479606..4036bea 100644
66410--- a/kernel/lockdep.c
66411+++ b/kernel/lockdep.c
66412@@ -584,6 +584,10 @@ static int static_obj(void *obj)
66413 end = (unsigned long) &_end,
66414 addr = (unsigned long) obj;
66415
66416+#ifdef CONFIG_PAX_KERNEXEC
66417+ start = ktla_ktva(start);
66418+#endif
66419+
66420 /*
66421 * static variable?
66422 */
66423@@ -719,6 +723,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
66424 if (!static_obj(lock->key)) {
66425 debug_locks_off();
66426 printk("INFO: trying to register non-static key.\n");
66427+ printk("lock:%pS key:%pS.\n", lock, lock->key);
66428 printk("the code is fine but needs lockdep annotation.\n");
66429 printk("turning off the locking correctness validator.\n");
66430 dump_stack();
66431@@ -2954,7 +2959,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
66432 if (!class)
66433 return 0;
66434 }
66435- atomic_inc((atomic_t *)&class->ops);
66436+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
66437 if (very_verbose(class)) {
66438 printk("\nacquire class [%p] %s", class->key, class->name);
66439 if (class->name_version > 1)
66440diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
66441index 71edd2f..e0542a5 100644
66442--- a/kernel/lockdep_proc.c
66443+++ b/kernel/lockdep_proc.c
66444@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
66445
66446 static void print_name(struct seq_file *m, struct lock_class *class)
66447 {
66448- char str[128];
66449+ char str[KSYM_NAME_LEN];
66450 const char *name = class->name;
66451
66452 if (!name) {
66453diff --git a/kernel/module.c b/kernel/module.c
66454index 04379f92..fba2faf 100644
66455--- a/kernel/module.c
66456+++ b/kernel/module.c
66457@@ -58,6 +58,7 @@
66458 #include <linux/jump_label.h>
66459 #include <linux/pfn.h>
66460 #include <linux/bsearch.h>
66461+#include <linux/grsecurity.h>
66462
66463 #define CREATE_TRACE_POINTS
66464 #include <trace/events/module.h>
66465@@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
66466
66467 /* Bounds of module allocation, for speeding __module_address.
66468 * Protected by module_mutex. */
66469-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
66470+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
66471+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
66472
66473 int register_module_notifier(struct notifier_block * nb)
66474 {
66475@@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
66476 return true;
66477
66478 list_for_each_entry_rcu(mod, &modules, list) {
66479- struct symsearch arr[] = {
66480+ struct symsearch modarr[] = {
66481 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
66482 NOT_GPL_ONLY, false },
66483 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
66484@@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
66485 #endif
66486 };
66487
66488- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
66489+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
66490 return true;
66491 }
66492 return false;
66493@@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu(struct module *mod)
66494 static int percpu_modalloc(struct module *mod,
66495 unsigned long size, unsigned long align)
66496 {
66497- if (align > PAGE_SIZE) {
66498+ if (align-1 >= PAGE_SIZE) {
66499 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
66500 mod->name, align, PAGE_SIZE);
66501 align = PAGE_SIZE;
66502@@ -1183,7 +1185,7 @@ resolve_symbol_wait(struct module *mod,
66503 */
66504 #ifdef CONFIG_SYSFS
66505
66506-#ifdef CONFIG_KALLSYMS
66507+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
66508 static inline bool sect_empty(const Elf_Shdr *sect)
66509 {
66510 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
66511@@ -1649,21 +1651,21 @@ static void set_section_ro_nx(void *base,
66512
66513 static void unset_module_core_ro_nx(struct module *mod)
66514 {
66515- set_page_attributes(mod->module_core + mod->core_text_size,
66516- mod->module_core + mod->core_size,
66517+ set_page_attributes(mod->module_core_rw,
66518+ mod->module_core_rw + mod->core_size_rw,
66519 set_memory_x);
66520- set_page_attributes(mod->module_core,
66521- mod->module_core + mod->core_ro_size,
66522+ set_page_attributes(mod->module_core_rx,
66523+ mod->module_core_rx + mod->core_size_rx,
66524 set_memory_rw);
66525 }
66526
66527 static void unset_module_init_ro_nx(struct module *mod)
66528 {
66529- set_page_attributes(mod->module_init + mod->init_text_size,
66530- mod->module_init + mod->init_size,
66531+ set_page_attributes(mod->module_init_rw,
66532+ mod->module_init_rw + mod->init_size_rw,
66533 set_memory_x);
66534- set_page_attributes(mod->module_init,
66535- mod->module_init + mod->init_ro_size,
66536+ set_page_attributes(mod->module_init_rx,
66537+ mod->module_init_rx + mod->init_size_rx,
66538 set_memory_rw);
66539 }
66540
66541@@ -1674,14 +1676,14 @@ void set_all_modules_text_rw(void)
66542
66543 mutex_lock(&module_mutex);
66544 list_for_each_entry_rcu(mod, &modules, list) {
66545- if ((mod->module_core) && (mod->core_text_size)) {
66546- set_page_attributes(mod->module_core,
66547- mod->module_core + mod->core_text_size,
66548+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
66549+ set_page_attributes(mod->module_core_rx,
66550+ mod->module_core_rx + mod->core_size_rx,
66551 set_memory_rw);
66552 }
66553- if ((mod->module_init) && (mod->init_text_size)) {
66554- set_page_attributes(mod->module_init,
66555- mod->module_init + mod->init_text_size,
66556+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
66557+ set_page_attributes(mod->module_init_rx,
66558+ mod->module_init_rx + mod->init_size_rx,
66559 set_memory_rw);
66560 }
66561 }
66562@@ -1695,14 +1697,14 @@ void set_all_modules_text_ro(void)
66563
66564 mutex_lock(&module_mutex);
66565 list_for_each_entry_rcu(mod, &modules, list) {
66566- if ((mod->module_core) && (mod->core_text_size)) {
66567- set_page_attributes(mod->module_core,
66568- mod->module_core + mod->core_text_size,
66569+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
66570+ set_page_attributes(mod->module_core_rx,
66571+ mod->module_core_rx + mod->core_size_rx,
66572 set_memory_ro);
66573 }
66574- if ((mod->module_init) && (mod->init_text_size)) {
66575- set_page_attributes(mod->module_init,
66576- mod->module_init + mod->init_text_size,
66577+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
66578+ set_page_attributes(mod->module_init_rx,
66579+ mod->module_init_rx + mod->init_size_rx,
66580 set_memory_ro);
66581 }
66582 }
66583@@ -1748,16 +1750,19 @@ static void free_module(struct module *mod)
66584
66585 /* This may be NULL, but that's OK */
66586 unset_module_init_ro_nx(mod);
66587- module_free(mod, mod->module_init);
66588+ module_free(mod, mod->module_init_rw);
66589+ module_free_exec(mod, mod->module_init_rx);
66590 kfree(mod->args);
66591 percpu_modfree(mod);
66592
66593 /* Free lock-classes: */
66594- lockdep_free_key_range(mod->module_core, mod->core_size);
66595+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
66596+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
66597
66598 /* Finally, free the core (containing the module structure) */
66599 unset_module_core_ro_nx(mod);
66600- module_free(mod, mod->module_core);
66601+ module_free_exec(mod, mod->module_core_rx);
66602+ module_free(mod, mod->module_core_rw);
66603
66604 #ifdef CONFIG_MPU
66605 update_protections(current->mm);
66606@@ -1826,10 +1831,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66607 unsigned int i;
66608 int ret = 0;
66609 const struct kernel_symbol *ksym;
66610+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66611+ int is_fs_load = 0;
66612+ int register_filesystem_found = 0;
66613+ char *p;
66614+
66615+ p = strstr(mod->args, "grsec_modharden_fs");
66616+ if (p) {
66617+ char *endptr = p + strlen("grsec_modharden_fs");
66618+ /* copy \0 as well */
66619+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
66620+ is_fs_load = 1;
66621+ }
66622+#endif
66623
66624 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
66625 const char *name = info->strtab + sym[i].st_name;
66626
66627+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66628+ /* it's a real shame this will never get ripped and copied
66629+ upstream! ;(
66630+ */
66631+ if (is_fs_load && !strcmp(name, "register_filesystem"))
66632+ register_filesystem_found = 1;
66633+#endif
66634+
66635 switch (sym[i].st_shndx) {
66636 case SHN_COMMON:
66637 /* We compiled with -fno-common. These are not
66638@@ -1850,7 +1876,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66639 ksym = resolve_symbol_wait(mod, info, name);
66640 /* Ok if resolved. */
66641 if (ksym && !IS_ERR(ksym)) {
66642+ pax_open_kernel();
66643 sym[i].st_value = ksym->value;
66644+ pax_close_kernel();
66645 break;
66646 }
66647
66648@@ -1869,11 +1897,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66649 secbase = (unsigned long)mod_percpu(mod);
66650 else
66651 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
66652+ pax_open_kernel();
66653 sym[i].st_value += secbase;
66654+ pax_close_kernel();
66655 break;
66656 }
66657 }
66658
66659+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66660+ if (is_fs_load && !register_filesystem_found) {
66661+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
66662+ ret = -EPERM;
66663+ }
66664+#endif
66665+
66666 return ret;
66667 }
66668
66669@@ -1977,22 +2014,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
66670 || s->sh_entsize != ~0UL
66671 || strstarts(sname, ".init"))
66672 continue;
66673- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
66674+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66675+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
66676+ else
66677+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
66678 DEBUGP("\t%s\n", name);
66679 }
66680- switch (m) {
66681- case 0: /* executable */
66682- mod->core_size = debug_align(mod->core_size);
66683- mod->core_text_size = mod->core_size;
66684- break;
66685- case 1: /* RO: text and ro-data */
66686- mod->core_size = debug_align(mod->core_size);
66687- mod->core_ro_size = mod->core_size;
66688- break;
66689- case 3: /* whole core */
66690- mod->core_size = debug_align(mod->core_size);
66691- break;
66692- }
66693 }
66694
66695 DEBUGP("Init section allocation order:\n");
66696@@ -2006,23 +2033,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
66697 || s->sh_entsize != ~0UL
66698 || !strstarts(sname, ".init"))
66699 continue;
66700- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
66701- | INIT_OFFSET_MASK);
66702+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66703+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
66704+ else
66705+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
66706+ s->sh_entsize |= INIT_OFFSET_MASK;
66707 DEBUGP("\t%s\n", sname);
66708 }
66709- switch (m) {
66710- case 0: /* executable */
66711- mod->init_size = debug_align(mod->init_size);
66712- mod->init_text_size = mod->init_size;
66713- break;
66714- case 1: /* RO: text and ro-data */
66715- mod->init_size = debug_align(mod->init_size);
66716- mod->init_ro_size = mod->init_size;
66717- break;
66718- case 3: /* whole init */
66719- mod->init_size = debug_align(mod->init_size);
66720- break;
66721- }
66722 }
66723 }
66724
66725@@ -2187,7 +2204,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
66726
66727 /* Put symbol section at end of init part of module. */
66728 symsect->sh_flags |= SHF_ALLOC;
66729- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
66730+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
66731 info->index.sym) | INIT_OFFSET_MASK;
66732 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
66733
66734@@ -2204,19 +2221,19 @@ static void layout_symtab(struct module *mod, struct load_info *info)
66735 }
66736
66737 /* Append room for core symbols at end of core part. */
66738- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
66739- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
66740+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
66741+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
66742
66743 /* Put string table section at end of init part of module. */
66744 strsect->sh_flags |= SHF_ALLOC;
66745- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
66746+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
66747 info->index.str) | INIT_OFFSET_MASK;
66748 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
66749
66750 /* Append room for core symbols' strings at end of core part. */
66751- info->stroffs = mod->core_size;
66752+ info->stroffs = mod->core_size_rx;
66753 __set_bit(0, info->strmap);
66754- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
66755+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
66756 }
66757
66758 static void add_kallsyms(struct module *mod, const struct load_info *info)
66759@@ -2232,11 +2249,13 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
66760 /* Make sure we get permanent strtab: don't use info->strtab. */
66761 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
66762
66763+ pax_open_kernel();
66764+
66765 /* Set types up while we still have access to sections. */
66766 for (i = 0; i < mod->num_symtab; i++)
66767 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
66768
66769- mod->core_symtab = dst = mod->module_core + info->symoffs;
66770+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
66771 src = mod->symtab;
66772 *dst = *src;
66773 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
66774@@ -2249,10 +2268,12 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
66775 }
66776 mod->core_num_syms = ndst;
66777
66778- mod->core_strtab = s = mod->module_core + info->stroffs;
66779+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
66780 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
66781 if (test_bit(i, info->strmap))
66782 *++s = mod->strtab[i];
66783+
66784+ pax_close_kernel();
66785 }
66786 #else
66787 static inline void layout_symtab(struct module *mod, struct load_info *info)
66788@@ -2286,17 +2307,33 @@ void * __weak module_alloc(unsigned long size)
66789 return size == 0 ? NULL : vmalloc_exec(size);
66790 }
66791
66792-static void *module_alloc_update_bounds(unsigned long size)
66793+static void *module_alloc_update_bounds_rw(unsigned long size)
66794 {
66795 void *ret = module_alloc(size);
66796
66797 if (ret) {
66798 mutex_lock(&module_mutex);
66799 /* Update module bounds. */
66800- if ((unsigned long)ret < module_addr_min)
66801- module_addr_min = (unsigned long)ret;
66802- if ((unsigned long)ret + size > module_addr_max)
66803- module_addr_max = (unsigned long)ret + size;
66804+ if ((unsigned long)ret < module_addr_min_rw)
66805+ module_addr_min_rw = (unsigned long)ret;
66806+ if ((unsigned long)ret + size > module_addr_max_rw)
66807+ module_addr_max_rw = (unsigned long)ret + size;
66808+ mutex_unlock(&module_mutex);
66809+ }
66810+ return ret;
66811+}
66812+
66813+static void *module_alloc_update_bounds_rx(unsigned long size)
66814+{
66815+ void *ret = module_alloc_exec(size);
66816+
66817+ if (ret) {
66818+ mutex_lock(&module_mutex);
66819+ /* Update module bounds. */
66820+ if ((unsigned long)ret < module_addr_min_rx)
66821+ module_addr_min_rx = (unsigned long)ret;
66822+ if ((unsigned long)ret + size > module_addr_max_rx)
66823+ module_addr_max_rx = (unsigned long)ret + size;
66824 mutex_unlock(&module_mutex);
66825 }
66826 return ret;
66827@@ -2474,8 +2511,14 @@ static struct module *setup_load_info(struct load_info *info)
66828 static int check_modinfo(struct module *mod, struct load_info *info)
66829 {
66830 const char *modmagic = get_modinfo(info, "vermagic");
66831+ const char *license = get_modinfo(info, "license");
66832 int err;
66833
66834+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
66835+ if (!license || !license_is_gpl_compatible(license))
66836+ return -ENOEXEC;
66837+#endif
66838+
66839 /* This is allowed: modprobe --force will invalidate it. */
66840 if (!modmagic) {
66841 err = try_to_force_load(mod, "bad vermagic");
66842@@ -2495,7 +2538,7 @@ static int check_modinfo(struct module *mod, struct load_info *info)
66843 }
66844
66845 /* Set up license info based on the info section */
66846- set_license(mod, get_modinfo(info, "license"));
66847+ set_license(mod, license);
66848
66849 return 0;
66850 }
66851@@ -2589,7 +2632,7 @@ static int move_module(struct module *mod, struct load_info *info)
66852 void *ptr;
66853
66854 /* Do the allocs. */
66855- ptr = module_alloc_update_bounds(mod->core_size);
66856+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
66857 /*
66858 * The pointer to this block is stored in the module structure
66859 * which is inside the block. Just mark it as not being a
66860@@ -2599,23 +2642,50 @@ static int move_module(struct module *mod, struct load_info *info)
66861 if (!ptr)
66862 return -ENOMEM;
66863
66864- memset(ptr, 0, mod->core_size);
66865- mod->module_core = ptr;
66866+ memset(ptr, 0, mod->core_size_rw);
66867+ mod->module_core_rw = ptr;
66868
66869- ptr = module_alloc_update_bounds(mod->init_size);
66870+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
66871 /*
66872 * The pointer to this block is stored in the module structure
66873 * which is inside the block. This block doesn't need to be
66874 * scanned as it contains data and code that will be freed
66875 * after the module is initialized.
66876 */
66877- kmemleak_ignore(ptr);
66878- if (!ptr && mod->init_size) {
66879- module_free(mod, mod->module_core);
66880+ kmemleak_not_leak(ptr);
66881+ if (!ptr && mod->init_size_rw) {
66882+ module_free(mod, mod->module_core_rw);
66883 return -ENOMEM;
66884 }
66885- memset(ptr, 0, mod->init_size);
66886- mod->module_init = ptr;
66887+ memset(ptr, 0, mod->init_size_rw);
66888+ mod->module_init_rw = ptr;
66889+
66890+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
66891+ kmemleak_not_leak(ptr);
66892+ if (!ptr) {
66893+ module_free(mod, mod->module_init_rw);
66894+ module_free(mod, mod->module_core_rw);
66895+ return -ENOMEM;
66896+ }
66897+
66898+ pax_open_kernel();
66899+ memset(ptr, 0, mod->core_size_rx);
66900+ pax_close_kernel();
66901+ mod->module_core_rx = ptr;
66902+
66903+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
66904+ kmemleak_not_leak(ptr);
66905+ if (!ptr && mod->init_size_rx) {
66906+ module_free_exec(mod, mod->module_core_rx);
66907+ module_free(mod, mod->module_init_rw);
66908+ module_free(mod, mod->module_core_rw);
66909+ return -ENOMEM;
66910+ }
66911+
66912+ pax_open_kernel();
66913+ memset(ptr, 0, mod->init_size_rx);
66914+ pax_close_kernel();
66915+ mod->module_init_rx = ptr;
66916
66917 /* Transfer each section which specifies SHF_ALLOC */
66918 DEBUGP("final section addresses:\n");
66919@@ -2626,16 +2696,45 @@ static int move_module(struct module *mod, struct load_info *info)
66920 if (!(shdr->sh_flags & SHF_ALLOC))
66921 continue;
66922
66923- if (shdr->sh_entsize & INIT_OFFSET_MASK)
66924- dest = mod->module_init
66925- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
66926- else
66927- dest = mod->module_core + shdr->sh_entsize;
66928+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
66929+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
66930+ dest = mod->module_init_rw
66931+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
66932+ else
66933+ dest = mod->module_init_rx
66934+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
66935+ } else {
66936+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
66937+ dest = mod->module_core_rw + shdr->sh_entsize;
66938+ else
66939+ dest = mod->module_core_rx + shdr->sh_entsize;
66940+ }
66941+
66942+ if (shdr->sh_type != SHT_NOBITS) {
66943+
66944+#ifdef CONFIG_PAX_KERNEXEC
66945+#ifdef CONFIG_X86_64
66946+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
66947+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
66948+#endif
66949+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
66950+ pax_open_kernel();
66951+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
66952+ pax_close_kernel();
66953+ } else
66954+#endif
66955
66956- if (shdr->sh_type != SHT_NOBITS)
66957 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
66958+ }
66959 /* Update sh_addr to point to copy in image. */
66960- shdr->sh_addr = (unsigned long)dest;
66961+
66962+#ifdef CONFIG_PAX_KERNEXEC
66963+ if (shdr->sh_flags & SHF_EXECINSTR)
66964+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
66965+ else
66966+#endif
66967+
66968+ shdr->sh_addr = (unsigned long)dest;
66969 DEBUGP("\t0x%lx %s\n",
66970 shdr->sh_addr, info->secstrings + shdr->sh_name);
66971 }
66972@@ -2686,12 +2785,12 @@ static void flush_module_icache(const struct module *mod)
66973 * Do it before processing of module parameters, so the module
66974 * can provide parameter accessor functions of its own.
66975 */
66976- if (mod->module_init)
66977- flush_icache_range((unsigned long)mod->module_init,
66978- (unsigned long)mod->module_init
66979- + mod->init_size);
66980- flush_icache_range((unsigned long)mod->module_core,
66981- (unsigned long)mod->module_core + mod->core_size);
66982+ if (mod->module_init_rx)
66983+ flush_icache_range((unsigned long)mod->module_init_rx,
66984+ (unsigned long)mod->module_init_rx
66985+ + mod->init_size_rx);
66986+ flush_icache_range((unsigned long)mod->module_core_rx,
66987+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
66988
66989 set_fs(old_fs);
66990 }
66991@@ -2771,8 +2870,10 @@ static void module_deallocate(struct module *mod, struct load_info *info)
66992 {
66993 kfree(info->strmap);
66994 percpu_modfree(mod);
66995- module_free(mod, mod->module_init);
66996- module_free(mod, mod->module_core);
66997+ module_free_exec(mod, mod->module_init_rx);
66998+ module_free_exec(mod, mod->module_core_rx);
66999+ module_free(mod, mod->module_init_rw);
67000+ module_free(mod, mod->module_core_rw);
67001 }
67002
67003 int __weak module_finalize(const Elf_Ehdr *hdr,
67004@@ -2836,9 +2937,38 @@ static struct module *load_module(void __user *umod,
67005 if (err)
67006 goto free_unload;
67007
67008+ /* Now copy in args */
67009+ mod->args = strndup_user(uargs, ~0UL >> 1);
67010+ if (IS_ERR(mod->args)) {
67011+ err = PTR_ERR(mod->args);
67012+ goto free_unload;
67013+ }
67014+
67015 /* Set up MODINFO_ATTR fields */
67016 setup_modinfo(mod, &info);
67017
67018+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67019+ {
67020+ char *p, *p2;
67021+
67022+ if (strstr(mod->args, "grsec_modharden_netdev")) {
67023+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
67024+ err = -EPERM;
67025+ goto free_modinfo;
67026+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
67027+ p += strlen("grsec_modharden_normal");
67028+ p2 = strstr(p, "_");
67029+ if (p2) {
67030+ *p2 = '\0';
67031+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
67032+ *p2 = '_';
67033+ }
67034+ err = -EPERM;
67035+ goto free_modinfo;
67036+ }
67037+ }
67038+#endif
67039+
67040 /* Fix up syms, so that st_value is a pointer to location. */
67041 err = simplify_symbols(mod, &info);
67042 if (err < 0)
67043@@ -2854,13 +2984,6 @@ static struct module *load_module(void __user *umod,
67044
67045 flush_module_icache(mod);
67046
67047- /* Now copy in args */
67048- mod->args = strndup_user(uargs, ~0UL >> 1);
67049- if (IS_ERR(mod->args)) {
67050- err = PTR_ERR(mod->args);
67051- goto free_arch_cleanup;
67052- }
67053-
67054 /* Mark state as coming so strong_try_module_get() ignores us. */
67055 mod->state = MODULE_STATE_COMING;
67056
67057@@ -2920,11 +3043,10 @@ static struct module *load_module(void __user *umod,
67058 unlock:
67059 mutex_unlock(&module_mutex);
67060 synchronize_sched();
67061- kfree(mod->args);
67062- free_arch_cleanup:
67063 module_arch_cleanup(mod);
67064 free_modinfo:
67065 free_modinfo(mod);
67066+ kfree(mod->args);
67067 free_unload:
67068 module_unload_free(mod);
67069 free_module:
67070@@ -2965,16 +3087,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67071 MODULE_STATE_COMING, mod);
67072
67073 /* Set RO and NX regions for core */
67074- set_section_ro_nx(mod->module_core,
67075- mod->core_text_size,
67076- mod->core_ro_size,
67077- mod->core_size);
67078+ set_section_ro_nx(mod->module_core_rx,
67079+ mod->core_size_rx,
67080+ mod->core_size_rx,
67081+ mod->core_size_rx);
67082
67083 /* Set RO and NX regions for init */
67084- set_section_ro_nx(mod->module_init,
67085- mod->init_text_size,
67086- mod->init_ro_size,
67087- mod->init_size);
67088+ set_section_ro_nx(mod->module_init_rx,
67089+ mod->init_size_rx,
67090+ mod->init_size_rx,
67091+ mod->init_size_rx);
67092
67093 do_mod_ctors(mod);
67094 /* Start the module */
67095@@ -3020,11 +3142,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67096 mod->strtab = mod->core_strtab;
67097 #endif
67098 unset_module_init_ro_nx(mod);
67099- module_free(mod, mod->module_init);
67100- mod->module_init = NULL;
67101- mod->init_size = 0;
67102- mod->init_ro_size = 0;
67103- mod->init_text_size = 0;
67104+ module_free(mod, mod->module_init_rw);
67105+ module_free_exec(mod, mod->module_init_rx);
67106+ mod->module_init_rw = NULL;
67107+ mod->module_init_rx = NULL;
67108+ mod->init_size_rw = 0;
67109+ mod->init_size_rx = 0;
67110 mutex_unlock(&module_mutex);
67111
67112 return 0;
67113@@ -3055,10 +3178,16 @@ static const char *get_ksymbol(struct module *mod,
67114 unsigned long nextval;
67115
67116 /* At worse, next value is at end of module */
67117- if (within_module_init(addr, mod))
67118- nextval = (unsigned long)mod->module_init+mod->init_text_size;
67119+ if (within_module_init_rx(addr, mod))
67120+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
67121+ else if (within_module_init_rw(addr, mod))
67122+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
67123+ else if (within_module_core_rx(addr, mod))
67124+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
67125+ else if (within_module_core_rw(addr, mod))
67126+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
67127 else
67128- nextval = (unsigned long)mod->module_core+mod->core_text_size;
67129+ return NULL;
67130
67131 /* Scan for closest preceding symbol, and next symbol. (ELF
67132 starts real symbols at 1). */
67133@@ -3304,7 +3433,7 @@ static int m_show(struct seq_file *m, void *p)
67134 char buf[8];
67135
67136 seq_printf(m, "%s %u",
67137- mod->name, mod->init_size + mod->core_size);
67138+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
67139 print_unload_info(m, mod);
67140
67141 /* Informative for users. */
67142@@ -3313,7 +3442,7 @@ static int m_show(struct seq_file *m, void *p)
67143 mod->state == MODULE_STATE_COMING ? "Loading":
67144 "Live");
67145 /* Used by oprofile and other similar tools. */
67146- seq_printf(m, " 0x%pK", mod->module_core);
67147+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
67148
67149 /* Taints info */
67150 if (mod->taints)
67151@@ -3349,7 +3478,17 @@ static const struct file_operations proc_modules_operations = {
67152
67153 static int __init proc_modules_init(void)
67154 {
67155+#ifndef CONFIG_GRKERNSEC_HIDESYM
67156+#ifdef CONFIG_GRKERNSEC_PROC_USER
67157+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
67158+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
67159+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
67160+#else
67161 proc_create("modules", 0, NULL, &proc_modules_operations);
67162+#endif
67163+#else
67164+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
67165+#endif
67166 return 0;
67167 }
67168 module_init(proc_modules_init);
67169@@ -3408,12 +3547,12 @@ struct module *__module_address(unsigned long addr)
67170 {
67171 struct module *mod;
67172
67173- if (addr < module_addr_min || addr > module_addr_max)
67174+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
67175+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
67176 return NULL;
67177
67178 list_for_each_entry_rcu(mod, &modules, list)
67179- if (within_module_core(addr, mod)
67180- || within_module_init(addr, mod))
67181+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
67182 return mod;
67183 return NULL;
67184 }
67185@@ -3447,11 +3586,20 @@ bool is_module_text_address(unsigned long addr)
67186 */
67187 struct module *__module_text_address(unsigned long addr)
67188 {
67189- struct module *mod = __module_address(addr);
67190+ struct module *mod;
67191+
67192+#ifdef CONFIG_X86_32
67193+ addr = ktla_ktva(addr);
67194+#endif
67195+
67196+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
67197+ return NULL;
67198+
67199+ mod = __module_address(addr);
67200+
67201 if (mod) {
67202 /* Make sure it's within the text section. */
67203- if (!within(addr, mod->module_init, mod->init_text_size)
67204- && !within(addr, mod->module_core, mod->core_text_size))
67205+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
67206 mod = NULL;
67207 }
67208 return mod;
67209diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
67210index 73da83a..fe46e99 100644
67211--- a/kernel/mutex-debug.c
67212+++ b/kernel/mutex-debug.c
67213@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
67214 }
67215
67216 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67217- struct thread_info *ti)
67218+ struct task_struct *task)
67219 {
67220 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
67221
67222 /* Mark the current thread as blocked on the lock: */
67223- ti->task->blocked_on = waiter;
67224+ task->blocked_on = waiter;
67225 }
67226
67227 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67228- struct thread_info *ti)
67229+ struct task_struct *task)
67230 {
67231 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
67232- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
67233- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
67234- ti->task->blocked_on = NULL;
67235+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
67236+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
67237+ task->blocked_on = NULL;
67238
67239 list_del_init(&waiter->list);
67240 waiter->task = NULL;
67241diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
67242index 0799fd3..d06ae3b 100644
67243--- a/kernel/mutex-debug.h
67244+++ b/kernel/mutex-debug.h
67245@@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
67246 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
67247 extern void debug_mutex_add_waiter(struct mutex *lock,
67248 struct mutex_waiter *waiter,
67249- struct thread_info *ti);
67250+ struct task_struct *task);
67251 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67252- struct thread_info *ti);
67253+ struct task_struct *task);
67254 extern void debug_mutex_unlock(struct mutex *lock);
67255 extern void debug_mutex_init(struct mutex *lock, const char *name,
67256 struct lock_class_key *key);
67257diff --git a/kernel/mutex.c b/kernel/mutex.c
67258index d607ed5..58d0a52 100644
67259--- a/kernel/mutex.c
67260+++ b/kernel/mutex.c
67261@@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67262 spin_lock_mutex(&lock->wait_lock, flags);
67263
67264 debug_mutex_lock_common(lock, &waiter);
67265- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
67266+ debug_mutex_add_waiter(lock, &waiter, task);
67267
67268 /* add waiting tasks to the end of the waitqueue (FIFO): */
67269 list_add_tail(&waiter.list, &lock->wait_list);
67270@@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67271 * TASK_UNINTERRUPTIBLE case.)
67272 */
67273 if (unlikely(signal_pending_state(state, task))) {
67274- mutex_remove_waiter(lock, &waiter,
67275- task_thread_info(task));
67276+ mutex_remove_waiter(lock, &waiter, task);
67277 mutex_release(&lock->dep_map, 1, ip);
67278 spin_unlock_mutex(&lock->wait_lock, flags);
67279
67280@@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67281 done:
67282 lock_acquired(&lock->dep_map, ip);
67283 /* got the lock - rejoice! */
67284- mutex_remove_waiter(lock, &waiter, current_thread_info());
67285+ mutex_remove_waiter(lock, &waiter, task);
67286 mutex_set_owner(lock);
67287
67288 /* set it to 0 if there are no waiters left: */
67289diff --git a/kernel/padata.c b/kernel/padata.c
67290index b91941d..0871d60 100644
67291--- a/kernel/padata.c
67292+++ b/kernel/padata.c
67293@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_instance *pinst,
67294 padata->pd = pd;
67295 padata->cb_cpu = cb_cpu;
67296
67297- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
67298- atomic_set(&pd->seq_nr, -1);
67299+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
67300+ atomic_set_unchecked(&pd->seq_nr, -1);
67301
67302- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
67303+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
67304
67305 target_cpu = padata_cpu_hash(padata);
67306 queue = per_cpu_ptr(pd->pqueue, target_cpu);
67307@@ -444,7 +444,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
67308 padata_init_pqueues(pd);
67309 padata_init_squeues(pd);
67310 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
67311- atomic_set(&pd->seq_nr, -1);
67312+ atomic_set_unchecked(&pd->seq_nr, -1);
67313 atomic_set(&pd->reorder_objects, 0);
67314 atomic_set(&pd->refcnt, 0);
67315 pd->pinst = pinst;
67316diff --git a/kernel/panic.c b/kernel/panic.c
67317index d7bb697..9ef9f19 100644
67318--- a/kernel/panic.c
67319+++ b/kernel/panic.c
67320@@ -371,7 +371,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
67321 const char *board;
67322
67323 printk(KERN_WARNING "------------[ cut here ]------------\n");
67324- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
67325+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
67326 board = dmi_get_system_info(DMI_PRODUCT_NAME);
67327 if (board)
67328 printk(KERN_WARNING "Hardware name: %s\n", board);
67329@@ -426,7 +426,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
67330 */
67331 void __stack_chk_fail(void)
67332 {
67333- panic("stack-protector: Kernel stack is corrupted in: %p\n",
67334+ dump_stack();
67335+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
67336 __builtin_return_address(0));
67337 }
67338 EXPORT_SYMBOL(__stack_chk_fail);
67339diff --git a/kernel/pid.c b/kernel/pid.c
67340index e432057..a2b2ac5 100644
67341--- a/kernel/pid.c
67342+++ b/kernel/pid.c
67343@@ -33,6 +33,7 @@
67344 #include <linux/rculist.h>
67345 #include <linux/bootmem.h>
67346 #include <linux/hash.h>
67347+#include <linux/security.h>
67348 #include <linux/pid_namespace.h>
67349 #include <linux/init_task.h>
67350 #include <linux/syscalls.h>
67351@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
67352
67353 int pid_max = PID_MAX_DEFAULT;
67354
67355-#define RESERVED_PIDS 300
67356+#define RESERVED_PIDS 500
67357
67358 int pid_max_min = RESERVED_PIDS + 1;
67359 int pid_max_max = PID_MAX_LIMIT;
67360@@ -418,8 +419,15 @@ EXPORT_SYMBOL(pid_task);
67361 */
67362 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
67363 {
67364+ struct task_struct *task;
67365+
67366 rcu_lockdep_assert(rcu_read_lock_held());
67367- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67368+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67369+
67370+ if (gr_pid_is_chrooted(task))
67371+ return NULL;
67372+
67373+ return task;
67374 }
67375
67376 struct task_struct *find_task_by_vpid(pid_t vnr)
67377@@ -427,6 +435,12 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
67378 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
67379 }
67380
67381+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
67382+{
67383+ rcu_lockdep_assert(rcu_read_lock_held());
67384+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
67385+}
67386+
67387 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
67388 {
67389 struct pid *pid;
67390diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
67391index 640ded8..3dafb85 100644
67392--- a/kernel/posix-cpu-timers.c
67393+++ b/kernel/posix-cpu-timers.c
67394@@ -6,6 +6,7 @@
67395 #include <linux/posix-timers.h>
67396 #include <linux/errno.h>
67397 #include <linux/math64.h>
67398+#include <linux/security.h>
67399 #include <asm/uaccess.h>
67400 #include <linux/kernel_stat.h>
67401 #include <trace/events/timer.h>
67402@@ -1606,14 +1607,14 @@ struct k_clock clock_posix_cpu = {
67403
67404 static __init int init_posix_cpu_timers(void)
67405 {
67406- struct k_clock process = {
67407+ static struct k_clock process = {
67408 .clock_getres = process_cpu_clock_getres,
67409 .clock_get = process_cpu_clock_get,
67410 .timer_create = process_cpu_timer_create,
67411 .nsleep = process_cpu_nsleep,
67412 .nsleep_restart = process_cpu_nsleep_restart,
67413 };
67414- struct k_clock thread = {
67415+ static struct k_clock thread = {
67416 .clock_getres = thread_cpu_clock_getres,
67417 .clock_get = thread_cpu_clock_get,
67418 .timer_create = thread_cpu_timer_create,
67419diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
67420index 4556182..9335419 100644
67421--- a/kernel/posix-timers.c
67422+++ b/kernel/posix-timers.c
67423@@ -43,6 +43,7 @@
67424 #include <linux/idr.h>
67425 #include <linux/posix-clock.h>
67426 #include <linux/posix-timers.h>
67427+#include <linux/grsecurity.h>
67428 #include <linux/syscalls.h>
67429 #include <linux/wait.h>
67430 #include <linux/workqueue.h>
67431@@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
67432 * which we beg off on and pass to do_sys_settimeofday().
67433 */
67434
67435-static struct k_clock posix_clocks[MAX_CLOCKS];
67436+static struct k_clock *posix_clocks[MAX_CLOCKS];
67437
67438 /*
67439 * These ones are defined below.
67440@@ -227,7 +228,7 @@ static int posix_get_boottime(const clockid_t which_clock, struct timespec *tp)
67441 */
67442 static __init int init_posix_timers(void)
67443 {
67444- struct k_clock clock_realtime = {
67445+ static struct k_clock clock_realtime = {
67446 .clock_getres = hrtimer_get_res,
67447 .clock_get = posix_clock_realtime_get,
67448 .clock_set = posix_clock_realtime_set,
67449@@ -239,7 +240,7 @@ static __init int init_posix_timers(void)
67450 .timer_get = common_timer_get,
67451 .timer_del = common_timer_del,
67452 };
67453- struct k_clock clock_monotonic = {
67454+ static struct k_clock clock_monotonic = {
67455 .clock_getres = hrtimer_get_res,
67456 .clock_get = posix_ktime_get_ts,
67457 .nsleep = common_nsleep,
67458@@ -249,19 +250,19 @@ static __init int init_posix_timers(void)
67459 .timer_get = common_timer_get,
67460 .timer_del = common_timer_del,
67461 };
67462- struct k_clock clock_monotonic_raw = {
67463+ static struct k_clock clock_monotonic_raw = {
67464 .clock_getres = hrtimer_get_res,
67465 .clock_get = posix_get_monotonic_raw,
67466 };
67467- struct k_clock clock_realtime_coarse = {
67468+ static struct k_clock clock_realtime_coarse = {
67469 .clock_getres = posix_get_coarse_res,
67470 .clock_get = posix_get_realtime_coarse,
67471 };
67472- struct k_clock clock_monotonic_coarse = {
67473+ static struct k_clock clock_monotonic_coarse = {
67474 .clock_getres = posix_get_coarse_res,
67475 .clock_get = posix_get_monotonic_coarse,
67476 };
67477- struct k_clock clock_boottime = {
67478+ static struct k_clock clock_boottime = {
67479 .clock_getres = hrtimer_get_res,
67480 .clock_get = posix_get_boottime,
67481 .nsleep = common_nsleep,
67482@@ -272,6 +273,8 @@ static __init int init_posix_timers(void)
67483 .timer_del = common_timer_del,
67484 };
67485
67486+ pax_track_stack();
67487+
67488 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
67489 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
67490 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
67491@@ -473,7 +476,7 @@ void posix_timers_register_clock(const clockid_t clock_id,
67492 return;
67493 }
67494
67495- posix_clocks[clock_id] = *new_clock;
67496+ posix_clocks[clock_id] = new_clock;
67497 }
67498 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
67499
67500@@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock(const clockid_t id)
67501 return (id & CLOCKFD_MASK) == CLOCKFD ?
67502 &clock_posix_dynamic : &clock_posix_cpu;
67503
67504- if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
67505+ if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
67506 return NULL;
67507- return &posix_clocks[id];
67508+ return posix_clocks[id];
67509 }
67510
67511 static int common_timer_create(struct k_itimer *new_timer)
67512@@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
67513 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
67514 return -EFAULT;
67515
67516+ /* only the CLOCK_REALTIME clock can be set, all other clocks
67517+ have their clock_set fptr set to a nosettime dummy function
67518+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
67519+ call common_clock_set, which calls do_sys_settimeofday, which
67520+ we hook
67521+ */
67522+
67523 return kc->clock_set(which_clock, &new_tp);
67524 }
67525
67526diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
67527index d523593..68197a4 100644
67528--- a/kernel/power/poweroff.c
67529+++ b/kernel/power/poweroff.c
67530@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
67531 .enable_mask = SYSRQ_ENABLE_BOOT,
67532 };
67533
67534-static int pm_sysrq_init(void)
67535+static int __init pm_sysrq_init(void)
67536 {
67537 register_sysrq_key('o', &sysrq_poweroff_op);
67538 return 0;
67539diff --git a/kernel/power/process.c b/kernel/power/process.c
67540index 0cf3a27..5481be4 100644
67541--- a/kernel/power/process.c
67542+++ b/kernel/power/process.c
67543@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_only)
67544 u64 elapsed_csecs64;
67545 unsigned int elapsed_csecs;
67546 bool wakeup = false;
67547+ bool timedout = false;
67548
67549 do_gettimeofday(&start);
67550
67551@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_only)
67552
67553 while (true) {
67554 todo = 0;
67555+ if (time_after(jiffies, end_time))
67556+ timedout = true;
67557 read_lock(&tasklist_lock);
67558 do_each_thread(g, p) {
67559 if (frozen(p) || !freezable(p))
67560@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_only)
67561 * try_to_stop() after schedule() in ptrace/signal
67562 * stop sees TIF_FREEZE.
67563 */
67564- if (!task_is_stopped_or_traced(p) &&
67565- !freezer_should_skip(p))
67566+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
67567 todo++;
67568+ if (timedout) {
67569+ printk(KERN_ERR "Task refusing to freeze:\n");
67570+ sched_show_task(p);
67571+ }
67572+ }
67573 } while_each_thread(g, p);
67574 read_unlock(&tasklist_lock);
67575
67576@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_only)
67577 todo += wq_busy;
67578 }
67579
67580- if (!todo || time_after(jiffies, end_time))
67581+ if (!todo || timedout)
67582 break;
67583
67584 if (pm_wakeup_pending()) {
67585diff --git a/kernel/printk.c b/kernel/printk.c
67586index 28a40d8..2411bec 100644
67587--- a/kernel/printk.c
67588+++ b/kernel/printk.c
67589@@ -313,6 +313,11 @@ static int check_syslog_permissions(int type, bool from_file)
67590 if (from_file && type != SYSLOG_ACTION_OPEN)
67591 return 0;
67592
67593+#ifdef CONFIG_GRKERNSEC_DMESG
67594+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
67595+ return -EPERM;
67596+#endif
67597+
67598 if (syslog_action_restricted(type)) {
67599 if (capable(CAP_SYSLOG))
67600 return 0;
67601diff --git a/kernel/profile.c b/kernel/profile.c
67602index 961b389..c451353 100644
67603--- a/kernel/profile.c
67604+++ b/kernel/profile.c
67605@@ -39,7 +39,7 @@ struct profile_hit {
67606 /* Oprofile timer tick hook */
67607 static int (*timer_hook)(struct pt_regs *) __read_mostly;
67608
67609-static atomic_t *prof_buffer;
67610+static atomic_unchecked_t *prof_buffer;
67611 static unsigned long prof_len, prof_shift;
67612
67613 int prof_on __read_mostly;
67614@@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
67615 hits[i].pc = 0;
67616 continue;
67617 }
67618- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67619+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67620 hits[i].hits = hits[i].pc = 0;
67621 }
67622 }
67623@@ -342,9 +342,9 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
67624 * Add the current hit(s) and flush the write-queue out
67625 * to the global buffer:
67626 */
67627- atomic_add(nr_hits, &prof_buffer[pc]);
67628+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
67629 for (i = 0; i < NR_PROFILE_HIT; ++i) {
67630- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67631+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67632 hits[i].pc = hits[i].hits = 0;
67633 }
67634 out:
67635@@ -419,7 +419,7 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
67636 {
67637 unsigned long pc;
67638 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
67639- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67640+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67641 }
67642 #endif /* !CONFIG_SMP */
67643
67644@@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
67645 return -EFAULT;
67646 buf++; p++; count--; read++;
67647 }
67648- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
67649+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
67650 if (copy_to_user(buf, (void *)pnt, count))
67651 return -EFAULT;
67652 read += count;
67653@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
67654 }
67655 #endif
67656 profile_discard_flip_buffers();
67657- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
67658+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
67659 return count;
67660 }
67661
67662diff --git a/kernel/ptrace.c b/kernel/ptrace.c
67663index a70d2a5..cbd4b4f 100644
67664--- a/kernel/ptrace.c
67665+++ b/kernel/ptrace.c
67666@@ -161,7 +161,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
67667 return ret;
67668 }
67669
67670-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67671+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
67672+ unsigned int log)
67673 {
67674 const struct cred *cred = current_cred(), *tcred;
67675
67676@@ -187,7 +188,8 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67677 cred->gid == tcred->sgid &&
67678 cred->gid == tcred->gid))
67679 goto ok;
67680- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
67681+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
67682+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
67683 goto ok;
67684 rcu_read_unlock();
67685 return -EPERM;
67686@@ -196,7 +198,9 @@ ok:
67687 smp_rmb();
67688 if (task->mm)
67689 dumpable = get_dumpable(task->mm);
67690- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
67691+ if (!dumpable &&
67692+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
67693+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
67694 return -EPERM;
67695
67696 return security_ptrace_access_check(task, mode);
67697@@ -206,7 +210,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
67698 {
67699 int err;
67700 task_lock(task);
67701- err = __ptrace_may_access(task, mode);
67702+ err = __ptrace_may_access(task, mode, 0);
67703+ task_unlock(task);
67704+ return !err;
67705+}
67706+
67707+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
67708+{
67709+ int err;
67710+ task_lock(task);
67711+ err = __ptrace_may_access(task, mode, 1);
67712 task_unlock(task);
67713 return !err;
67714 }
67715@@ -251,7 +264,7 @@ static int ptrace_attach(struct task_struct *task, long request,
67716 goto out;
67717
67718 task_lock(task);
67719- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
67720+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
67721 task_unlock(task);
67722 if (retval)
67723 goto unlock_creds;
67724@@ -266,7 +279,7 @@ static int ptrace_attach(struct task_struct *task, long request,
67725 task->ptrace = PT_PTRACED;
67726 if (seize)
67727 task->ptrace |= PT_SEIZED;
67728- if (task_ns_capable(task, CAP_SYS_PTRACE))
67729+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
67730 task->ptrace |= PT_PTRACE_CAP;
67731
67732 __ptrace_link(task, current);
67733@@ -461,6 +474,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
67734 {
67735 int copied = 0;
67736
67737+ pax_track_stack();
67738+
67739 while (len > 0) {
67740 char buf[128];
67741 int this_len, retval;
67742@@ -472,7 +487,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
67743 break;
67744 return -EIO;
67745 }
67746- if (copy_to_user(dst, buf, retval))
67747+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
67748 return -EFAULT;
67749 copied += retval;
67750 src += retval;
67751@@ -486,6 +501,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
67752 {
67753 int copied = 0;
67754
67755+ pax_track_stack();
67756+
67757 while (len > 0) {
67758 char buf[128];
67759 int this_len, retval;
67760@@ -669,10 +686,12 @@ int ptrace_request(struct task_struct *child, long request,
67761 bool seized = child->ptrace & PT_SEIZED;
67762 int ret = -EIO;
67763 siginfo_t siginfo, *si;
67764- void __user *datavp = (void __user *) data;
67765+ void __user *datavp = (__force void __user *) data;
67766 unsigned long __user *datalp = datavp;
67767 unsigned long flags;
67768
67769+ pax_track_stack();
67770+
67771 switch (request) {
67772 case PTRACE_PEEKTEXT:
67773 case PTRACE_PEEKDATA:
67774@@ -871,14 +890,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
67775 goto out;
67776 }
67777
67778+ if (gr_handle_ptrace(child, request)) {
67779+ ret = -EPERM;
67780+ goto out_put_task_struct;
67781+ }
67782+
67783 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
67784 ret = ptrace_attach(child, request, data);
67785 /*
67786 * Some architectures need to do book-keeping after
67787 * a ptrace attach.
67788 */
67789- if (!ret)
67790+ if (!ret) {
67791 arch_ptrace_attach(child);
67792+ gr_audit_ptrace(child);
67793+ }
67794 goto out_put_task_struct;
67795 }
67796
67797@@ -904,7 +930,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
67798 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
67799 if (copied != sizeof(tmp))
67800 return -EIO;
67801- return put_user(tmp, (unsigned long __user *)data);
67802+ return put_user(tmp, (__force unsigned long __user *)data);
67803 }
67804
67805 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
67806@@ -927,6 +953,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
67807 siginfo_t siginfo;
67808 int ret;
67809
67810+ pax_track_stack();
67811+
67812 switch (request) {
67813 case PTRACE_PEEKTEXT:
67814 case PTRACE_PEEKDATA:
67815@@ -1014,14 +1042,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
67816 goto out;
67817 }
67818
67819+ if (gr_handle_ptrace(child, request)) {
67820+ ret = -EPERM;
67821+ goto out_put_task_struct;
67822+ }
67823+
67824 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
67825 ret = ptrace_attach(child, request, data);
67826 /*
67827 * Some architectures need to do book-keeping after
67828 * a ptrace attach.
67829 */
67830- if (!ret)
67831+ if (!ret) {
67832 arch_ptrace_attach(child);
67833+ gr_audit_ptrace(child);
67834+ }
67835 goto out_put_task_struct;
67836 }
67837
67838diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
67839index 98f51b1..30b950c 100644
67840--- a/kernel/rcutorture.c
67841+++ b/kernel/rcutorture.c
67842@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
67843 { 0 };
67844 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
67845 { 0 };
67846-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67847-static atomic_t n_rcu_torture_alloc;
67848-static atomic_t n_rcu_torture_alloc_fail;
67849-static atomic_t n_rcu_torture_free;
67850-static atomic_t n_rcu_torture_mberror;
67851-static atomic_t n_rcu_torture_error;
67852+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67853+static atomic_unchecked_t n_rcu_torture_alloc;
67854+static atomic_unchecked_t n_rcu_torture_alloc_fail;
67855+static atomic_unchecked_t n_rcu_torture_free;
67856+static atomic_unchecked_t n_rcu_torture_mberror;
67857+static atomic_unchecked_t n_rcu_torture_error;
67858 static long n_rcu_torture_boost_ktrerror;
67859 static long n_rcu_torture_boost_rterror;
67860 static long n_rcu_torture_boost_failure;
67861@@ -223,11 +223,11 @@ rcu_torture_alloc(void)
67862
67863 spin_lock_bh(&rcu_torture_lock);
67864 if (list_empty(&rcu_torture_freelist)) {
67865- atomic_inc(&n_rcu_torture_alloc_fail);
67866+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
67867 spin_unlock_bh(&rcu_torture_lock);
67868 return NULL;
67869 }
67870- atomic_inc(&n_rcu_torture_alloc);
67871+ atomic_inc_unchecked(&n_rcu_torture_alloc);
67872 p = rcu_torture_freelist.next;
67873 list_del_init(p);
67874 spin_unlock_bh(&rcu_torture_lock);
67875@@ -240,7 +240,7 @@ rcu_torture_alloc(void)
67876 static void
67877 rcu_torture_free(struct rcu_torture *p)
67878 {
67879- atomic_inc(&n_rcu_torture_free);
67880+ atomic_inc_unchecked(&n_rcu_torture_free);
67881 spin_lock_bh(&rcu_torture_lock);
67882 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
67883 spin_unlock_bh(&rcu_torture_lock);
67884@@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p)
67885 i = rp->rtort_pipe_count;
67886 if (i > RCU_TORTURE_PIPE_LEN)
67887 i = RCU_TORTURE_PIPE_LEN;
67888- atomic_inc(&rcu_torture_wcount[i]);
67889+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67890 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67891 rp->rtort_mbtest = 0;
67892 rcu_torture_free(rp);
67893@@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
67894 i = rp->rtort_pipe_count;
67895 if (i > RCU_TORTURE_PIPE_LEN)
67896 i = RCU_TORTURE_PIPE_LEN;
67897- atomic_inc(&rcu_torture_wcount[i]);
67898+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67899 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67900 rp->rtort_mbtest = 0;
67901 list_del(&rp->rtort_free);
67902@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
67903 i = old_rp->rtort_pipe_count;
67904 if (i > RCU_TORTURE_PIPE_LEN)
67905 i = RCU_TORTURE_PIPE_LEN;
67906- atomic_inc(&rcu_torture_wcount[i]);
67907+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67908 old_rp->rtort_pipe_count++;
67909 cur_ops->deferred_free(old_rp);
67910 }
67911@@ -950,7 +950,7 @@ static void rcu_torture_timer(unsigned long unused)
67912 return;
67913 }
67914 if (p->rtort_mbtest == 0)
67915- atomic_inc(&n_rcu_torture_mberror);
67916+ atomic_inc_unchecked(&n_rcu_torture_mberror);
67917 spin_lock(&rand_lock);
67918 cur_ops->read_delay(&rand);
67919 n_rcu_torture_timers++;
67920@@ -1011,7 +1011,7 @@ rcu_torture_reader(void *arg)
67921 continue;
67922 }
67923 if (p->rtort_mbtest == 0)
67924- atomic_inc(&n_rcu_torture_mberror);
67925+ atomic_inc_unchecked(&n_rcu_torture_mberror);
67926 cur_ops->read_delay(&rand);
67927 preempt_disable();
67928 pipe_count = p->rtort_pipe_count;
67929@@ -1070,16 +1070,16 @@ rcu_torture_printk(char *page)
67930 rcu_torture_current,
67931 rcu_torture_current_version,
67932 list_empty(&rcu_torture_freelist),
67933- atomic_read(&n_rcu_torture_alloc),
67934- atomic_read(&n_rcu_torture_alloc_fail),
67935- atomic_read(&n_rcu_torture_free),
67936- atomic_read(&n_rcu_torture_mberror),
67937+ atomic_read_unchecked(&n_rcu_torture_alloc),
67938+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
67939+ atomic_read_unchecked(&n_rcu_torture_free),
67940+ atomic_read_unchecked(&n_rcu_torture_mberror),
67941 n_rcu_torture_boost_ktrerror,
67942 n_rcu_torture_boost_rterror,
67943 n_rcu_torture_boost_failure,
67944 n_rcu_torture_boosts,
67945 n_rcu_torture_timers);
67946- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
67947+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
67948 n_rcu_torture_boost_ktrerror != 0 ||
67949 n_rcu_torture_boost_rterror != 0 ||
67950 n_rcu_torture_boost_failure != 0)
67951@@ -1087,7 +1087,7 @@ rcu_torture_printk(char *page)
67952 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
67953 if (i > 1) {
67954 cnt += sprintf(&page[cnt], "!!! ");
67955- atomic_inc(&n_rcu_torture_error);
67956+ atomic_inc_unchecked(&n_rcu_torture_error);
67957 WARN_ON_ONCE(1);
67958 }
67959 cnt += sprintf(&page[cnt], "Reader Pipe: ");
67960@@ -1101,7 +1101,7 @@ rcu_torture_printk(char *page)
67961 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
67962 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
67963 cnt += sprintf(&page[cnt], " %d",
67964- atomic_read(&rcu_torture_wcount[i]));
67965+ atomic_read_unchecked(&rcu_torture_wcount[i]));
67966 }
67967 cnt += sprintf(&page[cnt], "\n");
67968 if (cur_ops->stats)
67969@@ -1410,7 +1410,7 @@ rcu_torture_cleanup(void)
67970
67971 if (cur_ops->cleanup)
67972 cur_ops->cleanup();
67973- if (atomic_read(&n_rcu_torture_error))
67974+ if (atomic_read_unchecked(&n_rcu_torture_error))
67975 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
67976 else
67977 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
67978@@ -1474,17 +1474,17 @@ rcu_torture_init(void)
67979
67980 rcu_torture_current = NULL;
67981 rcu_torture_current_version = 0;
67982- atomic_set(&n_rcu_torture_alloc, 0);
67983- atomic_set(&n_rcu_torture_alloc_fail, 0);
67984- atomic_set(&n_rcu_torture_free, 0);
67985- atomic_set(&n_rcu_torture_mberror, 0);
67986- atomic_set(&n_rcu_torture_error, 0);
67987+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
67988+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
67989+ atomic_set_unchecked(&n_rcu_torture_free, 0);
67990+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
67991+ atomic_set_unchecked(&n_rcu_torture_error, 0);
67992 n_rcu_torture_boost_ktrerror = 0;
67993 n_rcu_torture_boost_rterror = 0;
67994 n_rcu_torture_boost_failure = 0;
67995 n_rcu_torture_boosts = 0;
67996 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
67997- atomic_set(&rcu_torture_wcount[i], 0);
67998+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
67999 for_each_possible_cpu(cpu) {
68000 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68001 per_cpu(rcu_torture_count, cpu)[i] = 0;
68002diff --git a/kernel/rcutree.c b/kernel/rcutree.c
68003index ba06207..85d8ba8 100644
68004--- a/kernel/rcutree.c
68005+++ b/kernel/rcutree.c
68006@@ -356,9 +356,9 @@ void rcu_enter_nohz(void)
68007 }
68008 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68009 smp_mb__before_atomic_inc(); /* See above. */
68010- atomic_inc(&rdtp->dynticks);
68011+ atomic_inc_unchecked(&rdtp->dynticks);
68012 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
68013- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68014+ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68015 local_irq_restore(flags);
68016
68017 /* If the interrupt queued a callback, get out of dyntick mode. */
68018@@ -387,10 +387,10 @@ void rcu_exit_nohz(void)
68019 return;
68020 }
68021 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
68022- atomic_inc(&rdtp->dynticks);
68023+ atomic_inc_unchecked(&rdtp->dynticks);
68024 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68025 smp_mb__after_atomic_inc(); /* See above. */
68026- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68027+ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68028 local_irq_restore(flags);
68029 }
68030
68031@@ -406,14 +406,14 @@ void rcu_nmi_enter(void)
68032 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
68033
68034 if (rdtp->dynticks_nmi_nesting == 0 &&
68035- (atomic_read(&rdtp->dynticks) & 0x1))
68036+ (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
68037 return;
68038 rdtp->dynticks_nmi_nesting++;
68039 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
68040- atomic_inc(&rdtp->dynticks);
68041+ atomic_inc_unchecked(&rdtp->dynticks);
68042 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68043 smp_mb__after_atomic_inc(); /* See above. */
68044- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68045+ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68046 }
68047
68048 /**
68049@@ -432,9 +432,9 @@ void rcu_nmi_exit(void)
68050 return;
68051 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68052 smp_mb__before_atomic_inc(); /* See above. */
68053- atomic_inc(&rdtp->dynticks);
68054+ atomic_inc_unchecked(&rdtp->dynticks);
68055 smp_mb__after_atomic_inc(); /* Force delay to next write. */
68056- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68057+ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68058 }
68059
68060 /**
68061@@ -469,7 +469,7 @@ void rcu_irq_exit(void)
68062 */
68063 static int dyntick_save_progress_counter(struct rcu_data *rdp)
68064 {
68065- rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
68066+ rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68067 return 0;
68068 }
68069
68070@@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
68071 unsigned long curr;
68072 unsigned long snap;
68073
68074- curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks);
68075+ curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68076 snap = (unsigned long)rdp->dynticks_snap;
68077
68078 /*
68079@@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
68080 /*
68081 * Do softirq processing for the current CPU.
68082 */
68083-static void rcu_process_callbacks(struct softirq_action *unused)
68084+static void rcu_process_callbacks(void)
68085 {
68086 __rcu_process_callbacks(&rcu_sched_state,
68087 &__get_cpu_var(rcu_sched_data));
68088diff --git a/kernel/rcutree.h b/kernel/rcutree.h
68089index 01b2ccd..4f5d80a 100644
68090--- a/kernel/rcutree.h
68091+++ b/kernel/rcutree.h
68092@@ -86,7 +86,7 @@
68093 struct rcu_dynticks {
68094 int dynticks_nesting; /* Track irq/process nesting level. */
68095 int dynticks_nmi_nesting; /* Track NMI nesting level. */
68096- atomic_t dynticks; /* Even value for dynticks-idle, else odd. */
68097+ atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */
68098 };
68099
68100 /* RCU's kthread states for tracing. */
68101diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
68102index 8aafbb8..2fca109 100644
68103--- a/kernel/rcutree_plugin.h
68104+++ b/kernel/rcutree_plugin.h
68105@@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void)
68106
68107 /* Clean up and exit. */
68108 smp_mb(); /* ensure expedited GP seen before counter increment. */
68109- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
68110+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
68111 unlock_mb_ret:
68112 mutex_unlock(&sync_rcu_preempt_exp_mutex);
68113 mb_ret:
68114@@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expedited);
68115
68116 #else /* #ifndef CONFIG_SMP */
68117
68118-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
68119-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
68120+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
68121+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
68122
68123 static int synchronize_sched_expedited_cpu_stop(void *data)
68124 {
68125@@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void)
68126 int firstsnap, s, snap, trycount = 0;
68127
68128 /* Note that atomic_inc_return() implies full memory barrier. */
68129- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
68130+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
68131 get_online_cpus();
68132
68133 /*
68134@@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void)
68135 }
68136
68137 /* Check to see if someone else did our work for us. */
68138- s = atomic_read(&sync_sched_expedited_done);
68139+ s = atomic_read_unchecked(&sync_sched_expedited_done);
68140 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
68141 smp_mb(); /* ensure test happens before caller kfree */
68142 return;
68143@@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void)
68144 * grace period works for us.
68145 */
68146 get_online_cpus();
68147- snap = atomic_read(&sync_sched_expedited_started) - 1;
68148+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
68149 smp_mb(); /* ensure read is before try_stop_cpus(). */
68150 }
68151
68152@@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void)
68153 * than we did beat us to the punch.
68154 */
68155 do {
68156- s = atomic_read(&sync_sched_expedited_done);
68157+ s = atomic_read_unchecked(&sync_sched_expedited_done);
68158 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
68159 smp_mb(); /* ensure test happens before caller kfree */
68160 break;
68161 }
68162- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
68163+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
68164
68165 put_online_cpus();
68166 }
68167@@ -1953,7 +1953,7 @@ int rcu_needs_cpu(int cpu)
68168 for_each_online_cpu(thatcpu) {
68169 if (thatcpu == cpu)
68170 continue;
68171- snap = atomic_add_return(0, &per_cpu(rcu_dynticks,
68172+ snap = atomic_add_return_unchecked(0, &per_cpu(rcu_dynticks,
68173 thatcpu).dynticks);
68174 smp_mb(); /* Order sampling of snap with end of grace period. */
68175 if ((snap & 0x1) != 0) {
68176diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
68177index 3b0c098..43ba2d8 100644
68178--- a/kernel/rcutree_trace.c
68179+++ b/kernel/rcutree_trace.c
68180@@ -74,7 +74,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
68181 rdp->qs_pending);
68182 #ifdef CONFIG_NO_HZ
68183 seq_printf(m, " dt=%d/%d/%d df=%lu",
68184- atomic_read(&rdp->dynticks->dynticks),
68185+ atomic_read_unchecked(&rdp->dynticks->dynticks),
68186 rdp->dynticks->dynticks_nesting,
68187 rdp->dynticks->dynticks_nmi_nesting,
68188 rdp->dynticks_fqs);
68189@@ -148,7 +148,7 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
68190 rdp->qs_pending);
68191 #ifdef CONFIG_NO_HZ
68192 seq_printf(m, ",%d,%d,%d,%lu",
68193- atomic_read(&rdp->dynticks->dynticks),
68194+ atomic_read_unchecked(&rdp->dynticks->dynticks),
68195 rdp->dynticks->dynticks_nesting,
68196 rdp->dynticks->dynticks_nmi_nesting,
68197 rdp->dynticks_fqs);
68198diff --git a/kernel/relay.c b/kernel/relay.c
68199index 859ea5a..096e2fe 100644
68200--- a/kernel/relay.c
68201+++ b/kernel/relay.c
68202@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
68203 };
68204 ssize_t ret;
68205
68206+ pax_track_stack();
68207+
68208 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
68209 return 0;
68210 if (splice_grow_spd(pipe, &spd))
68211diff --git a/kernel/resource.c b/kernel/resource.c
68212index c8dc249..f1e2359 100644
68213--- a/kernel/resource.c
68214+++ b/kernel/resource.c
68215@@ -141,8 +141,18 @@ static const struct file_operations proc_iomem_operations = {
68216
68217 static int __init ioresources_init(void)
68218 {
68219+#ifdef CONFIG_GRKERNSEC_PROC_ADD
68220+#ifdef CONFIG_GRKERNSEC_PROC_USER
68221+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
68222+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
68223+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68224+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
68225+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
68226+#endif
68227+#else
68228 proc_create("ioports", 0, NULL, &proc_ioports_operations);
68229 proc_create("iomem", 0, NULL, &proc_iomem_operations);
68230+#endif
68231 return 0;
68232 }
68233 __initcall(ioresources_init);
68234diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
68235index 5c9ccd3..a35e22b 100644
68236--- a/kernel/rtmutex-tester.c
68237+++ b/kernel/rtmutex-tester.c
68238@@ -20,7 +20,7 @@
68239 #define MAX_RT_TEST_MUTEXES 8
68240
68241 static spinlock_t rttest_lock;
68242-static atomic_t rttest_event;
68243+static atomic_unchecked_t rttest_event;
68244
68245 struct test_thread_data {
68246 int opcode;
68247@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68248
68249 case RTTEST_LOCKCONT:
68250 td->mutexes[td->opdata] = 1;
68251- td->event = atomic_add_return(1, &rttest_event);
68252+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68253 return 0;
68254
68255 case RTTEST_RESET:
68256@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68257 return 0;
68258
68259 case RTTEST_RESETEVENT:
68260- atomic_set(&rttest_event, 0);
68261+ atomic_set_unchecked(&rttest_event, 0);
68262 return 0;
68263
68264 default:
68265@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68266 return ret;
68267
68268 td->mutexes[id] = 1;
68269- td->event = atomic_add_return(1, &rttest_event);
68270+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68271 rt_mutex_lock(&mutexes[id]);
68272- td->event = atomic_add_return(1, &rttest_event);
68273+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68274 td->mutexes[id] = 4;
68275 return 0;
68276
68277@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68278 return ret;
68279
68280 td->mutexes[id] = 1;
68281- td->event = atomic_add_return(1, &rttest_event);
68282+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68283 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
68284- td->event = atomic_add_return(1, &rttest_event);
68285+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68286 td->mutexes[id] = ret ? 0 : 4;
68287 return ret ? -EINTR : 0;
68288
68289@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68290 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
68291 return ret;
68292
68293- td->event = atomic_add_return(1, &rttest_event);
68294+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68295 rt_mutex_unlock(&mutexes[id]);
68296- td->event = atomic_add_return(1, &rttest_event);
68297+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68298 td->mutexes[id] = 0;
68299 return 0;
68300
68301@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68302 break;
68303
68304 td->mutexes[dat] = 2;
68305- td->event = atomic_add_return(1, &rttest_event);
68306+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68307 break;
68308
68309 default:
68310@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68311 return;
68312
68313 td->mutexes[dat] = 3;
68314- td->event = atomic_add_return(1, &rttest_event);
68315+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68316 break;
68317
68318 case RTTEST_LOCKNOWAIT:
68319@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68320 return;
68321
68322 td->mutexes[dat] = 1;
68323- td->event = atomic_add_return(1, &rttest_event);
68324+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68325 return;
68326
68327 default:
68328diff --git a/kernel/sched.c b/kernel/sched.c
68329index b50b0f0..1c6c591 100644
68330--- a/kernel/sched.c
68331+++ b/kernel/sched.c
68332@@ -4264,6 +4264,8 @@ static void __sched __schedule(void)
68333 struct rq *rq;
68334 int cpu;
68335
68336+ pax_track_stack();
68337+
68338 need_resched:
68339 preempt_disable();
68340 cpu = smp_processor_id();
68341@@ -4950,6 +4952,8 @@ int can_nice(const struct task_struct *p, const int nice)
68342 /* convert nice value [19,-20] to rlimit style value [1,40] */
68343 int nice_rlim = 20 - nice;
68344
68345+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
68346+
68347 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
68348 capable(CAP_SYS_NICE));
68349 }
68350@@ -4983,7 +4987,8 @@ SYSCALL_DEFINE1(nice, int, increment)
68351 if (nice > 19)
68352 nice = 19;
68353
68354- if (increment < 0 && !can_nice(current, nice))
68355+ if (increment < 0 && (!can_nice(current, nice) ||
68356+ gr_handle_chroot_nice()))
68357 return -EPERM;
68358
68359 retval = security_task_setnice(current, nice);
68360@@ -5127,6 +5132,7 @@ recheck:
68361 unsigned long rlim_rtprio =
68362 task_rlimit(p, RLIMIT_RTPRIO);
68363
68364+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
68365 /* can't set/change the rt policy */
68366 if (policy != p->policy && !rlim_rtprio)
68367 return -EPERM;
68368diff --git a/kernel/sched_autogroup.c b/kernel/sched_autogroup.c
68369index 429242f..d7cca82 100644
68370--- a/kernel/sched_autogroup.c
68371+++ b/kernel/sched_autogroup.c
68372@@ -7,7 +7,7 @@
68373
68374 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
68375 static struct autogroup autogroup_default;
68376-static atomic_t autogroup_seq_nr;
68377+static atomic_unchecked_t autogroup_seq_nr;
68378
68379 static void __init autogroup_init(struct task_struct *init_task)
68380 {
68381@@ -78,7 +78,7 @@ static inline struct autogroup *autogroup_create(void)
68382
68383 kref_init(&ag->kref);
68384 init_rwsem(&ag->lock);
68385- ag->id = atomic_inc_return(&autogroup_seq_nr);
68386+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
68387 ag->tg = tg;
68388 #ifdef CONFIG_RT_GROUP_SCHED
68389 /*
68390diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
68391index bc8ee99..b6f6492 100644
68392--- a/kernel/sched_fair.c
68393+++ b/kernel/sched_fair.c
68394@@ -4062,7 +4062,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
68395 * run_rebalance_domains is triggered when needed from the scheduler tick.
68396 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
68397 */
68398-static void run_rebalance_domains(struct softirq_action *h)
68399+static void run_rebalance_domains(void)
68400 {
68401 int this_cpu = smp_processor_id();
68402 struct rq *this_rq = cpu_rq(this_cpu);
68403diff --git a/kernel/signal.c b/kernel/signal.c
68404index 291c970..304bd03 100644
68405--- a/kernel/signal.c
68406+++ b/kernel/signal.c
68407@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cachep;
68408
68409 int print_fatal_signals __read_mostly;
68410
68411-static void __user *sig_handler(struct task_struct *t, int sig)
68412+static __sighandler_t sig_handler(struct task_struct *t, int sig)
68413 {
68414 return t->sighand->action[sig - 1].sa.sa_handler;
68415 }
68416
68417-static int sig_handler_ignored(void __user *handler, int sig)
68418+static int sig_handler_ignored(__sighandler_t handler, int sig)
68419 {
68420 /* Is it explicitly or implicitly ignored? */
68421 return handler == SIG_IGN ||
68422@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
68423 static int sig_task_ignored(struct task_struct *t, int sig,
68424 int from_ancestor_ns)
68425 {
68426- void __user *handler;
68427+ __sighandler_t handler;
68428
68429 handler = sig_handler(t, sig);
68430
68431@@ -364,6 +364,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
68432 atomic_inc(&user->sigpending);
68433 rcu_read_unlock();
68434
68435+ if (!override_rlimit)
68436+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
68437+
68438 if (override_rlimit ||
68439 atomic_read(&user->sigpending) <=
68440 task_rlimit(t, RLIMIT_SIGPENDING)) {
68441@@ -488,7 +491,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
68442
68443 int unhandled_signal(struct task_struct *tsk, int sig)
68444 {
68445- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
68446+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
68447 if (is_global_init(tsk))
68448 return 1;
68449 if (handler != SIG_IGN && handler != SIG_DFL)
68450@@ -815,6 +818,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
68451 }
68452 }
68453
68454+ /* allow glibc communication via tgkill to other threads in our
68455+ thread group */
68456+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
68457+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
68458+ && gr_handle_signal(t, sig))
68459+ return -EPERM;
68460+
68461 return security_task_kill(t, info, sig, 0);
68462 }
68463
68464@@ -1165,7 +1175,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
68465 return send_signal(sig, info, p, 1);
68466 }
68467
68468-static int
68469+int
68470 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68471 {
68472 return send_signal(sig, info, t, 0);
68473@@ -1202,6 +1212,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68474 unsigned long int flags;
68475 int ret, blocked, ignored;
68476 struct k_sigaction *action;
68477+ int is_unhandled = 0;
68478
68479 spin_lock_irqsave(&t->sighand->siglock, flags);
68480 action = &t->sighand->action[sig-1];
68481@@ -1216,9 +1227,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68482 }
68483 if (action->sa.sa_handler == SIG_DFL)
68484 t->signal->flags &= ~SIGNAL_UNKILLABLE;
68485+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
68486+ is_unhandled = 1;
68487 ret = specific_send_sig_info(sig, info, t);
68488 spin_unlock_irqrestore(&t->sighand->siglock, flags);
68489
68490+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
68491+ normal operation */
68492+ if (is_unhandled) {
68493+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
68494+ gr_handle_crash(t, sig);
68495+ }
68496+
68497 return ret;
68498 }
68499
68500@@ -1285,8 +1305,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
68501 ret = check_kill_permission(sig, info, p);
68502 rcu_read_unlock();
68503
68504- if (!ret && sig)
68505+ if (!ret && sig) {
68506 ret = do_send_sig_info(sig, info, p, true);
68507+ if (!ret)
68508+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
68509+ }
68510
68511 return ret;
68512 }
68513@@ -1909,6 +1932,8 @@ static void ptrace_do_notify(int signr, int exit_code, int why)
68514 {
68515 siginfo_t info;
68516
68517+ pax_track_stack();
68518+
68519 memset(&info, 0, sizeof info);
68520 info.si_signo = signr;
68521 info.si_code = exit_code;
68522@@ -2748,7 +2773,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
68523 int error = -ESRCH;
68524
68525 rcu_read_lock();
68526- p = find_task_by_vpid(pid);
68527+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
68528+ /* allow glibc communication via tgkill to other threads in our
68529+ thread group */
68530+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
68531+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
68532+ p = find_task_by_vpid_unrestricted(pid);
68533+ else
68534+#endif
68535+ p = find_task_by_vpid(pid);
68536 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
68537 error = check_kill_permission(sig, info, p);
68538 /*
68539diff --git a/kernel/smp.c b/kernel/smp.c
68540index fb67dfa..f819e2e 100644
68541--- a/kernel/smp.c
68542+++ b/kernel/smp.c
68543@@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait)
68544 }
68545 EXPORT_SYMBOL(smp_call_function);
68546
68547-void ipi_call_lock(void)
68548+void ipi_call_lock(void) __acquires(call_function.lock)
68549 {
68550 raw_spin_lock(&call_function.lock);
68551 }
68552
68553-void ipi_call_unlock(void)
68554+void ipi_call_unlock(void) __releases(call_function.lock)
68555 {
68556 raw_spin_unlock(&call_function.lock);
68557 }
68558
68559-void ipi_call_lock_irq(void)
68560+void ipi_call_lock_irq(void) __acquires(call_function.lock)
68561 {
68562 raw_spin_lock_irq(&call_function.lock);
68563 }
68564
68565-void ipi_call_unlock_irq(void)
68566+void ipi_call_unlock_irq(void) __releases(call_function.lock)
68567 {
68568 raw_spin_unlock_irq(&call_function.lock);
68569 }
68570diff --git a/kernel/softirq.c b/kernel/softirq.c
68571index fca82c3..1db9690 100644
68572--- a/kernel/softirq.c
68573+++ b/kernel/softirq.c
68574@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
68575
68576 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
68577
68578-char *softirq_to_name[NR_SOFTIRQS] = {
68579+const char * const softirq_to_name[NR_SOFTIRQS] = {
68580 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
68581 "TASKLET", "SCHED", "HRTIMER", "RCU"
68582 };
68583@@ -235,7 +235,7 @@ restart:
68584 kstat_incr_softirqs_this_cpu(vec_nr);
68585
68586 trace_softirq_entry(vec_nr);
68587- h->action(h);
68588+ h->action();
68589 trace_softirq_exit(vec_nr);
68590 if (unlikely(prev_count != preempt_count())) {
68591 printk(KERN_ERR "huh, entered softirq %u %s %p"
68592@@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr)
68593 local_irq_restore(flags);
68594 }
68595
68596-void open_softirq(int nr, void (*action)(struct softirq_action *))
68597+void open_softirq(int nr, void (*action)(void))
68598 {
68599- softirq_vec[nr].action = action;
68600+ pax_open_kernel();
68601+ *(void **)&softirq_vec[nr].action = action;
68602+ pax_close_kernel();
68603 }
68604
68605 /*
68606@@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
68607
68608 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
68609
68610-static void tasklet_action(struct softirq_action *a)
68611+static void tasklet_action(void)
68612 {
68613 struct tasklet_struct *list;
68614
68615@@ -476,7 +478,7 @@ static void tasklet_action(struct softirq_action *a)
68616 }
68617 }
68618
68619-static void tasklet_hi_action(struct softirq_action *a)
68620+static void tasklet_hi_action(void)
68621 {
68622 struct tasklet_struct *list;
68623
68624diff --git a/kernel/sys.c b/kernel/sys.c
68625index 1dbbe69..e96e1dd 100644
68626--- a/kernel/sys.c
68627+++ b/kernel/sys.c
68628@@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
68629 error = -EACCES;
68630 goto out;
68631 }
68632+
68633+ if (gr_handle_chroot_setpriority(p, niceval)) {
68634+ error = -EACCES;
68635+ goto out;
68636+ }
68637+
68638 no_nice = security_task_setnice(p, niceval);
68639 if (no_nice) {
68640 error = no_nice;
68641@@ -571,6 +577,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
68642 goto error;
68643 }
68644
68645+ if (gr_check_group_change(new->gid, new->egid, -1))
68646+ goto error;
68647+
68648 if (rgid != (gid_t) -1 ||
68649 (egid != (gid_t) -1 && egid != old->gid))
68650 new->sgid = new->egid;
68651@@ -600,6 +609,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
68652 old = current_cred();
68653
68654 retval = -EPERM;
68655+
68656+ if (gr_check_group_change(gid, gid, gid))
68657+ goto error;
68658+
68659 if (nsown_capable(CAP_SETGID))
68660 new->gid = new->egid = new->sgid = new->fsgid = gid;
68661 else if (gid == old->gid || gid == old->sgid)
68662@@ -687,6 +700,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
68663 goto error;
68664 }
68665
68666+ if (gr_check_user_change(new->uid, new->euid, -1))
68667+ goto error;
68668+
68669 if (new->uid != old->uid) {
68670 retval = set_user(new);
68671 if (retval < 0)
68672@@ -731,6 +747,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
68673 old = current_cred();
68674
68675 retval = -EPERM;
68676+
68677+ if (gr_check_crash_uid(uid))
68678+ goto error;
68679+ if (gr_check_user_change(uid, uid, uid))
68680+ goto error;
68681+
68682 if (nsown_capable(CAP_SETUID)) {
68683 new->suid = new->uid = uid;
68684 if (uid != old->uid) {
68685@@ -785,6 +807,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
68686 goto error;
68687 }
68688
68689+ if (gr_check_user_change(ruid, euid, -1))
68690+ goto error;
68691+
68692 if (ruid != (uid_t) -1) {
68693 new->uid = ruid;
68694 if (ruid != old->uid) {
68695@@ -849,6 +874,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
68696 goto error;
68697 }
68698
68699+ if (gr_check_group_change(rgid, egid, -1))
68700+ goto error;
68701+
68702 if (rgid != (gid_t) -1)
68703 new->gid = rgid;
68704 if (egid != (gid_t) -1)
68705@@ -895,6 +923,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68706 old = current_cred();
68707 old_fsuid = old->fsuid;
68708
68709+ if (gr_check_user_change(-1, -1, uid))
68710+ goto error;
68711+
68712 if (uid == old->uid || uid == old->euid ||
68713 uid == old->suid || uid == old->fsuid ||
68714 nsown_capable(CAP_SETUID)) {
68715@@ -905,6 +936,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68716 }
68717 }
68718
68719+error:
68720 abort_creds(new);
68721 return old_fsuid;
68722
68723@@ -931,12 +963,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
68724 if (gid == old->gid || gid == old->egid ||
68725 gid == old->sgid || gid == old->fsgid ||
68726 nsown_capable(CAP_SETGID)) {
68727+ if (gr_check_group_change(-1, -1, gid))
68728+ goto error;
68729+
68730 if (gid != old_fsgid) {
68731 new->fsgid = gid;
68732 goto change_okay;
68733 }
68734 }
68735
68736+error:
68737 abort_creds(new);
68738 return old_fsgid;
68739
68740@@ -1188,7 +1224,10 @@ static int override_release(char __user *release, int len)
68741 }
68742 v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
68743 snprintf(buf, len, "2.6.%u%s", v, rest);
68744- ret = copy_to_user(release, buf, len);
68745+ if (len > sizeof(buf))
68746+ ret = -EFAULT;
68747+ else
68748+ ret = copy_to_user(release, buf, len);
68749 }
68750 return ret;
68751 }
68752@@ -1242,19 +1281,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
68753 return -EFAULT;
68754
68755 down_read(&uts_sem);
68756- error = __copy_to_user(&name->sysname, &utsname()->sysname,
68757+ error = __copy_to_user(name->sysname, &utsname()->sysname,
68758 __OLD_UTS_LEN);
68759 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
68760- error |= __copy_to_user(&name->nodename, &utsname()->nodename,
68761+ error |= __copy_to_user(name->nodename, &utsname()->nodename,
68762 __OLD_UTS_LEN);
68763 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
68764- error |= __copy_to_user(&name->release, &utsname()->release,
68765+ error |= __copy_to_user(name->release, &utsname()->release,
68766 __OLD_UTS_LEN);
68767 error |= __put_user(0, name->release + __OLD_UTS_LEN);
68768- error |= __copy_to_user(&name->version, &utsname()->version,
68769+ error |= __copy_to_user(name->version, &utsname()->version,
68770 __OLD_UTS_LEN);
68771 error |= __put_user(0, name->version + __OLD_UTS_LEN);
68772- error |= __copy_to_user(&name->machine, &utsname()->machine,
68773+ error |= __copy_to_user(name->machine, &utsname()->machine,
68774 __OLD_UTS_LEN);
68775 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
68776 up_read(&uts_sem);
68777@@ -1717,7 +1756,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
68778 error = get_dumpable(me->mm);
68779 break;
68780 case PR_SET_DUMPABLE:
68781- if (arg2 < 0 || arg2 > 1) {
68782+ if (arg2 > 1) {
68783 error = -EINVAL;
68784 break;
68785 }
68786diff --git a/kernel/sysctl.c b/kernel/sysctl.c
68787index 11d65b5..6957b37 100644
68788--- a/kernel/sysctl.c
68789+++ b/kernel/sysctl.c
68790@@ -85,6 +85,13 @@
68791
68792
68793 #if defined(CONFIG_SYSCTL)
68794+#include <linux/grsecurity.h>
68795+#include <linux/grinternal.h>
68796+
68797+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
68798+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
68799+ const int op);
68800+extern int gr_handle_chroot_sysctl(const int op);
68801
68802 /* External variables not in a header file. */
68803 extern int sysctl_overcommit_memory;
68804@@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
68805 }
68806
68807 #endif
68808+extern struct ctl_table grsecurity_table[];
68809
68810 static struct ctl_table root_table[];
68811 static struct ctl_table_root sysctl_table_root;
68812@@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[];
68813 int sysctl_legacy_va_layout;
68814 #endif
68815
68816+#ifdef CONFIG_PAX_SOFTMODE
68817+static ctl_table pax_table[] = {
68818+ {
68819+ .procname = "softmode",
68820+ .data = &pax_softmode,
68821+ .maxlen = sizeof(unsigned int),
68822+ .mode = 0600,
68823+ .proc_handler = &proc_dointvec,
68824+ },
68825+
68826+ { }
68827+};
68828+#endif
68829+
68830 /* The default sysctl tables: */
68831
68832 static struct ctl_table root_table[] = {
68833@@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000;
68834 #endif
68835
68836 static struct ctl_table kern_table[] = {
68837+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
68838+ {
68839+ .procname = "grsecurity",
68840+ .mode = 0500,
68841+ .child = grsecurity_table,
68842+ },
68843+#endif
68844+
68845+#ifdef CONFIG_PAX_SOFTMODE
68846+ {
68847+ .procname = "pax",
68848+ .mode = 0500,
68849+ .child = pax_table,
68850+ },
68851+#endif
68852+
68853 {
68854 .procname = "sched_child_runs_first",
68855 .data = &sysctl_sched_child_runs_first,
68856@@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = {
68857 .data = &modprobe_path,
68858 .maxlen = KMOD_PATH_LEN,
68859 .mode = 0644,
68860- .proc_handler = proc_dostring,
68861+ .proc_handler = proc_dostring_modpriv,
68862 },
68863 {
68864 .procname = "modules_disabled",
68865@@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = {
68866 .extra1 = &zero,
68867 .extra2 = &one,
68868 },
68869+#endif
68870 {
68871 .procname = "kptr_restrict",
68872 .data = &kptr_restrict,
68873 .maxlen = sizeof(int),
68874 .mode = 0644,
68875 .proc_handler = proc_dmesg_restrict,
68876+#ifdef CONFIG_GRKERNSEC_HIDESYM
68877+ .extra1 = &two,
68878+#else
68879 .extra1 = &zero,
68880+#endif
68881 .extra2 = &two,
68882 },
68883-#endif
68884 {
68885 .procname = "ngroups_max",
68886 .data = &ngroups_max,
68887@@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = {
68888 .proc_handler = proc_dointvec_minmax,
68889 .extra1 = &zero,
68890 },
68891+ {
68892+ .procname = "heap_stack_gap",
68893+ .data = &sysctl_heap_stack_gap,
68894+ .maxlen = sizeof(sysctl_heap_stack_gap),
68895+ .mode = 0644,
68896+ .proc_handler = proc_doulongvec_minmax,
68897+ },
68898 #else
68899 {
68900 .procname = "nr_trim_pages",
68901@@ -1709,6 +1758,17 @@ static int test_perm(int mode, int op)
68902 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
68903 {
68904 int mode;
68905+ int error;
68906+
68907+ if (table->parent != NULL && table->parent->procname != NULL &&
68908+ table->procname != NULL &&
68909+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
68910+ return -EACCES;
68911+ if (gr_handle_chroot_sysctl(op))
68912+ return -EACCES;
68913+ error = gr_handle_sysctl(table, op);
68914+ if (error)
68915+ return error;
68916
68917 if (root->permissions)
68918 mode = root->permissions(root, current->nsproxy, table);
68919@@ -2113,6 +2173,16 @@ int proc_dostring(struct ctl_table *table, int write,
68920 buffer, lenp, ppos);
68921 }
68922
68923+int proc_dostring_modpriv(struct ctl_table *table, int write,
68924+ void __user *buffer, size_t *lenp, loff_t *ppos)
68925+{
68926+ if (write && !capable(CAP_SYS_MODULE))
68927+ return -EPERM;
68928+
68929+ return _proc_do_string(table->data, table->maxlen, write,
68930+ buffer, lenp, ppos);
68931+}
68932+
68933 static size_t proc_skip_spaces(char **buf)
68934 {
68935 size_t ret;
68936@@ -2218,6 +2288,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
68937 len = strlen(tmp);
68938 if (len > *size)
68939 len = *size;
68940+ if (len > sizeof(tmp))
68941+ len = sizeof(tmp);
68942 if (copy_to_user(*buf, tmp, len))
68943 return -EFAULT;
68944 *size -= len;
68945@@ -2534,8 +2606,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
68946 *i = val;
68947 } else {
68948 val = convdiv * (*i) / convmul;
68949- if (!first)
68950+ if (!first) {
68951 err = proc_put_char(&buffer, &left, '\t');
68952+ if (err)
68953+ break;
68954+ }
68955 err = proc_put_long(&buffer, &left, val, false);
68956 if (err)
68957 break;
68958@@ -2930,6 +3005,12 @@ int proc_dostring(struct ctl_table *table, int write,
68959 return -ENOSYS;
68960 }
68961
68962+int proc_dostring_modpriv(struct ctl_table *table, int write,
68963+ void __user *buffer, size_t *lenp, loff_t *ppos)
68964+{
68965+ return -ENOSYS;
68966+}
68967+
68968 int proc_dointvec(struct ctl_table *table, int write,
68969 void __user *buffer, size_t *lenp, loff_t *ppos)
68970 {
68971@@ -2986,6 +3067,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
68972 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
68973 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
68974 EXPORT_SYMBOL(proc_dostring);
68975+EXPORT_SYMBOL(proc_dostring_modpriv);
68976 EXPORT_SYMBOL(proc_doulongvec_minmax);
68977 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
68978 EXPORT_SYMBOL(register_sysctl_table);
68979diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
68980index e8bffbe..2344401 100644
68981--- a/kernel/sysctl_binary.c
68982+++ b/kernel/sysctl_binary.c
68983@@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
68984 int i;
68985
68986 set_fs(KERNEL_DS);
68987- result = vfs_read(file, buffer, BUFSZ - 1, &pos);
68988+ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
68989 set_fs(old_fs);
68990 if (result < 0)
68991 goto out_kfree;
68992@@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *file,
68993 }
68994
68995 set_fs(KERNEL_DS);
68996- result = vfs_write(file, buffer, str - buffer, &pos);
68997+ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
68998 set_fs(old_fs);
68999 if (result < 0)
69000 goto out_kfree;
69001@@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file *file,
69002 int i;
69003
69004 set_fs(KERNEL_DS);
69005- result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69006+ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69007 set_fs(old_fs);
69008 if (result < 0)
69009 goto out_kfree;
69010@@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file *file,
69011 }
69012
69013 set_fs(KERNEL_DS);
69014- result = vfs_write(file, buffer, str - buffer, &pos);
69015+ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69016 set_fs(old_fs);
69017 if (result < 0)
69018 goto out_kfree;
69019@@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *file,
69020 int i;
69021
69022 set_fs(KERNEL_DS);
69023- result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69024+ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69025 set_fs(old_fs);
69026 if (result < 0)
69027 goto out;
69028@@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69029 __le16 dnaddr;
69030
69031 set_fs(KERNEL_DS);
69032- result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69033+ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69034 set_fs(old_fs);
69035 if (result < 0)
69036 goto out;
69037@@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69038 le16_to_cpu(dnaddr) & 0x3ff);
69039
69040 set_fs(KERNEL_DS);
69041- result = vfs_write(file, buf, len, &pos);
69042+ result = vfs_write(file, (const char __force_user *)buf, len, &pos);
69043 set_fs(old_fs);
69044 if (result < 0)
69045 goto out;
69046diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
69047index 362da65..ab8ef8c 100644
69048--- a/kernel/sysctl_check.c
69049+++ b/kernel/sysctl_check.c
69050@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
69051 set_fail(&fail, table, "Directory with extra2");
69052 } else {
69053 if ((table->proc_handler == proc_dostring) ||
69054+ (table->proc_handler == proc_dostring_modpriv) ||
69055 (table->proc_handler == proc_dointvec) ||
69056 (table->proc_handler == proc_dointvec_minmax) ||
69057 (table->proc_handler == proc_dointvec_jiffies) ||
69058diff --git a/kernel/taskstats.c b/kernel/taskstats.c
69059index e660464..c8b9e67 100644
69060--- a/kernel/taskstats.c
69061+++ b/kernel/taskstats.c
69062@@ -27,9 +27,12 @@
69063 #include <linux/cgroup.h>
69064 #include <linux/fs.h>
69065 #include <linux/file.h>
69066+#include <linux/grsecurity.h>
69067 #include <net/genetlink.h>
69068 #include <linux/atomic.h>
69069
69070+extern int gr_is_taskstats_denied(int pid);
69071+
69072 /*
69073 * Maximum length of a cpumask that can be specified in
69074 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
69075@@ -556,6 +559,9 @@ err:
69076
69077 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
69078 {
69079+ if (gr_is_taskstats_denied(current->pid))
69080+ return -EACCES;
69081+
69082 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
69083 return cmd_attr_register_cpumask(info);
69084 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
69085diff --git a/kernel/time.c b/kernel/time.c
69086index d776062..fa8d186 100644
69087--- a/kernel/time.c
69088+++ b/kernel/time.c
69089@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
69090 return error;
69091
69092 if (tz) {
69093+ /* we log in do_settimeofday called below, so don't log twice
69094+ */
69095+ if (!tv)
69096+ gr_log_timechange();
69097+
69098 /* SMP safe, global irq locking makes it work. */
69099 sys_tz = *tz;
69100 update_vsyscall_tz();
69101diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
69102index 8b70c76..923e9f5 100644
69103--- a/kernel/time/alarmtimer.c
69104+++ b/kernel/time/alarmtimer.c
69105@@ -693,7 +693,7 @@ static int __init alarmtimer_init(void)
69106 {
69107 int error = 0;
69108 int i;
69109- struct k_clock alarm_clock = {
69110+ static struct k_clock alarm_clock = {
69111 .clock_getres = alarm_clock_getres,
69112 .clock_get = alarm_clock_get,
69113 .timer_create = alarm_timer_create,
69114diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
69115index 7a90d02..6d8585a 100644
69116--- a/kernel/time/tick-broadcast.c
69117+++ b/kernel/time/tick-broadcast.c
69118@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
69119 * then clear the broadcast bit.
69120 */
69121 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
69122- int cpu = smp_processor_id();
69123+ cpu = smp_processor_id();
69124
69125 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
69126 tick_broadcast_clear_oneshot(cpu);
69127diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
69128index 6f9798b..f8c4087 100644
69129--- a/kernel/time/timekeeping.c
69130+++ b/kernel/time/timekeeping.c
69131@@ -14,6 +14,7 @@
69132 #include <linux/init.h>
69133 #include <linux/mm.h>
69134 #include <linux/sched.h>
69135+#include <linux/grsecurity.h>
69136 #include <linux/syscore_ops.h>
69137 #include <linux/clocksource.h>
69138 #include <linux/jiffies.h>
69139@@ -365,6 +366,8 @@ int do_settimeofday(const struct timespec *tv)
69140 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
69141 return -EINVAL;
69142
69143+ gr_log_timechange();
69144+
69145 write_seqlock_irqsave(&xtime_lock, flags);
69146
69147 timekeeping_forward_now();
69148diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
69149index 3258455..f35227d 100644
69150--- a/kernel/time/timer_list.c
69151+++ b/kernel/time/timer_list.c
69152@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
69153
69154 static void print_name_offset(struct seq_file *m, void *sym)
69155 {
69156+#ifdef CONFIG_GRKERNSEC_HIDESYM
69157+ SEQ_printf(m, "<%p>", NULL);
69158+#else
69159 char symname[KSYM_NAME_LEN];
69160
69161 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
69162 SEQ_printf(m, "<%pK>", sym);
69163 else
69164 SEQ_printf(m, "%s", symname);
69165+#endif
69166 }
69167
69168 static void
69169@@ -112,7 +116,11 @@ next_one:
69170 static void
69171 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
69172 {
69173+#ifdef CONFIG_GRKERNSEC_HIDESYM
69174+ SEQ_printf(m, " .base: %p\n", NULL);
69175+#else
69176 SEQ_printf(m, " .base: %pK\n", base);
69177+#endif
69178 SEQ_printf(m, " .index: %d\n",
69179 base->index);
69180 SEQ_printf(m, " .resolution: %Lu nsecs\n",
69181@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs(void)
69182 {
69183 struct proc_dir_entry *pe;
69184
69185+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69186+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
69187+#else
69188 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
69189+#endif
69190 if (!pe)
69191 return -ENOMEM;
69192 return 0;
69193diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
69194index a5d0a3a..60c7948 100644
69195--- a/kernel/time/timer_stats.c
69196+++ b/kernel/time/timer_stats.c
69197@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
69198 static unsigned long nr_entries;
69199 static struct entry entries[MAX_ENTRIES];
69200
69201-static atomic_t overflow_count;
69202+static atomic_unchecked_t overflow_count;
69203
69204 /*
69205 * The entries are in a hash-table, for fast lookup:
69206@@ -140,7 +140,7 @@ static void reset_entries(void)
69207 nr_entries = 0;
69208 memset(entries, 0, sizeof(entries));
69209 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
69210- atomic_set(&overflow_count, 0);
69211+ atomic_set_unchecked(&overflow_count, 0);
69212 }
69213
69214 static struct entry *alloc_entry(void)
69215@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
69216 if (likely(entry))
69217 entry->count++;
69218 else
69219- atomic_inc(&overflow_count);
69220+ atomic_inc_unchecked(&overflow_count);
69221
69222 out_unlock:
69223 raw_spin_unlock_irqrestore(lock, flags);
69224@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
69225
69226 static void print_name_offset(struct seq_file *m, unsigned long addr)
69227 {
69228+#ifdef CONFIG_GRKERNSEC_HIDESYM
69229+ seq_printf(m, "<%p>", NULL);
69230+#else
69231 char symname[KSYM_NAME_LEN];
69232
69233 if (lookup_symbol_name(addr, symname) < 0)
69234 seq_printf(m, "<%p>", (void *)addr);
69235 else
69236 seq_printf(m, "%s", symname);
69237+#endif
69238 }
69239
69240 static int tstats_show(struct seq_file *m, void *v)
69241@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
69242
69243 seq_puts(m, "Timer Stats Version: v0.2\n");
69244 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
69245- if (atomic_read(&overflow_count))
69246+ if (atomic_read_unchecked(&overflow_count))
69247 seq_printf(m, "Overflow: %d entries\n",
69248- atomic_read(&overflow_count));
69249+ atomic_read_unchecked(&overflow_count));
69250
69251 for (i = 0; i < nr_entries; i++) {
69252 entry = entries + i;
69253@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(void)
69254 {
69255 struct proc_dir_entry *pe;
69256
69257+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69258+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
69259+#else
69260 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
69261+#endif
69262 if (!pe)
69263 return -ENOMEM;
69264 return 0;
69265diff --git a/kernel/timer.c b/kernel/timer.c
69266index 8cff361..0fb5cd8 100644
69267--- a/kernel/timer.c
69268+++ b/kernel/timer.c
69269@@ -1304,7 +1304,7 @@ void update_process_times(int user_tick)
69270 /*
69271 * This function runs timers and the timer-tq in bottom half context.
69272 */
69273-static void run_timer_softirq(struct softirq_action *h)
69274+static void run_timer_softirq(void)
69275 {
69276 struct tvec_base *base = __this_cpu_read(tvec_bases);
69277
69278diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
69279index 7c910a5..8b72104 100644
69280--- a/kernel/trace/blktrace.c
69281+++ b/kernel/trace/blktrace.c
69282@@ -323,7 +323,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
69283 struct blk_trace *bt = filp->private_data;
69284 char buf[16];
69285
69286- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
69287+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
69288
69289 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
69290 }
69291@@ -388,7 +388,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
69292 return 1;
69293
69294 bt = buf->chan->private_data;
69295- atomic_inc(&bt->dropped);
69296+ atomic_inc_unchecked(&bt->dropped);
69297 return 0;
69298 }
69299
69300@@ -489,7 +489,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
69301
69302 bt->dir = dir;
69303 bt->dev = dev;
69304- atomic_set(&bt->dropped, 0);
69305+ atomic_set_unchecked(&bt->dropped, 0);
69306
69307 ret = -EIO;
69308 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
69309diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
69310index 48d3762..3b61fce 100644
69311--- a/kernel/trace/ftrace.c
69312+++ b/kernel/trace/ftrace.c
69313@@ -1584,12 +1584,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
69314 if (unlikely(ftrace_disabled))
69315 return 0;
69316
69317+ ret = ftrace_arch_code_modify_prepare();
69318+ FTRACE_WARN_ON(ret);
69319+ if (ret)
69320+ return 0;
69321+
69322 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
69323+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
69324 if (ret) {
69325 ftrace_bug(ret, ip);
69326- return 0;
69327 }
69328- return 1;
69329+ return ret ? 0 : 1;
69330 }
69331
69332 /*
69333@@ -2606,7 +2611,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
69334
69335 int
69336 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
69337- void *data)
69338+ void *data)
69339 {
69340 struct ftrace_func_probe *entry;
69341 struct ftrace_page *pg;
69342diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
69343index 17a2d44..85907e2 100644
69344--- a/kernel/trace/trace.c
69345+++ b/kernel/trace/trace.c
69346@@ -3451,6 +3451,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
69347 size_t rem;
69348 unsigned int i;
69349
69350+ pax_track_stack();
69351+
69352 if (splice_grow_spd(pipe, &spd))
69353 return -ENOMEM;
69354
69355@@ -3926,6 +3928,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
69356 int entries, size, i;
69357 size_t ret;
69358
69359+ pax_track_stack();
69360+
69361 if (splice_grow_spd(pipe, &spd))
69362 return -ENOMEM;
69363
69364@@ -4093,10 +4097,9 @@ static const struct file_operations tracing_dyn_info_fops = {
69365 };
69366 #endif
69367
69368-static struct dentry *d_tracer;
69369-
69370 struct dentry *tracing_init_dentry(void)
69371 {
69372+ static struct dentry *d_tracer;
69373 static int once;
69374
69375 if (d_tracer)
69376@@ -4116,10 +4119,9 @@ struct dentry *tracing_init_dentry(void)
69377 return d_tracer;
69378 }
69379
69380-static struct dentry *d_percpu;
69381-
69382 struct dentry *tracing_dentry_percpu(void)
69383 {
69384+ static struct dentry *d_percpu;
69385 static int once;
69386 struct dentry *d_tracer;
69387
69388diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
69389index c212a7f..7b02394 100644
69390--- a/kernel/trace/trace_events.c
69391+++ b/kernel/trace/trace_events.c
69392@@ -1299,10 +1299,6 @@ static LIST_HEAD(ftrace_module_file_list);
69393 struct ftrace_module_file_ops {
69394 struct list_head list;
69395 struct module *mod;
69396- struct file_operations id;
69397- struct file_operations enable;
69398- struct file_operations format;
69399- struct file_operations filter;
69400 };
69401
69402 static struct ftrace_module_file_ops *
69403@@ -1323,17 +1319,12 @@ trace_create_file_ops(struct module *mod)
69404
69405 file_ops->mod = mod;
69406
69407- file_ops->id = ftrace_event_id_fops;
69408- file_ops->id.owner = mod;
69409-
69410- file_ops->enable = ftrace_enable_fops;
69411- file_ops->enable.owner = mod;
69412-
69413- file_ops->filter = ftrace_event_filter_fops;
69414- file_ops->filter.owner = mod;
69415-
69416- file_ops->format = ftrace_event_format_fops;
69417- file_ops->format.owner = mod;
69418+ pax_open_kernel();
69419+ *(void **)&mod->trace_id.owner = mod;
69420+ *(void **)&mod->trace_enable.owner = mod;
69421+ *(void **)&mod->trace_filter.owner = mod;
69422+ *(void **)&mod->trace_format.owner = mod;
69423+ pax_close_kernel();
69424
69425 list_add(&file_ops->list, &ftrace_module_file_list);
69426
69427@@ -1357,8 +1348,8 @@ static void trace_module_add_events(struct module *mod)
69428
69429 for_each_event(call, start, end) {
69430 __trace_add_event_call(*call, mod,
69431- &file_ops->id, &file_ops->enable,
69432- &file_ops->filter, &file_ops->format);
69433+ &mod->trace_id, &mod->trace_enable,
69434+ &mod->trace_filter, &mod->trace_format);
69435 }
69436 }
69437
69438diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
69439index 00d527c..7c5b1a3 100644
69440--- a/kernel/trace/trace_kprobe.c
69441+++ b/kernel/trace/trace_kprobe.c
69442@@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69443 long ret;
69444 int maxlen = get_rloc_len(*(u32 *)dest);
69445 u8 *dst = get_rloc_data(dest);
69446- u8 *src = addr;
69447+ const u8 __user *src = (const u8 __force_user *)addr;
69448 mm_segment_t old_fs = get_fs();
69449 if (!maxlen)
69450 return;
69451@@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69452 pagefault_disable();
69453 do
69454 ret = __copy_from_user_inatomic(dst++, src++, 1);
69455- while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
69456+ while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen);
69457 dst[-1] = '\0';
69458 pagefault_enable();
69459 set_fs(old_fs);
69460@@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69461 ((u8 *)get_rloc_data(dest))[0] = '\0';
69462 *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
69463 } else
69464- *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
69465+ *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr,
69466 get_rloc_offs(*(u32 *)dest));
69467 }
69468 /* Return the length of string -- including null terminal byte */
69469@@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string_size)(struct pt_regs *regs,
69470 set_fs(KERNEL_DS);
69471 pagefault_disable();
69472 do {
69473- ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
69474+ ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1);
69475 len++;
69476 } while (c && ret == 0 && len < MAX_STRING_SIZE);
69477 pagefault_enable();
69478diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
69479index fd3c8aa..5f324a6 100644
69480--- a/kernel/trace/trace_mmiotrace.c
69481+++ b/kernel/trace/trace_mmiotrace.c
69482@@ -24,7 +24,7 @@ struct header_iter {
69483 static struct trace_array *mmio_trace_array;
69484 static bool overrun_detected;
69485 static unsigned long prev_overruns;
69486-static atomic_t dropped_count;
69487+static atomic_unchecked_t dropped_count;
69488
69489 static void mmio_reset_data(struct trace_array *tr)
69490 {
69491@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iterator *iter)
69492
69493 static unsigned long count_overruns(struct trace_iterator *iter)
69494 {
69495- unsigned long cnt = atomic_xchg(&dropped_count, 0);
69496+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
69497 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
69498
69499 if (over > prev_overruns)
69500@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
69501 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
69502 sizeof(*entry), 0, pc);
69503 if (!event) {
69504- atomic_inc(&dropped_count);
69505+ atomic_inc_unchecked(&dropped_count);
69506 return;
69507 }
69508 entry = ring_buffer_event_data(event);
69509@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
69510 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
69511 sizeof(*entry), 0, pc);
69512 if (!event) {
69513- atomic_inc(&dropped_count);
69514+ atomic_inc_unchecked(&dropped_count);
69515 return;
69516 }
69517 entry = ring_buffer_event_data(event);
69518diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
69519index 5199930..26c73a0 100644
69520--- a/kernel/trace/trace_output.c
69521+++ b/kernel/trace/trace_output.c
69522@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
69523
69524 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
69525 if (!IS_ERR(p)) {
69526- p = mangle_path(s->buffer + s->len, p, "\n");
69527+ p = mangle_path(s->buffer + s->len, p, "\n\\");
69528 if (p) {
69529 s->len = p - s->buffer;
69530 return 1;
69531diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
69532index 77575b3..6e623d1 100644
69533--- a/kernel/trace/trace_stack.c
69534+++ b/kernel/trace/trace_stack.c
69535@@ -50,7 +50,7 @@ static inline void check_stack(void)
69536 return;
69537
69538 /* we do not handle interrupt stacks yet */
69539- if (!object_is_on_stack(&this_size))
69540+ if (!object_starts_on_stack(&this_size))
69541 return;
69542
69543 local_irq_save(flags);
69544diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
69545index 209b379..7f76423 100644
69546--- a/kernel/trace/trace_workqueue.c
69547+++ b/kernel/trace/trace_workqueue.c
69548@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
69549 int cpu;
69550 pid_t pid;
69551 /* Can be inserted from interrupt or user context, need to be atomic */
69552- atomic_t inserted;
69553+ atomic_unchecked_t inserted;
69554 /*
69555 * Don't need to be atomic, works are serialized in a single workqueue thread
69556 * on a single CPU.
69557@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
69558 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
69559 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
69560 if (node->pid == wq_thread->pid) {
69561- atomic_inc(&node->inserted);
69562+ atomic_inc_unchecked(&node->inserted);
69563 goto found;
69564 }
69565 }
69566@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
69567 tsk = get_pid_task(pid, PIDTYPE_PID);
69568 if (tsk) {
69569 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
69570- atomic_read(&cws->inserted), cws->executed,
69571+ atomic_read_unchecked(&cws->inserted), cws->executed,
69572 tsk->comm);
69573 put_task_struct(tsk);
69574 }
69575diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
69576index c0cb9c4..f33aa89 100644
69577--- a/lib/Kconfig.debug
69578+++ b/lib/Kconfig.debug
69579@@ -1091,6 +1091,7 @@ config LATENCYTOP
69580 depends on DEBUG_KERNEL
69581 depends on STACKTRACE_SUPPORT
69582 depends on PROC_FS
69583+ depends on !GRKERNSEC_HIDESYM
69584 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
69585 select KALLSYMS
69586 select KALLSYMS_ALL
69587diff --git a/lib/bitmap.c b/lib/bitmap.c
69588index 2f4412e..a557e27 100644
69589--- a/lib/bitmap.c
69590+++ b/lib/bitmap.c
69591@@ -419,7 +419,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
69592 {
69593 int c, old_c, totaldigits, ndigits, nchunks, nbits;
69594 u32 chunk;
69595- const char __user *ubuf = buf;
69596+ const char __user *ubuf = (const char __force_user *)buf;
69597
69598 bitmap_zero(maskp, nmaskbits);
69599
69600@@ -504,7 +504,7 @@ int bitmap_parse_user(const char __user *ubuf,
69601 {
69602 if (!access_ok(VERIFY_READ, ubuf, ulen))
69603 return -EFAULT;
69604- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
69605+ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
69606 }
69607 EXPORT_SYMBOL(bitmap_parse_user);
69608
69609@@ -594,7 +594,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
69610 {
69611 unsigned a, b;
69612 int c, old_c, totaldigits;
69613- const char __user *ubuf = buf;
69614+ const char __user *ubuf = (const char __force_user *)buf;
69615 int exp_digit, in_range;
69616
69617 totaldigits = c = 0;
69618@@ -694,7 +694,7 @@ int bitmap_parselist_user(const char __user *ubuf,
69619 {
69620 if (!access_ok(VERIFY_READ, ubuf, ulen))
69621 return -EFAULT;
69622- return __bitmap_parselist((const char *)ubuf,
69623+ return __bitmap_parselist((const char __force_kernel *)ubuf,
69624 ulen, 1, maskp, nmaskbits);
69625 }
69626 EXPORT_SYMBOL(bitmap_parselist_user);
69627diff --git a/lib/bug.c b/lib/bug.c
69628index 1955209..cbbb2ad 100644
69629--- a/lib/bug.c
69630+++ b/lib/bug.c
69631@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
69632 return BUG_TRAP_TYPE_NONE;
69633
69634 bug = find_bug(bugaddr);
69635+ if (!bug)
69636+ return BUG_TRAP_TYPE_NONE;
69637
69638 file = NULL;
69639 line = 0;
69640diff --git a/lib/debugobjects.c b/lib/debugobjects.c
69641index a78b7c6..2c73084 100644
69642--- a/lib/debugobjects.c
69643+++ b/lib/debugobjects.c
69644@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
69645 if (limit > 4)
69646 return;
69647
69648- is_on_stack = object_is_on_stack(addr);
69649+ is_on_stack = object_starts_on_stack(addr);
69650 if (is_on_stack == onstack)
69651 return;
69652
69653diff --git a/lib/devres.c b/lib/devres.c
69654index 7c0e953..f642b5c 100644
69655--- a/lib/devres.c
69656+++ b/lib/devres.c
69657@@ -80,7 +80,7 @@ EXPORT_SYMBOL(devm_ioremap_nocache);
69658 void devm_iounmap(struct device *dev, void __iomem *addr)
69659 {
69660 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
69661- (void *)addr));
69662+ (void __force *)addr));
69663 iounmap(addr);
69664 }
69665 EXPORT_SYMBOL(devm_iounmap);
69666@@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
69667 {
69668 ioport_unmap(addr);
69669 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
69670- devm_ioport_map_match, (void *)addr));
69671+ devm_ioport_map_match, (void __force *)addr));
69672 }
69673 EXPORT_SYMBOL(devm_ioport_unmap);
69674
69675diff --git a/lib/dma-debug.c b/lib/dma-debug.c
69676index db07bfd..719b5ab 100644
69677--- a/lib/dma-debug.c
69678+++ b/lib/dma-debug.c
69679@@ -870,7 +870,7 @@ out:
69680
69681 static void check_for_stack(struct device *dev, void *addr)
69682 {
69683- if (object_is_on_stack(addr))
69684+ if (object_starts_on_stack(addr))
69685 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
69686 "stack [addr=%p]\n", addr);
69687 }
69688diff --git a/lib/extable.c b/lib/extable.c
69689index 4cac81e..63e9b8f 100644
69690--- a/lib/extable.c
69691+++ b/lib/extable.c
69692@@ -13,6 +13,7 @@
69693 #include <linux/init.h>
69694 #include <linux/sort.h>
69695 #include <asm/uaccess.h>
69696+#include <asm/pgtable.h>
69697
69698 #ifndef ARCH_HAS_SORT_EXTABLE
69699 /*
69700@@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const void *b)
69701 void sort_extable(struct exception_table_entry *start,
69702 struct exception_table_entry *finish)
69703 {
69704+ pax_open_kernel();
69705 sort(start, finish - start, sizeof(struct exception_table_entry),
69706 cmp_ex, NULL);
69707+ pax_close_kernel();
69708 }
69709
69710 #ifdef CONFIG_MODULES
69711diff --git a/lib/inflate.c b/lib/inflate.c
69712index 013a761..c28f3fc 100644
69713--- a/lib/inflate.c
69714+++ b/lib/inflate.c
69715@@ -269,7 +269,7 @@ static void free(void *where)
69716 malloc_ptr = free_mem_ptr;
69717 }
69718 #else
69719-#define malloc(a) kmalloc(a, GFP_KERNEL)
69720+#define malloc(a) kmalloc((a), GFP_KERNEL)
69721 #define free(a) kfree(a)
69722 #endif
69723
69724diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
69725index bd2bea9..6b3c95e 100644
69726--- a/lib/is_single_threaded.c
69727+++ b/lib/is_single_threaded.c
69728@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
69729 struct task_struct *p, *t;
69730 bool ret;
69731
69732+ if (!mm)
69733+ return true;
69734+
69735 if (atomic_read(&task->signal->live) != 1)
69736 return false;
69737
69738diff --git a/lib/kref.c b/lib/kref.c
69739index 3efb882..8492f4c 100644
69740--- a/lib/kref.c
69741+++ b/lib/kref.c
69742@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
69743 */
69744 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
69745 {
69746- WARN_ON(release == NULL);
69747+ BUG_ON(release == NULL);
69748 WARN_ON(release == (void (*)(struct kref *))kfree);
69749
69750 if (atomic_dec_and_test(&kref->refcount)) {
69751diff --git a/lib/radix-tree.c b/lib/radix-tree.c
69752index a2f9da5..3bcadb6 100644
69753--- a/lib/radix-tree.c
69754+++ b/lib/radix-tree.c
69755@@ -80,7 +80,7 @@ struct radix_tree_preload {
69756 int nr;
69757 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
69758 };
69759-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
69760+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
69761
69762 static inline void *ptr_to_indirect(void *ptr)
69763 {
69764diff --git a/lib/vsprintf.c b/lib/vsprintf.c
69765index d7222a9..2172edc 100644
69766--- a/lib/vsprintf.c
69767+++ b/lib/vsprintf.c
69768@@ -16,6 +16,9 @@
69769 * - scnprintf and vscnprintf
69770 */
69771
69772+#ifdef CONFIG_GRKERNSEC_HIDESYM
69773+#define __INCLUDED_BY_HIDESYM 1
69774+#endif
69775 #include <stdarg.h>
69776 #include <linux/module.h>
69777 #include <linux/types.h>
69778@@ -432,7 +435,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
69779 char sym[KSYM_SYMBOL_LEN];
69780 if (ext == 'B')
69781 sprint_backtrace(sym, value);
69782- else if (ext != 'f' && ext != 's')
69783+ else if (ext != 'f' && ext != 's' && ext != 'a')
69784 sprint_symbol(sym, value);
69785 else
69786 kallsyms_lookup(value, NULL, NULL, NULL, sym);
69787@@ -796,7 +799,11 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
69788 return string(buf, end, uuid, spec);
69789 }
69790
69791+#ifdef CONFIG_GRKERNSEC_HIDESYM
69792+int kptr_restrict __read_mostly = 2;
69793+#else
69794 int kptr_restrict __read_mostly;
69795+#endif
69796
69797 /*
69798 * Show a '%p' thing. A kernel extension is that the '%p' is followed
69799@@ -810,6 +817,8 @@ int kptr_restrict __read_mostly;
69800 * - 'S' For symbolic direct pointers with offset
69801 * - 's' For symbolic direct pointers without offset
69802 * - 'B' For backtraced symbolic direct pointers with offset
69803+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
69804+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
69805 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
69806 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
69807 * - 'M' For a 6-byte MAC address, it prints the address in the
69808@@ -854,12 +863,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
69809 {
69810 if (!ptr && *fmt != 'K') {
69811 /*
69812- * Print (null) with the same width as a pointer so it makes
69813+ * Print (nil) with the same width as a pointer so it makes
69814 * tabular output look nice.
69815 */
69816 if (spec.field_width == -1)
69817 spec.field_width = 2 * sizeof(void *);
69818- return string(buf, end, "(null)", spec);
69819+ return string(buf, end, "(nil)", spec);
69820 }
69821
69822 switch (*fmt) {
69823@@ -869,6 +878,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
69824 /* Fallthrough */
69825 case 'S':
69826 case 's':
69827+#ifdef CONFIG_GRKERNSEC_HIDESYM
69828+ break;
69829+#else
69830+ return symbol_string(buf, end, ptr, spec, *fmt);
69831+#endif
69832+ case 'A':
69833+ case 'a':
69834 case 'B':
69835 return symbol_string(buf, end, ptr, spec, *fmt);
69836 case 'R':
69837@@ -1627,11 +1643,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
69838 typeof(type) value; \
69839 if (sizeof(type) == 8) { \
69840 args = PTR_ALIGN(args, sizeof(u32)); \
69841- *(u32 *)&value = *(u32 *)args; \
69842- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
69843+ *(u32 *)&value = *(const u32 *)args; \
69844+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
69845 } else { \
69846 args = PTR_ALIGN(args, sizeof(type)); \
69847- value = *(typeof(type) *)args; \
69848+ value = *(const typeof(type) *)args; \
69849 } \
69850 args += sizeof(type); \
69851 value; \
69852@@ -1694,7 +1710,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
69853 case FORMAT_TYPE_STR: {
69854 const char *str_arg = args;
69855 args += strlen(str_arg) + 1;
69856- str = string(str, end, (char *)str_arg, spec);
69857+ str = string(str, end, str_arg, spec);
69858 break;
69859 }
69860
69861diff --git a/localversion-grsec b/localversion-grsec
69862new file mode 100644
69863index 0000000..7cd6065
69864--- /dev/null
69865+++ b/localversion-grsec
69866@@ -0,0 +1 @@
69867+-grsec
69868diff --git a/mm/Kconfig b/mm/Kconfig
69869index f2f1ca1..0645f06 100644
69870--- a/mm/Kconfig
69871+++ b/mm/Kconfig
69872@@ -238,10 +238,10 @@ config KSM
69873 root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
69874
69875 config DEFAULT_MMAP_MIN_ADDR
69876- int "Low address space to protect from user allocation"
69877+ int "Low address space to protect from user allocation"
69878 depends on MMU
69879- default 4096
69880- help
69881+ default 65536
69882+ help
69883 This is the portion of low virtual memory which should be protected
69884 from userspace allocation. Keeping a user from writing to low pages
69885 can help reduce the impact of kernel NULL pointer bugs.
69886diff --git a/mm/filemap.c b/mm/filemap.c
69887index 7771871..91bcdb4 100644
69888--- a/mm/filemap.c
69889+++ b/mm/filemap.c
69890@@ -1784,7 +1784,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
69891 struct address_space *mapping = file->f_mapping;
69892
69893 if (!mapping->a_ops->readpage)
69894- return -ENOEXEC;
69895+ return -ENODEV;
69896 file_accessed(file);
69897 vma->vm_ops = &generic_file_vm_ops;
69898 vma->vm_flags |= VM_CAN_NONLINEAR;
69899@@ -2190,6 +2190,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
69900 *pos = i_size_read(inode);
69901
69902 if (limit != RLIM_INFINITY) {
69903+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
69904 if (*pos >= limit) {
69905 send_sig(SIGXFSZ, current, 0);
69906 return -EFBIG;
69907diff --git a/mm/fremap.c b/mm/fremap.c
69908index b8e0e2d..076e171 100644
69909--- a/mm/fremap.c
69910+++ b/mm/fremap.c
69911@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
69912 retry:
69913 vma = find_vma(mm, start);
69914
69915+#ifdef CONFIG_PAX_SEGMEXEC
69916+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
69917+ goto out;
69918+#endif
69919+
69920 /*
69921 * Make sure the vma is shared, that it supports prefaulting,
69922 * and that the remapped range is valid and fully within
69923diff --git a/mm/highmem.c b/mm/highmem.c
69924index 5ef672c..d7660f4 100644
69925--- a/mm/highmem.c
69926+++ b/mm/highmem.c
69927@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
69928 * So no dangers, even with speculative execution.
69929 */
69930 page = pte_page(pkmap_page_table[i]);
69931+ pax_open_kernel();
69932 pte_clear(&init_mm, (unsigned long)page_address(page),
69933 &pkmap_page_table[i]);
69934-
69935+ pax_close_kernel();
69936 set_page_address(page, NULL);
69937 need_flush = 1;
69938 }
69939@@ -186,9 +187,11 @@ start:
69940 }
69941 }
69942 vaddr = PKMAP_ADDR(last_pkmap_nr);
69943+
69944+ pax_open_kernel();
69945 set_pte_at(&init_mm, vaddr,
69946 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
69947-
69948+ pax_close_kernel();
69949 pkmap_count[last_pkmap_nr] = 1;
69950 set_page_address(page, (void *)vaddr);
69951
69952diff --git a/mm/huge_memory.c b/mm/huge_memory.c
69953index d819d93..468e18f 100644
69954--- a/mm/huge_memory.c
69955+++ b/mm/huge_memory.c
69956@@ -702,7 +702,7 @@ out:
69957 * run pte_offset_map on the pmd, if an huge pmd could
69958 * materialize from under us from a different thread.
69959 */
69960- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
69961+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
69962 return VM_FAULT_OOM;
69963 /* if an huge pmd materialized from under us just retry later */
69964 if (unlikely(pmd_trans_huge(*pmd)))
69965@@ -829,7 +829,7 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
69966
69967 for (i = 0; i < HPAGE_PMD_NR; i++) {
69968 copy_user_highpage(pages[i], page + i,
69969- haddr + PAGE_SHIFT*i, vma);
69970+ haddr + PAGE_SIZE*i, vma);
69971 __SetPageUptodate(pages[i]);
69972 cond_resched();
69973 }
69974diff --git a/mm/hugetlb.c b/mm/hugetlb.c
69975index 73f17c0..fef0140 100644
69976--- a/mm/hugetlb.c
69977+++ b/mm/hugetlb.c
69978@@ -2347,6 +2347,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
69979 return 1;
69980 }
69981
69982+#ifdef CONFIG_PAX_SEGMEXEC
69983+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
69984+{
69985+ struct mm_struct *mm = vma->vm_mm;
69986+ struct vm_area_struct *vma_m;
69987+ unsigned long address_m;
69988+ pte_t *ptep_m;
69989+
69990+ vma_m = pax_find_mirror_vma(vma);
69991+ if (!vma_m)
69992+ return;
69993+
69994+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
69995+ address_m = address + SEGMEXEC_TASK_SIZE;
69996+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
69997+ get_page(page_m);
69998+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
69999+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
70000+}
70001+#endif
70002+
70003 /*
70004 * Hugetlb_cow() should be called with page lock of the original hugepage held.
70005 */
70006@@ -2450,6 +2471,11 @@ retry_avoidcopy:
70007 make_huge_pte(vma, new_page, 1));
70008 page_remove_rmap(old_page);
70009 hugepage_add_new_anon_rmap(new_page, vma, address);
70010+
70011+#ifdef CONFIG_PAX_SEGMEXEC
70012+ pax_mirror_huge_pte(vma, address, new_page);
70013+#endif
70014+
70015 /* Make the old page be freed below */
70016 new_page = old_page;
70017 mmu_notifier_invalidate_range_end(mm,
70018@@ -2601,6 +2627,10 @@ retry:
70019 && (vma->vm_flags & VM_SHARED)));
70020 set_huge_pte_at(mm, address, ptep, new_pte);
70021
70022+#ifdef CONFIG_PAX_SEGMEXEC
70023+ pax_mirror_huge_pte(vma, address, page);
70024+#endif
70025+
70026 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
70027 /* Optimization, do the COW without a second fault */
70028 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
70029@@ -2630,6 +2660,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70030 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
70031 struct hstate *h = hstate_vma(vma);
70032
70033+#ifdef CONFIG_PAX_SEGMEXEC
70034+ struct vm_area_struct *vma_m;
70035+#endif
70036+
70037 ptep = huge_pte_offset(mm, address);
70038 if (ptep) {
70039 entry = huge_ptep_get(ptep);
70040@@ -2641,6 +2675,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70041 VM_FAULT_SET_HINDEX(h - hstates);
70042 }
70043
70044+#ifdef CONFIG_PAX_SEGMEXEC
70045+ vma_m = pax_find_mirror_vma(vma);
70046+ if (vma_m) {
70047+ unsigned long address_m;
70048+
70049+ if (vma->vm_start > vma_m->vm_start) {
70050+ address_m = address;
70051+ address -= SEGMEXEC_TASK_SIZE;
70052+ vma = vma_m;
70053+ h = hstate_vma(vma);
70054+ } else
70055+ address_m = address + SEGMEXEC_TASK_SIZE;
70056+
70057+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
70058+ return VM_FAULT_OOM;
70059+ address_m &= HPAGE_MASK;
70060+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
70061+ }
70062+#endif
70063+
70064 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
70065 if (!ptep)
70066 return VM_FAULT_OOM;
70067diff --git a/mm/internal.h b/mm/internal.h
70068index 2189af4..f2ca332 100644
70069--- a/mm/internal.h
70070+++ b/mm/internal.h
70071@@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page);
70072 * in mm/page_alloc.c
70073 */
70074 extern void __free_pages_bootmem(struct page *page, unsigned int order);
70075+extern void free_compound_page(struct page *page);
70076 extern void prep_compound_page(struct page *page, unsigned long order);
70077 #ifdef CONFIG_MEMORY_FAILURE
70078 extern bool is_free_buddy_page(struct page *page);
70079diff --git a/mm/kmemleak.c b/mm/kmemleak.c
70080index d6880f5..ed77913 100644
70081--- a/mm/kmemleak.c
70082+++ b/mm/kmemleak.c
70083@@ -357,7 +357,7 @@ static void print_unreferenced(struct seq_file *seq,
70084
70085 for (i = 0; i < object->trace_len; i++) {
70086 void *ptr = (void *)object->trace[i];
70087- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
70088+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
70089 }
70090 }
70091
70092diff --git a/mm/maccess.c b/mm/maccess.c
70093index 4cee182..e00511d 100644
70094--- a/mm/maccess.c
70095+++ b/mm/maccess.c
70096@@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
70097 set_fs(KERNEL_DS);
70098 pagefault_disable();
70099 ret = __copy_from_user_inatomic(dst,
70100- (__force const void __user *)src, size);
70101+ (const void __force_user *)src, size);
70102 pagefault_enable();
70103 set_fs(old_fs);
70104
70105@@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
70106
70107 set_fs(KERNEL_DS);
70108 pagefault_disable();
70109- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
70110+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
70111 pagefault_enable();
70112 set_fs(old_fs);
70113
70114diff --git a/mm/madvise.c b/mm/madvise.c
70115index 74bf193..feb6fd3 100644
70116--- a/mm/madvise.c
70117+++ b/mm/madvise.c
70118@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
70119 pgoff_t pgoff;
70120 unsigned long new_flags = vma->vm_flags;
70121
70122+#ifdef CONFIG_PAX_SEGMEXEC
70123+ struct vm_area_struct *vma_m;
70124+#endif
70125+
70126 switch (behavior) {
70127 case MADV_NORMAL:
70128 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
70129@@ -110,6 +114,13 @@ success:
70130 /*
70131 * vm_flags is protected by the mmap_sem held in write mode.
70132 */
70133+
70134+#ifdef CONFIG_PAX_SEGMEXEC
70135+ vma_m = pax_find_mirror_vma(vma);
70136+ if (vma_m)
70137+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
70138+#endif
70139+
70140 vma->vm_flags = new_flags;
70141
70142 out:
70143@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
70144 struct vm_area_struct ** prev,
70145 unsigned long start, unsigned long end)
70146 {
70147+
70148+#ifdef CONFIG_PAX_SEGMEXEC
70149+ struct vm_area_struct *vma_m;
70150+#endif
70151+
70152 *prev = vma;
70153 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
70154 return -EINVAL;
70155@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
70156 zap_page_range(vma, start, end - start, &details);
70157 } else
70158 zap_page_range(vma, start, end - start, NULL);
70159+
70160+#ifdef CONFIG_PAX_SEGMEXEC
70161+ vma_m = pax_find_mirror_vma(vma);
70162+ if (vma_m) {
70163+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
70164+ struct zap_details details = {
70165+ .nonlinear_vma = vma_m,
70166+ .last_index = ULONG_MAX,
70167+ };
70168+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
70169+ } else
70170+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
70171+ }
70172+#endif
70173+
70174 return 0;
70175 }
70176
70177@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
70178 if (end < start)
70179 goto out;
70180
70181+#ifdef CONFIG_PAX_SEGMEXEC
70182+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
70183+ if (end > SEGMEXEC_TASK_SIZE)
70184+ goto out;
70185+ } else
70186+#endif
70187+
70188+ if (end > TASK_SIZE)
70189+ goto out;
70190+
70191 error = 0;
70192 if (end == start)
70193 goto out;
70194diff --git a/mm/memory-failure.c b/mm/memory-failure.c
70195index 2b43ba0..fc09657 100644
70196--- a/mm/memory-failure.c
70197+++ b/mm/memory-failure.c
70198@@ -60,7 +60,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
70199
70200 int sysctl_memory_failure_recovery __read_mostly = 1;
70201
70202-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70203+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70204
70205 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
70206
70207@@ -201,7 +201,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
70208 si.si_signo = SIGBUS;
70209 si.si_errno = 0;
70210 si.si_code = BUS_MCEERR_AO;
70211- si.si_addr = (void *)addr;
70212+ si.si_addr = (void __user *)addr;
70213 #ifdef __ARCH_SI_TRAPNO
70214 si.si_trapno = trapno;
70215 #endif
70216@@ -1009,7 +1009,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70217 }
70218
70219 nr_pages = 1 << compound_trans_order(hpage);
70220- atomic_long_add(nr_pages, &mce_bad_pages);
70221+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
70222
70223 /*
70224 * We need/can do nothing about count=0 pages.
70225@@ -1039,7 +1039,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70226 if (!PageHWPoison(hpage)
70227 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
70228 || (p != hpage && TestSetPageHWPoison(hpage))) {
70229- atomic_long_sub(nr_pages, &mce_bad_pages);
70230+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70231 return 0;
70232 }
70233 set_page_hwpoison_huge_page(hpage);
70234@@ -1097,7 +1097,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70235 }
70236 if (hwpoison_filter(p)) {
70237 if (TestClearPageHWPoison(p))
70238- atomic_long_sub(nr_pages, &mce_bad_pages);
70239+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70240 unlock_page(hpage);
70241 put_page(hpage);
70242 return 0;
70243@@ -1314,7 +1314,7 @@ int unpoison_memory(unsigned long pfn)
70244 return 0;
70245 }
70246 if (TestClearPageHWPoison(p))
70247- atomic_long_sub(nr_pages, &mce_bad_pages);
70248+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70249 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
70250 return 0;
70251 }
70252@@ -1328,7 +1328,7 @@ int unpoison_memory(unsigned long pfn)
70253 */
70254 if (TestClearPageHWPoison(page)) {
70255 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
70256- atomic_long_sub(nr_pages, &mce_bad_pages);
70257+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70258 freeit = 1;
70259 if (PageHuge(page))
70260 clear_page_hwpoison_huge_page(page);
70261@@ -1441,7 +1441,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
70262 }
70263 done:
70264 if (!PageHWPoison(hpage))
70265- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
70266+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
70267 set_page_hwpoison_huge_page(hpage);
70268 dequeue_hwpoisoned_huge_page(hpage);
70269 /* keep elevated page count for bad page */
70270@@ -1572,7 +1572,7 @@ int soft_offline_page(struct page *page, int flags)
70271 return ret;
70272
70273 done:
70274- atomic_long_add(1, &mce_bad_pages);
70275+ atomic_long_add_unchecked(1, &mce_bad_pages);
70276 SetPageHWPoison(page);
70277 /* keep elevated page count for bad page */
70278 return ret;
70279diff --git a/mm/memory.c b/mm/memory.c
70280index b2b8731..6080174 100644
70281--- a/mm/memory.c
70282+++ b/mm/memory.c
70283@@ -457,8 +457,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
70284 return;
70285
70286 pmd = pmd_offset(pud, start);
70287+
70288+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
70289 pud_clear(pud);
70290 pmd_free_tlb(tlb, pmd, start);
70291+#endif
70292+
70293 }
70294
70295 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70296@@ -489,9 +493,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70297 if (end - 1 > ceiling - 1)
70298 return;
70299
70300+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
70301 pud = pud_offset(pgd, start);
70302 pgd_clear(pgd);
70303 pud_free_tlb(tlb, pud, start);
70304+#endif
70305+
70306 }
70307
70308 /*
70309@@ -1566,12 +1573,6 @@ no_page_table:
70310 return page;
70311 }
70312
70313-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
70314-{
70315- return stack_guard_page_start(vma, addr) ||
70316- stack_guard_page_end(vma, addr+PAGE_SIZE);
70317-}
70318-
70319 /**
70320 * __get_user_pages() - pin user pages in memory
70321 * @tsk: task_struct of target task
70322@@ -1644,10 +1645,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70323 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
70324 i = 0;
70325
70326- do {
70327+ while (nr_pages) {
70328 struct vm_area_struct *vma;
70329
70330- vma = find_extend_vma(mm, start);
70331+ vma = find_vma(mm, start);
70332 if (!vma && in_gate_area(mm, start)) {
70333 unsigned long pg = start & PAGE_MASK;
70334 pgd_t *pgd;
70335@@ -1695,7 +1696,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70336 goto next_page;
70337 }
70338
70339- if (!vma ||
70340+ if (!vma || start < vma->vm_start ||
70341 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
70342 !(vm_flags & vma->vm_flags))
70343 return i ? : -EFAULT;
70344@@ -1722,11 +1723,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70345 int ret;
70346 unsigned int fault_flags = 0;
70347
70348- /* For mlock, just skip the stack guard page. */
70349- if (foll_flags & FOLL_MLOCK) {
70350- if (stack_guard_page(vma, start))
70351- goto next_page;
70352- }
70353 if (foll_flags & FOLL_WRITE)
70354 fault_flags |= FAULT_FLAG_WRITE;
70355 if (nonblocking)
70356@@ -1800,7 +1796,7 @@ next_page:
70357 start += PAGE_SIZE;
70358 nr_pages--;
70359 } while (nr_pages && start < vma->vm_end);
70360- } while (nr_pages);
70361+ }
70362 return i;
70363 }
70364 EXPORT_SYMBOL(__get_user_pages);
70365@@ -2007,6 +2003,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
70366 page_add_file_rmap(page);
70367 set_pte_at(mm, addr, pte, mk_pte(page, prot));
70368
70369+#ifdef CONFIG_PAX_SEGMEXEC
70370+ pax_mirror_file_pte(vma, addr, page, ptl);
70371+#endif
70372+
70373 retval = 0;
70374 pte_unmap_unlock(pte, ptl);
70375 return retval;
70376@@ -2041,10 +2041,22 @@ out:
70377 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
70378 struct page *page)
70379 {
70380+
70381+#ifdef CONFIG_PAX_SEGMEXEC
70382+ struct vm_area_struct *vma_m;
70383+#endif
70384+
70385 if (addr < vma->vm_start || addr >= vma->vm_end)
70386 return -EFAULT;
70387 if (!page_count(page))
70388 return -EINVAL;
70389+
70390+#ifdef CONFIG_PAX_SEGMEXEC
70391+ vma_m = pax_find_mirror_vma(vma);
70392+ if (vma_m)
70393+ vma_m->vm_flags |= VM_INSERTPAGE;
70394+#endif
70395+
70396 vma->vm_flags |= VM_INSERTPAGE;
70397 return insert_page(vma, addr, page, vma->vm_page_prot);
70398 }
70399@@ -2130,6 +2142,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
70400 unsigned long pfn)
70401 {
70402 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
70403+ BUG_ON(vma->vm_mirror);
70404
70405 if (addr < vma->vm_start || addr >= vma->vm_end)
70406 return -EFAULT;
70407@@ -2445,6 +2458,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
70408 copy_user_highpage(dst, src, va, vma);
70409 }
70410
70411+#ifdef CONFIG_PAX_SEGMEXEC
70412+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
70413+{
70414+ struct mm_struct *mm = vma->vm_mm;
70415+ spinlock_t *ptl;
70416+ pte_t *pte, entry;
70417+
70418+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
70419+ entry = *pte;
70420+ if (!pte_present(entry)) {
70421+ if (!pte_none(entry)) {
70422+ BUG_ON(pte_file(entry));
70423+ free_swap_and_cache(pte_to_swp_entry(entry));
70424+ pte_clear_not_present_full(mm, address, pte, 0);
70425+ }
70426+ } else {
70427+ struct page *page;
70428+
70429+ flush_cache_page(vma, address, pte_pfn(entry));
70430+ entry = ptep_clear_flush(vma, address, pte);
70431+ BUG_ON(pte_dirty(entry));
70432+ page = vm_normal_page(vma, address, entry);
70433+ if (page) {
70434+ update_hiwater_rss(mm);
70435+ if (PageAnon(page))
70436+ dec_mm_counter_fast(mm, MM_ANONPAGES);
70437+ else
70438+ dec_mm_counter_fast(mm, MM_FILEPAGES);
70439+ page_remove_rmap(page);
70440+ page_cache_release(page);
70441+ }
70442+ }
70443+ pte_unmap_unlock(pte, ptl);
70444+}
70445+
70446+/* PaX: if vma is mirrored, synchronize the mirror's PTE
70447+ *
70448+ * the ptl of the lower mapped page is held on entry and is not released on exit
70449+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
70450+ */
70451+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70452+{
70453+ struct mm_struct *mm = vma->vm_mm;
70454+ unsigned long address_m;
70455+ spinlock_t *ptl_m;
70456+ struct vm_area_struct *vma_m;
70457+ pmd_t *pmd_m;
70458+ pte_t *pte_m, entry_m;
70459+
70460+ BUG_ON(!page_m || !PageAnon(page_m));
70461+
70462+ vma_m = pax_find_mirror_vma(vma);
70463+ if (!vma_m)
70464+ return;
70465+
70466+ BUG_ON(!PageLocked(page_m));
70467+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70468+ address_m = address + SEGMEXEC_TASK_SIZE;
70469+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70470+ pte_m = pte_offset_map(pmd_m, address_m);
70471+ ptl_m = pte_lockptr(mm, pmd_m);
70472+ if (ptl != ptl_m) {
70473+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70474+ if (!pte_none(*pte_m))
70475+ goto out;
70476+ }
70477+
70478+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70479+ page_cache_get(page_m);
70480+ page_add_anon_rmap(page_m, vma_m, address_m);
70481+ inc_mm_counter_fast(mm, MM_ANONPAGES);
70482+ set_pte_at(mm, address_m, pte_m, entry_m);
70483+ update_mmu_cache(vma_m, address_m, entry_m);
70484+out:
70485+ if (ptl != ptl_m)
70486+ spin_unlock(ptl_m);
70487+ pte_unmap(pte_m);
70488+ unlock_page(page_m);
70489+}
70490+
70491+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70492+{
70493+ struct mm_struct *mm = vma->vm_mm;
70494+ unsigned long address_m;
70495+ spinlock_t *ptl_m;
70496+ struct vm_area_struct *vma_m;
70497+ pmd_t *pmd_m;
70498+ pte_t *pte_m, entry_m;
70499+
70500+ BUG_ON(!page_m || PageAnon(page_m));
70501+
70502+ vma_m = pax_find_mirror_vma(vma);
70503+ if (!vma_m)
70504+ return;
70505+
70506+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70507+ address_m = address + SEGMEXEC_TASK_SIZE;
70508+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70509+ pte_m = pte_offset_map(pmd_m, address_m);
70510+ ptl_m = pte_lockptr(mm, pmd_m);
70511+ if (ptl != ptl_m) {
70512+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70513+ if (!pte_none(*pte_m))
70514+ goto out;
70515+ }
70516+
70517+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70518+ page_cache_get(page_m);
70519+ page_add_file_rmap(page_m);
70520+ inc_mm_counter_fast(mm, MM_FILEPAGES);
70521+ set_pte_at(mm, address_m, pte_m, entry_m);
70522+ update_mmu_cache(vma_m, address_m, entry_m);
70523+out:
70524+ if (ptl != ptl_m)
70525+ spin_unlock(ptl_m);
70526+ pte_unmap(pte_m);
70527+}
70528+
70529+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
70530+{
70531+ struct mm_struct *mm = vma->vm_mm;
70532+ unsigned long address_m;
70533+ spinlock_t *ptl_m;
70534+ struct vm_area_struct *vma_m;
70535+ pmd_t *pmd_m;
70536+ pte_t *pte_m, entry_m;
70537+
70538+ vma_m = pax_find_mirror_vma(vma);
70539+ if (!vma_m)
70540+ return;
70541+
70542+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70543+ address_m = address + SEGMEXEC_TASK_SIZE;
70544+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70545+ pte_m = pte_offset_map(pmd_m, address_m);
70546+ ptl_m = pte_lockptr(mm, pmd_m);
70547+ if (ptl != ptl_m) {
70548+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70549+ if (!pte_none(*pte_m))
70550+ goto out;
70551+ }
70552+
70553+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
70554+ set_pte_at(mm, address_m, pte_m, entry_m);
70555+out:
70556+ if (ptl != ptl_m)
70557+ spin_unlock(ptl_m);
70558+ pte_unmap(pte_m);
70559+}
70560+
70561+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
70562+{
70563+ struct page *page_m;
70564+ pte_t entry;
70565+
70566+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
70567+ goto out;
70568+
70569+ entry = *pte;
70570+ page_m = vm_normal_page(vma, address, entry);
70571+ if (!page_m)
70572+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
70573+ else if (PageAnon(page_m)) {
70574+ if (pax_find_mirror_vma(vma)) {
70575+ pte_unmap_unlock(pte, ptl);
70576+ lock_page(page_m);
70577+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
70578+ if (pte_same(entry, *pte))
70579+ pax_mirror_anon_pte(vma, address, page_m, ptl);
70580+ else
70581+ unlock_page(page_m);
70582+ }
70583+ } else
70584+ pax_mirror_file_pte(vma, address, page_m, ptl);
70585+
70586+out:
70587+ pte_unmap_unlock(pte, ptl);
70588+}
70589+#endif
70590+
70591 /*
70592 * This routine handles present pages, when users try to write
70593 * to a shared page. It is done by copying the page to a new address
70594@@ -2656,6 +2849,12 @@ gotten:
70595 */
70596 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70597 if (likely(pte_same(*page_table, orig_pte))) {
70598+
70599+#ifdef CONFIG_PAX_SEGMEXEC
70600+ if (pax_find_mirror_vma(vma))
70601+ BUG_ON(!trylock_page(new_page));
70602+#endif
70603+
70604 if (old_page) {
70605 if (!PageAnon(old_page)) {
70606 dec_mm_counter_fast(mm, MM_FILEPAGES);
70607@@ -2707,6 +2906,10 @@ gotten:
70608 page_remove_rmap(old_page);
70609 }
70610
70611+#ifdef CONFIG_PAX_SEGMEXEC
70612+ pax_mirror_anon_pte(vma, address, new_page, ptl);
70613+#endif
70614+
70615 /* Free the old page.. */
70616 new_page = old_page;
70617 ret |= VM_FAULT_WRITE;
70618@@ -2986,6 +3189,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
70619 swap_free(entry);
70620 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
70621 try_to_free_swap(page);
70622+
70623+#ifdef CONFIG_PAX_SEGMEXEC
70624+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
70625+#endif
70626+
70627 unlock_page(page);
70628 if (swapcache) {
70629 /*
70630@@ -3009,6 +3217,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
70631
70632 /* No need to invalidate - it was non-present before */
70633 update_mmu_cache(vma, address, page_table);
70634+
70635+#ifdef CONFIG_PAX_SEGMEXEC
70636+ pax_mirror_anon_pte(vma, address, page, ptl);
70637+#endif
70638+
70639 unlock:
70640 pte_unmap_unlock(page_table, ptl);
70641 out:
70642@@ -3028,40 +3241,6 @@ out_release:
70643 }
70644
70645 /*
70646- * This is like a special single-page "expand_{down|up}wards()",
70647- * except we must first make sure that 'address{-|+}PAGE_SIZE'
70648- * doesn't hit another vma.
70649- */
70650-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
70651-{
70652- address &= PAGE_MASK;
70653- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
70654- struct vm_area_struct *prev = vma->vm_prev;
70655-
70656- /*
70657- * Is there a mapping abutting this one below?
70658- *
70659- * That's only ok if it's the same stack mapping
70660- * that has gotten split..
70661- */
70662- if (prev && prev->vm_end == address)
70663- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
70664-
70665- expand_downwards(vma, address - PAGE_SIZE);
70666- }
70667- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
70668- struct vm_area_struct *next = vma->vm_next;
70669-
70670- /* As VM_GROWSDOWN but s/below/above/ */
70671- if (next && next->vm_start == address + PAGE_SIZE)
70672- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
70673-
70674- expand_upwards(vma, address + PAGE_SIZE);
70675- }
70676- return 0;
70677-}
70678-
70679-/*
70680 * We enter with non-exclusive mmap_sem (to exclude vma changes,
70681 * but allow concurrent faults), and pte mapped but not yet locked.
70682 * We return with mmap_sem still held, but pte unmapped and unlocked.
70683@@ -3070,27 +3249,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
70684 unsigned long address, pte_t *page_table, pmd_t *pmd,
70685 unsigned int flags)
70686 {
70687- struct page *page;
70688+ struct page *page = NULL;
70689 spinlock_t *ptl;
70690 pte_t entry;
70691
70692- pte_unmap(page_table);
70693-
70694- /* Check if we need to add a guard page to the stack */
70695- if (check_stack_guard_page(vma, address) < 0)
70696- return VM_FAULT_SIGBUS;
70697-
70698- /* Use the zero-page for reads */
70699 if (!(flags & FAULT_FLAG_WRITE)) {
70700 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
70701 vma->vm_page_prot));
70702- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70703+ ptl = pte_lockptr(mm, pmd);
70704+ spin_lock(ptl);
70705 if (!pte_none(*page_table))
70706 goto unlock;
70707 goto setpte;
70708 }
70709
70710 /* Allocate our own private page. */
70711+ pte_unmap(page_table);
70712+
70713 if (unlikely(anon_vma_prepare(vma)))
70714 goto oom;
70715 page = alloc_zeroed_user_highpage_movable(vma, address);
70716@@ -3109,6 +3284,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
70717 if (!pte_none(*page_table))
70718 goto release;
70719
70720+#ifdef CONFIG_PAX_SEGMEXEC
70721+ if (pax_find_mirror_vma(vma))
70722+ BUG_ON(!trylock_page(page));
70723+#endif
70724+
70725 inc_mm_counter_fast(mm, MM_ANONPAGES);
70726 page_add_new_anon_rmap(page, vma, address);
70727 setpte:
70728@@ -3116,6 +3296,12 @@ setpte:
70729
70730 /* No need to invalidate - it was non-present before */
70731 update_mmu_cache(vma, address, page_table);
70732+
70733+#ifdef CONFIG_PAX_SEGMEXEC
70734+ if (page)
70735+ pax_mirror_anon_pte(vma, address, page, ptl);
70736+#endif
70737+
70738 unlock:
70739 pte_unmap_unlock(page_table, ptl);
70740 return 0;
70741@@ -3259,6 +3445,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70742 */
70743 /* Only go through if we didn't race with anybody else... */
70744 if (likely(pte_same(*page_table, orig_pte))) {
70745+
70746+#ifdef CONFIG_PAX_SEGMEXEC
70747+ if (anon && pax_find_mirror_vma(vma))
70748+ BUG_ON(!trylock_page(page));
70749+#endif
70750+
70751 flush_icache_page(vma, page);
70752 entry = mk_pte(page, vma->vm_page_prot);
70753 if (flags & FAULT_FLAG_WRITE)
70754@@ -3278,6 +3470,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70755
70756 /* no need to invalidate: a not-present page won't be cached */
70757 update_mmu_cache(vma, address, page_table);
70758+
70759+#ifdef CONFIG_PAX_SEGMEXEC
70760+ if (anon)
70761+ pax_mirror_anon_pte(vma, address, page, ptl);
70762+ else
70763+ pax_mirror_file_pte(vma, address, page, ptl);
70764+#endif
70765+
70766 } else {
70767 if (cow_page)
70768 mem_cgroup_uncharge_page(cow_page);
70769@@ -3431,6 +3631,12 @@ int handle_pte_fault(struct mm_struct *mm,
70770 if (flags & FAULT_FLAG_WRITE)
70771 flush_tlb_fix_spurious_fault(vma, address);
70772 }
70773+
70774+#ifdef CONFIG_PAX_SEGMEXEC
70775+ pax_mirror_pte(vma, address, pte, pmd, ptl);
70776+ return 0;
70777+#endif
70778+
70779 unlock:
70780 pte_unmap_unlock(pte, ptl);
70781 return 0;
70782@@ -3447,6 +3653,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70783 pmd_t *pmd;
70784 pte_t *pte;
70785
70786+#ifdef CONFIG_PAX_SEGMEXEC
70787+ struct vm_area_struct *vma_m;
70788+#endif
70789+
70790 __set_current_state(TASK_RUNNING);
70791
70792 count_vm_event(PGFAULT);
70793@@ -3458,6 +3668,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70794 if (unlikely(is_vm_hugetlb_page(vma)))
70795 return hugetlb_fault(mm, vma, address, flags);
70796
70797+#ifdef CONFIG_PAX_SEGMEXEC
70798+ vma_m = pax_find_mirror_vma(vma);
70799+ if (vma_m) {
70800+ unsigned long address_m;
70801+ pgd_t *pgd_m;
70802+ pud_t *pud_m;
70803+ pmd_t *pmd_m;
70804+
70805+ if (vma->vm_start > vma_m->vm_start) {
70806+ address_m = address;
70807+ address -= SEGMEXEC_TASK_SIZE;
70808+ vma = vma_m;
70809+ } else
70810+ address_m = address + SEGMEXEC_TASK_SIZE;
70811+
70812+ pgd_m = pgd_offset(mm, address_m);
70813+ pud_m = pud_alloc(mm, pgd_m, address_m);
70814+ if (!pud_m)
70815+ return VM_FAULT_OOM;
70816+ pmd_m = pmd_alloc(mm, pud_m, address_m);
70817+ if (!pmd_m)
70818+ return VM_FAULT_OOM;
70819+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
70820+ return VM_FAULT_OOM;
70821+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
70822+ }
70823+#endif
70824+
70825 pgd = pgd_offset(mm, address);
70826 pud = pud_alloc(mm, pgd, address);
70827 if (!pud)
70828@@ -3487,7 +3725,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70829 * run pte_offset_map on the pmd, if an huge pmd could
70830 * materialize from under us from a different thread.
70831 */
70832- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
70833+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
70834 return VM_FAULT_OOM;
70835 /* if an huge pmd materialized from under us just retry later */
70836 if (unlikely(pmd_trans_huge(*pmd)))
70837@@ -3591,7 +3829,7 @@ static int __init gate_vma_init(void)
70838 gate_vma.vm_start = FIXADDR_USER_START;
70839 gate_vma.vm_end = FIXADDR_USER_END;
70840 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
70841- gate_vma.vm_page_prot = __P101;
70842+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
70843 /*
70844 * Make sure the vDSO gets into every core dump.
70845 * Dumping its contents makes post-mortem fully interpretable later
70846diff --git a/mm/mempolicy.c b/mm/mempolicy.c
70847index 9c51f9f..a9416cf 100644
70848--- a/mm/mempolicy.c
70849+++ b/mm/mempolicy.c
70850@@ -639,6 +639,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
70851 unsigned long vmstart;
70852 unsigned long vmend;
70853
70854+#ifdef CONFIG_PAX_SEGMEXEC
70855+ struct vm_area_struct *vma_m;
70856+#endif
70857+
70858 vma = find_vma_prev(mm, start, &prev);
70859 if (!vma || vma->vm_start > start)
70860 return -EFAULT;
70861@@ -669,6 +673,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
70862 err = policy_vma(vma, new_pol);
70863 if (err)
70864 goto out;
70865+
70866+#ifdef CONFIG_PAX_SEGMEXEC
70867+ vma_m = pax_find_mirror_vma(vma);
70868+ if (vma_m) {
70869+ err = policy_vma(vma_m, new_pol);
70870+ if (err)
70871+ goto out;
70872+ }
70873+#endif
70874+
70875 }
70876
70877 out:
70878@@ -1102,6 +1116,17 @@ static long do_mbind(unsigned long start, unsigned long len,
70879
70880 if (end < start)
70881 return -EINVAL;
70882+
70883+#ifdef CONFIG_PAX_SEGMEXEC
70884+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
70885+ if (end > SEGMEXEC_TASK_SIZE)
70886+ return -EINVAL;
70887+ } else
70888+#endif
70889+
70890+ if (end > TASK_SIZE)
70891+ return -EINVAL;
70892+
70893 if (end == start)
70894 return 0;
70895
70896@@ -1320,6 +1345,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
70897 if (!mm)
70898 goto out;
70899
70900+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
70901+ if (mm != current->mm &&
70902+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
70903+ err = -EPERM;
70904+ goto out;
70905+ }
70906+#endif
70907+
70908 /*
70909 * Check if this process has the right to modify the specified
70910 * process. The right exists if the process has administrative
70911@@ -1329,8 +1362,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
70912 rcu_read_lock();
70913 tcred = __task_cred(task);
70914 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
70915- cred->uid != tcred->suid && cred->uid != tcred->uid &&
70916- !capable(CAP_SYS_NICE)) {
70917+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
70918 rcu_read_unlock();
70919 err = -EPERM;
70920 goto out;
70921diff --git a/mm/migrate.c b/mm/migrate.c
70922index 14d0a6a..0360908 100644
70923--- a/mm/migrate.c
70924+++ b/mm/migrate.c
70925@@ -866,9 +866,9 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
70926
70927 if (anon_vma)
70928 put_anon_vma(anon_vma);
70929-out:
70930 unlock_page(hpage);
70931
70932+out:
70933 if (rc != -EAGAIN) {
70934 list_del(&hpage->lru);
70935 put_page(hpage);
70936@@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
70937 unsigned long chunk_start;
70938 int err;
70939
70940+ pax_track_stack();
70941+
70942 task_nodes = cpuset_mems_allowed(task);
70943
70944 err = -ENOMEM;
70945@@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
70946 if (!mm)
70947 return -EINVAL;
70948
70949+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
70950+ if (mm != current->mm &&
70951+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
70952+ err = -EPERM;
70953+ goto out;
70954+ }
70955+#endif
70956+
70957 /*
70958 * Check if this process has the right to modify the specified
70959 * process. The right exists if the process has administrative
70960@@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
70961 rcu_read_lock();
70962 tcred = __task_cred(task);
70963 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
70964- cred->uid != tcred->suid && cred->uid != tcred->uid &&
70965- !capable(CAP_SYS_NICE)) {
70966+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
70967 rcu_read_unlock();
70968 err = -EPERM;
70969 goto out;
70970diff --git a/mm/mlock.c b/mm/mlock.c
70971index 048260c..57f4a4e 100644
70972--- a/mm/mlock.c
70973+++ b/mm/mlock.c
70974@@ -13,6 +13,7 @@
70975 #include <linux/pagemap.h>
70976 #include <linux/mempolicy.h>
70977 #include <linux/syscalls.h>
70978+#include <linux/security.h>
70979 #include <linux/sched.h>
70980 #include <linux/module.h>
70981 #include <linux/rmap.h>
70982@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
70983 return -EINVAL;
70984 if (end == start)
70985 return 0;
70986+ if (end > TASK_SIZE)
70987+ return -EINVAL;
70988+
70989 vma = find_vma_prev(current->mm, start, &prev);
70990 if (!vma || vma->vm_start > start)
70991 return -ENOMEM;
70992@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
70993 for (nstart = start ; ; ) {
70994 vm_flags_t newflags;
70995
70996+#ifdef CONFIG_PAX_SEGMEXEC
70997+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
70998+ break;
70999+#endif
71000+
71001 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
71002
71003 newflags = vma->vm_flags | VM_LOCKED;
71004@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
71005 lock_limit >>= PAGE_SHIFT;
71006
71007 /* check against resource limits */
71008+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
71009 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
71010 error = do_mlock(start, len, 1);
71011 up_write(&current->mm->mmap_sem);
71012@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
71013 static int do_mlockall(int flags)
71014 {
71015 struct vm_area_struct * vma, * prev = NULL;
71016- unsigned int def_flags = 0;
71017
71018 if (flags & MCL_FUTURE)
71019- def_flags = VM_LOCKED;
71020- current->mm->def_flags = def_flags;
71021+ current->mm->def_flags |= VM_LOCKED;
71022+ else
71023+ current->mm->def_flags &= ~VM_LOCKED;
71024 if (flags == MCL_FUTURE)
71025 goto out;
71026
71027 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
71028 vm_flags_t newflags;
71029
71030+#ifdef CONFIG_PAX_SEGMEXEC
71031+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71032+ break;
71033+#endif
71034+
71035+ BUG_ON(vma->vm_end > TASK_SIZE);
71036 newflags = vma->vm_flags | VM_LOCKED;
71037 if (!(flags & MCL_CURRENT))
71038 newflags &= ~VM_LOCKED;
71039@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
71040 lock_limit >>= PAGE_SHIFT;
71041
71042 ret = -ENOMEM;
71043+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
71044 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
71045 capable(CAP_IPC_LOCK))
71046 ret = do_mlockall(flags);
71047diff --git a/mm/mmap.c b/mm/mmap.c
71048index a65efd4..17d61ff 100644
71049--- a/mm/mmap.c
71050+++ b/mm/mmap.c
71051@@ -46,6 +46,16 @@
71052 #define arch_rebalance_pgtables(addr, len) (addr)
71053 #endif
71054
71055+static inline void verify_mm_writelocked(struct mm_struct *mm)
71056+{
71057+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
71058+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
71059+ up_read(&mm->mmap_sem);
71060+ BUG();
71061+ }
71062+#endif
71063+}
71064+
71065 static void unmap_region(struct mm_struct *mm,
71066 struct vm_area_struct *vma, struct vm_area_struct *prev,
71067 unsigned long start, unsigned long end);
71068@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struct *mm,
71069 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
71070 *
71071 */
71072-pgprot_t protection_map[16] = {
71073+pgprot_t protection_map[16] __read_only = {
71074 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
71075 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
71076 };
71077
71078-pgprot_t vm_get_page_prot(unsigned long vm_flags)
71079+pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
71080 {
71081- return __pgprot(pgprot_val(protection_map[vm_flags &
71082+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
71083 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
71084 pgprot_val(arch_vm_get_page_prot(vm_flags)));
71085+
71086+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71087+ if (!(__supported_pte_mask & _PAGE_NX) &&
71088+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
71089+ (vm_flags & (VM_READ | VM_WRITE)))
71090+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
71091+#endif
71092+
71093+ return prot;
71094 }
71095 EXPORT_SYMBOL(vm_get_page_prot);
71096
71097 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
71098 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
71099 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
71100+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
71101 /*
71102 * Make sure vm_committed_as in one cacheline and not cacheline shared with
71103 * other variables. It can be updated by several CPUs frequently.
71104@@ -228,6 +248,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
71105 struct vm_area_struct *next = vma->vm_next;
71106
71107 might_sleep();
71108+ BUG_ON(vma->vm_mirror);
71109 if (vma->vm_ops && vma->vm_ops->close)
71110 vma->vm_ops->close(vma);
71111 if (vma->vm_file) {
71112@@ -272,6 +293,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
71113 * not page aligned -Ram Gupta
71114 */
71115 rlim = rlimit(RLIMIT_DATA);
71116+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
71117 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
71118 (mm->end_data - mm->start_data) > rlim)
71119 goto out;
71120@@ -689,6 +711,12 @@ static int
71121 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
71122 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
71123 {
71124+
71125+#ifdef CONFIG_PAX_SEGMEXEC
71126+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
71127+ return 0;
71128+#endif
71129+
71130 if (is_mergeable_vma(vma, file, vm_flags) &&
71131 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
71132 if (vma->vm_pgoff == vm_pgoff)
71133@@ -708,6 +736,12 @@ static int
71134 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
71135 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
71136 {
71137+
71138+#ifdef CONFIG_PAX_SEGMEXEC
71139+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
71140+ return 0;
71141+#endif
71142+
71143 if (is_mergeable_vma(vma, file, vm_flags) &&
71144 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
71145 pgoff_t vm_pglen;
71146@@ -750,13 +784,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
71147 struct vm_area_struct *vma_merge(struct mm_struct *mm,
71148 struct vm_area_struct *prev, unsigned long addr,
71149 unsigned long end, unsigned long vm_flags,
71150- struct anon_vma *anon_vma, struct file *file,
71151+ struct anon_vma *anon_vma, struct file *file,
71152 pgoff_t pgoff, struct mempolicy *policy)
71153 {
71154 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
71155 struct vm_area_struct *area, *next;
71156 int err;
71157
71158+#ifdef CONFIG_PAX_SEGMEXEC
71159+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
71160+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
71161+
71162+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
71163+#endif
71164+
71165 /*
71166 * We later require that vma->vm_flags == vm_flags,
71167 * so this tests vma->vm_flags & VM_SPECIAL, too.
71168@@ -772,6 +813,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71169 if (next && next->vm_end == end) /* cases 6, 7, 8 */
71170 next = next->vm_next;
71171
71172+#ifdef CONFIG_PAX_SEGMEXEC
71173+ if (prev)
71174+ prev_m = pax_find_mirror_vma(prev);
71175+ if (area)
71176+ area_m = pax_find_mirror_vma(area);
71177+ if (next)
71178+ next_m = pax_find_mirror_vma(next);
71179+#endif
71180+
71181 /*
71182 * Can it merge with the predecessor?
71183 */
71184@@ -791,9 +841,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71185 /* cases 1, 6 */
71186 err = vma_adjust(prev, prev->vm_start,
71187 next->vm_end, prev->vm_pgoff, NULL);
71188- } else /* cases 2, 5, 7 */
71189+
71190+#ifdef CONFIG_PAX_SEGMEXEC
71191+ if (!err && prev_m)
71192+ err = vma_adjust(prev_m, prev_m->vm_start,
71193+ next_m->vm_end, prev_m->vm_pgoff, NULL);
71194+#endif
71195+
71196+ } else { /* cases 2, 5, 7 */
71197 err = vma_adjust(prev, prev->vm_start,
71198 end, prev->vm_pgoff, NULL);
71199+
71200+#ifdef CONFIG_PAX_SEGMEXEC
71201+ if (!err && prev_m)
71202+ err = vma_adjust(prev_m, prev_m->vm_start,
71203+ end_m, prev_m->vm_pgoff, NULL);
71204+#endif
71205+
71206+ }
71207 if (err)
71208 return NULL;
71209 khugepaged_enter_vma_merge(prev);
71210@@ -807,12 +872,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71211 mpol_equal(policy, vma_policy(next)) &&
71212 can_vma_merge_before(next, vm_flags,
71213 anon_vma, file, pgoff+pglen)) {
71214- if (prev && addr < prev->vm_end) /* case 4 */
71215+ if (prev && addr < prev->vm_end) { /* case 4 */
71216 err = vma_adjust(prev, prev->vm_start,
71217 addr, prev->vm_pgoff, NULL);
71218- else /* cases 3, 8 */
71219+
71220+#ifdef CONFIG_PAX_SEGMEXEC
71221+ if (!err && prev_m)
71222+ err = vma_adjust(prev_m, prev_m->vm_start,
71223+ addr_m, prev_m->vm_pgoff, NULL);
71224+#endif
71225+
71226+ } else { /* cases 3, 8 */
71227 err = vma_adjust(area, addr, next->vm_end,
71228 next->vm_pgoff - pglen, NULL);
71229+
71230+#ifdef CONFIG_PAX_SEGMEXEC
71231+ if (!err && area_m)
71232+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
71233+ next_m->vm_pgoff - pglen, NULL);
71234+#endif
71235+
71236+ }
71237 if (err)
71238 return NULL;
71239 khugepaged_enter_vma_merge(area);
71240@@ -921,14 +1001,11 @@ none:
71241 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
71242 struct file *file, long pages)
71243 {
71244- const unsigned long stack_flags
71245- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
71246-
71247 if (file) {
71248 mm->shared_vm += pages;
71249 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
71250 mm->exec_vm += pages;
71251- } else if (flags & stack_flags)
71252+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
71253 mm->stack_vm += pages;
71254 if (flags & (VM_RESERVED|VM_IO))
71255 mm->reserved_vm += pages;
71256@@ -955,7 +1032,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71257 * (the exception is when the underlying filesystem is noexec
71258 * mounted, in which case we dont add PROT_EXEC.)
71259 */
71260- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
71261+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
71262 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
71263 prot |= PROT_EXEC;
71264
71265@@ -981,7 +1058,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71266 /* Obtain the address to map to. we verify (or select) it and ensure
71267 * that it represents a valid section of the address space.
71268 */
71269- addr = get_unmapped_area(file, addr, len, pgoff, flags);
71270+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
71271 if (addr & ~PAGE_MASK)
71272 return addr;
71273
71274@@ -992,6 +1069,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71275 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
71276 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
71277
71278+#ifdef CONFIG_PAX_MPROTECT
71279+ if (mm->pax_flags & MF_PAX_MPROTECT) {
71280+#ifndef CONFIG_PAX_MPROTECT_COMPAT
71281+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
71282+ gr_log_rwxmmap(file);
71283+
71284+#ifdef CONFIG_PAX_EMUPLT
71285+ vm_flags &= ~VM_EXEC;
71286+#else
71287+ return -EPERM;
71288+#endif
71289+
71290+ }
71291+
71292+ if (!(vm_flags & VM_EXEC))
71293+ vm_flags &= ~VM_MAYEXEC;
71294+#else
71295+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
71296+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
71297+#endif
71298+ else
71299+ vm_flags &= ~VM_MAYWRITE;
71300+ }
71301+#endif
71302+
71303+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71304+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
71305+ vm_flags &= ~VM_PAGEEXEC;
71306+#endif
71307+
71308 if (flags & MAP_LOCKED)
71309 if (!can_do_mlock())
71310 return -EPERM;
71311@@ -1003,6 +1110,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71312 locked += mm->locked_vm;
71313 lock_limit = rlimit(RLIMIT_MEMLOCK);
71314 lock_limit >>= PAGE_SHIFT;
71315+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71316 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
71317 return -EAGAIN;
71318 }
71319@@ -1073,6 +1181,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71320 if (error)
71321 return error;
71322
71323+ if (!gr_acl_handle_mmap(file, prot))
71324+ return -EACCES;
71325+
71326 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
71327 }
71328 EXPORT_SYMBOL(do_mmap_pgoff);
71329@@ -1153,7 +1264,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
71330 vm_flags_t vm_flags = vma->vm_flags;
71331
71332 /* If it was private or non-writable, the write bit is already clear */
71333- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
71334+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
71335 return 0;
71336
71337 /* The backer wishes to know when pages are first written to? */
71338@@ -1202,14 +1313,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
71339 unsigned long charged = 0;
71340 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
71341
71342+#ifdef CONFIG_PAX_SEGMEXEC
71343+ struct vm_area_struct *vma_m = NULL;
71344+#endif
71345+
71346+ /*
71347+ * mm->mmap_sem is required to protect against another thread
71348+ * changing the mappings in case we sleep.
71349+ */
71350+ verify_mm_writelocked(mm);
71351+
71352 /* Clear old maps */
71353 error = -ENOMEM;
71354-munmap_back:
71355 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71356 if (vma && vma->vm_start < addr + len) {
71357 if (do_munmap(mm, addr, len))
71358 return -ENOMEM;
71359- goto munmap_back;
71360+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71361+ BUG_ON(vma && vma->vm_start < addr + len);
71362 }
71363
71364 /* Check against address space limit. */
71365@@ -1258,6 +1379,16 @@ munmap_back:
71366 goto unacct_error;
71367 }
71368
71369+#ifdef CONFIG_PAX_SEGMEXEC
71370+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
71371+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
71372+ if (!vma_m) {
71373+ error = -ENOMEM;
71374+ goto free_vma;
71375+ }
71376+ }
71377+#endif
71378+
71379 vma->vm_mm = mm;
71380 vma->vm_start = addr;
71381 vma->vm_end = addr + len;
71382@@ -1281,6 +1412,19 @@ munmap_back:
71383 error = file->f_op->mmap(file, vma);
71384 if (error)
71385 goto unmap_and_free_vma;
71386+
71387+#ifdef CONFIG_PAX_SEGMEXEC
71388+ if (vma_m && (vm_flags & VM_EXECUTABLE))
71389+ added_exe_file_vma(mm);
71390+#endif
71391+
71392+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71393+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
71394+ vma->vm_flags |= VM_PAGEEXEC;
71395+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
71396+ }
71397+#endif
71398+
71399 if (vm_flags & VM_EXECUTABLE)
71400 added_exe_file_vma(mm);
71401
71402@@ -1316,6 +1460,11 @@ munmap_back:
71403 vma_link(mm, vma, prev, rb_link, rb_parent);
71404 file = vma->vm_file;
71405
71406+#ifdef CONFIG_PAX_SEGMEXEC
71407+ if (vma_m)
71408+ BUG_ON(pax_mirror_vma(vma_m, vma));
71409+#endif
71410+
71411 /* Once vma denies write, undo our temporary denial count */
71412 if (correct_wcount)
71413 atomic_inc(&inode->i_writecount);
71414@@ -1324,6 +1473,7 @@ out:
71415
71416 mm->total_vm += len >> PAGE_SHIFT;
71417 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
71418+ track_exec_limit(mm, addr, addr + len, vm_flags);
71419 if (vm_flags & VM_LOCKED) {
71420 if (!mlock_vma_pages_range(vma, addr, addr + len))
71421 mm->locked_vm += (len >> PAGE_SHIFT);
71422@@ -1341,6 +1491,12 @@ unmap_and_free_vma:
71423 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
71424 charged = 0;
71425 free_vma:
71426+
71427+#ifdef CONFIG_PAX_SEGMEXEC
71428+ if (vma_m)
71429+ kmem_cache_free(vm_area_cachep, vma_m);
71430+#endif
71431+
71432 kmem_cache_free(vm_area_cachep, vma);
71433 unacct_error:
71434 if (charged)
71435@@ -1348,6 +1504,44 @@ unacct_error:
71436 return error;
71437 }
71438
71439+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
71440+{
71441+ if (!vma) {
71442+#ifdef CONFIG_STACK_GROWSUP
71443+ if (addr > sysctl_heap_stack_gap)
71444+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
71445+ else
71446+ vma = find_vma(current->mm, 0);
71447+ if (vma && (vma->vm_flags & VM_GROWSUP))
71448+ return false;
71449+#endif
71450+ return true;
71451+ }
71452+
71453+ if (addr + len > vma->vm_start)
71454+ return false;
71455+
71456+ if (vma->vm_flags & VM_GROWSDOWN)
71457+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
71458+#ifdef CONFIG_STACK_GROWSUP
71459+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
71460+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
71461+#endif
71462+
71463+ return true;
71464+}
71465+
71466+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
71467+{
71468+ if (vma->vm_start < len)
71469+ return -ENOMEM;
71470+ if (!(vma->vm_flags & VM_GROWSDOWN))
71471+ return vma->vm_start - len;
71472+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
71473+ return vma->vm_start - len - sysctl_heap_stack_gap;
71474+ return -ENOMEM;
71475+}
71476+
71477 /* Get an address range which is currently unmapped.
71478 * For shmat() with addr=0.
71479 *
71480@@ -1374,18 +1568,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
71481 if (flags & MAP_FIXED)
71482 return addr;
71483
71484+#ifdef CONFIG_PAX_RANDMMAP
71485+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71486+#endif
71487+
71488 if (addr) {
71489 addr = PAGE_ALIGN(addr);
71490- vma = find_vma(mm, addr);
71491- if (TASK_SIZE - len >= addr &&
71492- (!vma || addr + len <= vma->vm_start))
71493- return addr;
71494+ if (TASK_SIZE - len >= addr) {
71495+ vma = find_vma(mm, addr);
71496+ if (check_heap_stack_gap(vma, addr, len))
71497+ return addr;
71498+ }
71499 }
71500 if (len > mm->cached_hole_size) {
71501- start_addr = addr = mm->free_area_cache;
71502+ start_addr = addr = mm->free_area_cache;
71503 } else {
71504- start_addr = addr = TASK_UNMAPPED_BASE;
71505- mm->cached_hole_size = 0;
71506+ start_addr = addr = mm->mmap_base;
71507+ mm->cached_hole_size = 0;
71508 }
71509
71510 full_search:
71511@@ -1396,34 +1595,40 @@ full_search:
71512 * Start a new search - just in case we missed
71513 * some holes.
71514 */
71515- if (start_addr != TASK_UNMAPPED_BASE) {
71516- addr = TASK_UNMAPPED_BASE;
71517- start_addr = addr;
71518+ if (start_addr != mm->mmap_base) {
71519+ start_addr = addr = mm->mmap_base;
71520 mm->cached_hole_size = 0;
71521 goto full_search;
71522 }
71523 return -ENOMEM;
71524 }
71525- if (!vma || addr + len <= vma->vm_start) {
71526- /*
71527- * Remember the place where we stopped the search:
71528- */
71529- mm->free_area_cache = addr + len;
71530- return addr;
71531- }
71532+ if (check_heap_stack_gap(vma, addr, len))
71533+ break;
71534 if (addr + mm->cached_hole_size < vma->vm_start)
71535 mm->cached_hole_size = vma->vm_start - addr;
71536 addr = vma->vm_end;
71537 }
71538+
71539+ /*
71540+ * Remember the place where we stopped the search:
71541+ */
71542+ mm->free_area_cache = addr + len;
71543+ return addr;
71544 }
71545 #endif
71546
71547 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
71548 {
71549+
71550+#ifdef CONFIG_PAX_SEGMEXEC
71551+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71552+ return;
71553+#endif
71554+
71555 /*
71556 * Is this a new hole at the lowest possible address?
71557 */
71558- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
71559+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
71560 mm->free_area_cache = addr;
71561 mm->cached_hole_size = ~0UL;
71562 }
71563@@ -1441,7 +1646,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71564 {
71565 struct vm_area_struct *vma;
71566 struct mm_struct *mm = current->mm;
71567- unsigned long addr = addr0;
71568+ unsigned long base = mm->mmap_base, addr = addr0;
71569
71570 /* requested length too big for entire address space */
71571 if (len > TASK_SIZE)
71572@@ -1450,13 +1655,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71573 if (flags & MAP_FIXED)
71574 return addr;
71575
71576+#ifdef CONFIG_PAX_RANDMMAP
71577+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71578+#endif
71579+
71580 /* requesting a specific address */
71581 if (addr) {
71582 addr = PAGE_ALIGN(addr);
71583- vma = find_vma(mm, addr);
71584- if (TASK_SIZE - len >= addr &&
71585- (!vma || addr + len <= vma->vm_start))
71586- return addr;
71587+ if (TASK_SIZE - len >= addr) {
71588+ vma = find_vma(mm, addr);
71589+ if (check_heap_stack_gap(vma, addr, len))
71590+ return addr;
71591+ }
71592 }
71593
71594 /* check if free_area_cache is useful for us */
71595@@ -1471,7 +1681,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71596 /* make sure it can fit in the remaining address space */
71597 if (addr > len) {
71598 vma = find_vma(mm, addr-len);
71599- if (!vma || addr <= vma->vm_start)
71600+ if (check_heap_stack_gap(vma, addr - len, len))
71601 /* remember the address as a hint for next time */
71602 return (mm->free_area_cache = addr-len);
71603 }
71604@@ -1488,7 +1698,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71605 * return with success:
71606 */
71607 vma = find_vma(mm, addr);
71608- if (!vma || addr+len <= vma->vm_start)
71609+ if (check_heap_stack_gap(vma, addr, len))
71610 /* remember the address as a hint for next time */
71611 return (mm->free_area_cache = addr);
71612
71613@@ -1497,8 +1707,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71614 mm->cached_hole_size = vma->vm_start - addr;
71615
71616 /* try just below the current vma->vm_start */
71617- addr = vma->vm_start-len;
71618- } while (len < vma->vm_start);
71619+ addr = skip_heap_stack_gap(vma, len);
71620+ } while (!IS_ERR_VALUE(addr));
71621
71622 bottomup:
71623 /*
71624@@ -1507,13 +1717,21 @@ bottomup:
71625 * can happen with large stack limits and large mmap()
71626 * allocations.
71627 */
71628+ mm->mmap_base = TASK_UNMAPPED_BASE;
71629+
71630+#ifdef CONFIG_PAX_RANDMMAP
71631+ if (mm->pax_flags & MF_PAX_RANDMMAP)
71632+ mm->mmap_base += mm->delta_mmap;
71633+#endif
71634+
71635+ mm->free_area_cache = mm->mmap_base;
71636 mm->cached_hole_size = ~0UL;
71637- mm->free_area_cache = TASK_UNMAPPED_BASE;
71638 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
71639 /*
71640 * Restore the topdown base:
71641 */
71642- mm->free_area_cache = mm->mmap_base;
71643+ mm->mmap_base = base;
71644+ mm->free_area_cache = base;
71645 mm->cached_hole_size = ~0UL;
71646
71647 return addr;
71648@@ -1522,6 +1740,12 @@ bottomup:
71649
71650 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71651 {
71652+
71653+#ifdef CONFIG_PAX_SEGMEXEC
71654+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71655+ return;
71656+#endif
71657+
71658 /*
71659 * Is this a new hole at the highest possible address?
71660 */
71661@@ -1529,8 +1753,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71662 mm->free_area_cache = addr;
71663
71664 /* dont allow allocations above current base */
71665- if (mm->free_area_cache > mm->mmap_base)
71666+ if (mm->free_area_cache > mm->mmap_base) {
71667 mm->free_area_cache = mm->mmap_base;
71668+ mm->cached_hole_size = ~0UL;
71669+ }
71670 }
71671
71672 unsigned long
71673@@ -1638,6 +1864,28 @@ out:
71674 return prev ? prev->vm_next : vma;
71675 }
71676
71677+#ifdef CONFIG_PAX_SEGMEXEC
71678+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
71679+{
71680+ struct vm_area_struct *vma_m;
71681+
71682+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
71683+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
71684+ BUG_ON(vma->vm_mirror);
71685+ return NULL;
71686+ }
71687+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
71688+ vma_m = vma->vm_mirror;
71689+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
71690+ BUG_ON(vma->vm_file != vma_m->vm_file);
71691+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
71692+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
71693+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
71694+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
71695+ return vma_m;
71696+}
71697+#endif
71698+
71699 /*
71700 * Verify that the stack growth is acceptable and
71701 * update accounting. This is shared with both the
71702@@ -1654,6 +1902,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71703 return -ENOMEM;
71704
71705 /* Stack limit test */
71706+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
71707 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
71708 return -ENOMEM;
71709
71710@@ -1664,6 +1913,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71711 locked = mm->locked_vm + grow;
71712 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
71713 limit >>= PAGE_SHIFT;
71714+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71715 if (locked > limit && !capable(CAP_IPC_LOCK))
71716 return -ENOMEM;
71717 }
71718@@ -1694,37 +1944,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71719 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
71720 * vma is the last one with address > vma->vm_end. Have to extend vma.
71721 */
71722+#ifndef CONFIG_IA64
71723+static
71724+#endif
71725 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71726 {
71727 int error;
71728+ bool locknext;
71729
71730 if (!(vma->vm_flags & VM_GROWSUP))
71731 return -EFAULT;
71732
71733+ /* Also guard against wrapping around to address 0. */
71734+ if (address < PAGE_ALIGN(address+1))
71735+ address = PAGE_ALIGN(address+1);
71736+ else
71737+ return -ENOMEM;
71738+
71739 /*
71740 * We must make sure the anon_vma is allocated
71741 * so that the anon_vma locking is not a noop.
71742 */
71743 if (unlikely(anon_vma_prepare(vma)))
71744 return -ENOMEM;
71745+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
71746+ if (locknext && anon_vma_prepare(vma->vm_next))
71747+ return -ENOMEM;
71748 vma_lock_anon_vma(vma);
71749+ if (locknext)
71750+ vma_lock_anon_vma(vma->vm_next);
71751
71752 /*
71753 * vma->vm_start/vm_end cannot change under us because the caller
71754 * is required to hold the mmap_sem in read mode. We need the
71755- * anon_vma lock to serialize against concurrent expand_stacks.
71756- * Also guard against wrapping around to address 0.
71757+ * anon_vma locks to serialize against concurrent expand_stacks
71758+ * and expand_upwards.
71759 */
71760- if (address < PAGE_ALIGN(address+4))
71761- address = PAGE_ALIGN(address+4);
71762- else {
71763- vma_unlock_anon_vma(vma);
71764- return -ENOMEM;
71765- }
71766 error = 0;
71767
71768 /* Somebody else might have raced and expanded it already */
71769- if (address > vma->vm_end) {
71770+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
71771+ error = -ENOMEM;
71772+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
71773 unsigned long size, grow;
71774
71775 size = address - vma->vm_start;
71776@@ -1739,6 +2000,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71777 }
71778 }
71779 }
71780+ if (locknext)
71781+ vma_unlock_anon_vma(vma->vm_next);
71782 vma_unlock_anon_vma(vma);
71783 khugepaged_enter_vma_merge(vma);
71784 return error;
71785@@ -1752,6 +2015,8 @@ int expand_downwards(struct vm_area_struct *vma,
71786 unsigned long address)
71787 {
71788 int error;
71789+ bool lockprev = false;
71790+ struct vm_area_struct *prev;
71791
71792 /*
71793 * We must make sure the anon_vma is allocated
71794@@ -1765,6 +2030,15 @@ int expand_downwards(struct vm_area_struct *vma,
71795 if (error)
71796 return error;
71797
71798+ prev = vma->vm_prev;
71799+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
71800+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
71801+#endif
71802+ if (lockprev && anon_vma_prepare(prev))
71803+ return -ENOMEM;
71804+ if (lockprev)
71805+ vma_lock_anon_vma(prev);
71806+
71807 vma_lock_anon_vma(vma);
71808
71809 /*
71810@@ -1774,9 +2048,17 @@ int expand_downwards(struct vm_area_struct *vma,
71811 */
71812
71813 /* Somebody else might have raced and expanded it already */
71814- if (address < vma->vm_start) {
71815+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
71816+ error = -ENOMEM;
71817+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
71818 unsigned long size, grow;
71819
71820+#ifdef CONFIG_PAX_SEGMEXEC
71821+ struct vm_area_struct *vma_m;
71822+
71823+ vma_m = pax_find_mirror_vma(vma);
71824+#endif
71825+
71826 size = vma->vm_end - address;
71827 grow = (vma->vm_start - address) >> PAGE_SHIFT;
71828
71829@@ -1786,11 +2068,22 @@ int expand_downwards(struct vm_area_struct *vma,
71830 if (!error) {
71831 vma->vm_start = address;
71832 vma->vm_pgoff -= grow;
71833+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
71834+
71835+#ifdef CONFIG_PAX_SEGMEXEC
71836+ if (vma_m) {
71837+ vma_m->vm_start -= grow << PAGE_SHIFT;
71838+ vma_m->vm_pgoff -= grow;
71839+ }
71840+#endif
71841+
71842 perf_event_mmap(vma);
71843 }
71844 }
71845 }
71846 vma_unlock_anon_vma(vma);
71847+ if (lockprev)
71848+ vma_unlock_anon_vma(prev);
71849 khugepaged_enter_vma_merge(vma);
71850 return error;
71851 }
71852@@ -1860,6 +2153,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
71853 do {
71854 long nrpages = vma_pages(vma);
71855
71856+#ifdef CONFIG_PAX_SEGMEXEC
71857+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
71858+ vma = remove_vma(vma);
71859+ continue;
71860+ }
71861+#endif
71862+
71863 mm->total_vm -= nrpages;
71864 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
71865 vma = remove_vma(vma);
71866@@ -1905,6 +2205,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
71867 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
71868 vma->vm_prev = NULL;
71869 do {
71870+
71871+#ifdef CONFIG_PAX_SEGMEXEC
71872+ if (vma->vm_mirror) {
71873+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
71874+ vma->vm_mirror->vm_mirror = NULL;
71875+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
71876+ vma->vm_mirror = NULL;
71877+ }
71878+#endif
71879+
71880 rb_erase(&vma->vm_rb, &mm->mm_rb);
71881 mm->map_count--;
71882 tail_vma = vma;
71883@@ -1933,14 +2243,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
71884 struct vm_area_struct *new;
71885 int err = -ENOMEM;
71886
71887+#ifdef CONFIG_PAX_SEGMEXEC
71888+ struct vm_area_struct *vma_m, *new_m = NULL;
71889+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
71890+#endif
71891+
71892 if (is_vm_hugetlb_page(vma) && (addr &
71893 ~(huge_page_mask(hstate_vma(vma)))))
71894 return -EINVAL;
71895
71896+#ifdef CONFIG_PAX_SEGMEXEC
71897+ vma_m = pax_find_mirror_vma(vma);
71898+#endif
71899+
71900 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
71901 if (!new)
71902 goto out_err;
71903
71904+#ifdef CONFIG_PAX_SEGMEXEC
71905+ if (vma_m) {
71906+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
71907+ if (!new_m) {
71908+ kmem_cache_free(vm_area_cachep, new);
71909+ goto out_err;
71910+ }
71911+ }
71912+#endif
71913+
71914 /* most fields are the same, copy all, and then fixup */
71915 *new = *vma;
71916
71917@@ -1953,6 +2282,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
71918 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
71919 }
71920
71921+#ifdef CONFIG_PAX_SEGMEXEC
71922+ if (vma_m) {
71923+ *new_m = *vma_m;
71924+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
71925+ new_m->vm_mirror = new;
71926+ new->vm_mirror = new_m;
71927+
71928+ if (new_below)
71929+ new_m->vm_end = addr_m;
71930+ else {
71931+ new_m->vm_start = addr_m;
71932+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
71933+ }
71934+ }
71935+#endif
71936+
71937 pol = mpol_dup(vma_policy(vma));
71938 if (IS_ERR(pol)) {
71939 err = PTR_ERR(pol);
71940@@ -1978,6 +2323,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
71941 else
71942 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
71943
71944+#ifdef CONFIG_PAX_SEGMEXEC
71945+ if (!err && vma_m) {
71946+ if (anon_vma_clone(new_m, vma_m))
71947+ goto out_free_mpol;
71948+
71949+ mpol_get(pol);
71950+ vma_set_policy(new_m, pol);
71951+
71952+ if (new_m->vm_file) {
71953+ get_file(new_m->vm_file);
71954+ if (vma_m->vm_flags & VM_EXECUTABLE)
71955+ added_exe_file_vma(mm);
71956+ }
71957+
71958+ if (new_m->vm_ops && new_m->vm_ops->open)
71959+ new_m->vm_ops->open(new_m);
71960+
71961+ if (new_below)
71962+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
71963+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
71964+ else
71965+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
71966+
71967+ if (err) {
71968+ if (new_m->vm_ops && new_m->vm_ops->close)
71969+ new_m->vm_ops->close(new_m);
71970+ if (new_m->vm_file) {
71971+ if (vma_m->vm_flags & VM_EXECUTABLE)
71972+ removed_exe_file_vma(mm);
71973+ fput(new_m->vm_file);
71974+ }
71975+ mpol_put(pol);
71976+ }
71977+ }
71978+#endif
71979+
71980 /* Success. */
71981 if (!err)
71982 return 0;
71983@@ -1990,10 +2371,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
71984 removed_exe_file_vma(mm);
71985 fput(new->vm_file);
71986 }
71987- unlink_anon_vmas(new);
71988 out_free_mpol:
71989 mpol_put(pol);
71990 out_free_vma:
71991+
71992+#ifdef CONFIG_PAX_SEGMEXEC
71993+ if (new_m) {
71994+ unlink_anon_vmas(new_m);
71995+ kmem_cache_free(vm_area_cachep, new_m);
71996+ }
71997+#endif
71998+
71999+ unlink_anon_vmas(new);
72000 kmem_cache_free(vm_area_cachep, new);
72001 out_err:
72002 return err;
72003@@ -2006,6 +2395,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72004 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72005 unsigned long addr, int new_below)
72006 {
72007+
72008+#ifdef CONFIG_PAX_SEGMEXEC
72009+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72010+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
72011+ if (mm->map_count >= sysctl_max_map_count-1)
72012+ return -ENOMEM;
72013+ } else
72014+#endif
72015+
72016 if (mm->map_count >= sysctl_max_map_count)
72017 return -ENOMEM;
72018
72019@@ -2017,11 +2415,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72020 * work. This now handles partial unmappings.
72021 * Jeremy Fitzhardinge <jeremy@goop.org>
72022 */
72023+#ifdef CONFIG_PAX_SEGMEXEC
72024 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72025 {
72026+ int ret = __do_munmap(mm, start, len);
72027+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
72028+ return ret;
72029+
72030+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
72031+}
72032+
72033+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72034+#else
72035+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72036+#endif
72037+{
72038 unsigned long end;
72039 struct vm_area_struct *vma, *prev, *last;
72040
72041+ /*
72042+ * mm->mmap_sem is required to protect against another thread
72043+ * changing the mappings in case we sleep.
72044+ */
72045+ verify_mm_writelocked(mm);
72046+
72047 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
72048 return -EINVAL;
72049
72050@@ -2096,6 +2513,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72051 /* Fix up all other VM information */
72052 remove_vma_list(mm, vma);
72053
72054+ track_exec_limit(mm, start, end, 0UL);
72055+
72056 return 0;
72057 }
72058
72059@@ -2108,22 +2527,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
72060
72061 profile_munmap(addr);
72062
72063+#ifdef CONFIG_PAX_SEGMEXEC
72064+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
72065+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
72066+ return -EINVAL;
72067+#endif
72068+
72069 down_write(&mm->mmap_sem);
72070 ret = do_munmap(mm, addr, len);
72071 up_write(&mm->mmap_sem);
72072 return ret;
72073 }
72074
72075-static inline void verify_mm_writelocked(struct mm_struct *mm)
72076-{
72077-#ifdef CONFIG_DEBUG_VM
72078- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72079- WARN_ON(1);
72080- up_read(&mm->mmap_sem);
72081- }
72082-#endif
72083-}
72084-
72085 /*
72086 * this is really a simplified "do_mmap". it only handles
72087 * anonymous maps. eventually we may be able to do some
72088@@ -2137,6 +2552,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72089 struct rb_node ** rb_link, * rb_parent;
72090 pgoff_t pgoff = addr >> PAGE_SHIFT;
72091 int error;
72092+ unsigned long charged;
72093
72094 len = PAGE_ALIGN(len);
72095 if (!len)
72096@@ -2148,16 +2564,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72097
72098 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
72099
72100+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
72101+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
72102+ flags &= ~VM_EXEC;
72103+
72104+#ifdef CONFIG_PAX_MPROTECT
72105+ if (mm->pax_flags & MF_PAX_MPROTECT)
72106+ flags &= ~VM_MAYEXEC;
72107+#endif
72108+
72109+ }
72110+#endif
72111+
72112 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
72113 if (error & ~PAGE_MASK)
72114 return error;
72115
72116+ charged = len >> PAGE_SHIFT;
72117+
72118 /*
72119 * mlock MCL_FUTURE?
72120 */
72121 if (mm->def_flags & VM_LOCKED) {
72122 unsigned long locked, lock_limit;
72123- locked = len >> PAGE_SHIFT;
72124+ locked = charged;
72125 locked += mm->locked_vm;
72126 lock_limit = rlimit(RLIMIT_MEMLOCK);
72127 lock_limit >>= PAGE_SHIFT;
72128@@ -2174,22 +2604,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72129 /*
72130 * Clear old maps. this also does some error checking for us
72131 */
72132- munmap_back:
72133 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72134 if (vma && vma->vm_start < addr + len) {
72135 if (do_munmap(mm, addr, len))
72136 return -ENOMEM;
72137- goto munmap_back;
72138+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72139+ BUG_ON(vma && vma->vm_start < addr + len);
72140 }
72141
72142 /* Check against address space limits *after* clearing old maps... */
72143- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
72144+ if (!may_expand_vm(mm, charged))
72145 return -ENOMEM;
72146
72147 if (mm->map_count > sysctl_max_map_count)
72148 return -ENOMEM;
72149
72150- if (security_vm_enough_memory(len >> PAGE_SHIFT))
72151+ if (security_vm_enough_memory(charged))
72152 return -ENOMEM;
72153
72154 /* Can we just expand an old private anonymous mapping? */
72155@@ -2203,7 +2633,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72156 */
72157 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72158 if (!vma) {
72159- vm_unacct_memory(len >> PAGE_SHIFT);
72160+ vm_unacct_memory(charged);
72161 return -ENOMEM;
72162 }
72163
72164@@ -2217,11 +2647,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72165 vma_link(mm, vma, prev, rb_link, rb_parent);
72166 out:
72167 perf_event_mmap(vma);
72168- mm->total_vm += len >> PAGE_SHIFT;
72169+ mm->total_vm += charged;
72170 if (flags & VM_LOCKED) {
72171 if (!mlock_vma_pages_range(vma, addr, addr + len))
72172- mm->locked_vm += (len >> PAGE_SHIFT);
72173+ mm->locked_vm += charged;
72174 }
72175+ track_exec_limit(mm, addr, addr + len, flags);
72176 return addr;
72177 }
72178
72179@@ -2268,8 +2699,10 @@ void exit_mmap(struct mm_struct *mm)
72180 * Walk the list again, actually closing and freeing it,
72181 * with preemption enabled, without holding any MM locks.
72182 */
72183- while (vma)
72184+ while (vma) {
72185+ vma->vm_mirror = NULL;
72186 vma = remove_vma(vma);
72187+ }
72188
72189 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
72190 }
72191@@ -2283,6 +2716,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
72192 struct vm_area_struct * __vma, * prev;
72193 struct rb_node ** rb_link, * rb_parent;
72194
72195+#ifdef CONFIG_PAX_SEGMEXEC
72196+ struct vm_area_struct *vma_m = NULL;
72197+#endif
72198+
72199+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
72200+ return -EPERM;
72201+
72202 /*
72203 * The vm_pgoff of a purely anonymous vma should be irrelevant
72204 * until its first write fault, when page's anon_vma and index
72205@@ -2305,7 +2745,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
72206 if ((vma->vm_flags & VM_ACCOUNT) &&
72207 security_vm_enough_memory_mm(mm, vma_pages(vma)))
72208 return -ENOMEM;
72209+
72210+#ifdef CONFIG_PAX_SEGMEXEC
72211+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
72212+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72213+ if (!vma_m)
72214+ return -ENOMEM;
72215+ }
72216+#endif
72217+
72218 vma_link(mm, vma, prev, rb_link, rb_parent);
72219+
72220+#ifdef CONFIG_PAX_SEGMEXEC
72221+ if (vma_m)
72222+ BUG_ON(pax_mirror_vma(vma_m, vma));
72223+#endif
72224+
72225 return 0;
72226 }
72227
72228@@ -2323,6 +2778,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
72229 struct rb_node **rb_link, *rb_parent;
72230 struct mempolicy *pol;
72231
72232+ BUG_ON(vma->vm_mirror);
72233+
72234 /*
72235 * If anonymous vma has not yet been faulted, update new pgoff
72236 * to match new location, to increase its chance of merging.
72237@@ -2373,6 +2830,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
72238 return NULL;
72239 }
72240
72241+#ifdef CONFIG_PAX_SEGMEXEC
72242+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
72243+{
72244+ struct vm_area_struct *prev_m;
72245+ struct rb_node **rb_link_m, *rb_parent_m;
72246+ struct mempolicy *pol_m;
72247+
72248+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
72249+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
72250+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
72251+ *vma_m = *vma;
72252+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
72253+ if (anon_vma_clone(vma_m, vma))
72254+ return -ENOMEM;
72255+ pol_m = vma_policy(vma_m);
72256+ mpol_get(pol_m);
72257+ vma_set_policy(vma_m, pol_m);
72258+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
72259+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
72260+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
72261+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
72262+ if (vma_m->vm_file)
72263+ get_file(vma_m->vm_file);
72264+ if (vma_m->vm_ops && vma_m->vm_ops->open)
72265+ vma_m->vm_ops->open(vma_m);
72266+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
72267+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
72268+ vma_m->vm_mirror = vma;
72269+ vma->vm_mirror = vma_m;
72270+ return 0;
72271+}
72272+#endif
72273+
72274 /*
72275 * Return true if the calling process may expand its vm space by the passed
72276 * number of pages
72277@@ -2383,7 +2873,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
72278 unsigned long lim;
72279
72280 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
72281-
72282+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
72283 if (cur + npages > lim)
72284 return 0;
72285 return 1;
72286@@ -2454,6 +2944,22 @@ int install_special_mapping(struct mm_struct *mm,
72287 vma->vm_start = addr;
72288 vma->vm_end = addr + len;
72289
72290+#ifdef CONFIG_PAX_MPROTECT
72291+ if (mm->pax_flags & MF_PAX_MPROTECT) {
72292+#ifndef CONFIG_PAX_MPROTECT_COMPAT
72293+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
72294+ return -EPERM;
72295+ if (!(vm_flags & VM_EXEC))
72296+ vm_flags &= ~VM_MAYEXEC;
72297+#else
72298+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72299+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72300+#endif
72301+ else
72302+ vm_flags &= ~VM_MAYWRITE;
72303+ }
72304+#endif
72305+
72306 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
72307 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72308
72309diff --git a/mm/mprotect.c b/mm/mprotect.c
72310index 5a688a2..27e031c 100644
72311--- a/mm/mprotect.c
72312+++ b/mm/mprotect.c
72313@@ -23,10 +23,16 @@
72314 #include <linux/mmu_notifier.h>
72315 #include <linux/migrate.h>
72316 #include <linux/perf_event.h>
72317+
72318+#ifdef CONFIG_PAX_MPROTECT
72319+#include <linux/elf.h>
72320+#endif
72321+
72322 #include <asm/uaccess.h>
72323 #include <asm/pgtable.h>
72324 #include <asm/cacheflush.h>
72325 #include <asm/tlbflush.h>
72326+#include <asm/mmu_context.h>
72327
72328 #ifndef pgprot_modify
72329 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
72330@@ -141,6 +147,48 @@ static void change_protection(struct vm_area_struct *vma,
72331 flush_tlb_range(vma, start, end);
72332 }
72333
72334+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72335+/* called while holding the mmap semaphor for writing except stack expansion */
72336+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
72337+{
72338+ unsigned long oldlimit, newlimit = 0UL;
72339+
72340+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
72341+ return;
72342+
72343+ spin_lock(&mm->page_table_lock);
72344+ oldlimit = mm->context.user_cs_limit;
72345+ if ((prot & VM_EXEC) && oldlimit < end)
72346+ /* USER_CS limit moved up */
72347+ newlimit = end;
72348+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
72349+ /* USER_CS limit moved down */
72350+ newlimit = start;
72351+
72352+ if (newlimit) {
72353+ mm->context.user_cs_limit = newlimit;
72354+
72355+#ifdef CONFIG_SMP
72356+ wmb();
72357+ cpus_clear(mm->context.cpu_user_cs_mask);
72358+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
72359+#endif
72360+
72361+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
72362+ }
72363+ spin_unlock(&mm->page_table_lock);
72364+ if (newlimit == end) {
72365+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
72366+
72367+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
72368+ if (is_vm_hugetlb_page(vma))
72369+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
72370+ else
72371+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
72372+ }
72373+}
72374+#endif
72375+
72376 int
72377 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72378 unsigned long start, unsigned long end, unsigned long newflags)
72379@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72380 int error;
72381 int dirty_accountable = 0;
72382
72383+#ifdef CONFIG_PAX_SEGMEXEC
72384+ struct vm_area_struct *vma_m = NULL;
72385+ unsigned long start_m, end_m;
72386+
72387+ start_m = start + SEGMEXEC_TASK_SIZE;
72388+ end_m = end + SEGMEXEC_TASK_SIZE;
72389+#endif
72390+
72391 if (newflags == oldflags) {
72392 *pprev = vma;
72393 return 0;
72394 }
72395
72396+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
72397+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
72398+
72399+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
72400+ return -ENOMEM;
72401+
72402+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
72403+ return -ENOMEM;
72404+ }
72405+
72406 /*
72407 * If we make a private mapping writable we increase our commit;
72408 * but (without finer accounting) cannot reduce our commit if we
72409@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72410 }
72411 }
72412
72413+#ifdef CONFIG_PAX_SEGMEXEC
72414+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
72415+ if (start != vma->vm_start) {
72416+ error = split_vma(mm, vma, start, 1);
72417+ if (error)
72418+ goto fail;
72419+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
72420+ *pprev = (*pprev)->vm_next;
72421+ }
72422+
72423+ if (end != vma->vm_end) {
72424+ error = split_vma(mm, vma, end, 0);
72425+ if (error)
72426+ goto fail;
72427+ }
72428+
72429+ if (pax_find_mirror_vma(vma)) {
72430+ error = __do_munmap(mm, start_m, end_m - start_m);
72431+ if (error)
72432+ goto fail;
72433+ } else {
72434+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72435+ if (!vma_m) {
72436+ error = -ENOMEM;
72437+ goto fail;
72438+ }
72439+ vma->vm_flags = newflags;
72440+ error = pax_mirror_vma(vma_m, vma);
72441+ if (error) {
72442+ vma->vm_flags = oldflags;
72443+ goto fail;
72444+ }
72445+ }
72446+ }
72447+#endif
72448+
72449 /*
72450 * First try to merge with previous and/or next vma.
72451 */
72452@@ -204,9 +306,21 @@ success:
72453 * vm_flags and vm_page_prot are protected by the mmap_sem
72454 * held in write mode.
72455 */
72456+
72457+#ifdef CONFIG_PAX_SEGMEXEC
72458+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
72459+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
72460+#endif
72461+
72462 vma->vm_flags = newflags;
72463+
72464+#ifdef CONFIG_PAX_MPROTECT
72465+ if (mm->binfmt && mm->binfmt->handle_mprotect)
72466+ mm->binfmt->handle_mprotect(vma, newflags);
72467+#endif
72468+
72469 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
72470- vm_get_page_prot(newflags));
72471+ vm_get_page_prot(vma->vm_flags));
72472
72473 if (vma_wants_writenotify(vma)) {
72474 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
72475@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72476 end = start + len;
72477 if (end <= start)
72478 return -ENOMEM;
72479+
72480+#ifdef CONFIG_PAX_SEGMEXEC
72481+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
72482+ if (end > SEGMEXEC_TASK_SIZE)
72483+ return -EINVAL;
72484+ } else
72485+#endif
72486+
72487+ if (end > TASK_SIZE)
72488+ return -EINVAL;
72489+
72490 if (!arch_validate_prot(prot))
72491 return -EINVAL;
72492
72493@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72494 /*
72495 * Does the application expect PROT_READ to imply PROT_EXEC:
72496 */
72497- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72498+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72499 prot |= PROT_EXEC;
72500
72501 vm_flags = calc_vm_prot_bits(prot);
72502@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72503 if (start > vma->vm_start)
72504 prev = vma;
72505
72506+#ifdef CONFIG_PAX_MPROTECT
72507+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
72508+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
72509+#endif
72510+
72511 for (nstart = start ; ; ) {
72512 unsigned long newflags;
72513
72514@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72515
72516 /* newflags >> 4 shift VM_MAY% in place of VM_% */
72517 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
72518+ if (prot & (PROT_WRITE | PROT_EXEC))
72519+ gr_log_rwxmprotect(vma->vm_file);
72520+
72521+ error = -EACCES;
72522+ goto out;
72523+ }
72524+
72525+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
72526 error = -EACCES;
72527 goto out;
72528 }
72529@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72530 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
72531 if (error)
72532 goto out;
72533+
72534+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
72535+
72536 nstart = tmp;
72537
72538 if (nstart < prev->vm_end)
72539diff --git a/mm/mremap.c b/mm/mremap.c
72540index 506fa44..ccc0ba9 100644
72541--- a/mm/mremap.c
72542+++ b/mm/mremap.c
72543@@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
72544 continue;
72545 pte = ptep_clear_flush(vma, old_addr, old_pte);
72546 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
72547+
72548+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72549+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
72550+ pte = pte_exprotect(pte);
72551+#endif
72552+
72553 set_pte_at(mm, new_addr, new_pte, pte);
72554 }
72555
72556@@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
72557 if (is_vm_hugetlb_page(vma))
72558 goto Einval;
72559
72560+#ifdef CONFIG_PAX_SEGMEXEC
72561+ if (pax_find_mirror_vma(vma))
72562+ goto Einval;
72563+#endif
72564+
72565 /* We can't remap across vm area boundaries */
72566 if (old_len > vma->vm_end - addr)
72567 goto Efault;
72568@@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned long addr,
72569 unsigned long ret = -EINVAL;
72570 unsigned long charged = 0;
72571 unsigned long map_flags;
72572+ unsigned long pax_task_size = TASK_SIZE;
72573
72574 if (new_addr & ~PAGE_MASK)
72575 goto out;
72576
72577- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
72578+#ifdef CONFIG_PAX_SEGMEXEC
72579+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
72580+ pax_task_size = SEGMEXEC_TASK_SIZE;
72581+#endif
72582+
72583+ pax_task_size -= PAGE_SIZE;
72584+
72585+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
72586 goto out;
72587
72588 /* Check if the location we're moving into overlaps the
72589 * old location at all, and fail if it does.
72590 */
72591- if ((new_addr <= addr) && (new_addr+new_len) > addr)
72592- goto out;
72593-
72594- if ((addr <= new_addr) && (addr+old_len) > new_addr)
72595+ if (addr + old_len > new_addr && new_addr + new_len > addr)
72596 goto out;
72597
72598 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72599@@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long addr,
72600 struct vm_area_struct *vma;
72601 unsigned long ret = -EINVAL;
72602 unsigned long charged = 0;
72603+ unsigned long pax_task_size = TASK_SIZE;
72604
72605 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
72606 goto out;
72607@@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long addr,
72608 if (!new_len)
72609 goto out;
72610
72611+#ifdef CONFIG_PAX_SEGMEXEC
72612+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
72613+ pax_task_size = SEGMEXEC_TASK_SIZE;
72614+#endif
72615+
72616+ pax_task_size -= PAGE_SIZE;
72617+
72618+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
72619+ old_len > pax_task_size || addr > pax_task_size-old_len)
72620+ goto out;
72621+
72622 if (flags & MREMAP_FIXED) {
72623 if (flags & MREMAP_MAYMOVE)
72624 ret = mremap_to(addr, old_len, new_addr, new_len);
72625@@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long addr,
72626 addr + new_len);
72627 }
72628 ret = addr;
72629+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
72630 goto out;
72631 }
72632 }
72633@@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long addr,
72634 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72635 if (ret)
72636 goto out;
72637+
72638+ map_flags = vma->vm_flags;
72639 ret = move_vma(vma, addr, old_len, new_len, new_addr);
72640+ if (!(ret & ~PAGE_MASK)) {
72641+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
72642+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
72643+ }
72644 }
72645 out:
72646 if (ret & ~PAGE_MASK)
72647diff --git a/mm/nobootmem.c b/mm/nobootmem.c
72648index 6e93dc7..c98df0c 100644
72649--- a/mm/nobootmem.c
72650+++ b/mm/nobootmem.c
72651@@ -110,19 +110,30 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
72652 unsigned long __init free_all_memory_core_early(int nodeid)
72653 {
72654 int i;
72655- u64 start, end;
72656+ u64 start, end, startrange, endrange;
72657 unsigned long count = 0;
72658- struct range *range = NULL;
72659+ struct range *range = NULL, rangerange = { 0, 0 };
72660 int nr_range;
72661
72662 nr_range = get_free_all_memory_range(&range, nodeid);
72663+ startrange = __pa(range) >> PAGE_SHIFT;
72664+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
72665
72666 for (i = 0; i < nr_range; i++) {
72667 start = range[i].start;
72668 end = range[i].end;
72669+ if (start <= endrange && startrange < end) {
72670+ BUG_ON(rangerange.start | rangerange.end);
72671+ rangerange = range[i];
72672+ continue;
72673+ }
72674 count += end - start;
72675 __free_pages_memory(start, end);
72676 }
72677+ start = rangerange.start;
72678+ end = rangerange.end;
72679+ count += end - start;
72680+ __free_pages_memory(start, end);
72681
72682 return count;
72683 }
72684diff --git a/mm/nommu.c b/mm/nommu.c
72685index 4358032..e79b99f 100644
72686--- a/mm/nommu.c
72687+++ b/mm/nommu.c
72688@@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72689 int sysctl_overcommit_ratio = 50; /* default is 50% */
72690 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
72691 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
72692-int heap_stack_gap = 0;
72693
72694 atomic_long_t mmap_pages_allocated;
72695
72696@@ -825,15 +824,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
72697 EXPORT_SYMBOL(find_vma);
72698
72699 /*
72700- * find a VMA
72701- * - we don't extend stack VMAs under NOMMU conditions
72702- */
72703-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
72704-{
72705- return find_vma(mm, addr);
72706-}
72707-
72708-/*
72709 * expand a stack to a given address
72710 * - not supported under NOMMU conditions
72711 */
72712@@ -1553,6 +1543,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72713
72714 /* most fields are the same, copy all, and then fixup */
72715 *new = *vma;
72716+ INIT_LIST_HEAD(&new->anon_vma_chain);
72717 *region = *vma->vm_region;
72718 new->vm_region = region;
72719
72720diff --git a/mm/oom_kill.c b/mm/oom_kill.c
72721index 626303b..e9a1785 100644
72722--- a/mm/oom_kill.c
72723+++ b/mm/oom_kill.c
72724@@ -162,7 +162,7 @@ static bool oom_unkillable_task(struct task_struct *p,
72725 unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
72726 const nodemask_t *nodemask, unsigned long totalpages)
72727 {
72728- int points;
72729+ long points;
72730
72731 if (oom_unkillable_task(p, mem, nodemask))
72732 return 0;
72733diff --git a/mm/page_alloc.c b/mm/page_alloc.c
72734index e8fae15..18c0442 100644
72735--- a/mm/page_alloc.c
72736+++ b/mm/page_alloc.c
72737@@ -340,7 +340,7 @@ out:
72738 * This usage means that zero-order pages may not be compound.
72739 */
72740
72741-static void free_compound_page(struct page *page)
72742+void free_compound_page(struct page *page)
72743 {
72744 __free_pages_ok(page, compound_order(page));
72745 }
72746@@ -653,6 +653,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
72747 int i;
72748 int bad = 0;
72749
72750+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72751+ unsigned long index = 1UL << order;
72752+#endif
72753+
72754 trace_mm_page_free_direct(page, order);
72755 kmemcheck_free_shadow(page, order);
72756
72757@@ -668,6 +672,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
72758 debug_check_no_obj_freed(page_address(page),
72759 PAGE_SIZE << order);
72760 }
72761+
72762+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72763+ for (; index; --index)
72764+ sanitize_highpage(page + index - 1);
72765+#endif
72766+
72767 arch_free_page(page, order);
72768 kernel_map_pages(page, 1 << order, 0);
72769
72770@@ -783,8 +793,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
72771 arch_alloc_page(page, order);
72772 kernel_map_pages(page, 1 << order, 1);
72773
72774+#ifndef CONFIG_PAX_MEMORY_SANITIZE
72775 if (gfp_flags & __GFP_ZERO)
72776 prep_zero_page(page, order, gfp_flags);
72777+#endif
72778
72779 if (order && (gfp_flags & __GFP_COMP))
72780 prep_compound_page(page, order);
72781@@ -2539,6 +2551,8 @@ void show_free_areas(unsigned int filter)
72782 int cpu;
72783 struct zone *zone;
72784
72785+ pax_track_stack();
72786+
72787 for_each_populated_zone(zone) {
72788 if (skip_free_areas_node(filter, zone_to_nid(zone)))
72789 continue;
72790@@ -3350,7 +3364,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
72791 unsigned long pfn;
72792
72793 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
72794+#ifdef CONFIG_X86_32
72795+ /* boot failures in VMware 8 on 32bit vanilla since
72796+ this change */
72797+ if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
72798+#else
72799 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
72800+#endif
72801 return 1;
72802 }
72803 return 0;
72804diff --git a/mm/percpu.c b/mm/percpu.c
72805index 93b5a7c..28d642c 100644
72806--- a/mm/percpu.c
72807+++ b/mm/percpu.c
72808@@ -121,7 +121,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
72809 static unsigned int pcpu_high_unit_cpu __read_mostly;
72810
72811 /* the address of the first chunk which starts with the kernel static area */
72812-void *pcpu_base_addr __read_mostly;
72813+void *pcpu_base_addr __read_only;
72814 EXPORT_SYMBOL_GPL(pcpu_base_addr);
72815
72816 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
72817diff --git a/mm/rmap.c b/mm/rmap.c
72818index 8005080..198c2cd 100644
72819--- a/mm/rmap.c
72820+++ b/mm/rmap.c
72821@@ -152,6 +152,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72822 struct anon_vma *anon_vma = vma->anon_vma;
72823 struct anon_vma_chain *avc;
72824
72825+#ifdef CONFIG_PAX_SEGMEXEC
72826+ struct anon_vma_chain *avc_m = NULL;
72827+#endif
72828+
72829 might_sleep();
72830 if (unlikely(!anon_vma)) {
72831 struct mm_struct *mm = vma->vm_mm;
72832@@ -161,6 +165,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72833 if (!avc)
72834 goto out_enomem;
72835
72836+#ifdef CONFIG_PAX_SEGMEXEC
72837+ avc_m = anon_vma_chain_alloc(GFP_KERNEL);
72838+ if (!avc_m)
72839+ goto out_enomem_free_avc;
72840+#endif
72841+
72842 anon_vma = find_mergeable_anon_vma(vma);
72843 allocated = NULL;
72844 if (!anon_vma) {
72845@@ -174,6 +184,21 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72846 /* page_table_lock to protect against threads */
72847 spin_lock(&mm->page_table_lock);
72848 if (likely(!vma->anon_vma)) {
72849+
72850+#ifdef CONFIG_PAX_SEGMEXEC
72851+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
72852+
72853+ if (vma_m) {
72854+ BUG_ON(vma_m->anon_vma);
72855+ vma_m->anon_vma = anon_vma;
72856+ avc_m->anon_vma = anon_vma;
72857+ avc_m->vma = vma;
72858+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
72859+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
72860+ avc_m = NULL;
72861+ }
72862+#endif
72863+
72864 vma->anon_vma = anon_vma;
72865 avc->anon_vma = anon_vma;
72866 avc->vma = vma;
72867@@ -187,12 +212,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72868
72869 if (unlikely(allocated))
72870 put_anon_vma(allocated);
72871+
72872+#ifdef CONFIG_PAX_SEGMEXEC
72873+ if (unlikely(avc_m))
72874+ anon_vma_chain_free(avc_m);
72875+#endif
72876+
72877 if (unlikely(avc))
72878 anon_vma_chain_free(avc);
72879 }
72880 return 0;
72881
72882 out_enomem_free_avc:
72883+
72884+#ifdef CONFIG_PAX_SEGMEXEC
72885+ if (avc_m)
72886+ anon_vma_chain_free(avc_m);
72887+#endif
72888+
72889 anon_vma_chain_free(avc);
72890 out_enomem:
72891 return -ENOMEM;
72892@@ -243,7 +280,7 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
72893 * Attach the anon_vmas from src to dst.
72894 * Returns 0 on success, -ENOMEM on failure.
72895 */
72896-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
72897+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
72898 {
72899 struct anon_vma_chain *avc, *pavc;
72900 struct anon_vma *root = NULL;
72901@@ -276,7 +313,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
72902 * the corresponding VMA in the parent process is attached to.
72903 * Returns 0 on success, non-zero on failure.
72904 */
72905-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
72906+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
72907 {
72908 struct anon_vma_chain *avc;
72909 struct anon_vma *anon_vma;
72910diff --git a/mm/shmem.c b/mm/shmem.c
72911index 32f6763..431c405 100644
72912--- a/mm/shmem.c
72913+++ b/mm/shmem.c
72914@@ -31,7 +31,7 @@
72915 #include <linux/module.h>
72916 #include <linux/swap.h>
72917
72918-static struct vfsmount *shm_mnt;
72919+struct vfsmount *shm_mnt;
72920
72921 #ifdef CONFIG_SHMEM
72922 /*
72923@@ -74,7 +74,7 @@ static struct vfsmount *shm_mnt;
72924 #define BOGO_DIRENT_SIZE 20
72925
72926 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
72927-#define SHORT_SYMLINK_LEN 128
72928+#define SHORT_SYMLINK_LEN 64
72929
72930 struct shmem_xattr {
72931 struct list_head list; /* anchored by shmem_inode_info->xattr_list */
72932@@ -769,6 +769,8 @@ static struct page *shmem_swapin(swp_entry_t swap, gfp_t gfp,
72933 struct mempolicy mpol, *spol;
72934 struct vm_area_struct pvma;
72935
72936+ pax_track_stack();
72937+
72938 spol = mpol_cond_copy(&mpol,
72939 mpol_shared_policy_lookup(&info->policy, index));
72940
72941@@ -2149,8 +2151,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
72942 int err = -ENOMEM;
72943
72944 /* Round up to L1_CACHE_BYTES to resist false sharing */
72945- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
72946- L1_CACHE_BYTES), GFP_KERNEL);
72947+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
72948 if (!sbinfo)
72949 return -ENOMEM;
72950
72951diff --git a/mm/slab.c b/mm/slab.c
72952index 893c76d..a742de2 100644
72953--- a/mm/slab.c
72954+++ b/mm/slab.c
72955@@ -151,7 +151,7 @@
72956
72957 /* Legal flag mask for kmem_cache_create(). */
72958 #if DEBUG
72959-# define CREATE_MASK (SLAB_RED_ZONE | \
72960+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
72961 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
72962 SLAB_CACHE_DMA | \
72963 SLAB_STORE_USER | \
72964@@ -159,7 +159,7 @@
72965 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
72966 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
72967 #else
72968-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
72969+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
72970 SLAB_CACHE_DMA | \
72971 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
72972 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
72973@@ -288,7 +288,7 @@ struct kmem_list3 {
72974 * Need this for bootstrapping a per node allocator.
72975 */
72976 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
72977-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
72978+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
72979 #define CACHE_CACHE 0
72980 #define SIZE_AC MAX_NUMNODES
72981 #define SIZE_L3 (2 * MAX_NUMNODES)
72982@@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
72983 if ((x)->max_freeable < i) \
72984 (x)->max_freeable = i; \
72985 } while (0)
72986-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
72987-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
72988-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
72989-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
72990+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
72991+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
72992+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
72993+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
72994 #else
72995 #define STATS_INC_ACTIVE(x) do { } while (0)
72996 #define STATS_DEC_ACTIVE(x) do { } while (0)
72997@@ -538,7 +538,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
72998 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
72999 */
73000 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
73001- const struct slab *slab, void *obj)
73002+ const struct slab *slab, const void *obj)
73003 {
73004 u32 offset = (obj - slab->s_mem);
73005 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
73006@@ -564,7 +564,7 @@ struct cache_names {
73007 static struct cache_names __initdata cache_names[] = {
73008 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
73009 #include <linux/kmalloc_sizes.h>
73010- {NULL,}
73011+ {NULL}
73012 #undef CACHE
73013 };
73014
73015@@ -1572,7 +1572,7 @@ void __init kmem_cache_init(void)
73016 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
73017 sizes[INDEX_AC].cs_size,
73018 ARCH_KMALLOC_MINALIGN,
73019- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73020+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73021 NULL);
73022
73023 if (INDEX_AC != INDEX_L3) {
73024@@ -1580,7 +1580,7 @@ void __init kmem_cache_init(void)
73025 kmem_cache_create(names[INDEX_L3].name,
73026 sizes[INDEX_L3].cs_size,
73027 ARCH_KMALLOC_MINALIGN,
73028- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73029+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73030 NULL);
73031 }
73032
73033@@ -1598,7 +1598,7 @@ void __init kmem_cache_init(void)
73034 sizes->cs_cachep = kmem_cache_create(names->name,
73035 sizes->cs_size,
73036 ARCH_KMALLOC_MINALIGN,
73037- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73038+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73039 NULL);
73040 }
73041 #ifdef CONFIG_ZONE_DMA
73042@@ -4327,10 +4327,10 @@ static int s_show(struct seq_file *m, void *p)
73043 }
73044 /* cpu stats */
73045 {
73046- unsigned long allochit = atomic_read(&cachep->allochit);
73047- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
73048- unsigned long freehit = atomic_read(&cachep->freehit);
73049- unsigned long freemiss = atomic_read(&cachep->freemiss);
73050+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
73051+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
73052+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
73053+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
73054
73055 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
73056 allochit, allocmiss, freehit, freemiss);
73057@@ -4587,15 +4587,70 @@ static const struct file_operations proc_slabstats_operations = {
73058
73059 static int __init slab_proc_init(void)
73060 {
73061- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
73062+ mode_t gr_mode = S_IRUGO;
73063+
73064+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73065+ gr_mode = S_IRUSR;
73066+#endif
73067+
73068+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
73069 #ifdef CONFIG_DEBUG_SLAB_LEAK
73070- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
73071+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
73072 #endif
73073 return 0;
73074 }
73075 module_init(slab_proc_init);
73076 #endif
73077
73078+void check_object_size(const void *ptr, unsigned long n, bool to)
73079+{
73080+
73081+#ifdef CONFIG_PAX_USERCOPY
73082+ struct page *page;
73083+ struct kmem_cache *cachep = NULL;
73084+ struct slab *slabp;
73085+ unsigned int objnr;
73086+ unsigned long offset;
73087+ const char *type;
73088+
73089+ if (!n)
73090+ return;
73091+
73092+ type = "<null>";
73093+ if (ZERO_OR_NULL_PTR(ptr))
73094+ goto report;
73095+
73096+ if (!virt_addr_valid(ptr))
73097+ return;
73098+
73099+ page = virt_to_head_page(ptr);
73100+
73101+ type = "<process stack>";
73102+ if (!PageSlab(page)) {
73103+ if (object_is_on_stack(ptr, n) == -1)
73104+ goto report;
73105+ return;
73106+ }
73107+
73108+ cachep = page_get_cache(page);
73109+ type = cachep->name;
73110+ if (!(cachep->flags & SLAB_USERCOPY))
73111+ goto report;
73112+
73113+ slabp = page_get_slab(page);
73114+ objnr = obj_to_index(cachep, slabp, ptr);
73115+ BUG_ON(objnr >= cachep->num);
73116+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
73117+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
73118+ return;
73119+
73120+report:
73121+ pax_report_usercopy(ptr, n, to, type);
73122+#endif
73123+
73124+}
73125+EXPORT_SYMBOL(check_object_size);
73126+
73127 /**
73128 * ksize - get the actual amount of memory allocated for a given object
73129 * @objp: Pointer to the object
73130diff --git a/mm/slob.c b/mm/slob.c
73131index bf39181..727f7a3 100644
73132--- a/mm/slob.c
73133+++ b/mm/slob.c
73134@@ -29,7 +29,7 @@
73135 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
73136 * alloc_pages() directly, allocating compound pages so the page order
73137 * does not have to be separately tracked, and also stores the exact
73138- * allocation size in page->private so that it can be used to accurately
73139+ * allocation size in slob_page->size so that it can be used to accurately
73140 * provide ksize(). These objects are detected in kfree() because slob_page()
73141 * is false for them.
73142 *
73143@@ -58,6 +58,7 @@
73144 */
73145
73146 #include <linux/kernel.h>
73147+#include <linux/sched.h>
73148 #include <linux/slab.h>
73149 #include <linux/mm.h>
73150 #include <linux/swap.h> /* struct reclaim_state */
73151@@ -102,7 +103,8 @@ struct slob_page {
73152 unsigned long flags; /* mandatory */
73153 atomic_t _count; /* mandatory */
73154 slobidx_t units; /* free units left in page */
73155- unsigned long pad[2];
73156+ unsigned long pad[1];
73157+ unsigned long size; /* size when >=PAGE_SIZE */
73158 slob_t *free; /* first free slob_t in page */
73159 struct list_head list; /* linked list of free pages */
73160 };
73161@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
73162 */
73163 static inline int is_slob_page(struct slob_page *sp)
73164 {
73165- return PageSlab((struct page *)sp);
73166+ return PageSlab((struct page *)sp) && !sp->size;
73167 }
73168
73169 static inline void set_slob_page(struct slob_page *sp)
73170@@ -150,7 +152,7 @@ static inline void clear_slob_page(struct slob_page *sp)
73171
73172 static inline struct slob_page *slob_page(const void *addr)
73173 {
73174- return (struct slob_page *)virt_to_page(addr);
73175+ return (struct slob_page *)virt_to_head_page(addr);
73176 }
73177
73178 /*
73179@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
73180 /*
73181 * Return the size of a slob block.
73182 */
73183-static slobidx_t slob_units(slob_t *s)
73184+static slobidx_t slob_units(const slob_t *s)
73185 {
73186 if (s->units > 0)
73187 return s->units;
73188@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
73189 /*
73190 * Return the next free slob block pointer after this one.
73191 */
73192-static slob_t *slob_next(slob_t *s)
73193+static slob_t *slob_next(const slob_t *s)
73194 {
73195 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
73196 slobidx_t next;
73197@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
73198 /*
73199 * Returns true if s is the last free block in its page.
73200 */
73201-static int slob_last(slob_t *s)
73202+static int slob_last(const slob_t *s)
73203 {
73204 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
73205 }
73206@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
73207 if (!page)
73208 return NULL;
73209
73210+ set_slob_page(page);
73211 return page_address(page);
73212 }
73213
73214@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
73215 if (!b)
73216 return NULL;
73217 sp = slob_page(b);
73218- set_slob_page(sp);
73219
73220 spin_lock_irqsave(&slob_lock, flags);
73221 sp->units = SLOB_UNITS(PAGE_SIZE);
73222 sp->free = b;
73223+ sp->size = 0;
73224 INIT_LIST_HEAD(&sp->list);
73225 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
73226 set_slob_page_free(sp, slob_list);
73227@@ -476,10 +479,9 @@ out:
73228 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
73229 */
73230
73231-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73232+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
73233 {
73234- unsigned int *m;
73235- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73236+ slob_t *m;
73237 void *ret;
73238
73239 gfp &= gfp_allowed_mask;
73240@@ -494,7 +496,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73241
73242 if (!m)
73243 return NULL;
73244- *m = size;
73245+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
73246+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
73247+ m[0].units = size;
73248+ m[1].units = align;
73249 ret = (void *)m + align;
73250
73251 trace_kmalloc_node(_RET_IP_, ret,
73252@@ -506,16 +511,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73253 gfp |= __GFP_COMP;
73254 ret = slob_new_pages(gfp, order, node);
73255 if (ret) {
73256- struct page *page;
73257- page = virt_to_page(ret);
73258- page->private = size;
73259+ struct slob_page *sp;
73260+ sp = slob_page(ret);
73261+ sp->size = size;
73262 }
73263
73264 trace_kmalloc_node(_RET_IP_, ret,
73265 size, PAGE_SIZE << order, gfp, node);
73266 }
73267
73268- kmemleak_alloc(ret, size, 1, gfp);
73269+ return ret;
73270+}
73271+
73272+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73273+{
73274+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73275+ void *ret = __kmalloc_node_align(size, gfp, node, align);
73276+
73277+ if (!ZERO_OR_NULL_PTR(ret))
73278+ kmemleak_alloc(ret, size, 1, gfp);
73279 return ret;
73280 }
73281 EXPORT_SYMBOL(__kmalloc_node);
73282@@ -533,13 +547,92 @@ void kfree(const void *block)
73283 sp = slob_page(block);
73284 if (is_slob_page(sp)) {
73285 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73286- unsigned int *m = (unsigned int *)(block - align);
73287- slob_free(m, *m + align);
73288- } else
73289+ slob_t *m = (slob_t *)(block - align);
73290+ slob_free(m, m[0].units + align);
73291+ } else {
73292+ clear_slob_page(sp);
73293+ free_slob_page(sp);
73294+ sp->size = 0;
73295 put_page(&sp->page);
73296+ }
73297 }
73298 EXPORT_SYMBOL(kfree);
73299
73300+void check_object_size(const void *ptr, unsigned long n, bool to)
73301+{
73302+
73303+#ifdef CONFIG_PAX_USERCOPY
73304+ struct slob_page *sp;
73305+ const slob_t *free;
73306+ const void *base;
73307+ unsigned long flags;
73308+ const char *type;
73309+
73310+ if (!n)
73311+ return;
73312+
73313+ type = "<null>";
73314+ if (ZERO_OR_NULL_PTR(ptr))
73315+ goto report;
73316+
73317+ if (!virt_addr_valid(ptr))
73318+ return;
73319+
73320+ type = "<process stack>";
73321+ sp = slob_page(ptr);
73322+ if (!PageSlab((struct page*)sp)) {
73323+ if (object_is_on_stack(ptr, n) == -1)
73324+ goto report;
73325+ return;
73326+ }
73327+
73328+ type = "<slob>";
73329+ if (sp->size) {
73330+ base = page_address(&sp->page);
73331+ if (base <= ptr && n <= sp->size - (ptr - base))
73332+ return;
73333+ goto report;
73334+ }
73335+
73336+ /* some tricky double walking to find the chunk */
73337+ spin_lock_irqsave(&slob_lock, flags);
73338+ base = (void *)((unsigned long)ptr & PAGE_MASK);
73339+ free = sp->free;
73340+
73341+ while (!slob_last(free) && (void *)free <= ptr) {
73342+ base = free + slob_units(free);
73343+ free = slob_next(free);
73344+ }
73345+
73346+ while (base < (void *)free) {
73347+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
73348+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
73349+ int offset;
73350+
73351+ if (ptr < base + align)
73352+ break;
73353+
73354+ offset = ptr - base - align;
73355+ if (offset >= m) {
73356+ base += size;
73357+ continue;
73358+ }
73359+
73360+ if (n > m - offset)
73361+ break;
73362+
73363+ spin_unlock_irqrestore(&slob_lock, flags);
73364+ return;
73365+ }
73366+
73367+ spin_unlock_irqrestore(&slob_lock, flags);
73368+report:
73369+ pax_report_usercopy(ptr, n, to, type);
73370+#endif
73371+
73372+}
73373+EXPORT_SYMBOL(check_object_size);
73374+
73375 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
73376 size_t ksize(const void *block)
73377 {
73378@@ -552,10 +645,10 @@ size_t ksize(const void *block)
73379 sp = slob_page(block);
73380 if (is_slob_page(sp)) {
73381 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73382- unsigned int *m = (unsigned int *)(block - align);
73383- return SLOB_UNITS(*m) * SLOB_UNIT;
73384+ slob_t *m = (slob_t *)(block - align);
73385+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
73386 } else
73387- return sp->page.private;
73388+ return sp->size;
73389 }
73390 EXPORT_SYMBOL(ksize);
73391
73392@@ -571,8 +664,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73393 {
73394 struct kmem_cache *c;
73395
73396+#ifdef CONFIG_PAX_USERCOPY
73397+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
73398+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
73399+#else
73400 c = slob_alloc(sizeof(struct kmem_cache),
73401 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
73402+#endif
73403
73404 if (c) {
73405 c->name = name;
73406@@ -614,17 +712,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
73407
73408 lockdep_trace_alloc(flags);
73409
73410+#ifdef CONFIG_PAX_USERCOPY
73411+ b = __kmalloc_node_align(c->size, flags, node, c->align);
73412+#else
73413 if (c->size < PAGE_SIZE) {
73414 b = slob_alloc(c->size, flags, c->align, node);
73415 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73416 SLOB_UNITS(c->size) * SLOB_UNIT,
73417 flags, node);
73418 } else {
73419+ struct slob_page *sp;
73420+
73421 b = slob_new_pages(flags, get_order(c->size), node);
73422+ sp = slob_page(b);
73423+ sp->size = c->size;
73424 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73425 PAGE_SIZE << get_order(c->size),
73426 flags, node);
73427 }
73428+#endif
73429
73430 if (c->ctor)
73431 c->ctor(b);
73432@@ -636,10 +742,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
73433
73434 static void __kmem_cache_free(void *b, int size)
73435 {
73436- if (size < PAGE_SIZE)
73437+ struct slob_page *sp = slob_page(b);
73438+
73439+ if (is_slob_page(sp))
73440 slob_free(b, size);
73441- else
73442+ else {
73443+ clear_slob_page(sp);
73444+ free_slob_page(sp);
73445+ sp->size = 0;
73446 slob_free_pages(b, get_order(size));
73447+ }
73448 }
73449
73450 static void kmem_rcu_free(struct rcu_head *head)
73451@@ -652,17 +764,31 @@ static void kmem_rcu_free(struct rcu_head *head)
73452
73453 void kmem_cache_free(struct kmem_cache *c, void *b)
73454 {
73455+ int size = c->size;
73456+
73457+#ifdef CONFIG_PAX_USERCOPY
73458+ if (size + c->align < PAGE_SIZE) {
73459+ size += c->align;
73460+ b -= c->align;
73461+ }
73462+#endif
73463+
73464 kmemleak_free_recursive(b, c->flags);
73465 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
73466 struct slob_rcu *slob_rcu;
73467- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
73468- slob_rcu->size = c->size;
73469+ slob_rcu = b + (size - sizeof(struct slob_rcu));
73470+ slob_rcu->size = size;
73471 call_rcu(&slob_rcu->head, kmem_rcu_free);
73472 } else {
73473- __kmem_cache_free(b, c->size);
73474+ __kmem_cache_free(b, size);
73475 }
73476
73477+#ifdef CONFIG_PAX_USERCOPY
73478+ trace_kfree(_RET_IP_, b);
73479+#else
73480 trace_kmem_cache_free(_RET_IP_, b);
73481+#endif
73482+
73483 }
73484 EXPORT_SYMBOL(kmem_cache_free);
73485
73486diff --git a/mm/slub.c b/mm/slub.c
73487index 7c54fe8..0bb4ac5 100644
73488--- a/mm/slub.c
73489+++ b/mm/slub.c
73490@@ -208,7 +208,7 @@ struct track {
73491
73492 enum track_item { TRACK_ALLOC, TRACK_FREE };
73493
73494-#ifdef CONFIG_SYSFS
73495+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73496 static int sysfs_slab_add(struct kmem_cache *);
73497 static int sysfs_slab_alias(struct kmem_cache *, const char *);
73498 static void sysfs_slab_remove(struct kmem_cache *);
73499@@ -556,7 +556,7 @@ static void print_track(const char *s, struct track *t)
73500 if (!t->addr)
73501 return;
73502
73503- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
73504+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
73505 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
73506 #ifdef CONFIG_STACKTRACE
73507 {
73508@@ -2456,6 +2456,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
73509
73510 page = virt_to_head_page(x);
73511
73512+ BUG_ON(!PageSlab(page));
73513+
73514 slab_free(s, page, x, _RET_IP_);
73515
73516 trace_kmem_cache_free(_RET_IP_, x);
73517@@ -2489,7 +2491,7 @@ static int slub_min_objects;
73518 * Merge control. If this is set then no merging of slab caches will occur.
73519 * (Could be removed. This was introduced to pacify the merge skeptics.)
73520 */
73521-static int slub_nomerge;
73522+static int slub_nomerge = 1;
73523
73524 /*
73525 * Calculate the order of allocation given an slab object size.
73526@@ -2912,7 +2914,7 @@ static int kmem_cache_open(struct kmem_cache *s,
73527 * list to avoid pounding the page allocator excessively.
73528 */
73529 set_min_partial(s, ilog2(s->size));
73530- s->refcount = 1;
73531+ atomic_set(&s->refcount, 1);
73532 #ifdef CONFIG_NUMA
73533 s->remote_node_defrag_ratio = 1000;
73534 #endif
73535@@ -3017,8 +3019,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
73536 void kmem_cache_destroy(struct kmem_cache *s)
73537 {
73538 down_write(&slub_lock);
73539- s->refcount--;
73540- if (!s->refcount) {
73541+ if (atomic_dec_and_test(&s->refcount)) {
73542 list_del(&s->list);
73543 if (kmem_cache_close(s)) {
73544 printk(KERN_ERR "SLUB %s: %s called for cache that "
73545@@ -3228,6 +3229,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
73546 EXPORT_SYMBOL(__kmalloc_node);
73547 #endif
73548
73549+void check_object_size(const void *ptr, unsigned long n, bool to)
73550+{
73551+
73552+#ifdef CONFIG_PAX_USERCOPY
73553+ struct page *page;
73554+ struct kmem_cache *s = NULL;
73555+ unsigned long offset;
73556+ const char *type;
73557+
73558+ if (!n)
73559+ return;
73560+
73561+ type = "<null>";
73562+ if (ZERO_OR_NULL_PTR(ptr))
73563+ goto report;
73564+
73565+ if (!virt_addr_valid(ptr))
73566+ return;
73567+
73568+ page = virt_to_head_page(ptr);
73569+
73570+ type = "<process stack>";
73571+ if (!PageSlab(page)) {
73572+ if (object_is_on_stack(ptr, n) == -1)
73573+ goto report;
73574+ return;
73575+ }
73576+
73577+ s = page->slab;
73578+ type = s->name;
73579+ if (!(s->flags & SLAB_USERCOPY))
73580+ goto report;
73581+
73582+ offset = (ptr - page_address(page)) % s->size;
73583+ if (offset <= s->objsize && n <= s->objsize - offset)
73584+ return;
73585+
73586+report:
73587+ pax_report_usercopy(ptr, n, to, type);
73588+#endif
73589+
73590+}
73591+EXPORT_SYMBOL(check_object_size);
73592+
73593 size_t ksize(const void *object)
73594 {
73595 struct page *page;
73596@@ -3502,7 +3547,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
73597 int node;
73598
73599 list_add(&s->list, &slab_caches);
73600- s->refcount = -1;
73601+ atomic_set(&s->refcount, -1);
73602
73603 for_each_node_state(node, N_NORMAL_MEMORY) {
73604 struct kmem_cache_node *n = get_node(s, node);
73605@@ -3619,17 +3664,17 @@ void __init kmem_cache_init(void)
73606
73607 /* Caches that are not of the two-to-the-power-of size */
73608 if (KMALLOC_MIN_SIZE <= 32) {
73609- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
73610+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
73611 caches++;
73612 }
73613
73614 if (KMALLOC_MIN_SIZE <= 64) {
73615- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
73616+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
73617 caches++;
73618 }
73619
73620 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
73621- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
73622+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
73623 caches++;
73624 }
73625
73626@@ -3697,7 +3742,7 @@ static int slab_unmergeable(struct kmem_cache *s)
73627 /*
73628 * We may have set a slab to be unmergeable during bootstrap.
73629 */
73630- if (s->refcount < 0)
73631+ if (atomic_read(&s->refcount) < 0)
73632 return 1;
73633
73634 return 0;
73635@@ -3756,7 +3801,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73636 down_write(&slub_lock);
73637 s = find_mergeable(size, align, flags, name, ctor);
73638 if (s) {
73639- s->refcount++;
73640+ atomic_inc(&s->refcount);
73641 /*
73642 * Adjust the object sizes so that we clear
73643 * the complete object on kzalloc.
73644@@ -3765,7 +3810,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73645 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
73646
73647 if (sysfs_slab_alias(s, name)) {
73648- s->refcount--;
73649+ atomic_dec(&s->refcount);
73650 goto err;
73651 }
73652 up_write(&slub_lock);
73653@@ -3893,7 +3938,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
73654 }
73655 #endif
73656
73657-#ifdef CONFIG_SYSFS
73658+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73659 static int count_inuse(struct page *page)
73660 {
73661 return page->inuse;
73662@@ -4280,12 +4325,12 @@ static void resiliency_test(void)
73663 validate_slab_cache(kmalloc_caches[9]);
73664 }
73665 #else
73666-#ifdef CONFIG_SYSFS
73667+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73668 static void resiliency_test(void) {};
73669 #endif
73670 #endif
73671
73672-#ifdef CONFIG_SYSFS
73673+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73674 enum slab_stat_type {
73675 SL_ALL, /* All slabs */
73676 SL_PARTIAL, /* Only partially allocated slabs */
73677@@ -4495,7 +4540,7 @@ SLAB_ATTR_RO(ctor);
73678
73679 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
73680 {
73681- return sprintf(buf, "%d\n", s->refcount - 1);
73682+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
73683 }
73684 SLAB_ATTR_RO(aliases);
73685
73686@@ -5025,6 +5070,7 @@ static char *create_unique_id(struct kmem_cache *s)
73687 return name;
73688 }
73689
73690+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73691 static int sysfs_slab_add(struct kmem_cache *s)
73692 {
73693 int err;
73694@@ -5087,6 +5133,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
73695 kobject_del(&s->kobj);
73696 kobject_put(&s->kobj);
73697 }
73698+#endif
73699
73700 /*
73701 * Need to buffer aliases during bootup until sysfs becomes
73702@@ -5100,6 +5147,7 @@ struct saved_alias {
73703
73704 static struct saved_alias *alias_list;
73705
73706+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73707 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
73708 {
73709 struct saved_alias *al;
73710@@ -5122,6 +5170,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
73711 alias_list = al;
73712 return 0;
73713 }
73714+#endif
73715
73716 static int __init slab_sysfs_init(void)
73717 {
73718@@ -5257,7 +5306,13 @@ static const struct file_operations proc_slabinfo_operations = {
73719
73720 static int __init slab_proc_init(void)
73721 {
73722- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
73723+ mode_t gr_mode = S_IRUGO;
73724+
73725+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73726+ gr_mode = S_IRUSR;
73727+#endif
73728+
73729+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
73730 return 0;
73731 }
73732 module_init(slab_proc_init);
73733diff --git a/mm/swap.c b/mm/swap.c
73734index 87627f1..8a9eb34 100644
73735--- a/mm/swap.c
73736+++ b/mm/swap.c
73737@@ -31,6 +31,7 @@
73738 #include <linux/backing-dev.h>
73739 #include <linux/memcontrol.h>
73740 #include <linux/gfp.h>
73741+#include <linux/hugetlb.h>
73742
73743 #include "internal.h"
73744
73745@@ -71,6 +72,8 @@ static void __put_compound_page(struct page *page)
73746
73747 __page_cache_release(page);
73748 dtor = get_compound_page_dtor(page);
73749+ if (!PageHuge(page))
73750+ BUG_ON(dtor != free_compound_page);
73751 (*dtor)(page);
73752 }
73753
73754diff --git a/mm/swapfile.c b/mm/swapfile.c
73755index 17bc224..1677059 100644
73756--- a/mm/swapfile.c
73757+++ b/mm/swapfile.c
73758@@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex);
73759
73760 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
73761 /* Activity counter to indicate that a swapon or swapoff has occurred */
73762-static atomic_t proc_poll_event = ATOMIC_INIT(0);
73763+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
73764
73765 static inline unsigned char swap_count(unsigned char ent)
73766 {
73767@@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
73768 }
73769 filp_close(swap_file, NULL);
73770 err = 0;
73771- atomic_inc(&proc_poll_event);
73772+ atomic_inc_unchecked(&proc_poll_event);
73773 wake_up_interruptible(&proc_poll_wait);
73774
73775 out_dput:
73776@@ -1687,8 +1687,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
73777
73778 poll_wait(file, &proc_poll_wait, wait);
73779
73780- if (seq->poll_event != atomic_read(&proc_poll_event)) {
73781- seq->poll_event = atomic_read(&proc_poll_event);
73782+ if (seq->poll_event != atomic_read_unchecked(&proc_poll_event)) {
73783+ seq->poll_event = atomic_read_unchecked(&proc_poll_event);
73784 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
73785 }
73786
73787@@ -1786,7 +1786,7 @@ static int swaps_open(struct inode *inode, struct file *file)
73788 return ret;
73789
73790 seq = file->private_data;
73791- seq->poll_event = atomic_read(&proc_poll_event);
73792+ seq->poll_event = atomic_read_unchecked(&proc_poll_event);
73793 return 0;
73794 }
73795
73796@@ -2124,7 +2124,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
73797 (p->flags & SWP_DISCARDABLE) ? "D" : "");
73798
73799 mutex_unlock(&swapon_mutex);
73800- atomic_inc(&proc_poll_event);
73801+ atomic_inc_unchecked(&proc_poll_event);
73802 wake_up_interruptible(&proc_poll_wait);
73803
73804 if (S_ISREG(inode->i_mode))
73805diff --git a/mm/util.c b/mm/util.c
73806index 88ea1bd..0f1dfdb 100644
73807--- a/mm/util.c
73808+++ b/mm/util.c
73809@@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user);
73810 * allocated buffer. Use this if you don't want to free the buffer immediately
73811 * like, for example, with RCU.
73812 */
73813+#undef __krealloc
73814 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
73815 {
73816 void *ret;
73817@@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc);
73818 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
73819 * %NULL pointer, the object pointed to is freed.
73820 */
73821+#undef krealloc
73822 void *krealloc(const void *p, size_t new_size, gfp_t flags)
73823 {
73824 void *ret;
73825@@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
73826 void arch_pick_mmap_layout(struct mm_struct *mm)
73827 {
73828 mm->mmap_base = TASK_UNMAPPED_BASE;
73829+
73830+#ifdef CONFIG_PAX_RANDMMAP
73831+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73832+ mm->mmap_base += mm->delta_mmap;
73833+#endif
73834+
73835 mm->get_unmapped_area = arch_get_unmapped_area;
73836 mm->unmap_area = arch_unmap_area;
73837 }
73838diff --git a/mm/vmalloc.c b/mm/vmalloc.c
73839index 3a65d6f7..862c072 100644
73840--- a/mm/vmalloc.c
73841+++ b/mm/vmalloc.c
73842@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
73843
73844 pte = pte_offset_kernel(pmd, addr);
73845 do {
73846- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73847- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73848+
73849+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73850+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
73851+ BUG_ON(!pte_exec(*pte));
73852+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
73853+ continue;
73854+ }
73855+#endif
73856+
73857+ {
73858+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73859+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73860+ }
73861 } while (pte++, addr += PAGE_SIZE, addr != end);
73862 }
73863
73864@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
73865 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
73866 {
73867 pte_t *pte;
73868+ int ret = -ENOMEM;
73869
73870 /*
73871 * nr is a running index into the array which helps higher level
73872@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
73873 pte = pte_alloc_kernel(pmd, addr);
73874 if (!pte)
73875 return -ENOMEM;
73876+
73877+ pax_open_kernel();
73878 do {
73879 struct page *page = pages[*nr];
73880
73881- if (WARN_ON(!pte_none(*pte)))
73882- return -EBUSY;
73883- if (WARN_ON(!page))
73884- return -ENOMEM;
73885+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73886+ if (pgprot_val(prot) & _PAGE_NX)
73887+#endif
73888+
73889+ if (WARN_ON(!pte_none(*pte))) {
73890+ ret = -EBUSY;
73891+ goto out;
73892+ }
73893+ if (WARN_ON(!page)) {
73894+ ret = -ENOMEM;
73895+ goto out;
73896+ }
73897 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
73898 (*nr)++;
73899 } while (pte++, addr += PAGE_SIZE, addr != end);
73900- return 0;
73901+ ret = 0;
73902+out:
73903+ pax_close_kernel();
73904+ return ret;
73905 }
73906
73907 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
73908@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void *x)
73909 * and fall back on vmalloc() if that fails. Others
73910 * just put it in the vmalloc space.
73911 */
73912-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
73913+#ifdef CONFIG_MODULES
73914+#ifdef MODULES_VADDR
73915 unsigned long addr = (unsigned long)x;
73916 if (addr >= MODULES_VADDR && addr < MODULES_END)
73917 return 1;
73918 #endif
73919+
73920+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73921+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
73922+ return 1;
73923+#endif
73924+
73925+#endif
73926+
73927 return is_vmalloc_addr(x);
73928 }
73929
73930@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
73931
73932 if (!pgd_none(*pgd)) {
73933 pud_t *pud = pud_offset(pgd, addr);
73934+#ifdef CONFIG_X86
73935+ if (!pud_large(*pud))
73936+#endif
73937 if (!pud_none(*pud)) {
73938 pmd_t *pmd = pmd_offset(pud, addr);
73939+#ifdef CONFIG_X86
73940+ if (!pmd_large(*pmd))
73941+#endif
73942 if (!pmd_none(*pmd)) {
73943 pte_t *ptep, pte;
73944
73945@@ -1294,6 +1334,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
73946 struct vm_struct *area;
73947
73948 BUG_ON(in_interrupt());
73949+
73950+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
73951+ if (flags & VM_KERNEXEC) {
73952+ if (start != VMALLOC_START || end != VMALLOC_END)
73953+ return NULL;
73954+ start = (unsigned long)MODULES_EXEC_VADDR;
73955+ end = (unsigned long)MODULES_EXEC_END;
73956+ }
73957+#endif
73958+
73959 if (flags & VM_IOREMAP) {
73960 int bit = fls(size);
73961
73962@@ -1526,6 +1576,11 @@ void *vmap(struct page **pages, unsigned int count,
73963 if (count > totalram_pages)
73964 return NULL;
73965
73966+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
73967+ if (!(pgprot_val(prot) & _PAGE_NX))
73968+ flags |= VM_KERNEXEC;
73969+#endif
73970+
73971 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
73972 __builtin_return_address(0));
73973 if (!area)
73974@@ -1627,6 +1682,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
73975 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
73976 return NULL;
73977
73978+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
73979+ if (!(pgprot_val(prot) & _PAGE_NX))
73980+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
73981+ VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
73982+ else
73983+#endif
73984+
73985 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
73986 start, end, node, gfp_mask, caller);
73987
73988@@ -1674,6 +1736,7 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
73989 gfp_mask, prot, node, caller);
73990 }
73991
73992+#undef __vmalloc
73993 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
73994 {
73995 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
73996@@ -1697,6 +1760,7 @@ static inline void *__vmalloc_node_flags(unsigned long size,
73997 * For tight control over page level allocator and protection flags
73998 * use __vmalloc() instead.
73999 */
74000+#undef vmalloc
74001 void *vmalloc(unsigned long size)
74002 {
74003 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
74004@@ -1713,6 +1777,7 @@ EXPORT_SYMBOL(vmalloc);
74005 * For tight control over page level allocator and protection flags
74006 * use __vmalloc() instead.
74007 */
74008+#undef vzalloc
74009 void *vzalloc(unsigned long size)
74010 {
74011 return __vmalloc_node_flags(size, -1,
74012@@ -1727,6 +1792,7 @@ EXPORT_SYMBOL(vzalloc);
74013 * The resulting memory area is zeroed so it can be mapped to userspace
74014 * without leaking data.
74015 */
74016+#undef vmalloc_user
74017 void *vmalloc_user(unsigned long size)
74018 {
74019 struct vm_struct *area;
74020@@ -1754,6 +1820,7 @@ EXPORT_SYMBOL(vmalloc_user);
74021 * For tight control over page level allocator and protection flags
74022 * use __vmalloc() instead.
74023 */
74024+#undef vmalloc_node
74025 void *vmalloc_node(unsigned long size, int node)
74026 {
74027 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
74028@@ -1773,6 +1840,7 @@ EXPORT_SYMBOL(vmalloc_node);
74029 * For tight control over page level allocator and protection flags
74030 * use __vmalloc_node() instead.
74031 */
74032+#undef vzalloc_node
74033 void *vzalloc_node(unsigned long size, int node)
74034 {
74035 return __vmalloc_node_flags(size, node,
74036@@ -1795,10 +1863,10 @@ EXPORT_SYMBOL(vzalloc_node);
74037 * For tight control over page level allocator and protection flags
74038 * use __vmalloc() instead.
74039 */
74040-
74041+#undef vmalloc_exec
74042 void *vmalloc_exec(unsigned long size)
74043 {
74044- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
74045+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
74046 -1, __builtin_return_address(0));
74047 }
74048
74049@@ -1817,6 +1885,7 @@ void *vmalloc_exec(unsigned long size)
74050 * Allocate enough 32bit PA addressable pages to cover @size from the
74051 * page level allocator and map them into contiguous kernel virtual space.
74052 */
74053+#undef vmalloc_32
74054 void *vmalloc_32(unsigned long size)
74055 {
74056 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
74057@@ -1831,6 +1900,7 @@ EXPORT_SYMBOL(vmalloc_32);
74058 * The resulting memory area is 32bit addressable and zeroed so it can be
74059 * mapped to userspace without leaking data.
74060 */
74061+#undef vmalloc_32_user
74062 void *vmalloc_32_user(unsigned long size)
74063 {
74064 struct vm_struct *area;
74065@@ -2093,6 +2163,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
74066 unsigned long uaddr = vma->vm_start;
74067 unsigned long usize = vma->vm_end - vma->vm_start;
74068
74069+ BUG_ON(vma->vm_mirror);
74070+
74071 if ((PAGE_SIZE-1) & (unsigned long)addr)
74072 return -EINVAL;
74073
74074diff --git a/mm/vmstat.c b/mm/vmstat.c
74075index d52b13d..381d1ac 100644
74076--- a/mm/vmstat.c
74077+++ b/mm/vmstat.c
74078@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
74079 *
74080 * vm_stat contains the global counters
74081 */
74082-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
74083+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
74084 EXPORT_SYMBOL(vm_stat);
74085
74086 #ifdef CONFIG_SMP
74087@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
74088 v = p->vm_stat_diff[i];
74089 p->vm_stat_diff[i] = 0;
74090 local_irq_restore(flags);
74091- atomic_long_add(v, &zone->vm_stat[i]);
74092+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
74093 global_diff[i] += v;
74094 #ifdef CONFIG_NUMA
74095 /* 3 seconds idle till flush */
74096@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
74097
74098 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
74099 if (global_diff[i])
74100- atomic_long_add(global_diff[i], &vm_stat[i]);
74101+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
74102 }
74103
74104 #endif
74105@@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void)
74106 start_cpu_timer(cpu);
74107 #endif
74108 #ifdef CONFIG_PROC_FS
74109- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
74110- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
74111- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
74112- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
74113+ {
74114+ mode_t gr_mode = S_IRUGO;
74115+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74116+ gr_mode = S_IRUSR;
74117+#endif
74118+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
74119+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
74120+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
74121+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
74122+#else
74123+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
74124+#endif
74125+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
74126+ }
74127 #endif
74128 return 0;
74129 }
74130diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
74131index 8970ba1..e3361fe 100644
74132--- a/net/8021q/vlan.c
74133+++ b/net/8021q/vlan.c
74134@@ -588,8 +588,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
74135 err = -EPERM;
74136 if (!capable(CAP_NET_ADMIN))
74137 break;
74138- if ((args.u.name_type >= 0) &&
74139- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
74140+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
74141 struct vlan_net *vn;
74142
74143 vn = net_generic(net, vlan_net_id);
74144diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
74145index fdfdb57..38d368c 100644
74146--- a/net/9p/trans_fd.c
74147+++ b/net/9p/trans_fd.c
74148@@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
74149 oldfs = get_fs();
74150 set_fs(get_ds());
74151 /* The cast to a user pointer is valid due to the set_fs() */
74152- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
74153+ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
74154 set_fs(oldfs);
74155
74156 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
74157diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
74158index e317583..3c8aeaf 100644
74159--- a/net/9p/trans_virtio.c
74160+++ b/net/9p/trans_virtio.c
74161@@ -327,7 +327,7 @@ req_retry_pinned:
74162 } else {
74163 char *pbuf;
74164 if (req->tc->pubuf)
74165- pbuf = (__force char *) req->tc->pubuf;
74166+ pbuf = (char __force_kernel *) req->tc->pubuf;
74167 else
74168 pbuf = req->tc->pkbuf;
74169 outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
74170@@ -357,7 +357,7 @@ req_retry_pinned:
74171 } else {
74172 char *pbuf;
74173 if (req->tc->pubuf)
74174- pbuf = (__force char *) req->tc->pubuf;
74175+ pbuf = (char __force_kernel *) req->tc->pubuf;
74176 else
74177 pbuf = req->tc->pkbuf;
74178
74179diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
74180index f41f026..fe76ea8 100644
74181--- a/net/atm/atm_misc.c
74182+++ b/net/atm/atm_misc.c
74183@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int truesize)
74184 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
74185 return 1;
74186 atm_return(vcc, truesize);
74187- atomic_inc(&vcc->stats->rx_drop);
74188+ atomic_inc_unchecked(&vcc->stats->rx_drop);
74189 return 0;
74190 }
74191 EXPORT_SYMBOL(atm_charge);
74192@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
74193 }
74194 }
74195 atm_return(vcc, guess);
74196- atomic_inc(&vcc->stats->rx_drop);
74197+ atomic_inc_unchecked(&vcc->stats->rx_drop);
74198 return NULL;
74199 }
74200 EXPORT_SYMBOL(atm_alloc_charge);
74201@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
74202
74203 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
74204 {
74205-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
74206+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
74207 __SONET_ITEMS
74208 #undef __HANDLE_ITEM
74209 }
74210@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
74211
74212 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
74213 {
74214-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
74215+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
74216 __SONET_ITEMS
74217 #undef __HANDLE_ITEM
74218 }
74219diff --git a/net/atm/lec.h b/net/atm/lec.h
74220index dfc0719..47c5322 100644
74221--- a/net/atm/lec.h
74222+++ b/net/atm/lec.h
74223@@ -48,7 +48,7 @@ struct lane2_ops {
74224 const u8 *tlvs, u32 sizeoftlvs);
74225 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
74226 const u8 *tlvs, u32 sizeoftlvs);
74227-};
74228+} __no_const;
74229
74230 /*
74231 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
74232diff --git a/net/atm/mpc.h b/net/atm/mpc.h
74233index 0919a88..a23d54e 100644
74234--- a/net/atm/mpc.h
74235+++ b/net/atm/mpc.h
74236@@ -33,7 +33,7 @@ struct mpoa_client {
74237 struct mpc_parameters parameters; /* parameters for this client */
74238
74239 const struct net_device_ops *old_ops;
74240- struct net_device_ops new_ops;
74241+ net_device_ops_no_const new_ops;
74242 };
74243
74244
74245diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
74246index d1b2d9a..7cc2219 100644
74247--- a/net/atm/mpoa_caches.c
74248+++ b/net/atm/mpoa_caches.c
74249@@ -255,6 +255,8 @@ static void check_resolving_entries(struct mpoa_client *client)
74250 struct timeval now;
74251 struct k_message msg;
74252
74253+ pax_track_stack();
74254+
74255 do_gettimeofday(&now);
74256
74257 read_lock_bh(&client->ingress_lock);
74258diff --git a/net/atm/proc.c b/net/atm/proc.c
74259index 0d020de..011c7bb 100644
74260--- a/net/atm/proc.c
74261+++ b/net/atm/proc.c
74262@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
74263 const struct k_atm_aal_stats *stats)
74264 {
74265 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
74266- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
74267- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
74268- atomic_read(&stats->rx_drop));
74269+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
74270+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
74271+ atomic_read_unchecked(&stats->rx_drop));
74272 }
74273
74274 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
74275diff --git a/net/atm/resources.c b/net/atm/resources.c
74276index 23f45ce..c748f1a 100644
74277--- a/net/atm/resources.c
74278+++ b/net/atm/resources.c
74279@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
74280 static void copy_aal_stats(struct k_atm_aal_stats *from,
74281 struct atm_aal_stats *to)
74282 {
74283-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
74284+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
74285 __AAL_STAT_ITEMS
74286 #undef __HANDLE_ITEM
74287 }
74288@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
74289 static void subtract_aal_stats(struct k_atm_aal_stats *from,
74290 struct atm_aal_stats *to)
74291 {
74292-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
74293+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
74294 __AAL_STAT_ITEMS
74295 #undef __HANDLE_ITEM
74296 }
74297diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
74298index db7aacf..991e539 100644
74299--- a/net/batman-adv/hard-interface.c
74300+++ b/net/batman-adv/hard-interface.c
74301@@ -347,8 +347,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
74302 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
74303 dev_add_pack(&hard_iface->batman_adv_ptype);
74304
74305- atomic_set(&hard_iface->seqno, 1);
74306- atomic_set(&hard_iface->frag_seqno, 1);
74307+ atomic_set_unchecked(&hard_iface->seqno, 1);
74308+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
74309 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
74310 hard_iface->net_dev->name);
74311
74312diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
74313index 0f32c81..82d1895 100644
74314--- a/net/batman-adv/routing.c
74315+++ b/net/batman-adv/routing.c
74316@@ -656,7 +656,7 @@ void receive_bat_packet(const struct ethhdr *ethhdr,
74317 return;
74318
74319 /* could be changed by schedule_own_packet() */
74320- if_incoming_seqno = atomic_read(&if_incoming->seqno);
74321+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
74322
74323 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
74324
74325diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
74326index 58d1447..2a66c8c 100644
74327--- a/net/batman-adv/send.c
74328+++ b/net/batman-adv/send.c
74329@@ -326,7 +326,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
74330
74331 /* change sequence number to network order */
74332 batman_packet->seqno =
74333- htonl((uint32_t)atomic_read(&hard_iface->seqno));
74334+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
74335
74336 batman_packet->ttvn = atomic_read(&bat_priv->ttvn);
74337 batman_packet->tt_crc = htons((uint16_t)atomic_read(&bat_priv->tt_crc));
74338@@ -343,7 +343,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
74339 else
74340 batman_packet->gw_flags = NO_FLAGS;
74341
74342- atomic_inc(&hard_iface->seqno);
74343+ atomic_inc_unchecked(&hard_iface->seqno);
74344
74345 slide_own_bcast_window(hard_iface);
74346 send_time = own_send_time(bat_priv);
74347diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
74348index 05dd351..2ecd19b 100644
74349--- a/net/batman-adv/soft-interface.c
74350+++ b/net/batman-adv/soft-interface.c
74351@@ -632,7 +632,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
74352
74353 /* set broadcast sequence number */
74354 bcast_packet->seqno =
74355- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
74356+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
74357
74358 add_bcast_packet_to_list(bat_priv, skb, 1);
74359
74360@@ -824,7 +824,7 @@ struct net_device *softif_create(const char *name)
74361 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
74362
74363 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
74364- atomic_set(&bat_priv->bcast_seqno, 1);
74365+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
74366 atomic_set(&bat_priv->ttvn, 0);
74367 atomic_set(&bat_priv->tt_local_changes, 0);
74368 atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
74369diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
74370index 51a0db7..b8a62be 100644
74371--- a/net/batman-adv/types.h
74372+++ b/net/batman-adv/types.h
74373@@ -38,8 +38,8 @@ struct hard_iface {
74374 int16_t if_num;
74375 char if_status;
74376 struct net_device *net_dev;
74377- atomic_t seqno;
74378- atomic_t frag_seqno;
74379+ atomic_unchecked_t seqno;
74380+ atomic_unchecked_t frag_seqno;
74381 unsigned char *packet_buff;
74382 int packet_len;
74383 struct kobject *hardif_obj;
74384@@ -153,7 +153,7 @@ struct bat_priv {
74385 atomic_t orig_interval; /* uint */
74386 atomic_t hop_penalty; /* uint */
74387 atomic_t log_level; /* uint */
74388- atomic_t bcast_seqno;
74389+ atomic_unchecked_t bcast_seqno;
74390 atomic_t bcast_queue_left;
74391 atomic_t batman_queue_left;
74392 atomic_t ttvn; /* tranlation table version number */
74393diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
74394index 32b125f..f1447e0 100644
74395--- a/net/batman-adv/unicast.c
74396+++ b/net/batman-adv/unicast.c
74397@@ -264,7 +264,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
74398 frag1->flags = UNI_FRAG_HEAD | large_tail;
74399 frag2->flags = large_tail;
74400
74401- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
74402+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
74403 frag1->seqno = htons(seqno - 1);
74404 frag2->seqno = htons(seqno);
74405
74406diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
74407index ea7f031..0615edc 100644
74408--- a/net/bluetooth/hci_conn.c
74409+++ b/net/bluetooth/hci_conn.c
74410@@ -218,7 +218,7 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
74411 cp.handle = cpu_to_le16(conn->handle);
74412 memcpy(cp.ltk, ltk, sizeof(cp.ltk));
74413 cp.ediv = ediv;
74414- memcpy(cp.rand, rand, sizeof(rand));
74415+ memcpy(cp.rand, rand, sizeof(cp.rand));
74416
74417 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
74418 }
74419@@ -234,7 +234,7 @@ void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
74420 memset(&cp, 0, sizeof(cp));
74421
74422 cp.handle = cpu_to_le16(conn->handle);
74423- memcpy(cp.ltk, ltk, sizeof(ltk));
74424+ memcpy(cp.ltk, ltk, sizeof(cp.ltk));
74425
74426 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
74427 }
74428diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
74429index e79ff75..215b57d 100644
74430--- a/net/bridge/br_multicast.c
74431+++ b/net/bridge/br_multicast.c
74432@@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
74433 nexthdr = ip6h->nexthdr;
74434 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
74435
74436- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
74437+ if (nexthdr != IPPROTO_ICMPV6)
74438 return 0;
74439
74440 /* Okay, we found ICMPv6 header */
74441diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
74442index 5864cc4..94cab18 100644
74443--- a/net/bridge/netfilter/ebtables.c
74444+++ b/net/bridge/netfilter/ebtables.c
74445@@ -1513,7 +1513,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
74446 tmp.valid_hooks = t->table->valid_hooks;
74447 }
74448 mutex_unlock(&ebt_mutex);
74449- if (copy_to_user(user, &tmp, *len) != 0){
74450+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
74451 BUGPRINT("c2u Didn't work\n");
74452 ret = -EFAULT;
74453 break;
74454@@ -1781,6 +1781,8 @@ static int compat_copy_everything_to_user(struct ebt_table *t,
74455 int ret;
74456 void __user *pos;
74457
74458+ pax_track_stack();
74459+
74460 memset(&tinfo, 0, sizeof(tinfo));
74461
74462 if (cmd == EBT_SO_GET_ENTRIES) {
74463diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
74464index a986280..13444a1 100644
74465--- a/net/caif/caif_socket.c
74466+++ b/net/caif/caif_socket.c
74467@@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
74468 #ifdef CONFIG_DEBUG_FS
74469 struct debug_fs_counter {
74470 atomic_t caif_nr_socks;
74471- atomic_t caif_sock_create;
74472- atomic_t num_connect_req;
74473- atomic_t num_connect_resp;
74474- atomic_t num_connect_fail_resp;
74475- atomic_t num_disconnect;
74476- atomic_t num_remote_shutdown_ind;
74477- atomic_t num_tx_flow_off_ind;
74478- atomic_t num_tx_flow_on_ind;
74479- atomic_t num_rx_flow_off;
74480- atomic_t num_rx_flow_on;
74481+ atomic_unchecked_t caif_sock_create;
74482+ atomic_unchecked_t num_connect_req;
74483+ atomic_unchecked_t num_connect_resp;
74484+ atomic_unchecked_t num_connect_fail_resp;
74485+ atomic_unchecked_t num_disconnect;
74486+ atomic_unchecked_t num_remote_shutdown_ind;
74487+ atomic_unchecked_t num_tx_flow_off_ind;
74488+ atomic_unchecked_t num_tx_flow_on_ind;
74489+ atomic_unchecked_t num_rx_flow_off;
74490+ atomic_unchecked_t num_rx_flow_on;
74491 };
74492 static struct debug_fs_counter cnt;
74493 #define dbfs_atomic_inc(v) atomic_inc_return(v)
74494+#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v)
74495 #define dbfs_atomic_dec(v) atomic_dec_return(v)
74496 #else
74497 #define dbfs_atomic_inc(v) 0
74498@@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74499 atomic_read(&cf_sk->sk.sk_rmem_alloc),
74500 sk_rcvbuf_lowwater(cf_sk));
74501 set_rx_flow_off(cf_sk);
74502- dbfs_atomic_inc(&cnt.num_rx_flow_off);
74503+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
74504 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
74505 }
74506
74507@@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74508 set_rx_flow_off(cf_sk);
74509 if (net_ratelimit())
74510 pr_debug("sending flow OFF due to rmem_schedule\n");
74511- dbfs_atomic_inc(&cnt.num_rx_flow_off);
74512+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
74513 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
74514 }
74515 skb->dev = NULL;
74516@@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer *layr,
74517 switch (flow) {
74518 case CAIF_CTRLCMD_FLOW_ON_IND:
74519 /* OK from modem to start sending again */
74520- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
74521+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
74522 set_tx_flow_on(cf_sk);
74523 cf_sk->sk.sk_state_change(&cf_sk->sk);
74524 break;
74525
74526 case CAIF_CTRLCMD_FLOW_OFF_IND:
74527 /* Modem asks us to shut up */
74528- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
74529+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
74530 set_tx_flow_off(cf_sk);
74531 cf_sk->sk.sk_state_change(&cf_sk->sk);
74532 break;
74533@@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74534 /* We're now connected */
74535 caif_client_register_refcnt(&cf_sk->layer,
74536 cfsk_hold, cfsk_put);
74537- dbfs_atomic_inc(&cnt.num_connect_resp);
74538+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
74539 cf_sk->sk.sk_state = CAIF_CONNECTED;
74540 set_tx_flow_on(cf_sk);
74541 cf_sk->sk.sk_state_change(&cf_sk->sk);
74542@@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74543
74544 case CAIF_CTRLCMD_INIT_FAIL_RSP:
74545 /* Connect request failed */
74546- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
74547+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
74548 cf_sk->sk.sk_err = ECONNREFUSED;
74549 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
74550 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
74551@@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74552
74553 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
74554 /* Modem has closed this connection, or device is down. */
74555- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
74556+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
74557 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
74558 cf_sk->sk.sk_err = ECONNRESET;
74559 set_rx_flow_on(cf_sk);
74560@@ -297,7 +298,7 @@ static void caif_check_flow_release(struct sock *sk)
74561 return;
74562
74563 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
74564- dbfs_atomic_inc(&cnt.num_rx_flow_on);
74565+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
74566 set_rx_flow_on(cf_sk);
74567 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
74568 }
74569@@ -854,7 +855,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
74570 /*ifindex = id of the interface.*/
74571 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
74572
74573- dbfs_atomic_inc(&cnt.num_connect_req);
74574+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
74575 cf_sk->layer.receive = caif_sktrecv_cb;
74576
74577 err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
74578@@ -943,7 +944,7 @@ static int caif_release(struct socket *sock)
74579 spin_unlock_bh(&sk->sk_receive_queue.lock);
74580 sock->sk = NULL;
74581
74582- dbfs_atomic_inc(&cnt.num_disconnect);
74583+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
74584
74585 WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
74586 if (cf_sk->debugfs_socket_dir != NULL)
74587@@ -1122,7 +1123,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
74588 cf_sk->conn_req.protocol = protocol;
74589 /* Increase the number of sockets created. */
74590 dbfs_atomic_inc(&cnt.caif_nr_socks);
74591- num = dbfs_atomic_inc(&cnt.caif_sock_create);
74592+ num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create);
74593 #ifdef CONFIG_DEBUG_FS
74594 if (!IS_ERR(debugfsdir)) {
74595
74596diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
74597index e22671b..6598ea0 100644
74598--- a/net/caif/cfctrl.c
74599+++ b/net/caif/cfctrl.c
74600@@ -9,6 +9,7 @@
74601 #include <linux/stddef.h>
74602 #include <linux/spinlock.h>
74603 #include <linux/slab.h>
74604+#include <linux/sched.h>
74605 #include <net/caif/caif_layer.h>
74606 #include <net/caif/cfpkt.h>
74607 #include <net/caif/cfctrl.h>
74608@@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void)
74609 dev_info.id = 0xff;
74610 memset(this, 0, sizeof(*this));
74611 cfsrvl_init(&this->serv, 0, &dev_info, false);
74612- atomic_set(&this->req_seq_no, 1);
74613- atomic_set(&this->rsp_seq_no, 1);
74614+ atomic_set_unchecked(&this->req_seq_no, 1);
74615+ atomic_set_unchecked(&this->rsp_seq_no, 1);
74616 this->serv.layer.receive = cfctrl_recv;
74617 sprintf(this->serv.layer.name, "ctrl");
74618 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
74619@@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl,
74620 struct cfctrl_request_info *req)
74621 {
74622 spin_lock_bh(&ctrl->info_list_lock);
74623- atomic_inc(&ctrl->req_seq_no);
74624- req->sequence_no = atomic_read(&ctrl->req_seq_no);
74625+ atomic_inc_unchecked(&ctrl->req_seq_no);
74626+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
74627 list_add_tail(&req->list, &ctrl->list);
74628 spin_unlock_bh(&ctrl->info_list_lock);
74629 }
74630@@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
74631 if (p != first)
74632 pr_warn("Requests are not received in order\n");
74633
74634- atomic_set(&ctrl->rsp_seq_no,
74635+ atomic_set_unchecked(&ctrl->rsp_seq_no,
74636 p->sequence_no);
74637 list_del(&p->list);
74638 goto out;
74639@@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
74640 struct cfctrl *cfctrl = container_obj(layer);
74641 struct cfctrl_request_info rsp, *req;
74642
74643+ pax_track_stack();
74644
74645 cfpkt_extr_head(pkt, &cmdrsp, 1);
74646 cmd = cmdrsp & CFCTRL_CMD_MASK;
74647diff --git a/net/compat.c b/net/compat.c
74648index c578d93..257fab7 100644
74649--- a/net/compat.c
74650+++ b/net/compat.c
74651@@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
74652 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
74653 __get_user(kmsg->msg_flags, &umsg->msg_flags))
74654 return -EFAULT;
74655- kmsg->msg_name = compat_ptr(tmp1);
74656- kmsg->msg_iov = compat_ptr(tmp2);
74657- kmsg->msg_control = compat_ptr(tmp3);
74658+ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
74659+ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
74660+ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
74661 return 0;
74662 }
74663
74664@@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74665
74666 if (kern_msg->msg_namelen) {
74667 if (mode == VERIFY_READ) {
74668- int err = move_addr_to_kernel(kern_msg->msg_name,
74669+ int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
74670 kern_msg->msg_namelen,
74671 kern_address);
74672 if (err < 0)
74673@@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74674 kern_msg->msg_name = NULL;
74675
74676 tot_len = iov_from_user_compat_to_kern(kern_iov,
74677- (struct compat_iovec __user *)kern_msg->msg_iov,
74678+ (struct compat_iovec __force_user *)kern_msg->msg_iov,
74679 kern_msg->msg_iovlen);
74680 if (tot_len >= 0)
74681 kern_msg->msg_iov = kern_iov;
74682@@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74683
74684 #define CMSG_COMPAT_FIRSTHDR(msg) \
74685 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
74686- (struct compat_cmsghdr __user *)((msg)->msg_control) : \
74687+ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
74688 (struct compat_cmsghdr __user *)NULL)
74689
74690 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
74691 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
74692 (ucmlen) <= (unsigned long) \
74693 ((mhdr)->msg_controllen - \
74694- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
74695+ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
74696
74697 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
74698 struct compat_cmsghdr __user *cmsg, int cmsg_len)
74699 {
74700 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
74701- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
74702+ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
74703 msg->msg_controllen)
74704 return NULL;
74705 return (struct compat_cmsghdr __user *)ptr;
74706@@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
74707 {
74708 struct compat_timeval ctv;
74709 struct compat_timespec cts[3];
74710- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
74711+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
74712 struct compat_cmsghdr cmhdr;
74713 int cmlen;
74714
74715@@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
74716
74717 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
74718 {
74719- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
74720+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
74721 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
74722 int fdnum = scm->fp->count;
74723 struct file **fp = scm->fp->fp;
74724@@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
74725 return -EFAULT;
74726 old_fs = get_fs();
74727 set_fs(KERNEL_DS);
74728- err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
74729+ err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
74730 set_fs(old_fs);
74731
74732 return err;
74733@@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
74734 len = sizeof(ktime);
74735 old_fs = get_fs();
74736 set_fs(KERNEL_DS);
74737- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
74738+ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
74739 set_fs(old_fs);
74740
74741 if (!err) {
74742@@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74743 case MCAST_JOIN_GROUP:
74744 case MCAST_LEAVE_GROUP:
74745 {
74746- struct compat_group_req __user *gr32 = (void *)optval;
74747+ struct compat_group_req __user *gr32 = (void __user *)optval;
74748 struct group_req __user *kgr =
74749 compat_alloc_user_space(sizeof(struct group_req));
74750 u32 interface;
74751@@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74752 case MCAST_BLOCK_SOURCE:
74753 case MCAST_UNBLOCK_SOURCE:
74754 {
74755- struct compat_group_source_req __user *gsr32 = (void *)optval;
74756+ struct compat_group_source_req __user *gsr32 = (void __user *)optval;
74757 struct group_source_req __user *kgsr = compat_alloc_user_space(
74758 sizeof(struct group_source_req));
74759 u32 interface;
74760@@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74761 }
74762 case MCAST_MSFILTER:
74763 {
74764- struct compat_group_filter __user *gf32 = (void *)optval;
74765+ struct compat_group_filter __user *gf32 = (void __user *)optval;
74766 struct group_filter __user *kgf;
74767 u32 interface, fmode, numsrc;
74768
74769@@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
74770 char __user *optval, int __user *optlen,
74771 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
74772 {
74773- struct compat_group_filter __user *gf32 = (void *)optval;
74774+ struct compat_group_filter __user *gf32 = (void __user *)optval;
74775 struct group_filter __user *kgf;
74776 int __user *koptlen;
74777 u32 interface, fmode, numsrc;
74778diff --git a/net/core/datagram.c b/net/core/datagram.c
74779index 18ac112..fe95ed9 100644
74780--- a/net/core/datagram.c
74781+++ b/net/core/datagram.c
74782@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
74783 }
74784
74785 kfree_skb(skb);
74786- atomic_inc(&sk->sk_drops);
74787+ atomic_inc_unchecked(&sk->sk_drops);
74788 sk_mem_reclaim_partial(sk);
74789
74790 return err;
74791diff --git a/net/core/dev.c b/net/core/dev.c
74792index ae5cf2d..2c950a1 100644
74793--- a/net/core/dev.c
74794+++ b/net/core/dev.c
74795@@ -1135,10 +1135,14 @@ void dev_load(struct net *net, const char *name)
74796 if (no_module && capable(CAP_NET_ADMIN))
74797 no_module = request_module("netdev-%s", name);
74798 if (no_module && capable(CAP_SYS_MODULE)) {
74799+#ifdef CONFIG_GRKERNSEC_MODHARDEN
74800+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
74801+#else
74802 if (!request_module("%s", name))
74803 pr_err("Loading kernel module for a network device "
74804 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
74805 "instead\n", name);
74806+#endif
74807 }
74808 }
74809 EXPORT_SYMBOL(dev_load);
74810@@ -1977,7 +1981,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
74811
74812 struct dev_gso_cb {
74813 void (*destructor)(struct sk_buff *skb);
74814-};
74815+} __no_const;
74816
74817 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
74818
74819@@ -2930,7 +2934,7 @@ int netif_rx_ni(struct sk_buff *skb)
74820 }
74821 EXPORT_SYMBOL(netif_rx_ni);
74822
74823-static void net_tx_action(struct softirq_action *h)
74824+static void net_tx_action(void)
74825 {
74826 struct softnet_data *sd = &__get_cpu_var(softnet_data);
74827
74828@@ -3779,7 +3783,7 @@ void netif_napi_del(struct napi_struct *napi)
74829 }
74830 EXPORT_SYMBOL(netif_napi_del);
74831
74832-static void net_rx_action(struct softirq_action *h)
74833+static void net_rx_action(void)
74834 {
74835 struct softnet_data *sd = &__get_cpu_var(softnet_data);
74836 unsigned long time_limit = jiffies + 2;
74837diff --git a/net/core/flow.c b/net/core/flow.c
74838index 555a456..de48421 100644
74839--- a/net/core/flow.c
74840+++ b/net/core/flow.c
74841@@ -61,7 +61,7 @@ struct flow_cache {
74842 struct timer_list rnd_timer;
74843 };
74844
74845-atomic_t flow_cache_genid = ATOMIC_INIT(0);
74846+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
74847 EXPORT_SYMBOL(flow_cache_genid);
74848 static struct flow_cache flow_cache_global;
74849 static struct kmem_cache *flow_cachep __read_mostly;
74850@@ -86,7 +86,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
74851
74852 static int flow_entry_valid(struct flow_cache_entry *fle)
74853 {
74854- if (atomic_read(&flow_cache_genid) != fle->genid)
74855+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
74856 return 0;
74857 if (fle->object && !fle->object->ops->check(fle->object))
74858 return 0;
74859@@ -259,7 +259,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
74860 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
74861 fcp->hash_count++;
74862 }
74863- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
74864+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
74865 flo = fle->object;
74866 if (!flo)
74867 goto ret_object;
74868@@ -280,7 +280,7 @@ nocache:
74869 }
74870 flo = resolver(net, key, family, dir, flo, ctx);
74871 if (fle) {
74872- fle->genid = atomic_read(&flow_cache_genid);
74873+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
74874 if (!IS_ERR(flo))
74875 fle->object = flo;
74876 else
74877diff --git a/net/core/iovec.c b/net/core/iovec.c
74878index c40f27e..7f49254 100644
74879--- a/net/core/iovec.c
74880+++ b/net/core/iovec.c
74881@@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
74882 if (m->msg_namelen) {
74883 if (mode == VERIFY_READ) {
74884 void __user *namep;
74885- namep = (void __user __force *) m->msg_name;
74886+ namep = (void __force_user *) m->msg_name;
74887 err = move_addr_to_kernel(namep, m->msg_namelen,
74888 address);
74889 if (err < 0)
74890@@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
74891 }
74892
74893 size = m->msg_iovlen * sizeof(struct iovec);
74894- if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
74895+ if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
74896 return -EFAULT;
74897
74898 m->msg_iov = iov;
74899diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
74900index 99d9e95..209bae2 100644
74901--- a/net/core/rtnetlink.c
74902+++ b/net/core/rtnetlink.c
74903@@ -57,7 +57,7 @@ struct rtnl_link {
74904 rtnl_doit_func doit;
74905 rtnl_dumpit_func dumpit;
74906 rtnl_calcit_func calcit;
74907-};
74908+} __no_const;
74909
74910 static DEFINE_MUTEX(rtnl_mutex);
74911 static u16 min_ifinfo_dump_size;
74912diff --git a/net/core/scm.c b/net/core/scm.c
74913index 811b53f..5d6c343 100644
74914--- a/net/core/scm.c
74915+++ b/net/core/scm.c
74916@@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send);
74917 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
74918 {
74919 struct cmsghdr __user *cm
74920- = (__force struct cmsghdr __user *)msg->msg_control;
74921+ = (struct cmsghdr __force_user *)msg->msg_control;
74922 struct cmsghdr cmhdr;
74923 int cmlen = CMSG_LEN(len);
74924 int err;
74925@@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
74926 err = -EFAULT;
74927 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
74928 goto out;
74929- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
74930+ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
74931 goto out;
74932 cmlen = CMSG_SPACE(len);
74933 if (msg->msg_controllen < cmlen)
74934@@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg);
74935 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
74936 {
74937 struct cmsghdr __user *cm
74938- = (__force struct cmsghdr __user*)msg->msg_control;
74939+ = (struct cmsghdr __force_user *)msg->msg_control;
74940
74941 int fdmax = 0;
74942 int fdnum = scm->fp->count;
74943@@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
74944 if (fdnum < fdmax)
74945 fdmax = fdnum;
74946
74947- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
74948+ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
74949 i++, cmfptr++)
74950 {
74951 int new_fd;
74952diff --git a/net/core/skbuff.c b/net/core/skbuff.c
74953index 387703f..035abcf 100644
74954--- a/net/core/skbuff.c
74955+++ b/net/core/skbuff.c
74956@@ -1650,6 +1650,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
74957 struct sock *sk = skb->sk;
74958 int ret = 0;
74959
74960+ pax_track_stack();
74961+
74962 if (splice_grow_spd(pipe, &spd))
74963 return -ENOMEM;
74964
74965diff --git a/net/core/sock.c b/net/core/sock.c
74966index 11d67b3..df26d4b 100644
74967--- a/net/core/sock.c
74968+++ b/net/core/sock.c
74969@@ -293,7 +293,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74970 */
74971 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
74972 (unsigned)sk->sk_rcvbuf) {
74973- atomic_inc(&sk->sk_drops);
74974+ atomic_inc_unchecked(&sk->sk_drops);
74975 trace_sock_rcvqueue_full(sk, skb);
74976 return -ENOMEM;
74977 }
74978@@ -303,7 +303,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74979 return err;
74980
74981 if (!sk_rmem_schedule(sk, skb->truesize)) {
74982- atomic_inc(&sk->sk_drops);
74983+ atomic_inc_unchecked(&sk->sk_drops);
74984 return -ENOBUFS;
74985 }
74986
74987@@ -323,7 +323,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74988 skb_dst_force(skb);
74989
74990 spin_lock_irqsave(&list->lock, flags);
74991- skb->dropcount = atomic_read(&sk->sk_drops);
74992+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
74993 __skb_queue_tail(list, skb);
74994 spin_unlock_irqrestore(&list->lock, flags);
74995
74996@@ -343,7 +343,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
74997 skb->dev = NULL;
74998
74999 if (sk_rcvqueues_full(sk, skb)) {
75000- atomic_inc(&sk->sk_drops);
75001+ atomic_inc_unchecked(&sk->sk_drops);
75002 goto discard_and_relse;
75003 }
75004 if (nested)
75005@@ -361,7 +361,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
75006 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
75007 } else if (sk_add_backlog(sk, skb)) {
75008 bh_unlock_sock(sk);
75009- atomic_inc(&sk->sk_drops);
75010+ atomic_inc_unchecked(&sk->sk_drops);
75011 goto discard_and_relse;
75012 }
75013
75014@@ -924,7 +924,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75015 if (len > sizeof(peercred))
75016 len = sizeof(peercred);
75017 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
75018- if (copy_to_user(optval, &peercred, len))
75019+ if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
75020 return -EFAULT;
75021 goto lenout;
75022 }
75023@@ -937,7 +937,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75024 return -ENOTCONN;
75025 if (lv < len)
75026 return -EINVAL;
75027- if (copy_to_user(optval, address, len))
75028+ if (len > sizeof(address) || copy_to_user(optval, address, len))
75029 return -EFAULT;
75030 goto lenout;
75031 }
75032@@ -970,7 +970,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75033
75034 if (len > lv)
75035 len = lv;
75036- if (copy_to_user(optval, &v, len))
75037+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
75038 return -EFAULT;
75039 lenout:
75040 if (put_user(len, optlen))
75041@@ -2029,7 +2029,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
75042 */
75043 smp_wmb();
75044 atomic_set(&sk->sk_refcnt, 1);
75045- atomic_set(&sk->sk_drops, 0);
75046+ atomic_set_unchecked(&sk->sk_drops, 0);
75047 }
75048 EXPORT_SYMBOL(sock_init_data);
75049
75050diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
75051index 02e75d1..9a57a7c 100644
75052--- a/net/decnet/sysctl_net_decnet.c
75053+++ b/net/decnet/sysctl_net_decnet.c
75054@@ -174,7 +174,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
75055
75056 if (len > *lenp) len = *lenp;
75057
75058- if (copy_to_user(buffer, addr, len))
75059+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
75060 return -EFAULT;
75061
75062 *lenp = len;
75063@@ -237,7 +237,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
75064
75065 if (len > *lenp) len = *lenp;
75066
75067- if (copy_to_user(buffer, devname, len))
75068+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
75069 return -EFAULT;
75070
75071 *lenp = len;
75072diff --git a/net/econet/Kconfig b/net/econet/Kconfig
75073index 39a2d29..f39c0fe 100644
75074--- a/net/econet/Kconfig
75075+++ b/net/econet/Kconfig
75076@@ -4,7 +4,7 @@
75077
75078 config ECONET
75079 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
75080- depends on EXPERIMENTAL && INET
75081+ depends on EXPERIMENTAL && INET && BROKEN
75082 ---help---
75083 Econet is a fairly old and slow networking protocol mainly used by
75084 Acorn computers to access file and print servers. It uses native
75085diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
75086index 92fc5f6..b790d91 100644
75087--- a/net/ipv4/fib_frontend.c
75088+++ b/net/ipv4/fib_frontend.c
75089@@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
75090 #ifdef CONFIG_IP_ROUTE_MULTIPATH
75091 fib_sync_up(dev);
75092 #endif
75093- atomic_inc(&net->ipv4.dev_addr_genid);
75094+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75095 rt_cache_flush(dev_net(dev), -1);
75096 break;
75097 case NETDEV_DOWN:
75098 fib_del_ifaddr(ifa, NULL);
75099- atomic_inc(&net->ipv4.dev_addr_genid);
75100+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75101 if (ifa->ifa_dev->ifa_list == NULL) {
75102 /* Last address was deleted from this interface.
75103 * Disable IP.
75104@@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
75105 #ifdef CONFIG_IP_ROUTE_MULTIPATH
75106 fib_sync_up(dev);
75107 #endif
75108- atomic_inc(&net->ipv4.dev_addr_genid);
75109+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75110 rt_cache_flush(dev_net(dev), -1);
75111 break;
75112 case NETDEV_DOWN:
75113diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
75114index 80106d8..232e898 100644
75115--- a/net/ipv4/fib_semantics.c
75116+++ b/net/ipv4/fib_semantics.c
75117@@ -699,7 +699,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh)
75118 nh->nh_saddr = inet_select_addr(nh->nh_dev,
75119 nh->nh_gw,
75120 nh->nh_parent->fib_scope);
75121- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
75122+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
75123
75124 return nh->nh_saddr;
75125 }
75126diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
75127index 389a2e6..ac1c1de 100644
75128--- a/net/ipv4/inet_diag.c
75129+++ b/net/ipv4/inet_diag.c
75130@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct sock *sk,
75131 r->idiag_retrans = 0;
75132
75133 r->id.idiag_if = sk->sk_bound_dev_if;
75134+
75135+#ifdef CONFIG_GRKERNSEC_HIDESYM
75136+ r->id.idiag_cookie[0] = 0;
75137+ r->id.idiag_cookie[1] = 0;
75138+#else
75139 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
75140 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
75141+#endif
75142
75143 r->id.idiag_sport = inet->inet_sport;
75144 r->id.idiag_dport = inet->inet_dport;
75145@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
75146 r->idiag_family = tw->tw_family;
75147 r->idiag_retrans = 0;
75148 r->id.idiag_if = tw->tw_bound_dev_if;
75149+
75150+#ifdef CONFIG_GRKERNSEC_HIDESYM
75151+ r->id.idiag_cookie[0] = 0;
75152+ r->id.idiag_cookie[1] = 0;
75153+#else
75154 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
75155 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
75156+#endif
75157+
75158 r->id.idiag_sport = tw->tw_sport;
75159 r->id.idiag_dport = tw->tw_dport;
75160 r->id.idiag_src[0] = tw->tw_rcv_saddr;
75161@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
75162 if (sk == NULL)
75163 goto unlock;
75164
75165+#ifndef CONFIG_GRKERNSEC_HIDESYM
75166 err = -ESTALE;
75167 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
75168 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
75169 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
75170 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
75171 goto out;
75172+#endif
75173
75174 err = -ENOMEM;
75175 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
75176@@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
75177 r->idiag_retrans = req->retrans;
75178
75179 r->id.idiag_if = sk->sk_bound_dev_if;
75180+
75181+#ifdef CONFIG_GRKERNSEC_HIDESYM
75182+ r->id.idiag_cookie[0] = 0;
75183+ r->id.idiag_cookie[1] = 0;
75184+#else
75185 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
75186 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
75187+#endif
75188
75189 tmo = req->expires - jiffies;
75190 if (tmo < 0)
75191diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
75192index 984ec65..97ac518 100644
75193--- a/net/ipv4/inet_hashtables.c
75194+++ b/net/ipv4/inet_hashtables.c
75195@@ -18,12 +18,15 @@
75196 #include <linux/sched.h>
75197 #include <linux/slab.h>
75198 #include <linux/wait.h>
75199+#include <linux/security.h>
75200
75201 #include <net/inet_connection_sock.h>
75202 #include <net/inet_hashtables.h>
75203 #include <net/secure_seq.h>
75204 #include <net/ip.h>
75205
75206+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
75207+
75208 /*
75209 * Allocate and initialize a new local port bind bucket.
75210 * The bindhash mutex for snum's hash chain must be held here.
75211@@ -530,6 +533,8 @@ ok:
75212 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
75213 spin_unlock(&head->lock);
75214
75215+ gr_update_task_in_ip_table(current, inet_sk(sk));
75216+
75217 if (tw) {
75218 inet_twsk_deschedule(tw, death_row);
75219 while (twrefcnt) {
75220diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
75221index 86f13c67..0bce60f 100644
75222--- a/net/ipv4/inetpeer.c
75223+++ b/net/ipv4/inetpeer.c
75224@@ -400,6 +400,8 @@ struct inet_peer *inet_getpeer(const struct inetpeer_addr *daddr, int create)
75225 unsigned int sequence;
75226 int invalidated, gccnt = 0;
75227
75228+ pax_track_stack();
75229+
75230 /* Attempt a lockless lookup first.
75231 * Because of a concurrent writer, we might not find an existing entry.
75232 */
75233@@ -436,8 +438,8 @@ relookup:
75234 if (p) {
75235 p->daddr = *daddr;
75236 atomic_set(&p->refcnt, 1);
75237- atomic_set(&p->rid, 0);
75238- atomic_set(&p->ip_id_count,
75239+ atomic_set_unchecked(&p->rid, 0);
75240+ atomic_set_unchecked(&p->ip_id_count,
75241 (daddr->family == AF_INET) ?
75242 secure_ip_id(daddr->addr.a4) :
75243 secure_ipv6_id(daddr->addr.a6));
75244diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
75245index 0e0ab98..2ed7dd5 100644
75246--- a/net/ipv4/ip_fragment.c
75247+++ b/net/ipv4/ip_fragment.c
75248@@ -316,7 +316,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
75249 return 0;
75250
75251 start = qp->rid;
75252- end = atomic_inc_return(&peer->rid);
75253+ end = atomic_inc_return_unchecked(&peer->rid);
75254 qp->rid = end;
75255
75256 rc = qp->q.fragments && (end - start) > max;
75257diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
75258index 8905e92..0b179fb 100644
75259--- a/net/ipv4/ip_sockglue.c
75260+++ b/net/ipv4/ip_sockglue.c
75261@@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75262 int val;
75263 int len;
75264
75265+ pax_track_stack();
75266+
75267 if (level != SOL_IP)
75268 return -EOPNOTSUPP;
75269
75270@@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75271 len = min_t(unsigned int, len, opt->optlen);
75272 if (put_user(len, optlen))
75273 return -EFAULT;
75274- if (copy_to_user(optval, opt->__data, len))
75275+ if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
75276+ copy_to_user(optval, opt->__data, len))
75277 return -EFAULT;
75278 return 0;
75279 }
75280@@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75281 if (sk->sk_type != SOCK_STREAM)
75282 return -ENOPROTOOPT;
75283
75284- msg.msg_control = optval;
75285+ msg.msg_control = (void __force_kernel *)optval;
75286 msg.msg_controllen = len;
75287 msg.msg_flags = flags;
75288
75289diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
75290index 472a8c4..6507cd4 100644
75291--- a/net/ipv4/ipconfig.c
75292+++ b/net/ipv4/ipconfig.c
75293@@ -313,7 +313,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
75294
75295 mm_segment_t oldfs = get_fs();
75296 set_fs(get_ds());
75297- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
75298+ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
75299 set_fs(oldfs);
75300 return res;
75301 }
75302@@ -324,7 +324,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
75303
75304 mm_segment_t oldfs = get_fs();
75305 set_fs(get_ds());
75306- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
75307+ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
75308 set_fs(oldfs);
75309 return res;
75310 }
75311@@ -335,7 +335,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
75312
75313 mm_segment_t oldfs = get_fs();
75314 set_fs(get_ds());
75315- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
75316+ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
75317 set_fs(oldfs);
75318 return res;
75319 }
75320diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
75321index 076b7c8..9c8d038 100644
75322--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
75323+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
75324@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
75325
75326 *len = 0;
75327
75328- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
75329+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
75330 if (*octets == NULL) {
75331 if (net_ratelimit())
75332 pr_notice("OOM in bsalg (%d)\n", __LINE__);
75333diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
75334index 39b403f..8e6a0a8 100644
75335--- a/net/ipv4/ping.c
75336+++ b/net/ipv4/ping.c
75337@@ -837,7 +837,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
75338 sk_rmem_alloc_get(sp),
75339 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75340 atomic_read(&sp->sk_refcnt), sp,
75341- atomic_read(&sp->sk_drops), len);
75342+ atomic_read_unchecked(&sp->sk_drops), len);
75343 }
75344
75345 static int ping_seq_show(struct seq_file *seq, void *v)
75346diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
75347index 61714bd..c9cee6d 100644
75348--- a/net/ipv4/raw.c
75349+++ b/net/ipv4/raw.c
75350@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
75351 int raw_rcv(struct sock *sk, struct sk_buff *skb)
75352 {
75353 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
75354- atomic_inc(&sk->sk_drops);
75355+ atomic_inc_unchecked(&sk->sk_drops);
75356 kfree_skb(skb);
75357 return NET_RX_DROP;
75358 }
75359@@ -737,16 +737,20 @@ static int raw_init(struct sock *sk)
75360
75361 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
75362 {
75363+ struct icmp_filter filter;
75364+
75365 if (optlen > sizeof(struct icmp_filter))
75366 optlen = sizeof(struct icmp_filter);
75367- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
75368+ if (copy_from_user(&filter, optval, optlen))
75369 return -EFAULT;
75370+ raw_sk(sk)->filter = filter;
75371 return 0;
75372 }
75373
75374 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
75375 {
75376 int len, ret = -EFAULT;
75377+ struct icmp_filter filter;
75378
75379 if (get_user(len, optlen))
75380 goto out;
75381@@ -756,8 +760,8 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
75382 if (len > sizeof(struct icmp_filter))
75383 len = sizeof(struct icmp_filter);
75384 ret = -EFAULT;
75385- if (put_user(len, optlen) ||
75386- copy_to_user(optval, &raw_sk(sk)->filter, len))
75387+ filter = raw_sk(sk)->filter;
75388+ if (put_user(len, optlen) || len > sizeof filter || copy_to_user(optval, &filter, len))
75389 goto out;
75390 ret = 0;
75391 out: return ret;
75392@@ -985,7 +989,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
75393 sk_wmem_alloc_get(sp),
75394 sk_rmem_alloc_get(sp),
75395 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75396- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
75397+ atomic_read(&sp->sk_refcnt),
75398+#ifdef CONFIG_GRKERNSEC_HIDESYM
75399+ NULL,
75400+#else
75401+ sp,
75402+#endif
75403+ atomic_read_unchecked(&sp->sk_drops));
75404 }
75405
75406 static int raw_seq_show(struct seq_file *seq, void *v)
75407diff --git a/net/ipv4/route.c b/net/ipv4/route.c
75408index 05ac666c..82384a7 100644
75409--- a/net/ipv4/route.c
75410+++ b/net/ipv4/route.c
75411@@ -309,7 +309,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
75412
75413 static inline int rt_genid(struct net *net)
75414 {
75415- return atomic_read(&net->ipv4.rt_genid);
75416+ return atomic_read_unchecked(&net->ipv4.rt_genid);
75417 }
75418
75419 #ifdef CONFIG_PROC_FS
75420@@ -842,7 +842,7 @@ static void rt_cache_invalidate(struct net *net)
75421 unsigned char shuffle;
75422
75423 get_random_bytes(&shuffle, sizeof(shuffle));
75424- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
75425+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
75426 redirect_genid++;
75427 }
75428
75429@@ -2920,7 +2920,7 @@ static int rt_fill_info(struct net *net,
75430 error = rt->dst.error;
75431 if (peer) {
75432 inet_peer_refcheck(rt->peer);
75433- id = atomic_read(&peer->ip_id_count) & 0xffff;
75434+ id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
75435 if (peer->tcp_ts_stamp) {
75436 ts = peer->tcp_ts;
75437 tsage = get_seconds() - peer->tcp_ts_stamp;
75438diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
75439index 46febca..98b73a4 100644
75440--- a/net/ipv4/tcp.c
75441+++ b/net/ipv4/tcp.c
75442@@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
75443 int val;
75444 int err = 0;
75445
75446+ pax_track_stack();
75447+
75448 /* These are data/string values, all the others are ints */
75449 switch (optname) {
75450 case TCP_CONGESTION: {
75451@@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
75452 struct tcp_sock *tp = tcp_sk(sk);
75453 int val, len;
75454
75455+ pax_track_stack();
75456+
75457 if (get_user(len, optlen))
75458 return -EFAULT;
75459
75460diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
75461index 7963e03..c44f5d0 100644
75462--- a/net/ipv4/tcp_ipv4.c
75463+++ b/net/ipv4/tcp_ipv4.c
75464@@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
75465 int sysctl_tcp_low_latency __read_mostly;
75466 EXPORT_SYMBOL(sysctl_tcp_low_latency);
75467
75468+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75469+extern int grsec_enable_blackhole;
75470+#endif
75471
75472 #ifdef CONFIG_TCP_MD5SIG
75473 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
75474@@ -1622,6 +1625,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
75475 return 0;
75476
75477 reset:
75478+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75479+ if (!grsec_enable_blackhole)
75480+#endif
75481 tcp_v4_send_reset(rsk, skb);
75482 discard:
75483 kfree_skb(skb);
75484@@ -1684,12 +1690,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
75485 TCP_SKB_CB(skb)->sacked = 0;
75486
75487 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
75488- if (!sk)
75489+ if (!sk) {
75490+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75491+ ret = 1;
75492+#endif
75493 goto no_tcp_socket;
75494-
75495+ }
75496 process:
75497- if (sk->sk_state == TCP_TIME_WAIT)
75498+ if (sk->sk_state == TCP_TIME_WAIT) {
75499+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75500+ ret = 2;
75501+#endif
75502 goto do_time_wait;
75503+ }
75504
75505 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
75506 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
75507@@ -1739,6 +1752,10 @@ no_tcp_socket:
75508 bad_packet:
75509 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
75510 } else {
75511+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75512+ if (!grsec_enable_blackhole || (ret == 1 &&
75513+ (skb->dev->flags & IFF_LOOPBACK)))
75514+#endif
75515 tcp_v4_send_reset(NULL, skb);
75516 }
75517
75518@@ -2403,7 +2420,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
75519 0, /* non standard timer */
75520 0, /* open_requests have no inode */
75521 atomic_read(&sk->sk_refcnt),
75522+#ifdef CONFIG_GRKERNSEC_HIDESYM
75523+ NULL,
75524+#else
75525 req,
75526+#endif
75527 len);
75528 }
75529
75530@@ -2453,7 +2474,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
75531 sock_i_uid(sk),
75532 icsk->icsk_probes_out,
75533 sock_i_ino(sk),
75534- atomic_read(&sk->sk_refcnt), sk,
75535+ atomic_read(&sk->sk_refcnt),
75536+#ifdef CONFIG_GRKERNSEC_HIDESYM
75537+ NULL,
75538+#else
75539+ sk,
75540+#endif
75541 jiffies_to_clock_t(icsk->icsk_rto),
75542 jiffies_to_clock_t(icsk->icsk_ack.ato),
75543 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
75544@@ -2481,7 +2507,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
75545 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
75546 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
75547 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
75548- atomic_read(&tw->tw_refcnt), tw, len);
75549+ atomic_read(&tw->tw_refcnt),
75550+#ifdef CONFIG_GRKERNSEC_HIDESYM
75551+ NULL,
75552+#else
75553+ tw,
75554+#endif
75555+ len);
75556 }
75557
75558 #define TMPSZ 150
75559diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
75560index 0ce3d06..e182e59 100644
75561--- a/net/ipv4/tcp_minisocks.c
75562+++ b/net/ipv4/tcp_minisocks.c
75563@@ -27,6 +27,10 @@
75564 #include <net/inet_common.h>
75565 #include <net/xfrm.h>
75566
75567+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75568+extern int grsec_enable_blackhole;
75569+#endif
75570+
75571 int sysctl_tcp_syncookies __read_mostly = 1;
75572 EXPORT_SYMBOL(sysctl_tcp_syncookies);
75573
75574@@ -750,6 +754,10 @@ listen_overflow:
75575
75576 embryonic_reset:
75577 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
75578+
75579+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75580+ if (!grsec_enable_blackhole)
75581+#endif
75582 if (!(flg & TCP_FLAG_RST))
75583 req->rsk_ops->send_reset(sk, skb);
75584
75585diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
75586index 882e0b0..2eba47f 100644
75587--- a/net/ipv4/tcp_output.c
75588+++ b/net/ipv4/tcp_output.c
75589@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
75590 int mss;
75591 int s_data_desired = 0;
75592
75593+ pax_track_stack();
75594+
75595 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
75596 s_data_desired = cvp->s_data_desired;
75597 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
75598diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
75599index 85ee7eb..53277ab 100644
75600--- a/net/ipv4/tcp_probe.c
75601+++ b/net/ipv4/tcp_probe.c
75602@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
75603 if (cnt + width >= len)
75604 break;
75605
75606- if (copy_to_user(buf + cnt, tbuf, width))
75607+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
75608 return -EFAULT;
75609 cnt += width;
75610 }
75611diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
75612index ecd44b0..b32fba6 100644
75613--- a/net/ipv4/tcp_timer.c
75614+++ b/net/ipv4/tcp_timer.c
75615@@ -22,6 +22,10 @@
75616 #include <linux/gfp.h>
75617 #include <net/tcp.h>
75618
75619+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75620+extern int grsec_lastack_retries;
75621+#endif
75622+
75623 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
75624 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
75625 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
75626@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock *sk)
75627 }
75628 }
75629
75630+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75631+ if ((sk->sk_state == TCP_LAST_ACK) &&
75632+ (grsec_lastack_retries > 0) &&
75633+ (grsec_lastack_retries < retry_until))
75634+ retry_until = grsec_lastack_retries;
75635+#endif
75636+
75637 if (retransmits_timed_out(sk, retry_until,
75638 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
75639 /* Has it gone just too far? */
75640diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
75641index 1b5a193..bd354b0 100644
75642--- a/net/ipv4/udp.c
75643+++ b/net/ipv4/udp.c
75644@@ -86,6 +86,7 @@
75645 #include <linux/types.h>
75646 #include <linux/fcntl.h>
75647 #include <linux/module.h>
75648+#include <linux/security.h>
75649 #include <linux/socket.h>
75650 #include <linux/sockios.h>
75651 #include <linux/igmp.h>
75652@@ -108,6 +109,10 @@
75653 #include <trace/events/udp.h>
75654 #include "udp_impl.h"
75655
75656+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75657+extern int grsec_enable_blackhole;
75658+#endif
75659+
75660 struct udp_table udp_table __read_mostly;
75661 EXPORT_SYMBOL(udp_table);
75662
75663@@ -565,6 +570,9 @@ found:
75664 return s;
75665 }
75666
75667+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
75668+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
75669+
75670 /*
75671 * This routine is called by the ICMP module when it gets some
75672 * sort of error condition. If err < 0 then the socket should
75673@@ -856,9 +864,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
75674 dport = usin->sin_port;
75675 if (dport == 0)
75676 return -EINVAL;
75677+
75678+ err = gr_search_udp_sendmsg(sk, usin);
75679+ if (err)
75680+ return err;
75681 } else {
75682 if (sk->sk_state != TCP_ESTABLISHED)
75683 return -EDESTADDRREQ;
75684+
75685+ err = gr_search_udp_sendmsg(sk, NULL);
75686+ if (err)
75687+ return err;
75688+
75689 daddr = inet->inet_daddr;
75690 dport = inet->inet_dport;
75691 /* Open fast path for connected socket.
75692@@ -1099,7 +1116,7 @@ static unsigned int first_packet_length(struct sock *sk)
75693 udp_lib_checksum_complete(skb)) {
75694 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
75695 IS_UDPLITE(sk));
75696- atomic_inc(&sk->sk_drops);
75697+ atomic_inc_unchecked(&sk->sk_drops);
75698 __skb_unlink(skb, rcvq);
75699 __skb_queue_tail(&list_kill, skb);
75700 }
75701@@ -1185,6 +1202,10 @@ try_again:
75702 if (!skb)
75703 goto out;
75704
75705+ err = gr_search_udp_recvmsg(sk, skb);
75706+ if (err)
75707+ goto out_free;
75708+
75709 ulen = skb->len - sizeof(struct udphdr);
75710 if (len > ulen)
75711 len = ulen;
75712@@ -1485,7 +1506,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75713
75714 drop:
75715 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
75716- atomic_inc(&sk->sk_drops);
75717+ atomic_inc_unchecked(&sk->sk_drops);
75718 kfree_skb(skb);
75719 return -1;
75720 }
75721@@ -1504,7 +1525,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
75722 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
75723
75724 if (!skb1) {
75725- atomic_inc(&sk->sk_drops);
75726+ atomic_inc_unchecked(&sk->sk_drops);
75727 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
75728 IS_UDPLITE(sk));
75729 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
75730@@ -1673,6 +1694,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
75731 goto csum_error;
75732
75733 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
75734+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75735+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
75736+#endif
75737 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
75738
75739 /*
75740@@ -2100,8 +2124,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
75741 sk_wmem_alloc_get(sp),
75742 sk_rmem_alloc_get(sp),
75743 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75744- atomic_read(&sp->sk_refcnt), sp,
75745- atomic_read(&sp->sk_drops), len);
75746+ atomic_read(&sp->sk_refcnt),
75747+#ifdef CONFIG_GRKERNSEC_HIDESYM
75748+ NULL,
75749+#else
75750+ sp,
75751+#endif
75752+ atomic_read_unchecked(&sp->sk_drops), len);
75753 }
75754
75755 int udp4_seq_show(struct seq_file *seq, void *v)
75756diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
75757index 12368c5..fbf899f 100644
75758--- a/net/ipv6/addrconf.c
75759+++ b/net/ipv6/addrconf.c
75760@@ -2083,7 +2083,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
75761 p.iph.ihl = 5;
75762 p.iph.protocol = IPPROTO_IPV6;
75763 p.iph.ttl = 64;
75764- ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
75765+ ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
75766
75767 if (ops->ndo_do_ioctl) {
75768 mm_segment_t oldfs = get_fs();
75769diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
75770index 8a58e8c..8b5e631 100644
75771--- a/net/ipv6/inet6_connection_sock.c
75772+++ b/net/ipv6/inet6_connection_sock.c
75773@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
75774 #ifdef CONFIG_XFRM
75775 {
75776 struct rt6_info *rt = (struct rt6_info *)dst;
75777- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
75778+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
75779 }
75780 #endif
75781 }
75782@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
75783 #ifdef CONFIG_XFRM
75784 if (dst) {
75785 struct rt6_info *rt = (struct rt6_info *)dst;
75786- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
75787+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
75788 __sk_dst_reset(sk);
75789 dst = NULL;
75790 }
75791diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
75792index 2fbda5f..26ed683 100644
75793--- a/net/ipv6/ipv6_sockglue.c
75794+++ b/net/ipv6/ipv6_sockglue.c
75795@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
75796 int val, valbool;
75797 int retv = -ENOPROTOOPT;
75798
75799+ pax_track_stack();
75800+
75801 if (optval == NULL)
75802 val=0;
75803 else {
75804@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
75805 int len;
75806 int val;
75807
75808+ pax_track_stack();
75809+
75810 if (ip6_mroute_opt(optname))
75811 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
75812
75813@@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
75814 if (sk->sk_type != SOCK_STREAM)
75815 return -ENOPROTOOPT;
75816
75817- msg.msg_control = optval;
75818+ msg.msg_control = (void __force_kernel *)optval;
75819 msg.msg_controllen = len;
75820 msg.msg_flags = flags;
75821
75822diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
75823index 343852e..c92bd15 100644
75824--- a/net/ipv6/raw.c
75825+++ b/net/ipv6/raw.c
75826@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
75827 {
75828 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
75829 skb_checksum_complete(skb)) {
75830- atomic_inc(&sk->sk_drops);
75831+ atomic_inc_unchecked(&sk->sk_drops);
75832 kfree_skb(skb);
75833 return NET_RX_DROP;
75834 }
75835@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
75836 struct raw6_sock *rp = raw6_sk(sk);
75837
75838 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
75839- atomic_inc(&sk->sk_drops);
75840+ atomic_inc_unchecked(&sk->sk_drops);
75841 kfree_skb(skb);
75842 return NET_RX_DROP;
75843 }
75844@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
75845
75846 if (inet->hdrincl) {
75847 if (skb_checksum_complete(skb)) {
75848- atomic_inc(&sk->sk_drops);
75849+ atomic_inc_unchecked(&sk->sk_drops);
75850 kfree_skb(skb);
75851 return NET_RX_DROP;
75852 }
75853@@ -601,7 +601,7 @@ out:
75854 return err;
75855 }
75856
75857-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
75858+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
75859 struct flowi6 *fl6, struct dst_entry **dstp,
75860 unsigned int flags)
75861 {
75862@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
75863 u16 proto;
75864 int err;
75865
75866+ pax_track_stack();
75867+
75868 /* Rough check on arithmetic overflow,
75869 better check is made in ip6_append_data().
75870 */
75871@@ -909,12 +911,15 @@ do_confirm:
75872 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
75873 char __user *optval, int optlen)
75874 {
75875+ struct icmp6_filter filter;
75876+
75877 switch (optname) {
75878 case ICMPV6_FILTER:
75879 if (optlen > sizeof(struct icmp6_filter))
75880 optlen = sizeof(struct icmp6_filter);
75881- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
75882+ if (copy_from_user(&filter, optval, optlen))
75883 return -EFAULT;
75884+ raw6_sk(sk)->filter = filter;
75885 return 0;
75886 default:
75887 return -ENOPROTOOPT;
75888@@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
75889 char __user *optval, int __user *optlen)
75890 {
75891 int len;
75892+ struct icmp6_filter filter;
75893
75894 switch (optname) {
75895 case ICMPV6_FILTER:
75896@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
75897 len = sizeof(struct icmp6_filter);
75898 if (put_user(len, optlen))
75899 return -EFAULT;
75900- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
75901+ filter = raw6_sk(sk)->filter;
75902+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
75903 return -EFAULT;
75904 return 0;
75905 default:
75906@@ -1245,7 +1252,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
75907 0, 0L, 0,
75908 sock_i_uid(sp), 0,
75909 sock_i_ino(sp),
75910- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
75911+ atomic_read(&sp->sk_refcnt),
75912+#ifdef CONFIG_GRKERNSEC_HIDESYM
75913+ NULL,
75914+#else
75915+ sp,
75916+#endif
75917+ atomic_read_unchecked(&sp->sk_drops));
75918 }
75919
75920 static int raw6_seq_show(struct seq_file *seq, void *v)
75921diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
75922index 7b8fc57..c6185da 100644
75923--- a/net/ipv6/tcp_ipv6.c
75924+++ b/net/ipv6/tcp_ipv6.c
75925@@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
75926 }
75927 #endif
75928
75929+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75930+extern int grsec_enable_blackhole;
75931+#endif
75932+
75933 static void tcp_v6_hash(struct sock *sk)
75934 {
75935 if (sk->sk_state != TCP_CLOSE) {
75936@@ -1647,6 +1651,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
75937 return 0;
75938
75939 reset:
75940+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75941+ if (!grsec_enable_blackhole)
75942+#endif
75943 tcp_v6_send_reset(sk, skb);
75944 discard:
75945 if (opt_skb)
75946@@ -1726,12 +1733,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
75947 TCP_SKB_CB(skb)->sacked = 0;
75948
75949 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
75950- if (!sk)
75951+ if (!sk) {
75952+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75953+ ret = 1;
75954+#endif
75955 goto no_tcp_socket;
75956+ }
75957
75958 process:
75959- if (sk->sk_state == TCP_TIME_WAIT)
75960+ if (sk->sk_state == TCP_TIME_WAIT) {
75961+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75962+ ret = 2;
75963+#endif
75964 goto do_time_wait;
75965+ }
75966
75967 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
75968 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
75969@@ -1779,6 +1794,10 @@ no_tcp_socket:
75970 bad_packet:
75971 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
75972 } else {
75973+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75974+ if (!grsec_enable_blackhole || (ret == 1 &&
75975+ (skb->dev->flags & IFF_LOOPBACK)))
75976+#endif
75977 tcp_v6_send_reset(NULL, skb);
75978 }
75979
75980@@ -2039,7 +2058,13 @@ static void get_openreq6(struct seq_file *seq,
75981 uid,
75982 0, /* non standard timer */
75983 0, /* open_requests have no inode */
75984- 0, req);
75985+ 0,
75986+#ifdef CONFIG_GRKERNSEC_HIDESYM
75987+ NULL
75988+#else
75989+ req
75990+#endif
75991+ );
75992 }
75993
75994 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
75995@@ -2089,7 +2114,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
75996 sock_i_uid(sp),
75997 icsk->icsk_probes_out,
75998 sock_i_ino(sp),
75999- atomic_read(&sp->sk_refcnt), sp,
76000+ atomic_read(&sp->sk_refcnt),
76001+#ifdef CONFIG_GRKERNSEC_HIDESYM
76002+ NULL,
76003+#else
76004+ sp,
76005+#endif
76006 jiffies_to_clock_t(icsk->icsk_rto),
76007 jiffies_to_clock_t(icsk->icsk_ack.ato),
76008 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
76009@@ -2124,7 +2154,13 @@ static void get_timewait6_sock(struct seq_file *seq,
76010 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76011 tw->tw_substate, 0, 0,
76012 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76013- atomic_read(&tw->tw_refcnt), tw);
76014+ atomic_read(&tw->tw_refcnt),
76015+#ifdef CONFIG_GRKERNSEC_HIDESYM
76016+ NULL
76017+#else
76018+ tw
76019+#endif
76020+ );
76021 }
76022
76023 static int tcp6_seq_show(struct seq_file *seq, void *v)
76024diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
76025index bb95e8e..ae0ee80 100644
76026--- a/net/ipv6/udp.c
76027+++ b/net/ipv6/udp.c
76028@@ -50,6 +50,10 @@
76029 #include <linux/seq_file.h>
76030 #include "udp_impl.h"
76031
76032+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76033+extern int grsec_enable_blackhole;
76034+#endif
76035+
76036 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76037 {
76038 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
76039@@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
76040
76041 return 0;
76042 drop:
76043- atomic_inc(&sk->sk_drops);
76044+ atomic_inc_unchecked(&sk->sk_drops);
76045 drop_no_sk_drops_inc:
76046 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76047 kfree_skb(skb);
76048@@ -624,7 +628,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
76049 continue;
76050 }
76051 drop:
76052- atomic_inc(&sk->sk_drops);
76053+ atomic_inc_unchecked(&sk->sk_drops);
76054 UDP6_INC_STATS_BH(sock_net(sk),
76055 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
76056 UDP6_INC_STATS_BH(sock_net(sk),
76057@@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76058 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76059 proto == IPPROTO_UDPLITE);
76060
76061+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76062+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76063+#endif
76064 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
76065
76066 kfree_skb(skb);
76067@@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76068 if (!sock_owned_by_user(sk))
76069 udpv6_queue_rcv_skb(sk, skb);
76070 else if (sk_add_backlog(sk, skb)) {
76071- atomic_inc(&sk->sk_drops);
76072+ atomic_inc_unchecked(&sk->sk_drops);
76073 bh_unlock_sock(sk);
76074 sock_put(sk);
76075 goto discard;
76076@@ -1406,8 +1413,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
76077 0, 0L, 0,
76078 sock_i_uid(sp), 0,
76079 sock_i_ino(sp),
76080- atomic_read(&sp->sk_refcnt), sp,
76081- atomic_read(&sp->sk_drops));
76082+ atomic_read(&sp->sk_refcnt),
76083+#ifdef CONFIG_GRKERNSEC_HIDESYM
76084+ NULL,
76085+#else
76086+ sp,
76087+#endif
76088+ atomic_read_unchecked(&sp->sk_drops));
76089 }
76090
76091 int udp6_seq_show(struct seq_file *seq, void *v)
76092diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
76093index b3cc8b3..baa02d0 100644
76094--- a/net/irda/ircomm/ircomm_tty.c
76095+++ b/net/irda/ircomm/ircomm_tty.c
76096@@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76097 add_wait_queue(&self->open_wait, &wait);
76098
76099 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
76100- __FILE__,__LINE__, tty->driver->name, self->open_count );
76101+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76102
76103 /* As far as I can see, we protect open_count - Jean II */
76104 spin_lock_irqsave(&self->spinlock, flags);
76105 if (!tty_hung_up_p(filp)) {
76106 extra_count = 1;
76107- self->open_count--;
76108+ local_dec(&self->open_count);
76109 }
76110 spin_unlock_irqrestore(&self->spinlock, flags);
76111- self->blocked_open++;
76112+ local_inc(&self->blocked_open);
76113
76114 while (1) {
76115 if (tty->termios->c_cflag & CBAUD) {
76116@@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76117 }
76118
76119 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
76120- __FILE__,__LINE__, tty->driver->name, self->open_count );
76121+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76122
76123 schedule();
76124 }
76125@@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76126 if (extra_count) {
76127 /* ++ is not atomic, so this should be protected - Jean II */
76128 spin_lock_irqsave(&self->spinlock, flags);
76129- self->open_count++;
76130+ local_inc(&self->open_count);
76131 spin_unlock_irqrestore(&self->spinlock, flags);
76132 }
76133- self->blocked_open--;
76134+ local_dec(&self->blocked_open);
76135
76136 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
76137- __FILE__,__LINE__, tty->driver->name, self->open_count);
76138+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
76139
76140 if (!retval)
76141 self->flags |= ASYNC_NORMAL_ACTIVE;
76142@@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
76143 }
76144 /* ++ is not atomic, so this should be protected - Jean II */
76145 spin_lock_irqsave(&self->spinlock, flags);
76146- self->open_count++;
76147+ local_inc(&self->open_count);
76148
76149 tty->driver_data = self;
76150 self->tty = tty;
76151 spin_unlock_irqrestore(&self->spinlock, flags);
76152
76153 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
76154- self->line, self->open_count);
76155+ self->line, local_read(&self->open_count));
76156
76157 /* Not really used by us, but lets do it anyway */
76158 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
76159@@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76160 return;
76161 }
76162
76163- if ((tty->count == 1) && (self->open_count != 1)) {
76164+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
76165 /*
76166 * Uh, oh. tty->count is 1, which means that the tty
76167 * structure will be freed. state->count should always
76168@@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76169 */
76170 IRDA_DEBUG(0, "%s(), bad serial port count; "
76171 "tty->count is 1, state->count is %d\n", __func__ ,
76172- self->open_count);
76173- self->open_count = 1;
76174+ local_read(&self->open_count));
76175+ local_set(&self->open_count, 1);
76176 }
76177
76178- if (--self->open_count < 0) {
76179+ if (local_dec_return(&self->open_count) < 0) {
76180 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
76181- __func__, self->line, self->open_count);
76182- self->open_count = 0;
76183+ __func__, self->line, local_read(&self->open_count));
76184+ local_set(&self->open_count, 0);
76185 }
76186- if (self->open_count) {
76187+ if (local_read(&self->open_count)) {
76188 spin_unlock_irqrestore(&self->spinlock, flags);
76189
76190 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
76191@@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76192 tty->closing = 0;
76193 self->tty = NULL;
76194
76195- if (self->blocked_open) {
76196+ if (local_read(&self->blocked_open)) {
76197 if (self->close_delay)
76198 schedule_timeout_interruptible(self->close_delay);
76199 wake_up_interruptible(&self->open_wait);
76200@@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
76201 spin_lock_irqsave(&self->spinlock, flags);
76202 self->flags &= ~ASYNC_NORMAL_ACTIVE;
76203 self->tty = NULL;
76204- self->open_count = 0;
76205+ local_set(&self->open_count, 0);
76206 spin_unlock_irqrestore(&self->spinlock, flags);
76207
76208 wake_up_interruptible(&self->open_wait);
76209@@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
76210 seq_putc(m, '\n');
76211
76212 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
76213- seq_printf(m, "Open count: %d\n", self->open_count);
76214+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
76215 seq_printf(m, "Max data size: %d\n", self->max_data_size);
76216 seq_printf(m, "Max header size: %d\n", self->max_header_size);
76217
76218diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
76219index e2013e4..edfc1e3 100644
76220--- a/net/iucv/af_iucv.c
76221+++ b/net/iucv/af_iucv.c
76222@@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct sock *sk)
76223
76224 write_lock_bh(&iucv_sk_list.lock);
76225
76226- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
76227+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
76228 while (__iucv_get_sock_by_name(name)) {
76229 sprintf(name, "%08x",
76230- atomic_inc_return(&iucv_sk_list.autobind_name));
76231+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
76232 }
76233
76234 write_unlock_bh(&iucv_sk_list.lock);
76235diff --git a/net/key/af_key.c b/net/key/af_key.c
76236index 1e733e9..c84de2f 100644
76237--- a/net/key/af_key.c
76238+++ b/net/key/af_key.c
76239@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
76240 struct xfrm_migrate m[XFRM_MAX_DEPTH];
76241 struct xfrm_kmaddress k;
76242
76243+ pax_track_stack();
76244+
76245 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
76246 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
76247 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
76248@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
76249 static u32 get_acqseq(void)
76250 {
76251 u32 res;
76252- static atomic_t acqseq;
76253+ static atomic_unchecked_t acqseq;
76254
76255 do {
76256- res = atomic_inc_return(&acqseq);
76257+ res = atomic_inc_return_unchecked(&acqseq);
76258 } while (!res);
76259 return res;
76260 }
76261diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
76262index 956b7e4..f01d328 100644
76263--- a/net/lapb/lapb_iface.c
76264+++ b/net/lapb/lapb_iface.c
76265@@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
76266 goto out;
76267
76268 lapb->dev = dev;
76269- lapb->callbacks = *callbacks;
76270+ lapb->callbacks = callbacks;
76271
76272 __lapb_insert_cb(lapb);
76273
76274@@ -380,32 +380,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
76275
76276 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
76277 {
76278- if (lapb->callbacks.connect_confirmation)
76279- lapb->callbacks.connect_confirmation(lapb->dev, reason);
76280+ if (lapb->callbacks->connect_confirmation)
76281+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
76282 }
76283
76284 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
76285 {
76286- if (lapb->callbacks.connect_indication)
76287- lapb->callbacks.connect_indication(lapb->dev, reason);
76288+ if (lapb->callbacks->connect_indication)
76289+ lapb->callbacks->connect_indication(lapb->dev, reason);
76290 }
76291
76292 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
76293 {
76294- if (lapb->callbacks.disconnect_confirmation)
76295- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
76296+ if (lapb->callbacks->disconnect_confirmation)
76297+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
76298 }
76299
76300 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
76301 {
76302- if (lapb->callbacks.disconnect_indication)
76303- lapb->callbacks.disconnect_indication(lapb->dev, reason);
76304+ if (lapb->callbacks->disconnect_indication)
76305+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
76306 }
76307
76308 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
76309 {
76310- if (lapb->callbacks.data_indication)
76311- return lapb->callbacks.data_indication(lapb->dev, skb);
76312+ if (lapb->callbacks->data_indication)
76313+ return lapb->callbacks->data_indication(lapb->dev, skb);
76314
76315 kfree_skb(skb);
76316 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
76317@@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
76318 {
76319 int used = 0;
76320
76321- if (lapb->callbacks.data_transmit) {
76322- lapb->callbacks.data_transmit(lapb->dev, skb);
76323+ if (lapb->callbacks->data_transmit) {
76324+ lapb->callbacks->data_transmit(lapb->dev, skb);
76325 used = 1;
76326 }
76327
76328diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
76329index a01d213..6a1f1ab 100644
76330--- a/net/mac80211/debugfs_sta.c
76331+++ b/net/mac80211/debugfs_sta.c
76332@@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
76333 struct tid_ampdu_rx *tid_rx;
76334 struct tid_ampdu_tx *tid_tx;
76335
76336+ pax_track_stack();
76337+
76338 rcu_read_lock();
76339
76340 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
76341@@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
76342 struct sta_info *sta = file->private_data;
76343 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
76344
76345+ pax_track_stack();
76346+
76347 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
76348 htc->ht_supported ? "" : "not ");
76349 if (htc->ht_supported) {
76350diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
76351index 9fab144..7f0fc14 100644
76352--- a/net/mac80211/ieee80211_i.h
76353+++ b/net/mac80211/ieee80211_i.h
76354@@ -27,6 +27,7 @@
76355 #include <net/ieee80211_radiotap.h>
76356 #include <net/cfg80211.h>
76357 #include <net/mac80211.h>
76358+#include <asm/local.h>
76359 #include "key.h"
76360 #include "sta_info.h"
76361
76362@@ -754,7 +755,7 @@ struct ieee80211_local {
76363 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
76364 spinlock_t queue_stop_reason_lock;
76365
76366- int open_count;
76367+ local_t open_count;
76368 int monitors, cooked_mntrs;
76369 /* number of interfaces with corresponding FIF_ flags */
76370 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
76371diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
76372index 556e7e6..120dcaf 100644
76373--- a/net/mac80211/iface.c
76374+++ b/net/mac80211/iface.c
76375@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76376 break;
76377 }
76378
76379- if (local->open_count == 0) {
76380+ if (local_read(&local->open_count) == 0) {
76381 res = drv_start(local);
76382 if (res)
76383 goto err_del_bss;
76384@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76385 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
76386
76387 if (!is_valid_ether_addr(dev->dev_addr)) {
76388- if (!local->open_count)
76389+ if (!local_read(&local->open_count))
76390 drv_stop(local);
76391 return -EADDRNOTAVAIL;
76392 }
76393@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76394 mutex_unlock(&local->mtx);
76395
76396 if (coming_up)
76397- local->open_count++;
76398+ local_inc(&local->open_count);
76399
76400 if (hw_reconf_flags) {
76401 ieee80211_hw_config(local, hw_reconf_flags);
76402@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76403 err_del_interface:
76404 drv_remove_interface(local, &sdata->vif);
76405 err_stop:
76406- if (!local->open_count)
76407+ if (!local_read(&local->open_count))
76408 drv_stop(local);
76409 err_del_bss:
76410 sdata->bss = NULL;
76411@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
76412 }
76413
76414 if (going_down)
76415- local->open_count--;
76416+ local_dec(&local->open_count);
76417
76418 switch (sdata->vif.type) {
76419 case NL80211_IFTYPE_AP_VLAN:
76420@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
76421
76422 ieee80211_recalc_ps(local, -1);
76423
76424- if (local->open_count == 0) {
76425+ if (local_read(&local->open_count) == 0) {
76426 if (local->ops->napi_poll)
76427 napi_disable(&local->napi);
76428 ieee80211_clear_tx_pending(local);
76429diff --git a/net/mac80211/main.c b/net/mac80211/main.c
76430index 3d90dad..36884d5 100644
76431--- a/net/mac80211/main.c
76432+++ b/net/mac80211/main.c
76433@@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
76434 local->hw.conf.power_level = power;
76435 }
76436
76437- if (changed && local->open_count) {
76438+ if (changed && local_read(&local->open_count)) {
76439 ret = drv_config(local, changed);
76440 /*
76441 * Goal:
76442diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
76443index 0f48368..d48e688 100644
76444--- a/net/mac80211/mlme.c
76445+++ b/net/mac80211/mlme.c
76446@@ -1464,6 +1464,8 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
76447 bool have_higher_than_11mbit = false;
76448 u16 ap_ht_cap_flags;
76449
76450+ pax_track_stack();
76451+
76452 /* AssocResp and ReassocResp have identical structure */
76453
76454 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
76455diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
76456index 6326d34..7225f61 100644
76457--- a/net/mac80211/pm.c
76458+++ b/net/mac80211/pm.c
76459@@ -34,7 +34,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76460 struct ieee80211_sub_if_data *sdata;
76461 struct sta_info *sta;
76462
76463- if (!local->open_count)
76464+ if (!local_read(&local->open_count))
76465 goto suspend;
76466
76467 ieee80211_scan_cancel(local);
76468@@ -72,7 +72,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76469 cancel_work_sync(&local->dynamic_ps_enable_work);
76470 del_timer_sync(&local->dynamic_ps_timer);
76471
76472- local->wowlan = wowlan && local->open_count;
76473+ local->wowlan = wowlan && local_read(&local->open_count);
76474 if (local->wowlan) {
76475 int err = drv_suspend(local, wowlan);
76476 if (err < 0) {
76477@@ -129,7 +129,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76478 }
76479
76480 /* stop hardware - this must stop RX */
76481- if (local->open_count)
76482+ if (local_read(&local->open_count))
76483 ieee80211_stop_device(local);
76484
76485 suspend:
76486diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
76487index 3d5a2cb..b17ad48 100644
76488--- a/net/mac80211/rate.c
76489+++ b/net/mac80211/rate.c
76490@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
76491
76492 ASSERT_RTNL();
76493
76494- if (local->open_count)
76495+ if (local_read(&local->open_count))
76496 return -EBUSY;
76497
76498 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
76499diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
76500index 4851e9e..d860e05 100644
76501--- a/net/mac80211/rc80211_pid_debugfs.c
76502+++ b/net/mac80211/rc80211_pid_debugfs.c
76503@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
76504
76505 spin_unlock_irqrestore(&events->lock, status);
76506
76507- if (copy_to_user(buf, pb, p))
76508+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
76509 return -EFAULT;
76510
76511 return p;
76512diff --git a/net/mac80211/util.c b/net/mac80211/util.c
76513index fd031e8..84fbfcf 100644
76514--- a/net/mac80211/util.c
76515+++ b/net/mac80211/util.c
76516@@ -1170,7 +1170,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
76517 drv_set_coverage_class(local, hw->wiphy->coverage_class);
76518
76519 /* everything else happens only if HW was up & running */
76520- if (!local->open_count)
76521+ if (!local_read(&local->open_count))
76522 goto wake_up;
76523
76524 /*
76525diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
76526index 32bff6d..d0cf986 100644
76527--- a/net/netfilter/Kconfig
76528+++ b/net/netfilter/Kconfig
76529@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
76530
76531 To compile it as a module, choose M here. If unsure, say N.
76532
76533+config NETFILTER_XT_MATCH_GRADM
76534+ tristate '"gradm" match support'
76535+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
76536+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
76537+ ---help---
76538+ The gradm match allows to match on grsecurity RBAC being enabled.
76539+ It is useful when iptables rules are applied early on bootup to
76540+ prevent connections to the machine (except from a trusted host)
76541+ while the RBAC system is disabled.
76542+
76543 config NETFILTER_XT_MATCH_HASHLIMIT
76544 tristate '"hashlimit" match support'
76545 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
76546diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
76547index 1a02853..5d8c22e 100644
76548--- a/net/netfilter/Makefile
76549+++ b/net/netfilter/Makefile
76550@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
76551 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
76552 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
76553 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
76554+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
76555 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
76556 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
76557 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
76558diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
76559index 12571fb..fb73976 100644
76560--- a/net/netfilter/ipvs/ip_vs_conn.c
76561+++ b/net/netfilter/ipvs/ip_vs_conn.c
76562@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
76563 /* Increase the refcnt counter of the dest */
76564 atomic_inc(&dest->refcnt);
76565
76566- conn_flags = atomic_read(&dest->conn_flags);
76567+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
76568 if (cp->protocol != IPPROTO_UDP)
76569 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
76570 /* Bind with the destination and its corresponding transmitter */
76571@@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
76572 atomic_set(&cp->refcnt, 1);
76573
76574 atomic_set(&cp->n_control, 0);
76575- atomic_set(&cp->in_pkts, 0);
76576+ atomic_set_unchecked(&cp->in_pkts, 0);
76577
76578 atomic_inc(&ipvs->conn_count);
76579 if (flags & IP_VS_CONN_F_NO_CPORT)
76580@@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
76581
76582 /* Don't drop the entry if its number of incoming packets is not
76583 located in [0, 8] */
76584- i = atomic_read(&cp->in_pkts);
76585+ i = atomic_read_unchecked(&cp->in_pkts);
76586 if (i > 8 || i < 0) return 0;
76587
76588 if (!todrop_rate[i]) return 0;
76589diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
76590index 4f77bb1..5d0bc26 100644
76591--- a/net/netfilter/ipvs/ip_vs_core.c
76592+++ b/net/netfilter/ipvs/ip_vs_core.c
76593@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
76594 ret = cp->packet_xmit(skb, cp, pd->pp);
76595 /* do not touch skb anymore */
76596
76597- atomic_inc(&cp->in_pkts);
76598+ atomic_inc_unchecked(&cp->in_pkts);
76599 ip_vs_conn_put(cp);
76600 return ret;
76601 }
76602@@ -1612,7 +1612,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
76603 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
76604 pkts = sysctl_sync_threshold(ipvs);
76605 else
76606- pkts = atomic_add_return(1, &cp->in_pkts);
76607+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
76608
76609 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
76610 cp->protocol == IPPROTO_SCTP) {
76611diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
76612index e3be48b..d658c8c 100644
76613--- a/net/netfilter/ipvs/ip_vs_ctl.c
76614+++ b/net/netfilter/ipvs/ip_vs_ctl.c
76615@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
76616 ip_vs_rs_hash(ipvs, dest);
76617 write_unlock_bh(&ipvs->rs_lock);
76618 }
76619- atomic_set(&dest->conn_flags, conn_flags);
76620+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
76621
76622 /* bind the service */
76623 if (!dest->svc) {
76624@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
76625 " %-7s %-6d %-10d %-10d\n",
76626 &dest->addr.in6,
76627 ntohs(dest->port),
76628- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
76629+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
76630 atomic_read(&dest->weight),
76631 atomic_read(&dest->activeconns),
76632 atomic_read(&dest->inactconns));
76633@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
76634 "%-7s %-6d %-10d %-10d\n",
76635 ntohl(dest->addr.ip),
76636 ntohs(dest->port),
76637- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
76638+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
76639 atomic_read(&dest->weight),
76640 atomic_read(&dest->activeconns),
76641 atomic_read(&dest->inactconns));
76642@@ -2285,6 +2285,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
76643 struct ip_vs_dest_user_kern udest;
76644 struct netns_ipvs *ipvs = net_ipvs(net);
76645
76646+ pax_track_stack();
76647+
76648 if (!capable(CAP_NET_ADMIN))
76649 return -EPERM;
76650
76651@@ -2508,7 +2510,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
76652
76653 entry.addr = dest->addr.ip;
76654 entry.port = dest->port;
76655- entry.conn_flags = atomic_read(&dest->conn_flags);
76656+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
76657 entry.weight = atomic_read(&dest->weight);
76658 entry.u_threshold = dest->u_threshold;
76659 entry.l_threshold = dest->l_threshold;
76660@@ -3041,7 +3043,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
76661 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
76662
76663 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
76664- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
76665+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
76666 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
76667 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
76668 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
76669diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
76670index 3cdd479..116afa8 100644
76671--- a/net/netfilter/ipvs/ip_vs_sync.c
76672+++ b/net/netfilter/ipvs/ip_vs_sync.c
76673@@ -649,7 +649,7 @@ control:
76674 * i.e only increment in_pkts for Templates.
76675 */
76676 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
76677- int pkts = atomic_add_return(1, &cp->in_pkts);
76678+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
76679
76680 if (pkts % sysctl_sync_period(ipvs) != 1)
76681 return;
76682@@ -795,7 +795,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
76683
76684 if (opt)
76685 memcpy(&cp->in_seq, opt, sizeof(*opt));
76686- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
76687+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
76688 cp->state = state;
76689 cp->old_state = cp->state;
76690 /*
76691diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
76692index ee319a4..8a285ee 100644
76693--- a/net/netfilter/ipvs/ip_vs_xmit.c
76694+++ b/net/netfilter/ipvs/ip_vs_xmit.c
76695@@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
76696 else
76697 rc = NF_ACCEPT;
76698 /* do not touch skb anymore */
76699- atomic_inc(&cp->in_pkts);
76700+ atomic_inc_unchecked(&cp->in_pkts);
76701 goto out;
76702 }
76703
76704@@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
76705 else
76706 rc = NF_ACCEPT;
76707 /* do not touch skb anymore */
76708- atomic_inc(&cp->in_pkts);
76709+ atomic_inc_unchecked(&cp->in_pkts);
76710 goto out;
76711 }
76712
76713diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
76714index 2d8158a..5dca296 100644
76715--- a/net/netfilter/nfnetlink_log.c
76716+++ b/net/netfilter/nfnetlink_log.c
76717@@ -70,7 +70,7 @@ struct nfulnl_instance {
76718 };
76719
76720 static DEFINE_SPINLOCK(instances_lock);
76721-static atomic_t global_seq;
76722+static atomic_unchecked_t global_seq;
76723
76724 #define INSTANCE_BUCKETS 16
76725 static struct hlist_head instance_table[INSTANCE_BUCKETS];
76726@@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_instance *inst,
76727 /* global sequence number */
76728 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
76729 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
76730- htonl(atomic_inc_return(&global_seq)));
76731+ htonl(atomic_inc_return_unchecked(&global_seq)));
76732
76733 if (data_len) {
76734 struct nlattr *nla;
76735diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
76736new file mode 100644
76737index 0000000..6905327
76738--- /dev/null
76739+++ b/net/netfilter/xt_gradm.c
76740@@ -0,0 +1,51 @@
76741+/*
76742+ * gradm match for netfilter
76743