]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-3.1.7-201201032037.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-3.1.7-201201032037.patch
CommitLineData
a965eed0
PK		 1diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2index dfa6fc6..0095943 100644
3--- a/Documentation/dontdiff
4+++ b/Documentation/dontdiff
5@@ -5,6 +5,7 @@
6 *.cis
7 *.cpio
8 *.csp
9+*.dbg
10 *.dsp
11 *.dvi
12 *.elf
13@@ -14,6 +15,7 @@
14 *.gcov
15 *.gen.S
16 *.gif
17+*.gmo
18 *.grep
19 *.grp
20 *.gz
21@@ -48,9 +50,11 @@
22 *.tab.h
23 *.tex
24 *.ver
25+*.vim
26 *.xml
27 *.xz
28 *_MODULES
29+*_reg_safe.h
30 *_vga16.c
31 *~
32 \#*#
33@@ -70,6 +74,7 @@ Kerntypes
34 Module.markers
35 Module.symvers
36 PENDING
37+PERF*
38 SCCS
39 System.map*
40 TAGS
41@@ -93,19 +98,24 @@ bounds.h
42 bsetup
43 btfixupprep
44 build
45+builtin-policy.h
46 bvmlinux
47 bzImage*
48 capability_names.h
49 capflags.c
50 classlist.h*
51+clut_vga16.c
52+common-cmds.h
53 comp*.log
54 compile.h*
55 conf
56 config
57 config-*
58 config_data.h*
59+config.c
60 config.mak
61 config.mak.autogen
62+config.tmp
63 conmakehash
64 consolemap_deftbl.c*
65 cpustr.h
66@@ -119,6 +129,7 @@ dslm
67 elf2ecoff
68 elfconfig.h*
69 evergreen_reg_safe.h
70+exception_policy.conf
71 fixdep
72 flask.h
73 fore200e_mkfirm
74@@ -126,12 +137,15 @@ fore200e_pca_fw.c*
75 gconf
76 gconf.glade.h
77 gen-devlist
78+gen-kdb_cmds.c
79 gen_crc32table
80 gen_init_cpio
81 generated
82 genheaders
83 genksyms
84 *_gray256.c
85+hash
86+hid-example
87 hpet_example
88 hugepage-mmap
89 hugepage-shm
90@@ -146,7 +160,7 @@ int32.c
91 int4.c
92 int8.c
93 kallsyms
94-kconfig
95+kern_constants.h
96 keywords.c
97 ksym.c*
98 ksym.h*
99@@ -154,7 +168,6 @@ kxgettext
100 lkc_defs.h
101 lex.c
102 lex.*.c
103-linux
104 logo_*.c
105 logo_*_clut224.c
106 logo_*_mono.c
107@@ -166,14 +179,15 @@ machtypes.h
108 map
109 map_hugetlb
110 maui_boot.h
111-media
112 mconf
113+mdp
114 miboot*
115 mk_elfconfig
116 mkboot
117 mkbugboot
118 mkcpustr
119 mkdep
120+mkpiggy
121 mkprep
122 mkregtable
123 mktables
124@@ -209,6 +223,7 @@ r300_reg_safe.h
125 r420_reg_safe.h
126 r600_reg_safe.h
127 recordmcount
128+regdb.c
129 relocs
130 rlim_names.h
131 rn50_reg_safe.h
132@@ -219,6 +234,7 @@ setup
133 setup.bin
134 setup.elf
135 sImage
136+slabinfo
137 sm_tbl*
138 split-include
139 syscalltab.h
140@@ -229,6 +245,7 @@ tftpboot.img
141 timeconst.h
142 times.h*
143 trix_boot.h
144+user_constants.h
145 utsrelease.h*
146 vdso-syms.lds
147 vdso.lds
148@@ -246,7 +263,9 @@ vmlinux
149 vmlinux-*
150 vmlinux.aout
151 vmlinux.bin.all
152+vmlinux.bin.bz2
153 vmlinux.lds
154+vmlinux.relocs
155 vmlinuz
156 voffset.h
157 vsyscall.lds
158@@ -254,9 +273,11 @@ vsyscall_32.lds
159 wanxlfw.inc
160 uImage
161 unifdef
162+utsrelease.h
163 wakeup.bin
164 wakeup.elf
165 wakeup.lds
166 zImage*
167 zconf.hash.c
168+zconf.lex.c
169 zoffset.h
170diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
171index d6e6724..a024ce8 100644
172--- a/Documentation/kernel-parameters.txt
173+++ b/Documentation/kernel-parameters.txt
174@@ -1898,6 +1898,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
175 the specified number of seconds. This is to be used if
176 your oopses keep scrolling off the screen.
177
178+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
179+ virtualization environments that don't cope well with the
180+ expand down segment used by UDEREF on X86-32 or the frequent
181+ page table updates on X86-64.
182+
183+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
184+
185 pcbit= [HW,ISDN]
186
187 pcd. [PARIDE]
188diff --git a/Makefile b/Makefile
189index 96c48df..f811964 100644
190--- a/Makefile
191+++ b/Makefile
192@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
193
194 HOSTCC = gcc
195 HOSTCXX = g++
196-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
197-HOSTCXXFLAGS = -O2
198+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
199+HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
200+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
201
202 # Decide whether to build built-in, modular, or both.
203 # Normally, just do built-in.
204@@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
205 # Rules shared between *config targets and build targets
206
207 # Basic helpers built in scripts/
208-PHONY += scripts_basic
209-scripts_basic:
210+PHONY += scripts_basic gcc-plugins
211+scripts_basic: gcc-plugins
212 $(Q)$(MAKE) $(build)=scripts/basic
213 $(Q)rm -f .tmp_quiet_recordmcount
214
215@@ -564,6 +565,42 @@ else
216 KBUILD_CFLAGS += -O2
217 endif
218
219+ifndef DISABLE_PAX_PLUGINS
220+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
221+ifndef DISABLE_PAX_CONSTIFY_PLUGIN
222+CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
223+endif
224+ifdef CONFIG_PAX_MEMORY_STACKLEAK
225+STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
226+STACKLEAK_PLUGIN += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
227+endif
228+ifdef CONFIG_KALLOCSTAT_PLUGIN
229+KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
230+endif
231+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
232+KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
233+KERNEXEC_PLUGIN += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD)
234+endif
235+ifdef CONFIG_CHECKER_PLUGIN
236+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
237+CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
238+endif
239+endif
240+GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
241+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
242+gcc-plugins:
243+ $(Q)$(MAKE) $(build)=tools/gcc
244+else
245+gcc-plugins:
246+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
247+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
248+else
249+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
250+endif
251+ $(Q)echo "PAX_MEMORY_STACKLEAK and other features will be less secure"
252+endif
253+endif
254+
255 include $(srctree)/arch/$(SRCARCH)/Makefile
256
257 ifneq ($(CONFIG_FRAME_WARN),0)
258@@ -708,7 +745,7 @@ export mod_strip_cmd
259
260
261 ifeq ($(KBUILD_EXTMOD),)
262-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
263+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
264
265 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
266 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
267@@ -932,6 +969,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
268
269 # The actual objects are generated when descending,
270 # make sure no implicit rule kicks in
271+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
272 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
273
274 # Handle descending into subdirectories listed in $(vmlinux-dirs)
275@@ -941,7 +979,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
276 # Error messages still appears in the original language
277
278 PHONY += $(vmlinux-dirs)
279-$(vmlinux-dirs): prepare scripts
280+$(vmlinux-dirs): gcc-plugins prepare scripts
281 $(Q)$(MAKE) $(build)=$@
282
283 # Store (new) KERNELRELASE string in include/config/kernel.release
284@@ -986,6 +1024,7 @@ prepare0: archprepare FORCE
285 $(Q)$(MAKE) $(build)=. missing-syscalls
286
287 # All the preparing..
288+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
289 prepare: prepare0
290
291 # Generate some files
292@@ -1087,6 +1126,7 @@ all: modules
293 # using awk while concatenating to the final file.
294
295 PHONY += modules
296+modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
297 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
298 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
299 @$(kecho) ' Building modules, stage 2.';
300@@ -1102,7 +1142,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
301
302 # Target to prepare building external modules
303 PHONY += modules_prepare
304-modules_prepare: prepare scripts
305+modules_prepare: gcc-plugins prepare scripts
306
307 # Target to install modules
308 PHONY += modules_install
309@@ -1198,7 +1238,7 @@ distclean: mrproper
310 @find $(srctree) $(RCS_FIND_IGNORE) \
311 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
312 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
313- -o -name '.*.rej' -o -size 0 \
314+ -o -name '.*.rej' -o -name '*.so' -o -size 0 \
315 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
316 -type f -print | xargs rm -f
317
318@@ -1360,6 +1400,7 @@ PHONY += $(module-dirs) modules
319 $(module-dirs): crmodverdir $(objtree)/Module.symvers
320 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
321
322+modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
323 modules: $(module-dirs)
324 @$(kecho) ' Building modules, stage 2.';
325 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
326@@ -1486,17 +1527,19 @@ else
327 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
328 endif
329
330-%.s: %.c prepare scripts FORCE
331+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
332+%.s: %.c gcc-plugins prepare scripts FORCE
333 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
334 %.i: %.c prepare scripts FORCE
335 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
336-%.o: %.c prepare scripts FORCE
337+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
338+%.o: %.c gcc-plugins prepare scripts FORCE
339 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
340 %.lst: %.c prepare scripts FORCE
341 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
342-%.s: %.S prepare scripts FORCE
343+%.s: %.S gcc-plugins prepare scripts FORCE
344 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
345-%.o: %.S prepare scripts FORCE
346+%.o: %.S gcc-plugins prepare scripts FORCE
347 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
348 %.symtypes: %.c prepare scripts FORCE
349 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
350@@ -1506,11 +1549,13 @@ endif
351 $(cmd_crmodverdir)
352 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
353 $(build)=$(build-dir)
354-%/: prepare scripts FORCE
355+%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
356+%/: gcc-plugins prepare scripts FORCE
357 $(cmd_crmodverdir)
358 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
359 $(build)=$(build-dir)
360-%.ko: prepare scripts FORCE
361+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
362+%.ko: gcc-plugins prepare scripts FORCE
363 $(cmd_crmodverdir)
364 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
365 $(build)=$(build-dir) $(@:.ko=.o)
366diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
367index da5449e..7418343 100644
368--- a/arch/alpha/include/asm/elf.h
369+++ b/arch/alpha/include/asm/elf.h
370@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
371
372 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
373
374+#ifdef CONFIG_PAX_ASLR
375+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
376+
377+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
378+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
379+#endif
380+
381 /* $0 is set by ld.so to a pointer to a function which might be
382 registered using atexit. This provides a mean for the dynamic
383 linker to call DT_FINI functions for shared libraries that have
384diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
385index de98a73..bd4f1f8 100644
386--- a/arch/alpha/include/asm/pgtable.h
387+++ b/arch/alpha/include/asm/pgtable.h
388@@ -101,6 +101,17 @@ struct vm_area_struct;
389 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
390 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
391 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
392+
393+#ifdef CONFIG_PAX_PAGEEXEC
394+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
395+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
396+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
397+#else
398+# define PAGE_SHARED_NOEXEC PAGE_SHARED
399+# define PAGE_COPY_NOEXEC PAGE_COPY
400+# define PAGE_READONLY_NOEXEC PAGE_READONLY
401+#endif
402+
403 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
404
405 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
406diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
407index 2fd00b7..cfd5069 100644
408--- a/arch/alpha/kernel/module.c
409+++ b/arch/alpha/kernel/module.c
410@@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
411
412 /* The small sections were sorted to the end of the segment.
413 The following should definitely cover them. */
414- gp = (u64)me->module_core + me->core_size - 0x8000;
415+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
416 got = sechdrs[me->arch.gotsecindex].sh_addr;
417
418 for (i = 0; i < n; i++) {
419diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
420index 01e8715..be0e80f 100644
421--- a/arch/alpha/kernel/osf_sys.c
422+++ b/arch/alpha/kernel/osf_sys.c
423@@ -1147,7 +1147,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
424 /* At this point: (!vma || addr < vma->vm_end). */
425 if (limit - len < addr)
426 return -ENOMEM;
427- if (!vma || addr + len <= vma->vm_start)
428+ if (check_heap_stack_gap(vma, addr, len))
429 return addr;
430 addr = vma->vm_end;
431 vma = vma->vm_next;
432@@ -1183,6 +1183,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
433 merely specific addresses, but regions of memory -- perhaps
434 this feature should be incorporated into all ports? */
435
436+#ifdef CONFIG_PAX_RANDMMAP
437+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
438+#endif
439+
440 if (addr) {
441 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
442 if (addr != (unsigned long) -ENOMEM)
443@@ -1190,8 +1194,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
444 }
445
446 /* Next, try allocating at TASK_UNMAPPED_BASE. */
447- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
448- len, limit);
449+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
450+
451 if (addr != (unsigned long) -ENOMEM)
452 return addr;
453
454diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
455index fadd5f8..904e73a 100644
456--- a/arch/alpha/mm/fault.c
457+++ b/arch/alpha/mm/fault.c
458@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
459 __reload_thread(pcb);
460 }
461
462+#ifdef CONFIG_PAX_PAGEEXEC
463+/*
464+ * PaX: decide what to do with offenders (regs->pc = fault address)
465+ *
466+ * returns 1 when task should be killed
467+ * 2 when patched PLT trampoline was detected
468+ * 3 when unpatched PLT trampoline was detected
469+ */
470+static int pax_handle_fetch_fault(struct pt_regs *regs)
471+{
472+
473+#ifdef CONFIG_PAX_EMUPLT
474+ int err;
475+
476+ do { /* PaX: patched PLT emulation #1 */
477+ unsigned int ldah, ldq, jmp;
478+
479+ err = get_user(ldah, (unsigned int *)regs->pc);
480+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
481+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
482+
483+ if (err)
484+ break;
485+
486+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
487+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
488+ jmp == 0x6BFB0000U)
489+ {
490+ unsigned long r27, addr;
491+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
492+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
493+
494+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
495+ err = get_user(r27, (unsigned long *)addr);
496+ if (err)
497+ break;
498+
499+ regs->r27 = r27;
500+ regs->pc = r27;
501+ return 2;
502+ }
503+ } while (0);
504+
505+ do { /* PaX: patched PLT emulation #2 */
506+ unsigned int ldah, lda, br;
507+
508+ err = get_user(ldah, (unsigned int *)regs->pc);
509+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
510+ err |= get_user(br, (unsigned int *)(regs->pc+8));
511+
512+ if (err)
513+ break;
514+
515+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
516+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
517+ (br & 0xFFE00000U) == 0xC3E00000U)
518+ {
519+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
520+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
521+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
522+
523+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
524+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
525+ return 2;
526+ }
527+ } while (0);
528+
529+ do { /* PaX: unpatched PLT emulation */
530+ unsigned int br;
531+
532+ err = get_user(br, (unsigned int *)regs->pc);
533+
534+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
535+ unsigned int br2, ldq, nop, jmp;
536+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
537+
538+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
539+ err = get_user(br2, (unsigned int *)addr);
540+ err |= get_user(ldq, (unsigned int *)(addr+4));
541+ err |= get_user(nop, (unsigned int *)(addr+8));
542+ err |= get_user(jmp, (unsigned int *)(addr+12));
543+ err |= get_user(resolver, (unsigned long *)(addr+16));
544+
545+ if (err)
546+ break;
547+
548+ if (br2 == 0xC3600000U &&
549+ ldq == 0xA77B000CU &&
550+ nop == 0x47FF041FU &&
551+ jmp == 0x6B7B0000U)
552+ {
553+ regs->r28 = regs->pc+4;
554+ regs->r27 = addr+16;
555+ regs->pc = resolver;
556+ return 3;
557+ }
558+ }
559+ } while (0);
560+#endif
561+
562+ return 1;
563+}
564+
565+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
566+{
567+ unsigned long i;
568+
569+ printk(KERN_ERR "PAX: bytes at PC: ");
570+ for (i = 0; i < 5; i++) {
571+ unsigned int c;
572+ if (get_user(c, (unsigned int *)pc+i))
573+ printk(KERN_CONT "???????? ");
574+ else
575+ printk(KERN_CONT "%08x ", c);
576+ }
577+ printk("\n");
578+}
579+#endif
580
581 /*
582 * This routine handles page faults. It determines the address,
583@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
584 good_area:
585 si_code = SEGV_ACCERR;
586 if (cause < 0) {
587- if (!(vma->vm_flags & VM_EXEC))
588+ if (!(vma->vm_flags & VM_EXEC)) {
589+
590+#ifdef CONFIG_PAX_PAGEEXEC
591+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
592+ goto bad_area;
593+
594+ up_read(&mm->mmap_sem);
595+ switch (pax_handle_fetch_fault(regs)) {
596+
597+#ifdef CONFIG_PAX_EMUPLT
598+ case 2:
599+ case 3:
600+ return;
601+#endif
602+
603+ }
604+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
605+ do_group_exit(SIGKILL);
606+#else
607 goto bad_area;
608+#endif
609+
610+ }
611 } else if (!cause) {
612 /* Allow reads even for write-only mappings */
613 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
614diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
615index 86976d0..8a57797 100644
616--- a/arch/arm/include/asm/atomic.h
617+++ b/arch/arm/include/asm/atomic.h
618@@ -239,6 +239,14 @@ typedef struct {
619 u64 __aligned(8) counter;
620 } atomic64_t;
621
622+#ifdef CONFIG_PAX_REFCOUNT
623+typedef struct {
624+ u64 __aligned(8) counter;
625+} atomic64_unchecked_t;
626+#else
627+typedef atomic64_t atomic64_unchecked_t;
628+#endif
629+
630 #define ATOMIC64_INIT(i) { (i) }
631
632 static inline u64 atomic64_read(atomic64_t *v)
633diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
634index 0e9ce8d..6ef1e03 100644
635--- a/arch/arm/include/asm/elf.h
636+++ b/arch/arm/include/asm/elf.h
637@@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
638 the loader. We need to make sure that it is out of the way of the program
639 that it will "exec", and that there is sufficient room for the brk. */
640
641-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
642+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
643+
644+#ifdef CONFIG_PAX_ASLR
645+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
646+
647+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
648+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
649+#endif
650
651 /* When the program starts, a1 contains a pointer to a function to be
652 registered with atexit, as per the SVR4 ABI. A value of 0 means we
653@@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
654 extern void elf_set_personality(const struct elf32_hdr *);
655 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
656
657-struct mm_struct;
658-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
659-#define arch_randomize_brk arch_randomize_brk
660-
661 extern int vectors_user_mapping(void);
662 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
663 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
664diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
665index e51b1e8..32a3113 100644
666--- a/arch/arm/include/asm/kmap_types.h
667+++ b/arch/arm/include/asm/kmap_types.h
668@@ -21,6 +21,7 @@ enum km_type {
669 KM_L1_CACHE,
670 KM_L2_CACHE,
671 KM_KDB,
672+ KM_CLEARPAGE,
673 KM_TYPE_NR
674 };
675
676diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
677index b293616..96310e5 100644
678--- a/arch/arm/include/asm/uaccess.h
679+++ b/arch/arm/include/asm/uaccess.h
680@@ -22,6 +22,8 @@
681 #define VERIFY_READ 0
682 #define VERIFY_WRITE 1
683
684+extern void check_object_size(const void *ptr, unsigned long n, bool to);
685+
686 /*
687 * The exception table consists of pairs of addresses: the first is the
688 * address of an instruction that is allowed to fault, and the second is
689@@ -387,8 +389,23 @@ do { \
690
691
692 #ifdef CONFIG_MMU
693-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
694-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
695+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
696+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
697+
698+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
699+{
700+ if (!__builtin_constant_p(n))
701+ check_object_size(to, n, false);
702+ return ___copy_from_user(to, from, n);
703+}
704+
705+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
706+{
707+ if (!__builtin_constant_p(n))
708+ check_object_size(from, n, true);
709+ return ___copy_to_user(to, from, n);
710+}
711+
712 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
713 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
714 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
715@@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
716
717 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
718 {
719+ if ((long)n < 0)
720+ return n;
721+
722 if (access_ok(VERIFY_READ, from, n))
723 n = __copy_from_user(to, from, n);
724 else /* security hole - plug it */
725@@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
726
727 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
728 {
729+ if ((long)n < 0)
730+ return n;
731+
732 if (access_ok(VERIFY_WRITE, to, n))
733 n = __copy_to_user(to, from, n);
734 return n;
735diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
736index aeef960..2966009 100644
737--- a/arch/arm/kernel/armksyms.c
738+++ b/arch/arm/kernel/armksyms.c
739@@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
740 #ifdef CONFIG_MMU
741 EXPORT_SYMBOL(copy_page);
742
743-EXPORT_SYMBOL(__copy_from_user);
744-EXPORT_SYMBOL(__copy_to_user);
745+EXPORT_SYMBOL(___copy_from_user);
746+EXPORT_SYMBOL(___copy_to_user);
747 EXPORT_SYMBOL(__clear_user);
748
749 EXPORT_SYMBOL(__get_user_1);
750diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
751index c9d11ea..5078081 100644
752--- a/arch/arm/kernel/process.c
753+++ b/arch/arm/kernel/process.c
754@@ -28,7 +28,6 @@
755 #include <linux/tick.h>
756 #include <linux/utsname.h>
757 #include <linux/uaccess.h>
758-#include <linux/random.h>
759 #include <linux/hw_breakpoint.h>
760 #include <linux/cpuidle.h>
761
762@@ -484,12 +483,6 @@ unsigned long get_wchan(struct task_struct *p)
763 return 0;
764 }
765
766-unsigned long arch_randomize_brk(struct mm_struct *mm)
767-{
768- unsigned long range_end = mm->brk + 0x02000000;
769- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
770-}
771-
772 #ifdef CONFIG_MMU
773 /*
774 * The vectors page is always readable from user space for the
775diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
776index bc9f9da..c75d826 100644
777--- a/arch/arm/kernel/traps.c
778+++ b/arch/arm/kernel/traps.c
779@@ -257,6 +257,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
780
781 static DEFINE_SPINLOCK(die_lock);
782
783+extern void gr_handle_kernel_exploit(void);
784+
785 /*
786 * This function is protected against re-entrancy.
787 */
788@@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs *regs, int err)
789 panic("Fatal exception in interrupt");
790 if (panic_on_oops)
791 panic("Fatal exception");
792+
793+ gr_handle_kernel_exploit();
794+
795 if (ret != NOTIFY_STOP)
796 do_exit(SIGSEGV);
797 }
798diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
799index 66a477a..bee61d3 100644
800--- a/arch/arm/lib/copy_from_user.S
801+++ b/arch/arm/lib/copy_from_user.S
802@@ -16,7 +16,7 @@
803 /*
804 * Prototype:
805 *
806- * size_t __copy_from_user(void *to, const void *from, size_t n)
807+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
808 *
809 * Purpose:
810 *
811@@ -84,11 +84,11 @@
812
813 .text
814
815-ENTRY(__copy_from_user)
816+ENTRY(___copy_from_user)
817
818 #include "copy_template.S"
819
820-ENDPROC(__copy_from_user)
821+ENDPROC(___copy_from_user)
822
823 .pushsection .fixup,"ax"
824 .align 0
825diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
826index d066df6..df28194 100644
827--- a/arch/arm/lib/copy_to_user.S
828+++ b/arch/arm/lib/copy_to_user.S
829@@ -16,7 +16,7 @@
830 /*
831 * Prototype:
832 *
833- * size_t __copy_to_user(void *to, const void *from, size_t n)
834+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
835 *
836 * Purpose:
837 *
838@@ -88,11 +88,11 @@
839 .text
840
841 ENTRY(__copy_to_user_std)
842-WEAK(__copy_to_user)
843+WEAK(___copy_to_user)
844
845 #include "copy_template.S"
846
847-ENDPROC(__copy_to_user)
848+ENDPROC(___copy_to_user)
849 ENDPROC(__copy_to_user_std)
850
851 .pushsection .fixup,"ax"
852diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
853index d0ece2a..5ae2f39 100644
854--- a/arch/arm/lib/uaccess.S
855+++ b/arch/arm/lib/uaccess.S
856@@ -20,7 +20,7 @@
857
858 #define PAGE_SHIFT 12
859
860-/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
861+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
862 * Purpose : copy a block to user memory from kernel memory
863 * Params : to - user memory
864 * : from - kernel memory
865@@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May fault
866 sub r2, r2, ip
867 b .Lc2u_dest_aligned
868
869-ENTRY(__copy_to_user)
870+ENTRY(___copy_to_user)
871 stmfd sp!, {r2, r4 - r7, lr}
872 cmp r2, #4
873 blt .Lc2u_not_enough
874@@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May fault
875 ldrgtb r3, [r1], #0
876 USER( T(strgtb) r3, [r0], #1) @ May fault
877 b .Lc2u_finished
878-ENDPROC(__copy_to_user)
879+ENDPROC(___copy_to_user)
880
881 .pushsection .fixup,"ax"
882 .align 0
883 9001: ldmfd sp!, {r0, r4 - r7, pc}
884 .popsection
885
886-/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
887+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
888 * Purpose : copy a block from user memory to kernel memory
889 * Params : to - kernel memory
890 * : from - user memory
891@@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May fault
892 sub r2, r2, ip
893 b .Lcfu_dest_aligned
894
895-ENTRY(__copy_from_user)
896+ENTRY(___copy_from_user)
897 stmfd sp!, {r0, r2, r4 - r7, lr}
898 cmp r2, #4
899 blt .Lcfu_not_enough
900@@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May fault
901 USER( T(ldrgtb) r3, [r1], #1) @ May fault
902 strgtb r3, [r0], #1
903 b .Lcfu_finished
904-ENDPROC(__copy_from_user)
905+ENDPROC(___copy_from_user)
906
907 .pushsection .fixup,"ax"
908 .align 0
909diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
910index 8b9b136..70d5100 100644
911--- a/arch/arm/lib/uaccess_with_memcpy.c
912+++ b/arch/arm/lib/uaccess_with_memcpy.c
913@@ -103,7 +103,7 @@ out:
914 }
915
916 unsigned long
917-__copy_to_user(void __user *to, const void *from, unsigned long n)
918+___copy_to_user(void __user *to, const void *from, unsigned long n)
919 {
920 /*
921 * This test is stubbed out of the main function above to keep
922diff --git a/arch/arm/mach-ux500/mbox-db5500.c b/arch/arm/mach-ux500/mbox-db5500.c
923index 2b2d51c..0127490 100644
924--- a/arch/arm/mach-ux500/mbox-db5500.c
925+++ b/arch/arm/mach-ux500/mbox-db5500.c
926@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct device *dev,
927 return sprintf(buf, "0x%X\n", mbox_value);
928 }
929
930-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
931+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
932
933 static int mbox_show(struct seq_file *s, void *data)
934 {
935diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
936index 3b5ea68..42fc9af 100644
937--- a/arch/arm/mm/fault.c
938+++ b/arch/arm/mm/fault.c
939@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
940 }
941 #endif
942
943+#ifdef CONFIG_PAX_PAGEEXEC
944+ if (fsr & FSR_LNX_PF) {
945+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
946+ do_group_exit(SIGKILL);
947+ }
948+#endif
949+
950 tsk->thread.address = addr;
951 tsk->thread.error_code = fsr;
952 tsk->thread.trap_no = 14;
953@@ -383,6 +390,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
954 }
955 #endif /* CONFIG_MMU */
956
957+#ifdef CONFIG_PAX_PAGEEXEC
958+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
959+{
960+ long i;
961+
962+ printk(KERN_ERR "PAX: bytes at PC: ");
963+ for (i = 0; i < 20; i++) {
964+ unsigned char c;
965+ if (get_user(c, (__force unsigned char __user *)pc+i))
966+ printk(KERN_CONT "?? ");
967+ else
968+ printk(KERN_CONT "%02x ", c);
969+ }
970+ printk("\n");
971+
972+ printk(KERN_ERR "PAX: bytes at SP-4: ");
973+ for (i = -1; i < 20; i++) {
974+ unsigned long c;
975+ if (get_user(c, (__force unsigned long __user *)sp+i))
976+ printk(KERN_CONT "???????? ");
977+ else
978+ printk(KERN_CONT "%08lx ", c);
979+ }
980+ printk("\n");
981+}
982+#endif
983+
984 /*
985 * First Level Translation Fault Handler
986 *
987diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
988index 74be05f..f605b8c 100644
989--- a/arch/arm/mm/mmap.c
990+++ b/arch/arm/mm/mmap.c
991@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
992 if (len > TASK_SIZE)
993 return -ENOMEM;
994
995+#ifdef CONFIG_PAX_RANDMMAP
996+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
997+#endif
998+
999 if (addr) {
1000 if (do_align)
1001 addr = COLOUR_ALIGN(addr, pgoff);
1002@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
1003 addr = PAGE_ALIGN(addr);
1004
1005 vma = find_vma(mm, addr);
1006- if (TASK_SIZE - len >= addr &&
1007- (!vma || addr + len <= vma->vm_start))
1008+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1009 return addr;
1010 }
1011 if (len > mm->cached_hole_size) {
1012- start_addr = addr = mm->free_area_cache;
1013+ start_addr = addr = mm->free_area_cache;
1014 } else {
1015- start_addr = addr = TASK_UNMAPPED_BASE;
1016- mm->cached_hole_size = 0;
1017+ start_addr = addr = mm->mmap_base;
1018+ mm->cached_hole_size = 0;
1019 }
1020 /* 8 bits of randomness in 20 address space bits */
1021 if ((current->flags & PF_RANDOMIZE) &&
1022@@ -100,14 +103,14 @@ full_search:
1023 * Start a new search - just in case we missed
1024 * some holes.
1025 */
1026- if (start_addr != TASK_UNMAPPED_BASE) {
1027- start_addr = addr = TASK_UNMAPPED_BASE;
1028+ if (start_addr != mm->mmap_base) {
1029+ start_addr = addr = mm->mmap_base;
1030 mm->cached_hole_size = 0;
1031 goto full_search;
1032 }
1033 return -ENOMEM;
1034 }
1035- if (!vma || addr + len <= vma->vm_start) {
1036+ if (check_heap_stack_gap(vma, addr, len)) {
1037 /*
1038 * Remember the place where we stopped the search:
1039 */
1040diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
1041index 3b3159b..425ea94 100644
1042--- a/arch/avr32/include/asm/elf.h
1043+++ b/arch/avr32/include/asm/elf.h
1044@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
1045 the loader. We need to make sure that it is out of the way of the program
1046 that it will "exec", and that there is sufficient room for the brk. */
1047
1048-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1049+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1050
1051+#ifdef CONFIG_PAX_ASLR
1052+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1053+
1054+#define PAX_DELTA_MMAP_LEN 15
1055+#define PAX_DELTA_STACK_LEN 15
1056+#endif
1057
1058 /* This yields a mask that user programs can use to figure out what
1059 instruction set this CPU supports. This could be done in user space,
1060diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
1061index b7f5c68..556135c 100644
1062--- a/arch/avr32/include/asm/kmap_types.h
1063+++ b/arch/avr32/include/asm/kmap_types.h
1064@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1065 D(11) KM_IRQ1,
1066 D(12) KM_SOFTIRQ0,
1067 D(13) KM_SOFTIRQ1,
1068-D(14) KM_TYPE_NR
1069+D(14) KM_CLEARPAGE,
1070+D(15) KM_TYPE_NR
1071 };
1072
1073 #undef D
1074diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
1075index f7040a1..db9f300 100644
1076--- a/arch/avr32/mm/fault.c
1077+++ b/arch/avr32/mm/fault.c
1078@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
1079
1080 int exception_trace = 1;
1081
1082+#ifdef CONFIG_PAX_PAGEEXEC
1083+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1084+{
1085+ unsigned long i;
1086+
1087+ printk(KERN_ERR "PAX: bytes at PC: ");
1088+ for (i = 0; i < 20; i++) {
1089+ unsigned char c;
1090+ if (get_user(c, (unsigned char *)pc+i))
1091+ printk(KERN_CONT "???????? ");
1092+ else
1093+ printk(KERN_CONT "%02x ", c);
1094+ }
1095+ printk("\n");
1096+}
1097+#endif
1098+
1099 /*
1100 * This routine handles page faults. It determines the address and the
1101 * problem, and then passes it off to one of the appropriate routines.
1102@@ -156,6 +173,16 @@ bad_area:
1103 up_read(&mm->mmap_sem);
1104
1105 if (user_mode(regs)) {
1106+
1107+#ifdef CONFIG_PAX_PAGEEXEC
1108+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1109+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1110+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1111+ do_group_exit(SIGKILL);
1112+ }
1113+ }
1114+#endif
1115+
1116 if (exception_trace && printk_ratelimit())
1117 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1118 "sp %08lx ecr %lu\n",
1119diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
1120index f8e16b2..c73ff79 100644
1121--- a/arch/frv/include/asm/kmap_types.h
1122+++ b/arch/frv/include/asm/kmap_types.h
1123@@ -23,6 +23,7 @@ enum km_type {
1124 KM_IRQ1,
1125 KM_SOFTIRQ0,
1126 KM_SOFTIRQ1,
1127+ KM_CLEARPAGE,
1128 KM_TYPE_NR
1129 };
1130
1131diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
1132index 385fd30..6c3d97e 100644
1133--- a/arch/frv/mm/elf-fdpic.c
1134+++ b/arch/frv/mm/elf-fdpic.c
1135@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1136 if (addr) {
1137 addr = PAGE_ALIGN(addr);
1138 vma = find_vma(current->mm, addr);
1139- if (TASK_SIZE - len >= addr &&
1140- (!vma || addr + len <= vma->vm_start))
1141+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1142 goto success;
1143 }
1144
1145@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1146 for (; vma; vma = vma->vm_next) {
1147 if (addr > limit)
1148 break;
1149- if (addr + len <= vma->vm_start)
1150+ if (check_heap_stack_gap(vma, addr, len))
1151 goto success;
1152 addr = vma->vm_end;
1153 }
1154@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1155 for (; vma; vma = vma->vm_next) {
1156 if (addr > limit)
1157 break;
1158- if (addr + len <= vma->vm_start)
1159+ if (check_heap_stack_gap(vma, addr, len))
1160 goto success;
1161 addr = vma->vm_end;
1162 }
1163diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
1164index b5298eb..67c6e62 100644
1165--- a/arch/ia64/include/asm/elf.h
1166+++ b/arch/ia64/include/asm/elf.h
1167@@ -42,6 +42,13 @@
1168 */
1169 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1170
1171+#ifdef CONFIG_PAX_ASLR
1172+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1173+
1174+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1175+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1176+#endif
1177+
1178 #define PT_IA_64_UNWIND 0x70000001
1179
1180 /* IA-64 relocations: */
1181diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
1182index 1a97af3..7529d31 100644
1183--- a/arch/ia64/include/asm/pgtable.h
1184+++ b/arch/ia64/include/asm/pgtable.h
1185@@ -12,7 +12,7 @@
1186 * David Mosberger-Tang <davidm@hpl.hp.com>
1187 */
1188
1189-
1190+#include <linux/const.h>
1191 #include <asm/mman.h>
1192 #include <asm/page.h>
1193 #include <asm/processor.h>
1194@@ -143,6 +143,17 @@
1195 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1196 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1197 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1198+
1199+#ifdef CONFIG_PAX_PAGEEXEC
1200+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1201+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1202+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1203+#else
1204+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1205+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1206+# define PAGE_COPY_NOEXEC PAGE_COPY
1207+#endif
1208+
1209 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1210 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1211 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1212diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
1213index b77768d..e0795eb 100644
1214--- a/arch/ia64/include/asm/spinlock.h
1215+++ b/arch/ia64/include/asm/spinlock.h
1216@@ -72,7 +72,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
1217 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1218
1219 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1220- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1221+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1222 }
1223
1224 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1225diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
1226index 449c8c0..432a3d2 100644
1227--- a/arch/ia64/include/asm/uaccess.h
1228+++ b/arch/ia64/include/asm/uaccess.h
1229@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1230 const void *__cu_from = (from); \
1231 long __cu_len = (n); \
1232 \
1233- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1234+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1235 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1236 __cu_len; \
1237 })
1238@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1239 long __cu_len = (n); \
1240 \
1241 __chk_user_ptr(__cu_from); \
1242- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1243+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1244 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1245 __cu_len; \
1246 })
1247diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
1248index 24603be..948052d 100644
1249--- a/arch/ia64/kernel/module.c
1250+++ b/arch/ia64/kernel/module.c
1251@@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
1252 void
1253 module_free (struct module *mod, void *module_region)
1254 {
1255- if (mod && mod->arch.init_unw_table &&
1256- module_region == mod->module_init) {
1257+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1258 unw_remove_unwind_table(mod->arch.init_unw_table);
1259 mod->arch.init_unw_table = NULL;
1260 }
1261@@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
1262 }
1263
1264 static inline int
1265+in_init_rx (const struct module *mod, uint64_t addr)
1266+{
1267+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1268+}
1269+
1270+static inline int
1271+in_init_rw (const struct module *mod, uint64_t addr)
1272+{
1273+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1274+}
1275+
1276+static inline int
1277 in_init (const struct module *mod, uint64_t addr)
1278 {
1279- return addr - (uint64_t) mod->module_init < mod->init_size;
1280+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1281+}
1282+
1283+static inline int
1284+in_core_rx (const struct module *mod, uint64_t addr)
1285+{
1286+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1287+}
1288+
1289+static inline int
1290+in_core_rw (const struct module *mod, uint64_t addr)
1291+{
1292+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1293 }
1294
1295 static inline int
1296 in_core (const struct module *mod, uint64_t addr)
1297 {
1298- return addr - (uint64_t) mod->module_core < mod->core_size;
1299+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1300 }
1301
1302 static inline int
1303@@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
1304 break;
1305
1306 case RV_BDREL:
1307- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1308+ if (in_init_rx(mod, val))
1309+ val -= (uint64_t) mod->module_init_rx;
1310+ else if (in_init_rw(mod, val))
1311+ val -= (uint64_t) mod->module_init_rw;
1312+ else if (in_core_rx(mod, val))
1313+ val -= (uint64_t) mod->module_core_rx;
1314+ else if (in_core_rw(mod, val))
1315+ val -= (uint64_t) mod->module_core_rw;
1316 break;
1317
1318 case RV_LTV:
1319@@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
1320 * addresses have been selected...
1321 */
1322 uint64_t gp;
1323- if (mod->core_size > MAX_LTOFF)
1324+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1325 /*
1326 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1327 * at the end of the module.
1328 */
1329- gp = mod->core_size - MAX_LTOFF / 2;
1330+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1331 else
1332- gp = mod->core_size / 2;
1333- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1334+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1335+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1336 mod->arch.gp = gp;
1337 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1338 }
1339diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
1340index 609d500..7dde2a8 100644
1341--- a/arch/ia64/kernel/sys_ia64.c
1342+++ b/arch/ia64/kernel/sys_ia64.c
1343@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1344 if (REGION_NUMBER(addr) == RGN_HPAGE)
1345 addr = 0;
1346 #endif
1347+
1348+#ifdef CONFIG_PAX_RANDMMAP
1349+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1350+ addr = mm->free_area_cache;
1351+ else
1352+#endif
1353+
1354 if (!addr)
1355 addr = mm->free_area_cache;
1356
1357@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1358 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1359 /* At this point: (!vma || addr < vma->vm_end). */
1360 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1361- if (start_addr != TASK_UNMAPPED_BASE) {
1362+ if (start_addr != mm->mmap_base) {
1363 /* Start a new search --- just in case we missed some holes. */
1364- addr = TASK_UNMAPPED_BASE;
1365+ addr = mm->mmap_base;
1366 goto full_search;
1367 }
1368 return -ENOMEM;
1369 }
1370- if (!vma || addr + len <= vma->vm_start) {
1371+ if (check_heap_stack_gap(vma, addr, len)) {
1372 /* Remember the address where we stopped this search: */
1373 mm->free_area_cache = addr + len;
1374 return addr;
1375diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
1376index 53c0ba0..2accdde 100644
1377--- a/arch/ia64/kernel/vmlinux.lds.S
1378+++ b/arch/ia64/kernel/vmlinux.lds.S
1379@@ -199,7 +199,7 @@ SECTIONS {
1380 /* Per-cpu data: */
1381 . = ALIGN(PERCPU_PAGE_SIZE);
1382 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1383- __phys_per_cpu_start = __per_cpu_load;
1384+ __phys_per_cpu_start = per_cpu_load;
1385 /*
1386 * ensure percpu data fits
1387 * into percpu page size
1388diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
1389index 20b3593..1ce77f0 100644
1390--- a/arch/ia64/mm/fault.c
1391+++ b/arch/ia64/mm/fault.c
1392@@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned long address)
1393 return pte_present(pte);
1394 }
1395
1396+#ifdef CONFIG_PAX_PAGEEXEC
1397+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1398+{
1399+ unsigned long i;
1400+
1401+ printk(KERN_ERR "PAX: bytes at PC: ");
1402+ for (i = 0; i < 8; i++) {
1403+ unsigned int c;
1404+ if (get_user(c, (unsigned int *)pc+i))
1405+ printk(KERN_CONT "???????? ");
1406+ else
1407+ printk(KERN_CONT "%08x ", c);
1408+ }
1409+ printk("\n");
1410+}
1411+#endif
1412+
1413 void __kprobes
1414 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1415 {
1416@@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
1417 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1418 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1419
1420- if ((vma->vm_flags & mask) != mask)
1421+ if ((vma->vm_flags & mask) != mask) {
1422+
1423+#ifdef CONFIG_PAX_PAGEEXEC
1424+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1425+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1426+ goto bad_area;
1427+
1428+ up_read(&mm->mmap_sem);
1429+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1430+ do_group_exit(SIGKILL);
1431+ }
1432+#endif
1433+
1434 goto bad_area;
1435
1436+ }
1437+
1438 /*
1439 * If for any reason at all we couldn't handle the fault, make
1440 * sure we exit gracefully rather than endlessly redo the
1441diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
1442index 5ca674b..e0e1b70 100644
1443--- a/arch/ia64/mm/hugetlbpage.c
1444+++ b/arch/ia64/mm/hugetlbpage.c
1445@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
1446 /* At this point: (!vmm || addr < vmm->vm_end). */
1447 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1448 return -ENOMEM;
1449- if (!vmm || (addr + len) <= vmm->vm_start)
1450+ if (check_heap_stack_gap(vmm, addr, len))
1451 return addr;
1452 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1453 }
1454diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
1455index 00cb0e2..2ad8024 100644
1456--- a/arch/ia64/mm/init.c
1457+++ b/arch/ia64/mm/init.c
1458@@ -120,6 +120,19 @@ ia64_init_addr_space (void)
1459 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1460 vma->vm_end = vma->vm_start + PAGE_SIZE;
1461 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1462+
1463+#ifdef CONFIG_PAX_PAGEEXEC
1464+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1465+ vma->vm_flags &= ~VM_EXEC;
1466+
1467+#ifdef CONFIG_PAX_MPROTECT
1468+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1469+ vma->vm_flags &= ~VM_MAYEXEC;
1470+#endif
1471+
1472+ }
1473+#endif
1474+
1475 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1476 down_write(&current->mm->mmap_sem);
1477 if (insert_vm_struct(current->mm, vma)) {
1478diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
1479index 82abd15..d95ae5d 100644
1480--- a/arch/m32r/lib/usercopy.c
1481+++ b/arch/m32r/lib/usercopy.c
1482@@ -14,6 +14,9 @@
1483 unsigned long
1484 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1485 {
1486+ if ((long)n < 0)
1487+ return n;
1488+
1489 prefetch(from);
1490 if (access_ok(VERIFY_WRITE, to, n))
1491 __copy_user(to,from,n);
1492@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1493 unsigned long
1494 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1495 {
1496+ if ((long)n < 0)
1497+ return n;
1498+
1499 prefetchw(to);
1500 if (access_ok(VERIFY_READ, from, n))
1501 __copy_user_zeroing(to,from,n);
1502diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
1503index 455c0ac..ad65fbe 100644
1504--- a/arch/mips/include/asm/elf.h
1505+++ b/arch/mips/include/asm/elf.h
1506@@ -372,13 +372,16 @@ extern const char *__elf_platform;
1507 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1508 #endif
1509
1510+#ifdef CONFIG_PAX_ASLR
1511+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1512+
1513+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1514+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1515+#endif
1516+
1517 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1518 struct linux_binprm;
1519 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
1520 int uses_interp);
1521
1522-struct mm_struct;
1523-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1524-#define arch_randomize_brk arch_randomize_brk
1525-
1526 #endif /* _ASM_ELF_H */
1527diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
1528index e59cd1a..8e329d6 100644
1529--- a/arch/mips/include/asm/page.h
1530+++ b/arch/mips/include/asm/page.h
1531@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
1532 #ifdef CONFIG_CPU_MIPS32
1533 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1534 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1535- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1536+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1537 #else
1538 typedef struct { unsigned long long pte; } pte_t;
1539 #define pte_val(x) ((x).pte)
1540diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
1541index 6018c80..7c37203 100644
1542--- a/arch/mips/include/asm/system.h
1543+++ b/arch/mips/include/asm/system.h
1544@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1545 */
1546 #define __ARCH_WANT_UNLOCKED_CTXSW
1547
1548-extern unsigned long arch_align_stack(unsigned long sp);
1549+#define arch_align_stack(x) ((x) & ~0xfUL)
1550
1551 #endif /* _ASM_SYSTEM_H */
1552diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
1553index 9fdd8bc..4bd7f1a 100644
1554--- a/arch/mips/kernel/binfmt_elfn32.c
1555+++ b/arch/mips/kernel/binfmt_elfn32.c
1556@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1557 #undef ELF_ET_DYN_BASE
1558 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1559
1560+#ifdef CONFIG_PAX_ASLR
1561+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1562+
1563+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1564+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1565+#endif
1566+
1567 #include <asm/processor.h>
1568 #include <linux/module.h>
1569 #include <linux/elfcore.h>
1570diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
1571index ff44823..97f8906 100644
1572--- a/arch/mips/kernel/binfmt_elfo32.c
1573+++ b/arch/mips/kernel/binfmt_elfo32.c
1574@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1575 #undef ELF_ET_DYN_BASE
1576 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1577
1578+#ifdef CONFIG_PAX_ASLR
1579+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1580+
1581+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1582+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1583+#endif
1584+
1585 #include <asm/processor.h>
1586
1587 /*
1588diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
1589index b30cb25..454c0a9 100644
1590--- a/arch/mips/kernel/process.c
1591+++ b/arch/mips/kernel/process.c
1592@@ -481,15 +481,3 @@ unsigned long get_wchan(struct task_struct *task)
1593 out:
1594 return pc;
1595 }
1596-
1597-/*
1598- * Don't forget that the stack pointer must be aligned on a 8 bytes
1599- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1600- */
1601-unsigned long arch_align_stack(unsigned long sp)
1602-{
1603- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1604- sp -= get_random_int() & ~PAGE_MASK;
1605-
1606- return sp & ALMASK;
1607-}
1608diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
1609index 937cf33..adb39bb 100644
1610--- a/arch/mips/mm/fault.c
1611+++ b/arch/mips/mm/fault.c
1612@@ -28,6 +28,23 @@
1613 #include <asm/highmem.h> /* For VMALLOC_END */
1614 #include <linux/kdebug.h>
1615
1616+#ifdef CONFIG_PAX_PAGEEXEC
1617+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1618+{
1619+ unsigned long i;
1620+
1621+ printk(KERN_ERR "PAX: bytes at PC: ");
1622+ for (i = 0; i < 5; i++) {
1623+ unsigned int c;
1624+ if (get_user(c, (unsigned int *)pc+i))
1625+ printk(KERN_CONT "???????? ");
1626+ else
1627+ printk(KERN_CONT "%08x ", c);
1628+ }
1629+ printk("\n");
1630+}
1631+#endif
1632+
1633 /*
1634 * This routine handles page faults. It determines the address,
1635 * and the problem, and then passes it off to one of the appropriate
1636diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
1637index 302d779..7d35bf8 100644
1638--- a/arch/mips/mm/mmap.c
1639+++ b/arch/mips/mm/mmap.c
1640@@ -95,6 +95,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1641 do_color_align = 1;
1642
1643 /* requesting a specific address */
1644+
1645+#ifdef CONFIG_PAX_RANDMMAP
1646+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1647+#endif
1648+
1649 if (addr) {
1650 if (do_color_align)
1651 addr = COLOUR_ALIGN(addr, pgoff);
1652@@ -102,8 +107,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1653 addr = PAGE_ALIGN(addr);
1654
1655 vma = find_vma(mm, addr);
1656- if (TASK_SIZE - len >= addr &&
1657- (!vma || addr + len <= vma->vm_start))
1658+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
1659 return addr;
1660 }
1661
1662@@ -118,7 +122,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1663 /* At this point: (!vma || addr < vma->vm_end). */
1664 if (TASK_SIZE - len < addr)
1665 return -ENOMEM;
1666- if (!vma || addr + len <= vma->vm_start)
1667+ if (check_heap_stack_gap(vmm, addr, len))
1668 return addr;
1669 addr = vma->vm_end;
1670 if (do_color_align)
1671@@ -145,7 +149,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1672 /* make sure it can fit in the remaining address space */
1673 if (likely(addr > len)) {
1674 vma = find_vma(mm, addr - len);
1675- if (!vma || addr <= vma->vm_start) {
1676+ if (check_heap_stack_gap(vmm, addr - len, len))
1677 /* cache the address as a hint for next time */
1678 return mm->free_area_cache = addr - len;
1679 }
1680@@ -165,7 +169,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1681 * return with success:
1682 */
1683 vma = find_vma(mm, addr);
1684- if (likely(!vma || addr + len <= vma->vm_start)) {
1685+ if (check_heap_stack_gap(vmm, addr, len)) {
1686 /* cache the address as a hint for next time */
1687 return mm->free_area_cache = addr;
1688 }
1689@@ -242,30 +246,3 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
1690 mm->unmap_area = arch_unmap_area_topdown;
1691 }
1692 }
1693-
1694-static inline unsigned long brk_rnd(void)
1695-{
1696- unsigned long rnd = get_random_int();
1697-
1698- rnd = rnd << PAGE_SHIFT;
1699- /* 8MB for 32bit, 256MB for 64bit */
1700- if (TASK_IS_32BIT_ADDR)
1701- rnd = rnd & 0x7ffffful;
1702- else
1703- rnd = rnd & 0xffffffful;
1704-
1705- return rnd;
1706-}
1707-
1708-unsigned long arch_randomize_brk(struct mm_struct *mm)
1709-{
1710- unsigned long base = mm->brk;
1711- unsigned long ret;
1712-
1713- ret = PAGE_ALIGN(base + brk_rnd());
1714-
1715- if (ret < mm->brk)
1716- return mm->brk;
1717-
1718- return ret;
1719-}
1720diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
1721index 19f6cb1..6c78cf2 100644
1722--- a/arch/parisc/include/asm/elf.h
1723+++ b/arch/parisc/include/asm/elf.h
1724@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
1725
1726 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1727
1728+#ifdef CONFIG_PAX_ASLR
1729+#define PAX_ELF_ET_DYN_BASE 0x10000UL
1730+
1731+#define PAX_DELTA_MMAP_LEN 16
1732+#define PAX_DELTA_STACK_LEN 16
1733+#endif
1734+
1735 /* This yields a mask that user programs can use to figure out what
1736 instruction set this CPU supports. This could be done in user space,
1737 but it's not easy, and we've already done it here. */
1738diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
1739index 22dadeb..f6c2be4 100644
1740--- a/arch/parisc/include/asm/pgtable.h
1741+++ b/arch/parisc/include/asm/pgtable.h
1742@@ -210,6 +210,17 @@ struct vm_area_struct;
1743 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1744 #define PAGE_COPY PAGE_EXECREAD
1745 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1746+
1747+#ifdef CONFIG_PAX_PAGEEXEC
1748+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1749+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1750+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1751+#else
1752+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1753+# define PAGE_COPY_NOEXEC PAGE_COPY
1754+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1755+#endif
1756+
1757 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1758 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
1759 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
1760diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
1761index 5e34ccf..672bc9c 100644
1762--- a/arch/parisc/kernel/module.c
1763+++ b/arch/parisc/kernel/module.c
1764@@ -98,16 +98,38 @@
1765
1766 /* three functions to determine where in the module core
1767 * or init pieces the location is */
1768+static inline int in_init_rx(struct module *me, void *loc)
1769+{
1770+ return (loc >= me->module_init_rx &&
1771+ loc < (me->module_init_rx + me->init_size_rx));
1772+}
1773+
1774+static inline int in_init_rw(struct module *me, void *loc)
1775+{
1776+ return (loc >= me->module_init_rw &&
1777+ loc < (me->module_init_rw + me->init_size_rw));
1778+}
1779+
1780 static inline int in_init(struct module *me, void *loc)
1781 {
1782- return (loc >= me->module_init &&
1783- loc <= (me->module_init + me->init_size));
1784+ return in_init_rx(me, loc) || in_init_rw(me, loc);
1785+}
1786+
1787+static inline int in_core_rx(struct module *me, void *loc)
1788+{
1789+ return (loc >= me->module_core_rx &&
1790+ loc < (me->module_core_rx + me->core_size_rx));
1791+}
1792+
1793+static inline int in_core_rw(struct module *me, void *loc)
1794+{
1795+ return (loc >= me->module_core_rw &&
1796+ loc < (me->module_core_rw + me->core_size_rw));
1797 }
1798
1799 static inline int in_core(struct module *me, void *loc)
1800 {
1801- return (loc >= me->module_core &&
1802- loc <= (me->module_core + me->core_size));
1803+ return in_core_rx(me, loc) || in_core_rw(me, loc);
1804 }
1805
1806 static inline int in_local(struct module *me, void *loc)
1807@@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
1808 }
1809
1810 /* align things a bit */
1811- me->core_size = ALIGN(me->core_size, 16);
1812- me->arch.got_offset = me->core_size;
1813- me->core_size += gots * sizeof(struct got_entry);
1814+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1815+ me->arch.got_offset = me->core_size_rw;
1816+ me->core_size_rw += gots * sizeof(struct got_entry);
1817
1818- me->core_size = ALIGN(me->core_size, 16);
1819- me->arch.fdesc_offset = me->core_size;
1820- me->core_size += fdescs * sizeof(Elf_Fdesc);
1821+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1822+ me->arch.fdesc_offset = me->core_size_rw;
1823+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1824
1825 me->arch.got_max = gots;
1826 me->arch.fdesc_max = fdescs;
1827@@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1828
1829 BUG_ON(value == 0);
1830
1831- got = me->module_core + me->arch.got_offset;
1832+ got = me->module_core_rw + me->arch.got_offset;
1833 for (i = 0; got[i].addr; i++)
1834 if (got[i].addr == value)
1835 goto out;
1836@@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1837 #ifdef CONFIG_64BIT
1838 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1839 {
1840- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1841+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1842
1843 if (!value) {
1844 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1845@@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1846
1847 /* Create new one */
1848 fdesc->addr = value;
1849- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1850+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1851 return (Elf_Addr)fdesc;
1852 }
1853 #endif /* CONFIG_64BIT */
1854@@ -845,7 +867,7 @@ register_unwind_table(struct module *me,
1855
1856 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1857 end = table + sechdrs[me->arch.unwind_section].sh_size;
1858- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1859+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1860
1861 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1862 me->arch.unwind_section, table, end, gp);
1863diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
1864index c9b9322..02d8940 100644
1865--- a/arch/parisc/kernel/sys_parisc.c
1866+++ b/arch/parisc/kernel/sys_parisc.c
1867@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
1868 /* At this point: (!vma || addr < vma->vm_end). */
1869 if (TASK_SIZE - len < addr)
1870 return -ENOMEM;
1871- if (!vma || addr + len <= vma->vm_start)
1872+ if (check_heap_stack_gap(vma, addr, len))
1873 return addr;
1874 addr = vma->vm_end;
1875 }
1876@@ -79,7 +79,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
1877 /* At this point: (!vma || addr < vma->vm_end). */
1878 if (TASK_SIZE - len < addr)
1879 return -ENOMEM;
1880- if (!vma || addr + len <= vma->vm_start)
1881+ if (check_heap_stack_gap(vma, addr, len))
1882 return addr;
1883 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1884 if (addr < vma->vm_end) /* handle wraparound */
1885@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
1886 if (flags & MAP_FIXED)
1887 return addr;
1888 if (!addr)
1889- addr = TASK_UNMAPPED_BASE;
1890+ addr = current->mm->mmap_base;
1891
1892 if (filp) {
1893 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1894diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
1895index f19e660..414fe24 100644
1896--- a/arch/parisc/kernel/traps.c
1897+++ b/arch/parisc/kernel/traps.c
1898@@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
1899
1900 down_read(&current->mm->mmap_sem);
1901 vma = find_vma(current->mm,regs->iaoq[0]);
1902- if (vma && (regs->iaoq[0] >= vma->vm_start)
1903- && (vma->vm_flags & VM_EXEC)) {
1904-
1905+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1906 fault_address = regs->iaoq[0];
1907 fault_space = regs->iasq[0];
1908
1909diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
1910index 18162ce..94de376 100644
1911--- a/arch/parisc/mm/fault.c
1912+++ b/arch/parisc/mm/fault.c
1913@@ -15,6 +15,7 @@
1914 #include <linux/sched.h>
1915 #include <linux/interrupt.h>
1916 #include <linux/module.h>
1917+#include <linux/unistd.h>
1918
1919 #include <asm/uaccess.h>
1920 #include <asm/traps.h>
1921@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
1922 static unsigned long
1923 parisc_acctyp(unsigned long code, unsigned int inst)
1924 {
1925- if (code == 6 || code == 16)
1926+ if (code == 6 || code == 7 || code == 16)
1927 return VM_EXEC;
1928
1929 switch (inst & 0xf0000000) {
1930@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
1931 }
1932 #endif
1933
1934+#ifdef CONFIG_PAX_PAGEEXEC
1935+/*
1936+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1937+ *
1938+ * returns 1 when task should be killed
1939+ * 2 when rt_sigreturn trampoline was detected
1940+ * 3 when unpatched PLT trampoline was detected
1941+ */
1942+static int pax_handle_fetch_fault(struct pt_regs *regs)
1943+{
1944+
1945+#ifdef CONFIG_PAX_EMUPLT
1946+ int err;
1947+
1948+ do { /* PaX: unpatched PLT emulation */
1949+ unsigned int bl, depwi;
1950+
1951+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1952+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1953+
1954+ if (err)
1955+ break;
1956+
1957+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1958+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1959+
1960+ err = get_user(ldw, (unsigned int *)addr);
1961+ err |= get_user(bv, (unsigned int *)(addr+4));
1962+ err |= get_user(ldw2, (unsigned int *)(addr+8));
1963+
1964+ if (err)
1965+ break;
1966+
1967+ if (ldw == 0x0E801096U &&
1968+ bv == 0xEAC0C000U &&
1969+ ldw2 == 0x0E881095U)
1970+ {
1971+ unsigned int resolver, map;
1972+
1973+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1974+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1975+ if (err)
1976+ break;
1977+
1978+ regs->gr[20] = instruction_pointer(regs)+8;
1979+ regs->gr[21] = map;
1980+ regs->gr[22] = resolver;
1981+ regs->iaoq[0] = resolver | 3UL;
1982+ regs->iaoq[1] = regs->iaoq[0] + 4;
1983+ return 3;
1984+ }
1985+ }
1986+ } while (0);
1987+#endif
1988+
1989+#ifdef CONFIG_PAX_EMUTRAMP
1990+
1991+#ifndef CONFIG_PAX_EMUSIGRT
1992+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1993+ return 1;
1994+#endif
1995+
1996+ do { /* PaX: rt_sigreturn emulation */
1997+ unsigned int ldi1, ldi2, bel, nop;
1998+
1999+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
2000+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
2001+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
2002+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
2003+
2004+ if (err)
2005+ break;
2006+
2007+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
2008+ ldi2 == 0x3414015AU &&
2009+ bel == 0xE4008200U &&
2010+ nop == 0x08000240U)
2011+ {
2012+ regs->gr[25] = (ldi1 & 2) >> 1;
2013+ regs->gr[20] = __NR_rt_sigreturn;
2014+ regs->gr[31] = regs->iaoq[1] + 16;
2015+ regs->sr[0] = regs->iasq[1];
2016+ regs->iaoq[0] = 0x100UL;
2017+ regs->iaoq[1] = regs->iaoq[0] + 4;
2018+ regs->iasq[0] = regs->sr[2];
2019+ regs->iasq[1] = regs->sr[2];
2020+ return 2;
2021+ }
2022+ } while (0);
2023+#endif
2024+
2025+ return 1;
2026+}
2027+
2028+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2029+{
2030+ unsigned long i;
2031+
2032+ printk(KERN_ERR "PAX: bytes at PC: ");
2033+ for (i = 0; i < 5; i++) {
2034+ unsigned int c;
2035+ if (get_user(c, (unsigned int *)pc+i))
2036+ printk(KERN_CONT "???????? ");
2037+ else
2038+ printk(KERN_CONT "%08x ", c);
2039+ }
2040+ printk("\n");
2041+}
2042+#endif
2043+
2044 int fixup_exception(struct pt_regs *regs)
2045 {
2046 const struct exception_table_entry *fix;
2047@@ -192,8 +303,33 @@ good_area:
2048
2049 acc_type = parisc_acctyp(code,regs->iir);
2050
2051- if ((vma->vm_flags & acc_type) != acc_type)
2052+ if ((vma->vm_flags & acc_type) != acc_type) {
2053+
2054+#ifdef CONFIG_PAX_PAGEEXEC
2055+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2056+ (address & ~3UL) == instruction_pointer(regs))
2057+ {
2058+ up_read(&mm->mmap_sem);
2059+ switch (pax_handle_fetch_fault(regs)) {
2060+
2061+#ifdef CONFIG_PAX_EMUPLT
2062+ case 3:
2063+ return;
2064+#endif
2065+
2066+#ifdef CONFIG_PAX_EMUTRAMP
2067+ case 2:
2068+ return;
2069+#endif
2070+
2071+ }
2072+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2073+ do_group_exit(SIGKILL);
2074+ }
2075+#endif
2076+
2077 goto bad_area;
2078+ }
2079
2080 /*
2081 * If for any reason at all we couldn't handle the fault, make
2082diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
2083index 3bf9cca..e7457d0 100644
2084--- a/arch/powerpc/include/asm/elf.h
2085+++ b/arch/powerpc/include/asm/elf.h
2086@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
2087 the loader. We need to make sure that it is out of the way of the program
2088 that it will "exec", and that there is sufficient room for the brk. */
2089
2090-extern unsigned long randomize_et_dyn(unsigned long base);
2091-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2092+#define ELF_ET_DYN_BASE (0x20000000)
2093+
2094+#ifdef CONFIG_PAX_ASLR
2095+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2096+
2097+#ifdef __powerpc64__
2098+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
2099+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
2100+#else
2101+#define PAX_DELTA_MMAP_LEN 15
2102+#define PAX_DELTA_STACK_LEN 15
2103+#endif
2104+#endif
2105
2106 /*
2107 * Our registers are always unsigned longs, whether we're a 32 bit
2108@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2109 (0x7ff >> (PAGE_SHIFT - 12)) : \
2110 (0x3ffff >> (PAGE_SHIFT - 12)))
2111
2112-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2113-#define arch_randomize_brk arch_randomize_brk
2114-
2115 #endif /* __KERNEL__ */
2116
2117 /*
2118diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
2119index bca8fdc..61e9580 100644
2120--- a/arch/powerpc/include/asm/kmap_types.h
2121+++ b/arch/powerpc/include/asm/kmap_types.h
2122@@ -27,6 +27,7 @@ enum km_type {
2123 KM_PPC_SYNC_PAGE,
2124 KM_PPC_SYNC_ICACHE,
2125 KM_KDB,
2126+ KM_CLEARPAGE,
2127 KM_TYPE_NR
2128 };
2129
2130diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
2131index d4a7f64..451de1c 100644
2132--- a/arch/powerpc/include/asm/mman.h
2133+++ b/arch/powerpc/include/asm/mman.h
2134@@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
2135 }
2136 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
2137
2138-static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
2139+static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
2140 {
2141 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
2142 }
2143diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
2144index 2cd664e..1d2e8a7 100644
2145--- a/arch/powerpc/include/asm/page.h
2146+++ b/arch/powerpc/include/asm/page.h
2147@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
2148 * and needs to be executable. This means the whole heap ends
2149 * up being executable.
2150 */
2151-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2152- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2153+#define VM_DATA_DEFAULT_FLAGS32 \
2154+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2155+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2156
2157 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2158 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2159@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
2160 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2161 #endif
2162
2163+#define ktla_ktva(addr) (addr)
2164+#define ktva_ktla(addr) (addr)
2165+
2166 #ifndef __ASSEMBLY__
2167
2168 #undef STRICT_MM_TYPECHECKS
2169diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
2170index 9356262..ea96148 100644
2171--- a/arch/powerpc/include/asm/page_64.h
2172+++ b/arch/powerpc/include/asm/page_64.h
2173@@ -155,15 +155,18 @@ do { \
2174 * stack by default, so in the absence of a PT_GNU_STACK program header
2175 * we turn execute permission off.
2176 */
2177-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2178- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2179+#define VM_STACK_DEFAULT_FLAGS32 \
2180+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2181+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2182
2183 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2184 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2185
2186+#ifndef CONFIG_PAX_PAGEEXEC
2187 #define VM_STACK_DEFAULT_FLAGS \
2188 (is_32bit_task() ? \
2189 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2190+#endif
2191
2192 #include <asm-generic/getorder.h>
2193
2194diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
2195index 88b0bd9..e32bc67 100644
2196--- a/arch/powerpc/include/asm/pgtable.h
2197+++ b/arch/powerpc/include/asm/pgtable.h
2198@@ -2,6 +2,7 @@
2199 #define _ASM_POWERPC_PGTABLE_H
2200 #ifdef __KERNEL__
2201
2202+#include <linux/const.h>
2203 #ifndef __ASSEMBLY__
2204 #include <asm/processor.h> /* For TASK_SIZE */
2205 #include <asm/mmu.h>
2206diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
2207index 4aad413..85d86bf 100644
2208--- a/arch/powerpc/include/asm/pte-hash32.h
2209+++ b/arch/powerpc/include/asm/pte-hash32.h
2210@@ -21,6 +21,7 @@
2211 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2212 #define _PAGE_USER 0x004 /* usermode access allowed */
2213 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2214+#define _PAGE_EXEC _PAGE_GUARDED
2215 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2216 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2217 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2218diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
2219index 559da19..7e5835c 100644
2220--- a/arch/powerpc/include/asm/reg.h
2221+++ b/arch/powerpc/include/asm/reg.h
2222@@ -212,6 +212,7 @@
2223 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2224 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2225 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2226+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2227 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2228 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2229 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2230diff --git a/arch/powerpc/include/asm/system.h b/arch/powerpc/include/asm/system.h
2231index e30a13d..2b7d994 100644
2232--- a/arch/powerpc/include/asm/system.h
2233+++ b/arch/powerpc/include/asm/system.h
2234@@ -530,7 +530,7 @@ __cmpxchg_local(volatile void *ptr, unsigned long old, unsigned long new,
2235 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2236 #endif
2237
2238-extern unsigned long arch_align_stack(unsigned long sp);
2239+#define arch_align_stack(x) ((x) & ~0xfUL)
2240
2241 /* Used in very early kernel initialization. */
2242 extern unsigned long reloc_offset(void);
2243diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
2244index bd0fb84..a42a14b 100644
2245--- a/arch/powerpc/include/asm/uaccess.h
2246+++ b/arch/powerpc/include/asm/uaccess.h
2247@@ -13,6 +13,8 @@
2248 #define VERIFY_READ 0
2249 #define VERIFY_WRITE 1
2250
2251+extern void check_object_size(const void *ptr, unsigned long n, bool to);
2252+
2253 /*
2254 * The fs value determines whether argument validity checking should be
2255 * performed or not. If get_fs() == USER_DS, checking is performed, with
2256@@ -327,52 +329,6 @@ do { \
2257 extern unsigned long __copy_tofrom_user(void __user *to,
2258 const void __user *from, unsigned long size);
2259
2260-#ifndef __powerpc64__
2261-
2262-static inline unsigned long copy_from_user(void *to,
2263- const void __user *from, unsigned long n)
2264-{
2265- unsigned long over;
2266-
2267- if (access_ok(VERIFY_READ, from, n))
2268- return __copy_tofrom_user((__force void __user *)to, from, n);
2269- if ((unsigned long)from < TASK_SIZE) {
2270- over = (unsigned long)from + n - TASK_SIZE;
2271- return __copy_tofrom_user((__force void __user *)to, from,
2272- n - over) + over;
2273- }
2274- return n;
2275-}
2276-
2277-static inline unsigned long copy_to_user(void __user *to,
2278- const void *from, unsigned long n)
2279-{
2280- unsigned long over;
2281-
2282- if (access_ok(VERIFY_WRITE, to, n))
2283- return __copy_tofrom_user(to, (__force void __user *)from, n);
2284- if ((unsigned long)to < TASK_SIZE) {
2285- over = (unsigned long)to + n - TASK_SIZE;
2286- return __copy_tofrom_user(to, (__force void __user *)from,
2287- n - over) + over;
2288- }
2289- return n;
2290-}
2291-
2292-#else /* __powerpc64__ */
2293-
2294-#define __copy_in_user(to, from, size) \
2295- __copy_tofrom_user((to), (from), (size))
2296-
2297-extern unsigned long copy_from_user(void *to, const void __user *from,
2298- unsigned long n);
2299-extern unsigned long copy_to_user(void __user *to, const void *from,
2300- unsigned long n);
2301-extern unsigned long copy_in_user(void __user *to, const void __user *from,
2302- unsigned long n);
2303-
2304-#endif /* __powerpc64__ */
2305-
2306 static inline unsigned long __copy_from_user_inatomic(void *to,
2307 const void __user *from, unsigned long n)
2308 {
2309@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
2310 if (ret == 0)
2311 return 0;
2312 }
2313+
2314+ if (!__builtin_constant_p(n))
2315+ check_object_size(to, n, false);
2316+
2317 return __copy_tofrom_user((__force void __user *)to, from, n);
2318 }
2319
2320@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
2321 if (ret == 0)
2322 return 0;
2323 }
2324+
2325+ if (!__builtin_constant_p(n))
2326+ check_object_size(from, n, true);
2327+
2328 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2329 }
2330
2331@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
2332 return __copy_to_user_inatomic(to, from, size);
2333 }
2334
2335+#ifndef __powerpc64__
2336+
2337+static inline unsigned long __must_check copy_from_user(void *to,
2338+ const void __user *from, unsigned long n)
2339+{
2340+ unsigned long over;
2341+
2342+ if ((long)n < 0)
2343+ return n;
2344+
2345+ if (access_ok(VERIFY_READ, from, n)) {
2346+ if (!__builtin_constant_p(n))
2347+ check_object_size(to, n, false);
2348+ return __copy_tofrom_user((__force void __user *)to, from, n);
2349+ }
2350+ if ((unsigned long)from < TASK_SIZE) {
2351+ over = (unsigned long)from + n - TASK_SIZE;
2352+ if (!__builtin_constant_p(n - over))
2353+ check_object_size(to, n - over, false);
2354+ return __copy_tofrom_user((__force void __user *)to, from,
2355+ n - over) + over;
2356+ }
2357+ return n;
2358+}
2359+
2360+static inline unsigned long __must_check copy_to_user(void __user *to,
2361+ const void *from, unsigned long n)
2362+{
2363+ unsigned long over;
2364+
2365+ if ((long)n < 0)
2366+ return n;
2367+
2368+ if (access_ok(VERIFY_WRITE, to, n)) {
2369+ if (!__builtin_constant_p(n))
2370+ check_object_size(from, n, true);
2371+ return __copy_tofrom_user(to, (__force void __user *)from, n);
2372+ }
2373+ if ((unsigned long)to < TASK_SIZE) {
2374+ over = (unsigned long)to + n - TASK_SIZE;
2375+ if (!__builtin_constant_p(n))
2376+ check_object_size(from, n - over, true);
2377+ return __copy_tofrom_user(to, (__force void __user *)from,
2378+ n - over) + over;
2379+ }
2380+ return n;
2381+}
2382+
2383+#else /* __powerpc64__ */
2384+
2385+#define __copy_in_user(to, from, size) \
2386+ __copy_tofrom_user((to), (from), (size))
2387+
2388+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2389+{
2390+ if ((long)n < 0 || n > INT_MAX)
2391+ return n;
2392+
2393+ if (!__builtin_constant_p(n))
2394+ check_object_size(to, n, false);
2395+
2396+ if (likely(access_ok(VERIFY_READ, from, n)))
2397+ n = __copy_from_user(to, from, n);
2398+ else
2399+ memset(to, 0, n);
2400+ return n;
2401+}
2402+
2403+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2404+{
2405+ if ((long)n < 0 || n > INT_MAX)
2406+ return n;
2407+
2408+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
2409+ if (!__builtin_constant_p(n))
2410+ check_object_size(from, n, true);
2411+ n = __copy_to_user(to, from, n);
2412+ }
2413+ return n;
2414+}
2415+
2416+extern unsigned long copy_in_user(void __user *to, const void __user *from,
2417+ unsigned long n);
2418+
2419+#endif /* __powerpc64__ */
2420+
2421 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2422
2423 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2424diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
2425index 429983c..7af363b 100644
2426--- a/arch/powerpc/kernel/exceptions-64e.S
2427+++ b/arch/powerpc/kernel/exceptions-64e.S
2428@@ -587,6 +587,7 @@ storage_fault_common:
2429 std r14,_DAR(r1)
2430 std r15,_DSISR(r1)
2431 addi r3,r1,STACK_FRAME_OVERHEAD
2432+ bl .save_nvgprs
2433 mr r4,r14
2434 mr r5,r15
2435 ld r14,PACA_EXGEN+EX_R14(r13)
2436@@ -596,8 +597,7 @@ storage_fault_common:
2437 cmpdi r3,0
2438 bne- 1f
2439 b .ret_from_except_lite
2440-1: bl .save_nvgprs
2441- mr r5,r3
2442+1: mr r5,r3
2443 addi r3,r1,STACK_FRAME_OVERHEAD
2444 ld r4,_DAR(r1)
2445 bl .bad_page_fault
2446diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
2447index 41b02c7..05e76fb 100644
2448--- a/arch/powerpc/kernel/exceptions-64s.S
2449+++ b/arch/powerpc/kernel/exceptions-64s.S
2450@@ -1014,10 +1014,10 @@ handle_page_fault:
2451 11: ld r4,_DAR(r1)
2452 ld r5,_DSISR(r1)
2453 addi r3,r1,STACK_FRAME_OVERHEAD
2454+ bl .save_nvgprs
2455 bl .do_page_fault
2456 cmpdi r3,0
2457 beq+ 13f
2458- bl .save_nvgprs
2459 mr r5,r3
2460 addi r3,r1,STACK_FRAME_OVERHEAD
2461 lwz r4,_DAR(r1)
2462diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
2463index 0b6d796..d760ddb 100644
2464--- a/arch/powerpc/kernel/module_32.c
2465+++ b/arch/powerpc/kernel/module_32.c
2466@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
2467 me->arch.core_plt_section = i;
2468 }
2469 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2470- printk("Module doesn't contain .plt or .init.plt sections.\n");
2471+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2472 return -ENOEXEC;
2473 }
2474
2475@@ -192,11 +192,16 @@ static uint32_t do_plt_call(void *location,
2476
2477 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2478 /* Init, or core PLT? */
2479- if (location >= mod->module_core
2480- && location < mod->module_core + mod->core_size)
2481+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2482+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2483 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2484- else
2485+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2486+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2487 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2488+ else {
2489+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2490+ return ~0UL;
2491+ }
2492
2493 /* Find this entry, or if that fails, the next avail. entry */
2494 while (entry->jump[0]) {
2495diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
2496index 8f53954..a704ad6 100644
2497--- a/arch/powerpc/kernel/process.c
2498+++ b/arch/powerpc/kernel/process.c
2499@@ -682,8 +682,8 @@ void show_regs(struct pt_regs * regs)
2500 * Lookup NIP late so we have the best change of getting the
2501 * above info out without failing
2502 */
2503- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2504- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2505+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2506+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2507 #endif
2508 show_stack(current, (unsigned long *) regs->gpr[1]);
2509 if (!user_mode(regs))
2510@@ -1187,10 +1187,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2511 newsp = stack[0];
2512 ip = stack[STACK_FRAME_LR_SAVE];
2513 if (!firstframe || ip != lr) {
2514- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2515+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2516 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2517 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2518- printk(" (%pS)",
2519+ printk(" (%pA)",
2520 (void *)current->ret_stack[curr_frame].ret);
2521 curr_frame--;
2522 }
2523@@ -1210,7 +1210,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2524 struct pt_regs *regs = (struct pt_regs *)
2525 (sp + STACK_FRAME_OVERHEAD);
2526 lr = regs->link;
2527- printk("--- Exception: %lx at %pS\n LR = %pS\n",
2528+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
2529 regs->trap, (void *)regs->nip, (void *)lr);
2530 firstframe = 1;
2531 }
2532@@ -1285,58 +1285,3 @@ void thread_info_cache_init(void)
2533 }
2534
2535 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2536-
2537-unsigned long arch_align_stack(unsigned long sp)
2538-{
2539- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2540- sp -= get_random_int() & ~PAGE_MASK;
2541- return sp & ~0xf;
2542-}
2543-
2544-static inline unsigned long brk_rnd(void)
2545-{
2546- unsigned long rnd = 0;
2547-
2548- /* 8MB for 32bit, 1GB for 64bit */
2549- if (is_32bit_task())
2550- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2551- else
2552- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2553-
2554- return rnd << PAGE_SHIFT;
2555-}
2556-
2557-unsigned long arch_randomize_brk(struct mm_struct *mm)
2558-{
2559- unsigned long base = mm->brk;
2560- unsigned long ret;
2561-
2562-#ifdef CONFIG_PPC_STD_MMU_64
2563- /*
2564- * If we are using 1TB segments and we are allowed to randomise
2565- * the heap, we can put it above 1TB so it is backed by a 1TB
2566- * segment. Otherwise the heap will be in the bottom 1TB
2567- * which always uses 256MB segments and this may result in a
2568- * performance penalty.
2569- */
2570- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2571- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2572-#endif
2573-
2574- ret = PAGE_ALIGN(base + brk_rnd());
2575-
2576- if (ret < mm->brk)
2577- return mm->brk;
2578-
2579- return ret;
2580-}
2581-
2582-unsigned long randomize_et_dyn(unsigned long base)
2583-{
2584- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2585-
2586- if (ret < base)
2587- return base;
2588-
2589- return ret;
2590-}
2591diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
2592index 78b76dc..7f232ef 100644
2593--- a/arch/powerpc/kernel/signal_32.c
2594+++ b/arch/powerpc/kernel/signal_32.c
2595@@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
2596 /* Save user registers on the stack */
2597 frame = &rt_sf->uc.uc_mcontext;
2598 addr = frame;
2599- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2600+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2601 if (save_user_regs(regs, frame, 0, 1))
2602 goto badframe;
2603 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2604diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
2605index e91c736..742ec06 100644
2606--- a/arch/powerpc/kernel/signal_64.c
2607+++ b/arch/powerpc/kernel/signal_64.c
2608@@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
2609 current->thread.fpscr.val = 0;
2610
2611 /* Set up to return from userspace. */
2612- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2613+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2614 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2615 } else {
2616 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2617diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
2618index f19d977..8ac286e 100644
2619--- a/arch/powerpc/kernel/traps.c
2620+++ b/arch/powerpc/kernel/traps.c
2621@@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void)
2622 static inline void pmac_backlight_unblank(void) { }
2623 #endif
2624
2625+extern void gr_handle_kernel_exploit(void);
2626+
2627 int die(const char *str, struct pt_regs *regs, long err)
2628 {
2629 static struct {
2630@@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs *regs, long err)
2631 if (panic_on_oops)
2632 panic("Fatal exception");
2633
2634+ gr_handle_kernel_exploit();
2635+
2636 oops_exit();
2637 do_exit(err);
2638
2639diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
2640index 142ab10..236e61a 100644
2641--- a/arch/powerpc/kernel/vdso.c
2642+++ b/arch/powerpc/kernel/vdso.c
2643@@ -36,6 +36,7 @@
2644 #include <asm/firmware.h>
2645 #include <asm/vdso.h>
2646 #include <asm/vdso_datapage.h>
2647+#include <asm/mman.h>
2648
2649 #include "setup.h"
2650
2651@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2652 vdso_base = VDSO32_MBASE;
2653 #endif
2654
2655- current->mm->context.vdso_base = 0;
2656+ current->mm->context.vdso_base = ~0UL;
2657
2658 /* vDSO has a problem and was disabled, just don't "enable" it for the
2659 * process
2660@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2661 vdso_base = get_unmapped_area(NULL, vdso_base,
2662 (vdso_pages << PAGE_SHIFT) +
2663 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2664- 0, 0);
2665+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
2666 if (IS_ERR_VALUE(vdso_base)) {
2667 rc = vdso_base;
2668 goto fail_mmapsem;
2669diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
2670index 5eea6f3..5d10396 100644
2671--- a/arch/powerpc/lib/usercopy_64.c
2672+++ b/arch/powerpc/lib/usercopy_64.c
2673@@ -9,22 +9,6 @@
2674 #include <linux/module.h>
2675 #include <asm/uaccess.h>
2676
2677-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2678-{
2679- if (likely(access_ok(VERIFY_READ, from, n)))
2680- n = __copy_from_user(to, from, n);
2681- else
2682- memset(to, 0, n);
2683- return n;
2684-}
2685-
2686-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2687-{
2688- if (likely(access_ok(VERIFY_WRITE, to, n)))
2689- n = __copy_to_user(to, from, n);
2690- return n;
2691-}
2692-
2693 unsigned long copy_in_user(void __user *to, const void __user *from,
2694 unsigned long n)
2695 {
2696@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
2697 return n;
2698 }
2699
2700-EXPORT_SYMBOL(copy_from_user);
2701-EXPORT_SYMBOL(copy_to_user);
2702 EXPORT_SYMBOL(copy_in_user);
2703
2704diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
2705index 5efe8c9..db9ceef 100644
2706--- a/arch/powerpc/mm/fault.c
2707+++ b/arch/powerpc/mm/fault.c
2708@@ -32,6 +32,10 @@
2709 #include <linux/perf_event.h>
2710 #include <linux/magic.h>
2711 #include <linux/ratelimit.h>
2712+#include <linux/slab.h>
2713+#include <linux/pagemap.h>
2714+#include <linux/compiler.h>
2715+#include <linux/unistd.h>
2716
2717 #include <asm/firmware.h>
2718 #include <asm/page.h>
2719@@ -43,6 +47,7 @@
2720 #include <asm/tlbflush.h>
2721 #include <asm/siginfo.h>
2722 #include <mm/mmu_decl.h>
2723+#include <asm/ptrace.h>
2724
2725 #ifdef CONFIG_KPROBES
2726 static inline int notify_page_fault(struct pt_regs *regs)
2727@@ -66,6 +71,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
2728 }
2729 #endif
2730
2731+#ifdef CONFIG_PAX_PAGEEXEC
2732+/*
2733+ * PaX: decide what to do with offenders (regs->nip = fault address)
2734+ *
2735+ * returns 1 when task should be killed
2736+ */
2737+static int pax_handle_fetch_fault(struct pt_regs *regs)
2738+{
2739+ return 1;
2740+}
2741+
2742+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2743+{
2744+ unsigned long i;
2745+
2746+ printk(KERN_ERR "PAX: bytes at PC: ");
2747+ for (i = 0; i < 5; i++) {
2748+ unsigned int c;
2749+ if (get_user(c, (unsigned int __user *)pc+i))
2750+ printk(KERN_CONT "???????? ");
2751+ else
2752+ printk(KERN_CONT "%08x ", c);
2753+ }
2754+ printk("\n");
2755+}
2756+#endif
2757+
2758 /*
2759 * Check whether the instruction at regs->nip is a store using
2760 * an update addressing form which will update r1.
2761@@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
2762 * indicate errors in DSISR but can validly be set in SRR1.
2763 */
2764 if (trap == 0x400)
2765- error_code &= 0x48200000;
2766+ error_code &= 0x58200000;
2767 else
2768 is_write = error_code & DSISR_ISSTORE;
2769 #else
2770@@ -259,7 +291,7 @@ good_area:
2771 * "undefined". Of those that can be set, this is the only
2772 * one which seems bad.
2773 */
2774- if (error_code & 0x10000000)
2775+ if (error_code & DSISR_GUARDED)
2776 /* Guarded storage error. */
2777 goto bad_area;
2778 #endif /* CONFIG_8xx */
2779@@ -274,7 +306,7 @@ good_area:
2780 * processors use the same I/D cache coherency mechanism
2781 * as embedded.
2782 */
2783- if (error_code & DSISR_PROTFAULT)
2784+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2785 goto bad_area;
2786 #endif /* CONFIG_PPC_STD_MMU */
2787
2788@@ -343,6 +375,23 @@ bad_area:
2789 bad_area_nosemaphore:
2790 /* User mode accesses cause a SIGSEGV */
2791 if (user_mode(regs)) {
2792+
2793+#ifdef CONFIG_PAX_PAGEEXEC
2794+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2795+#ifdef CONFIG_PPC_STD_MMU
2796+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2797+#else
2798+ if (is_exec && regs->nip == address) {
2799+#endif
2800+ switch (pax_handle_fetch_fault(regs)) {
2801+ }
2802+
2803+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2804+ do_group_exit(SIGKILL);
2805+ }
2806+ }
2807+#endif
2808+
2809 _exception(SIGSEGV, regs, code, address);
2810 return 0;
2811 }
2812diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
2813index 5a783d8..c23e14b 100644
2814--- a/arch/powerpc/mm/mmap_64.c
2815+++ b/arch/powerpc/mm/mmap_64.c
2816@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
2817 */
2818 if (mmap_is_legacy()) {
2819 mm->mmap_base = TASK_UNMAPPED_BASE;
2820+
2821+#ifdef CONFIG_PAX_RANDMMAP
2822+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2823+ mm->mmap_base += mm->delta_mmap;
2824+#endif
2825+
2826 mm->get_unmapped_area = arch_get_unmapped_area;
2827 mm->unmap_area = arch_unmap_area;
2828 } else {
2829 mm->mmap_base = mmap_base();
2830+
2831+#ifdef CONFIG_PAX_RANDMMAP
2832+ if (mm->pax_flags & MF_PAX_RANDMMAP)
2833+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2834+#endif
2835+
2836 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2837 mm->unmap_area = arch_unmap_area_topdown;
2838 }
2839diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
2840index ba51948..23009d9 100644
2841--- a/arch/powerpc/mm/slice.c
2842+++ b/arch/powerpc/mm/slice.c
2843@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
2844 if ((mm->task_size - len) < addr)
2845 return 0;
2846 vma = find_vma(mm, addr);
2847- return (!vma || (addr + len) <= vma->vm_start);
2848+ return check_heap_stack_gap(vma, addr, len);
2849 }
2850
2851 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
2852@@ -256,7 +256,7 @@ full_search:
2853 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
2854 continue;
2855 }
2856- if (!vma || addr + len <= vma->vm_start) {
2857+ if (check_heap_stack_gap(vma, addr, len)) {
2858 /*
2859 * Remember the place where we stopped the search:
2860 */
2861@@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2862 }
2863 }
2864
2865- addr = mm->mmap_base;
2866- while (addr > len) {
2867+ if (mm->mmap_base < len)
2868+ addr = -ENOMEM;
2869+ else
2870+ addr = mm->mmap_base - len;
2871+
2872+ while (!IS_ERR_VALUE(addr)) {
2873 /* Go down by chunk size */
2874- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
2875+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
2876
2877 /* Check for hit with different page size */
2878 mask = slice_range_to_mask(addr, len);
2879@@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2880 * return with success:
2881 */
2882 vma = find_vma(mm, addr);
2883- if (!vma || (addr + len) <= vma->vm_start) {
2884+ if (check_heap_stack_gap(vma, addr, len)) {
2885 /* remember the address as a hint for next time */
2886 if (use_cache)
2887 mm->free_area_cache = addr;
2888@@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2889 mm->cached_hole_size = vma->vm_start - addr;
2890
2891 /* try just below the current vma->vm_start */
2892- addr = vma->vm_start;
2893+ addr = skip_heap_stack_gap(vma, len);
2894 }
2895
2896 /*
2897@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
2898 if (fixed && addr > (mm->task_size - len))
2899 return -EINVAL;
2900
2901+#ifdef CONFIG_PAX_RANDMMAP
2902+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2903+ addr = 0;
2904+#endif
2905+
2906 /* If hint, make sure it matches our alignment restrictions */
2907 if (!fixed && addr) {
2908 addr = _ALIGN_UP(addr, 1ul << pshift);
2909diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
2910index 547f1a6..3fff354 100644
2911--- a/arch/s390/include/asm/elf.h
2912+++ b/arch/s390/include/asm/elf.h
2913@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
2914 the loader. We need to make sure that it is out of the way of the program
2915 that it will "exec", and that there is sufficient room for the brk. */
2916
2917-extern unsigned long randomize_et_dyn(unsigned long base);
2918-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
2919+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
2920+
2921+#ifdef CONFIG_PAX_ASLR
2922+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2923+
2924+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2925+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2926+#endif
2927
2928 /* This yields a mask that user programs can use to figure out what
2929 instruction set this CPU supports. */
2930@@ -211,7 +217,4 @@ struct linux_binprm;
2931 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2932 int arch_setup_additional_pages(struct linux_binprm *, int);
2933
2934-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2935-#define arch_randomize_brk arch_randomize_brk
2936-
2937 #endif
2938diff --git a/arch/s390/include/asm/system.h b/arch/s390/include/asm/system.h
2939index 6582f69..b69906f 100644
2940--- a/arch/s390/include/asm/system.h
2941+++ b/arch/s390/include/asm/system.h
2942@@ -256,7 +256,7 @@ extern void (*_machine_restart)(char *command);
2943 extern void (*_machine_halt)(void);
2944 extern void (*_machine_power_off)(void);
2945
2946-extern unsigned long arch_align_stack(unsigned long sp);
2947+#define arch_align_stack(x) ((x) & ~0xfUL)
2948
2949 static inline int tprot(unsigned long addr)
2950 {
2951diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
2952index 2b23885..e136e31 100644
2953--- a/arch/s390/include/asm/uaccess.h
2954+++ b/arch/s390/include/asm/uaccess.h
2955@@ -235,6 +235,10 @@ static inline unsigned long __must_check
2956 copy_to_user(void __user *to, const void *from, unsigned long n)
2957 {
2958 might_fault();
2959+
2960+ if ((long)n < 0)
2961+ return n;
2962+
2963 if (access_ok(VERIFY_WRITE, to, n))
2964 n = __copy_to_user(to, from, n);
2965 return n;
2966@@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
2967 static inline unsigned long __must_check
2968 __copy_from_user(void *to, const void __user *from, unsigned long n)
2969 {
2970+ if ((long)n < 0)
2971+ return n;
2972+
2973 if (__builtin_constant_p(n) && (n <= 256))
2974 return uaccess.copy_from_user_small(n, from, to);
2975 else
2976@@ -294,6 +301,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
2977 unsigned int sz = __compiletime_object_size(to);
2978
2979 might_fault();
2980+
2981+ if ((long)n < 0)
2982+ return n;
2983+
2984 if (unlikely(sz != -1 && sz < n)) {
2985 copy_from_user_overflow();
2986 return n;
2987diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
2988index dfcb343..eda788a 100644
2989--- a/arch/s390/kernel/module.c
2990+++ b/arch/s390/kernel/module.c
2991@@ -161,11 +161,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
2992
2993 /* Increase core size by size of got & plt and set start
2994 offsets for got and plt. */
2995- me->core_size = ALIGN(me->core_size, 4);
2996- me->arch.got_offset = me->core_size;
2997- me->core_size += me->arch.got_size;
2998- me->arch.plt_offset = me->core_size;
2999- me->core_size += me->arch.plt_size;
3000+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
3001+ me->arch.got_offset = me->core_size_rw;
3002+ me->core_size_rw += me->arch.got_size;
3003+ me->arch.plt_offset = me->core_size_rx;
3004+ me->core_size_rx += me->arch.plt_size;
3005 return 0;
3006 }
3007
3008@@ -242,7 +242,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3009 if (info->got_initialized == 0) {
3010 Elf_Addr *gotent;
3011
3012- gotent = me->module_core + me->arch.got_offset +
3013+ gotent = me->module_core_rw + me->arch.got_offset +
3014 info->got_offset;
3015 *gotent = val;
3016 info->got_initialized = 1;
3017@@ -266,7 +266,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3018 else if (r_type == R_390_GOTENT ||
3019 r_type == R_390_GOTPLTENT)
3020 *(unsigned int *) loc =
3021- (val + (Elf_Addr) me->module_core - loc) >> 1;
3022+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3023 else if (r_type == R_390_GOT64 ||
3024 r_type == R_390_GOTPLT64)
3025 *(unsigned long *) loc = val;
3026@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3027 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3028 if (info->plt_initialized == 0) {
3029 unsigned int *ip;
3030- ip = me->module_core + me->arch.plt_offset +
3031+ ip = me->module_core_rx + me->arch.plt_offset +
3032 info->plt_offset;
3033 #ifndef CONFIG_64BIT
3034 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3035@@ -305,7 +305,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3036 val - loc + 0xffffUL < 0x1ffffeUL) ||
3037 (r_type == R_390_PLT32DBL &&
3038 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3039- val = (Elf_Addr) me->module_core +
3040+ val = (Elf_Addr) me->module_core_rx +
3041 me->arch.plt_offset +
3042 info->plt_offset;
3043 val += rela->r_addend - loc;
3044@@ -327,7 +327,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3045 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3046 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3047 val = val + rela->r_addend -
3048- ((Elf_Addr) me->module_core + me->arch.got_offset);
3049+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3050 if (r_type == R_390_GOTOFF16)
3051 *(unsigned short *) loc = val;
3052 else if (r_type == R_390_GOTOFF32)
3053@@ -337,7 +337,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3054 break;
3055 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3056 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3057- val = (Elf_Addr) me->module_core + me->arch.got_offset +
3058+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3059 rela->r_addend - loc;
3060 if (r_type == R_390_GOTPC)
3061 *(unsigned int *) loc = val;
3062diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
3063index 541a750..8739853 100644
3064--- a/arch/s390/kernel/process.c
3065+++ b/arch/s390/kernel/process.c
3066@@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_struct *p)
3067 }
3068 return 0;
3069 }
3070-
3071-unsigned long arch_align_stack(unsigned long sp)
3072-{
3073- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3074- sp -= get_random_int() & ~PAGE_MASK;
3075- return sp & ~0xf;
3076-}
3077-
3078-static inline unsigned long brk_rnd(void)
3079-{
3080- /* 8MB for 32bit, 1GB for 64bit */
3081- if (is_32bit_task())
3082- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
3083- else
3084- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
3085-}
3086-
3087-unsigned long arch_randomize_brk(struct mm_struct *mm)
3088-{
3089- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
3090-
3091- if (ret < mm->brk)
3092- return mm->brk;
3093- return ret;
3094-}
3095-
3096-unsigned long randomize_et_dyn(unsigned long base)
3097-{
3098- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3099-
3100- if (!(current->flags & PF_RANDOMIZE))
3101- return base;
3102- if (ret < base)
3103- return base;
3104- return ret;
3105-}
3106diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
3107index 7b371c3..ad06cf1 100644
3108--- a/arch/s390/kernel/setup.c
3109+++ b/arch/s390/kernel/setup.c
3110@@ -271,7 +271,7 @@ static int __init early_parse_mem(char *p)
3111 }
3112 early_param("mem", early_parse_mem);
3113
3114-unsigned int user_mode = HOME_SPACE_MODE;
3115+unsigned int user_mode = SECONDARY_SPACE_MODE;
3116 EXPORT_SYMBOL_GPL(user_mode);
3117
3118 static int set_amode_and_uaccess(unsigned long user_amode,
3119diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
3120index c9a9f7f..60d0315 100644
3121--- a/arch/s390/mm/mmap.c
3122+++ b/arch/s390/mm/mmap.c
3123@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3124 */
3125 if (mmap_is_legacy()) {
3126 mm->mmap_base = TASK_UNMAPPED_BASE;
3127+
3128+#ifdef CONFIG_PAX_RANDMMAP
3129+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3130+ mm->mmap_base += mm->delta_mmap;
3131+#endif
3132+
3133 mm->get_unmapped_area = arch_get_unmapped_area;
3134 mm->unmap_area = arch_unmap_area;
3135 } else {
3136 mm->mmap_base = mmap_base();
3137+
3138+#ifdef CONFIG_PAX_RANDMMAP
3139+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3140+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3141+#endif
3142+
3143 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3144 mm->unmap_area = arch_unmap_area_topdown;
3145 }
3146@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3147 */
3148 if (mmap_is_legacy()) {
3149 mm->mmap_base = TASK_UNMAPPED_BASE;
3150+
3151+#ifdef CONFIG_PAX_RANDMMAP
3152+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3153+ mm->mmap_base += mm->delta_mmap;
3154+#endif
3155+
3156 mm->get_unmapped_area = s390_get_unmapped_area;
3157 mm->unmap_area = arch_unmap_area;
3158 } else {
3159 mm->mmap_base = mmap_base();
3160+
3161+#ifdef CONFIG_PAX_RANDMMAP
3162+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3163+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3164+#endif
3165+
3166 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3167 mm->unmap_area = arch_unmap_area_topdown;
3168 }
3169diff --git a/arch/score/include/asm/system.h b/arch/score/include/asm/system.h
3170index 589d5c7..669e274 100644
3171--- a/arch/score/include/asm/system.h
3172+++ b/arch/score/include/asm/system.h
3173@@ -17,7 +17,7 @@ do { \
3174 #define finish_arch_switch(prev) do {} while (0)
3175
3176 typedef void (*vi_handler_t)(void);
3177-extern unsigned long arch_align_stack(unsigned long sp);
3178+#define arch_align_stack(x) (x)
3179
3180 #define mb() barrier()
3181 #define rmb() barrier()
3182diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
3183index 25d0803..d6c8e36 100644
3184--- a/arch/score/kernel/process.c
3185+++ b/arch/score/kernel/process.c
3186@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_struct *task)
3187
3188 return task_pt_regs(task)->cp0_epc;
3189 }
3190-
3191-unsigned long arch_align_stack(unsigned long sp)
3192-{
3193- return sp;
3194-}
3195diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
3196index afeb710..d1d1289 100644
3197--- a/arch/sh/mm/mmap.c
3198+++ b/arch/sh/mm/mmap.c
3199@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
3200 addr = PAGE_ALIGN(addr);
3201
3202 vma = find_vma(mm, addr);
3203- if (TASK_SIZE - len >= addr &&
3204- (!vma || addr + len <= vma->vm_start))
3205+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3206 return addr;
3207 }
3208
3209@@ -106,7 +105,7 @@ full_search:
3210 }
3211 return -ENOMEM;
3212 }
3213- if (likely(!vma || addr + len <= vma->vm_start)) {
3214+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3215 /*
3216 * Remember the place where we stopped the search:
3217 */
3218@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3219 addr = PAGE_ALIGN(addr);
3220
3221 vma = find_vma(mm, addr);
3222- if (TASK_SIZE - len >= addr &&
3223- (!vma || addr + len <= vma->vm_start))
3224+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3225 return addr;
3226 }
3227
3228@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3229 /* make sure it can fit in the remaining address space */
3230 if (likely(addr > len)) {
3231 vma = find_vma(mm, addr-len);
3232- if (!vma || addr <= vma->vm_start) {
3233+ if (check_heap_stack_gap(vma, addr - len, len)) {
3234 /* remember the address as a hint for next time */
3235 return (mm->free_area_cache = addr-len);
3236 }
3237@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3238 if (unlikely(mm->mmap_base < len))
3239 goto bottomup;
3240
3241- addr = mm->mmap_base-len;
3242- if (do_colour_align)
3243- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3244+ addr = mm->mmap_base - len;
3245
3246 do {
3247+ if (do_colour_align)
3248+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3249 /*
3250 * Lookup failure means no vma is above this address,
3251 * else if new region fits below vma->vm_start,
3252 * return with success:
3253 */
3254 vma = find_vma(mm, addr);
3255- if (likely(!vma || addr+len <= vma->vm_start)) {
3256+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3257 /* remember the address as a hint for next time */
3258 return (mm->free_area_cache = addr);
3259 }
3260@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3261 mm->cached_hole_size = vma->vm_start - addr;
3262
3263 /* try just below the current vma->vm_start */
3264- addr = vma->vm_start-len;
3265- if (do_colour_align)
3266- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3267- } while (likely(len < vma->vm_start));
3268+ addr = skip_heap_stack_gap(vma, len);
3269+ } while (!IS_ERR_VALUE(addr));
3270
3271 bottomup:
3272 /*
3273diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
3274index ad1fb5d..fc5315b 100644
3275--- a/arch/sparc/Makefile
3276+++ b/arch/sparc/Makefile
3277@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
3278 # Export what is needed by arch/sparc/boot/Makefile
3279 export VMLINUX_INIT VMLINUX_MAIN
3280 VMLINUX_INIT := $(head-y) $(init-y)
3281-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
3282+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
3283 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
3284 VMLINUX_MAIN += $(drivers-y) $(net-y)
3285
3286diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
3287index 9f421df..b81fc12 100644
3288--- a/arch/sparc/include/asm/atomic_64.h
3289+++ b/arch/sparc/include/asm/atomic_64.h
3290@@ -14,18 +14,40 @@
3291 #define ATOMIC64_INIT(i) { (i) }
3292
3293 #define atomic_read(v) (*(volatile int *)&(v)->counter)
3294+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3295+{
3296+ return v->counter;
3297+}
3298 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
3299+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3300+{
3301+ return v->counter;
3302+}
3303
3304 #define atomic_set(v, i) (((v)->counter) = i)
3305+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3306+{
3307+ v->counter = i;
3308+}
3309 #define atomic64_set(v, i) (((v)->counter) = i)
3310+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3311+{
3312+ v->counter = i;
3313+}
3314
3315 extern void atomic_add(int, atomic_t *);
3316+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3317 extern void atomic64_add(long, atomic64_t *);
3318+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3319 extern void atomic_sub(int, atomic_t *);
3320+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3321 extern void atomic64_sub(long, atomic64_t *);
3322+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3323
3324 extern int atomic_add_ret(int, atomic_t *);
3325+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3326 extern long atomic64_add_ret(long, atomic64_t *);
3327+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3328 extern int atomic_sub_ret(int, atomic_t *);
3329 extern long atomic64_sub_ret(long, atomic64_t *);
3330
3331@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3332 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3333
3334 #define atomic_inc_return(v) atomic_add_ret(1, v)
3335+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3336+{
3337+ return atomic_add_ret_unchecked(1, v);
3338+}
3339 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3340+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3341+{
3342+ return atomic64_add_ret_unchecked(1, v);
3343+}
3344
3345 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3346 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3347
3348 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3349+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3350+{
3351+ return atomic_add_ret_unchecked(i, v);
3352+}
3353 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3354+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3355+{
3356+ return atomic64_add_ret_unchecked(i, v);
3357+}
3358
3359 /*
3360 * atomic_inc_and_test - increment and test
3361@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3362 * other cases.
3363 */
3364 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3365+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3366+{
3367+ return atomic_inc_return_unchecked(v) == 0;
3368+}
3369 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3370
3371 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3372@@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3373 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3374
3375 #define atomic_inc(v) atomic_add(1, v)
3376+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3377+{
3378+ atomic_add_unchecked(1, v);
3379+}
3380 #define atomic64_inc(v) atomic64_add(1, v)
3381+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3382+{
3383+ atomic64_add_unchecked(1, v);
3384+}
3385
3386 #define atomic_dec(v) atomic_sub(1, v)
3387+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3388+{
3389+ atomic_sub_unchecked(1, v);
3390+}
3391 #define atomic64_dec(v) atomic64_sub(1, v)
3392+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3393+{
3394+ atomic64_sub_unchecked(1, v);
3395+}
3396
3397 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3398 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3399
3400 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3401+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3402+{
3403+ return cmpxchg(&v->counter, old, new);
3404+}
3405 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3406+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3407+{
3408+ return xchg(&v->counter, new);
3409+}
3410
3411 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3412 {
3413- int c, old;
3414+ int c, old, new;
3415 c = atomic_read(v);
3416 for (;;) {
3417- if (unlikely(c == (u)))
3418+ if (unlikely(c == u))
3419 break;
3420- old = atomic_cmpxchg((v), c, c + (a));
3421+
3422+ asm volatile("addcc %2, %0, %0\n"
3423+
3424+#ifdef CONFIG_PAX_REFCOUNT
3425+ "tvs %%icc, 6\n"
3426+#endif
3427+
3428+ : "=r" (new)
3429+ : "0" (c), "ir" (a)
3430+ : "cc");
3431+
3432+ old = atomic_cmpxchg(v, c, new);
3433 if (likely(old == c))
3434 break;
3435 c = old;
3436@@ -89,20 +166,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3437 #define atomic64_cmpxchg(v, o, n) \
3438 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3439 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3440+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3441+{
3442+ return xchg(&v->counter, new);
3443+}
3444
3445 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3446 {
3447- long c, old;
3448+ long c, old, new;
3449 c = atomic64_read(v);
3450 for (;;) {
3451- if (unlikely(c == (u)))
3452+ if (unlikely(c == u))
3453 break;
3454- old = atomic64_cmpxchg((v), c, c + (a));
3455+
3456+ asm volatile("addcc %2, %0, %0\n"
3457+
3458+#ifdef CONFIG_PAX_REFCOUNT
3459+ "tvs %%xcc, 6\n"
3460+#endif
3461+
3462+ : "=r" (new)
3463+ : "0" (c), "ir" (a)
3464+ : "cc");
3465+
3466+ old = atomic64_cmpxchg(v, c, new);
3467 if (likely(old == c))
3468 break;
3469 c = old;
3470 }
3471- return c != (u);
3472+ return c != u;
3473 }
3474
3475 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3476diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
3477index 69358b5..17b4745 100644
3478--- a/arch/sparc/include/asm/cache.h
3479+++ b/arch/sparc/include/asm/cache.h
3480@@ -10,7 +10,7 @@
3481 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
3482
3483 #define L1_CACHE_SHIFT 5
3484-#define L1_CACHE_BYTES 32
3485+#define L1_CACHE_BYTES 32UL
3486
3487 #ifdef CONFIG_SPARC32
3488 #define SMP_CACHE_BYTES_SHIFT 5
3489diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
3490index 4269ca6..e3da77f 100644
3491--- a/arch/sparc/include/asm/elf_32.h
3492+++ b/arch/sparc/include/asm/elf_32.h
3493@@ -114,6 +114,13 @@ typedef struct {
3494
3495 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3496
3497+#ifdef CONFIG_PAX_ASLR
3498+#define PAX_ELF_ET_DYN_BASE 0x10000UL
3499+
3500+#define PAX_DELTA_MMAP_LEN 16
3501+#define PAX_DELTA_STACK_LEN 16
3502+#endif
3503+
3504 /* This yields a mask that user programs can use to figure out what
3505 instruction set this cpu supports. This can NOT be done in userspace
3506 on Sparc. */
3507diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
3508index 7df8b7f..4946269 100644
3509--- a/arch/sparc/include/asm/elf_64.h
3510+++ b/arch/sparc/include/asm/elf_64.h
3511@@ -180,6 +180,13 @@ typedef struct {
3512 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3513 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3514
3515+#ifdef CONFIG_PAX_ASLR
3516+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3517+
3518+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3519+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3520+#endif
3521+
3522 extern unsigned long sparc64_elf_hwcap;
3523 #define ELF_HWCAP sparc64_elf_hwcap
3524
3525diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
3526index 5b31a8e..1d92567 100644
3527--- a/arch/sparc/include/asm/pgtable_32.h
3528+++ b/arch/sparc/include/asm/pgtable_32.h
3529@@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3530 BTFIXUPDEF_INT(page_none)
3531 BTFIXUPDEF_INT(page_copy)
3532 BTFIXUPDEF_INT(page_readonly)
3533+
3534+#ifdef CONFIG_PAX_PAGEEXEC
3535+BTFIXUPDEF_INT(page_shared_noexec)
3536+BTFIXUPDEF_INT(page_copy_noexec)
3537+BTFIXUPDEF_INT(page_readonly_noexec)
3538+#endif
3539+
3540 BTFIXUPDEF_INT(page_kernel)
3541
3542 #define PMD_SHIFT SUN4C_PMD_SHIFT
3543@@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED;
3544 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
3545 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
3546
3547+#ifdef CONFIG_PAX_PAGEEXEC
3548+extern pgprot_t PAGE_SHARED_NOEXEC;
3549+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
3550+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
3551+#else
3552+# define PAGE_SHARED_NOEXEC PAGE_SHARED
3553+# define PAGE_COPY_NOEXEC PAGE_COPY
3554+# define PAGE_READONLY_NOEXEC PAGE_READONLY
3555+#endif
3556+
3557 extern unsigned long page_kernel;
3558
3559 #ifdef MODULE
3560diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
3561index f6ae2b2..b03ffc7 100644
3562--- a/arch/sparc/include/asm/pgtsrmmu.h
3563+++ b/arch/sparc/include/asm/pgtsrmmu.h
3564@@ -115,6 +115,13 @@
3565 SRMMU_EXEC | SRMMU_REF)
3566 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3567 SRMMU_EXEC | SRMMU_REF)
3568+
3569+#ifdef CONFIG_PAX_PAGEEXEC
3570+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3571+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3572+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3573+#endif
3574+
3575 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3576 SRMMU_DIRTY | SRMMU_REF)
3577
3578diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
3579index 9689176..63c18ea 100644
3580--- a/arch/sparc/include/asm/spinlock_64.h
3581+++ b/arch/sparc/include/asm/spinlock_64.h
3582@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
3583
3584 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
3585
3586-static void inline arch_read_lock(arch_rwlock_t *lock)
3587+static inline void arch_read_lock(arch_rwlock_t *lock)
3588 {
3589 unsigned long tmp1, tmp2;
3590
3591 __asm__ __volatile__ (
3592 "1: ldsw [%2], %0\n"
3593 " brlz,pn %0, 2f\n"
3594-"4: add %0, 1, %1\n"
3595+"4: addcc %0, 1, %1\n"
3596+
3597+#ifdef CONFIG_PAX_REFCOUNT
3598+" tvs %%icc, 6\n"
3599+#endif
3600+
3601 " cas [%2], %0, %1\n"
3602 " cmp %0, %1\n"
3603 " bne,pn %%icc, 1b\n"
3604@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
3605 " .previous"
3606 : "=&r" (tmp1), "=&r" (tmp2)
3607 : "r" (lock)
3608- : "memory");
3609+ : "memory", "cc");
3610 }
3611
3612-static int inline arch_read_trylock(arch_rwlock_t *lock)
3613+static inline int arch_read_trylock(arch_rwlock_t *lock)
3614 {
3615 int tmp1, tmp2;
3616
3617@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3618 "1: ldsw [%2], %0\n"
3619 " brlz,a,pn %0, 2f\n"
3620 " mov 0, %0\n"
3621-" add %0, 1, %1\n"
3622+" addcc %0, 1, %1\n"
3623+
3624+#ifdef CONFIG_PAX_REFCOUNT
3625+" tvs %%icc, 6\n"
3626+#endif
3627+
3628 " cas [%2], %0, %1\n"
3629 " cmp %0, %1\n"
3630 " bne,pn %%icc, 1b\n"
3631@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3632 return tmp1;
3633 }
3634
3635-static void inline arch_read_unlock(arch_rwlock_t *lock)
3636+static inline void arch_read_unlock(arch_rwlock_t *lock)
3637 {
3638 unsigned long tmp1, tmp2;
3639
3640 __asm__ __volatile__(
3641 "1: lduw [%2], %0\n"
3642-" sub %0, 1, %1\n"
3643+" subcc %0, 1, %1\n"
3644+
3645+#ifdef CONFIG_PAX_REFCOUNT
3646+" tvs %%icc, 6\n"
3647+#endif
3648+
3649 " cas [%2], %0, %1\n"
3650 " cmp %0, %1\n"
3651 " bne,pn %%xcc, 1b\n"
3652@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
3653 : "memory");
3654 }
3655
3656-static void inline arch_write_lock(arch_rwlock_t *lock)
3657+static inline void arch_write_lock(arch_rwlock_t *lock)
3658 {
3659 unsigned long mask, tmp1, tmp2;
3660
3661@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
3662 : "memory");
3663 }
3664
3665-static void inline arch_write_unlock(arch_rwlock_t *lock)
3666+static inline void arch_write_unlock(arch_rwlock_t *lock)
3667 {
3668 __asm__ __volatile__(
3669 " stw %%g0, [%0]"
3670@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
3671 : "memory");
3672 }
3673
3674-static int inline arch_write_trylock(arch_rwlock_t *lock)
3675+static inline int arch_write_trylock(arch_rwlock_t *lock)
3676 {
3677 unsigned long mask, tmp1, tmp2, result;
3678
3679diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
3680index fa57532..e1a4c53 100644
3681--- a/arch/sparc/include/asm/thread_info_32.h
3682+++ b/arch/sparc/include/asm/thread_info_32.h
3683@@ -50,6 +50,8 @@ struct thread_info {
3684 unsigned long w_saved;
3685
3686 struct restart_block restart_block;
3687+
3688+ unsigned long lowest_stack;
3689 };
3690
3691 /*
3692diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
3693index 60d86be..952dea1 100644
3694--- a/arch/sparc/include/asm/thread_info_64.h
3695+++ b/arch/sparc/include/asm/thread_info_64.h
3696@@ -63,6 +63,8 @@ struct thread_info {
3697 struct pt_regs *kern_una_regs;
3698 unsigned int kern_una_insn;
3699
3700+ unsigned long lowest_stack;
3701+
3702 unsigned long fpregs[0] __attribute__ ((aligned(64)));
3703 };
3704
3705diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
3706index e88fbe5..96b0ce5 100644
3707--- a/arch/sparc/include/asm/uaccess.h
3708+++ b/arch/sparc/include/asm/uaccess.h
3709@@ -1,5 +1,13 @@
3710 #ifndef ___ASM_SPARC_UACCESS_H
3711 #define ___ASM_SPARC_UACCESS_H
3712+
3713+#ifdef __KERNEL__
3714+#ifndef __ASSEMBLY__
3715+#include <linux/types.h>
3716+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3717+#endif
3718+#endif
3719+
3720 #if defined(__sparc__) && defined(__arch64__)
3721 #include <asm/uaccess_64.h>
3722 #else
3723diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
3724index 8303ac4..07f333d 100644
3725--- a/arch/sparc/include/asm/uaccess_32.h
3726+++ b/arch/sparc/include/asm/uaccess_32.h
3727@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
3728
3729 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3730 {
3731- if (n && __access_ok((unsigned long) to, n))
3732+ if ((long)n < 0)
3733+ return n;
3734+
3735+ if (n && __access_ok((unsigned long) to, n)) {
3736+ if (!__builtin_constant_p(n))
3737+ check_object_size(from, n, true);
3738 return __copy_user(to, (__force void __user *) from, n);
3739- else
3740+ } else
3741 return n;
3742 }
3743
3744 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3745 {
3746+ if ((long)n < 0)
3747+ return n;
3748+
3749+ if (!__builtin_constant_p(n))
3750+ check_object_size(from, n, true);
3751+
3752 return __copy_user(to, (__force void __user *) from, n);
3753 }
3754
3755 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
3756 {
3757- if (n && __access_ok((unsigned long) from, n))
3758+ if ((long)n < 0)
3759+ return n;
3760+
3761+ if (n && __access_ok((unsigned long) from, n)) {
3762+ if (!__builtin_constant_p(n))
3763+ check_object_size(to, n, false);
3764 return __copy_user((__force void __user *) to, from, n);
3765- else
3766+ } else
3767 return n;
3768 }
3769
3770 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3771 {
3772+ if ((long)n < 0)
3773+ return n;
3774+
3775 return __copy_user((__force void __user *) to, from, n);
3776 }
3777
3778diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
3779index 3e1449f..5293a0e 100644
3780--- a/arch/sparc/include/asm/uaccess_64.h
3781+++ b/arch/sparc/include/asm/uaccess_64.h
3782@@ -10,6 +10,7 @@
3783 #include <linux/compiler.h>
3784 #include <linux/string.h>
3785 #include <linux/thread_info.h>
3786+#include <linux/kernel.h>
3787 #include <asm/asi.h>
3788 #include <asm/system.h>
3789 #include <asm/spitfire.h>
3790@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
3791 static inline unsigned long __must_check
3792 copy_from_user(void *to, const void __user *from, unsigned long size)
3793 {
3794- unsigned long ret = ___copy_from_user(to, from, size);
3795+ unsigned long ret;
3796
3797+ if ((long)size < 0 || size > INT_MAX)
3798+ return size;
3799+
3800+ if (!__builtin_constant_p(size))
3801+ check_object_size(to, size, false);
3802+
3803+ ret = ___copy_from_user(to, from, size);
3804 if (unlikely(ret))
3805 ret = copy_from_user_fixup(to, from, size);
3806
3807@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
3808 static inline unsigned long __must_check
3809 copy_to_user(void __user *to, const void *from, unsigned long size)
3810 {
3811- unsigned long ret = ___copy_to_user(to, from, size);
3812+ unsigned long ret;
3813
3814+ if ((long)size < 0 || size > INT_MAX)
3815+ return size;
3816+
3817+ if (!__builtin_constant_p(size))
3818+ check_object_size(from, size, true);
3819+
3820+ ret = ___copy_to_user(to, from, size);
3821 if (unlikely(ret))
3822 ret = copy_to_user_fixup(to, from, size);
3823 return ret;
3824diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
3825index cb85458..e063f17 100644
3826--- a/arch/sparc/kernel/Makefile
3827+++ b/arch/sparc/kernel/Makefile
3828@@ -3,7 +3,7 @@
3829 #
3830
3831 asflags-y := -ansi
3832-ccflags-y := -Werror
3833+#ccflags-y := -Werror
3834
3835 extra-y := head_$(BITS).o
3836 extra-y += init_task.o
3837diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
3838index f793742..4d880af 100644
3839--- a/arch/sparc/kernel/process_32.c
3840+++ b/arch/sparc/kernel/process_32.c
3841@@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp)
3842 rw->ins[4], rw->ins[5],
3843 rw->ins[6],
3844 rw->ins[7]);
3845- printk("%pS\n", (void *) rw->ins[7]);
3846+ printk("%pA\n", (void *) rw->ins[7]);
3847 rw = (struct reg_window32 *) rw->ins[6];
3848 }
3849 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
3850@@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r)
3851
3852 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
3853 r->psr, r->pc, r->npc, r->y, print_tainted());
3854- printk("PC: <%pS>\n", (void *) r->pc);
3855+ printk("PC: <%pA>\n", (void *) r->pc);
3856 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3857 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
3858 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
3859 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3860 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
3861 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
3862- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
3863+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
3864
3865 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3866 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
3867@@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
3868 rw = (struct reg_window32 *) fp;
3869 pc = rw->ins[7];
3870 printk("[%08lx : ", pc);
3871- printk("%pS ] ", (void *) pc);
3872+ printk("%pA ] ", (void *) pc);
3873 fp = rw->ins[6];
3874 } while (++count < 16);
3875 printk("\n");
3876diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
3877index d959cd0..7b42812 100644
3878--- a/arch/sparc/kernel/process_64.c
3879+++ b/arch/sparc/kernel/process_64.c
3880@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_regs *regs)
3881 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
3882 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
3883 if (regs->tstate & TSTATE_PRIV)
3884- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
3885+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
3886 }
3887
3888 void show_regs(struct pt_regs *regs)
3889 {
3890 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
3891 regs->tpc, regs->tnpc, regs->y, print_tainted());
3892- printk("TPC: <%pS>\n", (void *) regs->tpc);
3893+ printk("TPC: <%pA>\n", (void *) regs->tpc);
3894 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
3895 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
3896 regs->u_regs[3]);
3897@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
3898 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
3899 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
3900 regs->u_regs[15]);
3901- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
3902+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
3903 show_regwindow(regs);
3904 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
3905 }
3906@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void)
3907 ((tp && tp->task) ? tp->task->pid : -1));
3908
3909 if (gp->tstate & TSTATE_PRIV) {
3910- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
3911+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
3912 (void *) gp->tpc,
3913 (void *) gp->o7,
3914 (void *) gp->i7,
3915diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
3916index 42b282f..28ce9f2 100644
3917--- a/arch/sparc/kernel/sys_sparc_32.c
3918+++ b/arch/sparc/kernel/sys_sparc_32.c
3919@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3920 if (ARCH_SUN4C && len > 0x20000000)
3921 return -ENOMEM;
3922 if (!addr)
3923- addr = TASK_UNMAPPED_BASE;
3924+ addr = current->mm->mmap_base;
3925
3926 if (flags & MAP_SHARED)
3927 addr = COLOUR_ALIGN(addr);
3928@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3929 }
3930 if (TASK_SIZE - PAGE_SIZE - len < addr)
3931 return -ENOMEM;
3932- if (!vmm || addr + len <= vmm->vm_start)
3933+ if (check_heap_stack_gap(vmm, addr, len))
3934 return addr;
3935 addr = vmm->vm_end;
3936 if (flags & MAP_SHARED)
3937diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
3938index 908b47a..aa9e584 100644
3939--- a/arch/sparc/kernel/sys_sparc_64.c
3940+++ b/arch/sparc/kernel/sys_sparc_64.c
3941@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3942 /* We do not accept a shared mapping if it would violate
3943 * cache aliasing constraints.
3944 */
3945- if ((flags & MAP_SHARED) &&
3946+ if ((filp || (flags & MAP_SHARED)) &&
3947 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3948 return -EINVAL;
3949 return addr;
3950@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3951 if (filp || (flags & MAP_SHARED))
3952 do_color_align = 1;
3953
3954+#ifdef CONFIG_PAX_RANDMMAP
3955+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3956+#endif
3957+
3958 if (addr) {
3959 if (do_color_align)
3960 addr = COLOUR_ALIGN(addr, pgoff);
3961@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3962 addr = PAGE_ALIGN(addr);
3963
3964 vma = find_vma(mm, addr);
3965- if (task_size - len >= addr &&
3966- (!vma || addr + len <= vma->vm_start))
3967+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3968 return addr;
3969 }
3970
3971 if (len > mm->cached_hole_size) {
3972- start_addr = addr = mm->free_area_cache;
3973+ start_addr = addr = mm->free_area_cache;
3974 } else {
3975- start_addr = addr = TASK_UNMAPPED_BASE;
3976+ start_addr = addr = mm->mmap_base;
3977 mm->cached_hole_size = 0;
3978 }
3979
3980@@ -174,14 +177,14 @@ full_search:
3981 vma = find_vma(mm, VA_EXCLUDE_END);
3982 }
3983 if (unlikely(task_size < addr)) {
3984- if (start_addr != TASK_UNMAPPED_BASE) {
3985- start_addr = addr = TASK_UNMAPPED_BASE;
3986+ if (start_addr != mm->mmap_base) {
3987+ start_addr = addr = mm->mmap_base;
3988 mm->cached_hole_size = 0;
3989 goto full_search;
3990 }
3991 return -ENOMEM;
3992 }
3993- if (likely(!vma || addr + len <= vma->vm_start)) {
3994+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3995 /*
3996 * Remember the place where we stopped the search:
3997 */
3998@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3999 /* We do not accept a shared mapping if it would violate
4000 * cache aliasing constraints.
4001 */
4002- if ((flags & MAP_SHARED) &&
4003+ if ((filp || (flags & MAP_SHARED)) &&
4004 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4005 return -EINVAL;
4006 return addr;
4007@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4008 addr = PAGE_ALIGN(addr);
4009
4010 vma = find_vma(mm, addr);
4011- if (task_size - len >= addr &&
4012- (!vma || addr + len <= vma->vm_start))
4013+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4014 return addr;
4015 }
4016
4017@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4018 /* make sure it can fit in the remaining address space */
4019 if (likely(addr > len)) {
4020 vma = find_vma(mm, addr-len);
4021- if (!vma || addr <= vma->vm_start) {
4022+ if (check_heap_stack_gap(vma, addr - len, len)) {
4023 /* remember the address as a hint for next time */
4024 return (mm->free_area_cache = addr-len);
4025 }
4026@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4027 if (unlikely(mm->mmap_base < len))
4028 goto bottomup;
4029
4030- addr = mm->mmap_base-len;
4031- if (do_color_align)
4032- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4033+ addr = mm->mmap_base - len;
4034
4035 do {
4036+ if (do_color_align)
4037+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4038 /*
4039 * Lookup failure means no vma is above this address,
4040 * else if new region fits below vma->vm_start,
4041 * return with success:
4042 */
4043 vma = find_vma(mm, addr);
4044- if (likely(!vma || addr+len <= vma->vm_start)) {
4045+ if (likely(check_heap_stack_gap(vma, addr, len))) {
4046 /* remember the address as a hint for next time */
4047 return (mm->free_area_cache = addr);
4048 }
4049@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4050 mm->cached_hole_size = vma->vm_start - addr;
4051
4052 /* try just below the current vma->vm_start */
4053- addr = vma->vm_start-len;
4054- if (do_color_align)
4055- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4056- } while (likely(len < vma->vm_start));
4057+ addr = skip_heap_stack_gap(vma, len);
4058+ } while (!IS_ERR_VALUE(addr));
4059
4060 bottomup:
4061 /*
4062@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4063 gap == RLIM_INFINITY ||
4064 sysctl_legacy_va_layout) {
4065 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4066+
4067+#ifdef CONFIG_PAX_RANDMMAP
4068+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4069+ mm->mmap_base += mm->delta_mmap;
4070+#endif
4071+
4072 mm->get_unmapped_area = arch_get_unmapped_area;
4073 mm->unmap_area = arch_unmap_area;
4074 } else {
4075@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4076 gap = (task_size / 6 * 5);
4077
4078 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4079+
4080+#ifdef CONFIG_PAX_RANDMMAP
4081+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4082+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4083+#endif
4084+
4085 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4086 mm->unmap_area = arch_unmap_area_topdown;
4087 }
4088diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
4089index c0490c7..84959d1 100644
4090--- a/arch/sparc/kernel/traps_32.c
4091+++ b/arch/sparc/kernel/traps_32.c
4092@@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
4093 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4094 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4095
4096+extern void gr_handle_kernel_exploit(void);
4097+
4098 void die_if_kernel(char *str, struct pt_regs *regs)
4099 {
4100 static int die_counter;
4101@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4102 count++ < 30 &&
4103 (((unsigned long) rw) >= PAGE_OFFSET) &&
4104 !(((unsigned long) rw) & 0x7)) {
4105- printk("Caller[%08lx]: %pS\n", rw->ins[7],
4106+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
4107 (void *) rw->ins[7]);
4108 rw = (struct reg_window32 *)rw->ins[6];
4109 }
4110 }
4111 printk("Instruction DUMP:");
4112 instruction_dump ((unsigned long *) regs->pc);
4113- if(regs->psr & PSR_PS)
4114+ if(regs->psr & PSR_PS) {
4115+ gr_handle_kernel_exploit();
4116 do_exit(SIGKILL);
4117+ }
4118 do_exit(SIGSEGV);
4119 }
4120
4121diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
4122index 0cbdaa4..438e4c9 100644
4123--- a/arch/sparc/kernel/traps_64.c
4124+++ b/arch/sparc/kernel/traps_64.c
4125@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
4126 i + 1,
4127 p->trapstack[i].tstate, p->trapstack[i].tpc,
4128 p->trapstack[i].tnpc, p->trapstack[i].tt);
4129- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4130+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4131 }
4132 }
4133
4134@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
4135
4136 lvl -= 0x100;
4137 if (regs->tstate & TSTATE_PRIV) {
4138+
4139+#ifdef CONFIG_PAX_REFCOUNT
4140+ if (lvl == 6)
4141+ pax_report_refcount_overflow(regs);
4142+#endif
4143+
4144 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4145 die_if_kernel(buffer, regs);
4146 }
4147@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
4148 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4149 {
4150 char buffer[32];
4151-
4152+
4153 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4154 0, lvl, SIGTRAP) == NOTIFY_STOP)
4155 return;
4156
4157+#ifdef CONFIG_PAX_REFCOUNT
4158+ if (lvl == 6)
4159+ pax_report_refcount_overflow(regs);
4160+#endif
4161+
4162 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4163
4164 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4165@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
4166 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4167 printk("%s" "ERROR(%d): ",
4168 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4169- printk("TPC<%pS>\n", (void *) regs->tpc);
4170+ printk("TPC<%pA>\n", (void *) regs->tpc);
4171 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4172 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4173 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4174@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4175 smp_processor_id(),
4176 (type & 0x1) ? 'I' : 'D',
4177 regs->tpc);
4178- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4179+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4180 panic("Irrecoverable Cheetah+ parity error.");
4181 }
4182
4183@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4184 smp_processor_id(),
4185 (type & 0x1) ? 'I' : 'D',
4186 regs->tpc);
4187- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4188+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4189 }
4190
4191 struct sun4v_error_entry {
4192@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
4193
4194 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4195 regs->tpc, tl);
4196- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4197+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4198 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4199- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4200+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4201 (void *) regs->u_regs[UREG_I7]);
4202 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4203 "pte[%lx] error[%lx]\n",
4204@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
4205
4206 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4207 regs->tpc, tl);
4208- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4209+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4210 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4211- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4212+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4213 (void *) regs->u_regs[UREG_I7]);
4214 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4215 "pte[%lx] error[%lx]\n",
4216@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
4217 fp = (unsigned long)sf->fp + STACK_BIAS;
4218 }
4219
4220- printk(" [%016lx] %pS\n", pc, (void *) pc);
4221+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4222 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
4223 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
4224 int index = tsk->curr_ret_stack;
4225 if (tsk->ret_stack && index >= graph) {
4226 pc = tsk->ret_stack[index - graph].ret;
4227- printk(" [%016lx] %pS\n", pc, (void *) pc);
4228+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4229 graph++;
4230 }
4231 }
4232@@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
4233 return (struct reg_window *) (fp + STACK_BIAS);
4234 }
4235
4236+extern void gr_handle_kernel_exploit(void);
4237+
4238 void die_if_kernel(char *str, struct pt_regs *regs)
4239 {
4240 static int die_counter;
4241@@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4242 while (rw &&
4243 count++ < 30 &&
4244 kstack_valid(tp, (unsigned long) rw)) {
4245- printk("Caller[%016lx]: %pS\n", rw->ins[7],
4246+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
4247 (void *) rw->ins[7]);
4248
4249 rw = kernel_stack_up(rw);
4250@@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4251 }
4252 user_instruction_dump ((unsigned int __user *) regs->tpc);
4253 }
4254- if (regs->tstate & TSTATE_PRIV)
4255+ if (regs->tstate & TSTATE_PRIV) {
4256+ gr_handle_kernel_exploit();
4257 do_exit(SIGKILL);
4258+ }
4259 do_exit(SIGSEGV);
4260 }
4261 EXPORT_SYMBOL(die_if_kernel);
4262diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
4263index 76e4ac1..78f8bb1 100644
4264--- a/arch/sparc/kernel/unaligned_64.c
4265+++ b/arch/sparc/kernel/unaligned_64.c
4266@@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs *regs)
4267 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
4268
4269 if (__ratelimit(&ratelimit)) {
4270- printk("Kernel unaligned access at TPC[%lx] %pS\n",
4271+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
4272 regs->tpc, (void *) regs->tpc);
4273 }
4274 }
4275diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
4276index a3fc437..fea9957 100644
4277--- a/arch/sparc/lib/Makefile
4278+++ b/arch/sparc/lib/Makefile
4279@@ -2,7 +2,7 @@
4280 #
4281
4282 asflags-y := -ansi -DST_DIV0=0x02
4283-ccflags-y := -Werror
4284+#ccflags-y := -Werror
4285
4286 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
4287 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
4288diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
4289index 59186e0..f747d7a 100644
4290--- a/arch/sparc/lib/atomic_64.S
4291+++ b/arch/sparc/lib/atomic_64.S
4292@@ -18,7 +18,12 @@
4293 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4294 BACKOFF_SETUP(%o2)
4295 1: lduw [%o1], %g1
4296- add %g1, %o0, %g7
4297+ addcc %g1, %o0, %g7
4298+
4299+#ifdef CONFIG_PAX_REFCOUNT
4300+ tvs %icc, 6
4301+#endif
4302+
4303 cas [%o1], %g1, %g7
4304 cmp %g1, %g7
4305 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4306@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4307 2: BACKOFF_SPIN(%o2, %o3, 1b)
4308 .size atomic_add, .-atomic_add
4309
4310+ .globl atomic_add_unchecked
4311+ .type atomic_add_unchecked,#function
4312+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4313+ BACKOFF_SETUP(%o2)
4314+1: lduw [%o1], %g1
4315+ add %g1, %o0, %g7
4316+ cas [%o1], %g1, %g7
4317+ cmp %g1, %g7
4318+ bne,pn %icc, 2f
4319+ nop
4320+ retl
4321+ nop
4322+2: BACKOFF_SPIN(%o2, %o3, 1b)
4323+ .size atomic_add_unchecked, .-atomic_add_unchecked
4324+
4325 .globl atomic_sub
4326 .type atomic_sub,#function
4327 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4328 BACKOFF_SETUP(%o2)
4329 1: lduw [%o1], %g1
4330- sub %g1, %o0, %g7
4331+ subcc %g1, %o0, %g7
4332+
4333+#ifdef CONFIG_PAX_REFCOUNT
4334+ tvs %icc, 6
4335+#endif
4336+
4337 cas [%o1], %g1, %g7
4338 cmp %g1, %g7
4339 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4340@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4341 2: BACKOFF_SPIN(%o2, %o3, 1b)
4342 .size atomic_sub, .-atomic_sub
4343
4344+ .globl atomic_sub_unchecked
4345+ .type atomic_sub_unchecked,#function
4346+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4347+ BACKOFF_SETUP(%o2)
4348+1: lduw [%o1], %g1
4349+ sub %g1, %o0, %g7
4350+ cas [%o1], %g1, %g7
4351+ cmp %g1, %g7
4352+ bne,pn %icc, 2f
4353+ nop
4354+ retl
4355+ nop
4356+2: BACKOFF_SPIN(%o2, %o3, 1b)
4357+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
4358+
4359 .globl atomic_add_ret
4360 .type atomic_add_ret,#function
4361 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4362 BACKOFF_SETUP(%o2)
4363 1: lduw [%o1], %g1
4364- add %g1, %o0, %g7
4365+ addcc %g1, %o0, %g7
4366+
4367+#ifdef CONFIG_PAX_REFCOUNT
4368+ tvs %icc, 6
4369+#endif
4370+
4371 cas [%o1], %g1, %g7
4372 cmp %g1, %g7
4373 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4374@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4375 2: BACKOFF_SPIN(%o2, %o3, 1b)
4376 .size atomic_add_ret, .-atomic_add_ret
4377
4378+ .globl atomic_add_ret_unchecked
4379+ .type atomic_add_ret_unchecked,#function
4380+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4381+ BACKOFF_SETUP(%o2)
4382+1: lduw [%o1], %g1
4383+ addcc %g1, %o0, %g7
4384+ cas [%o1], %g1, %g7
4385+ cmp %g1, %g7
4386+ bne,pn %icc, 2f
4387+ add %g7, %o0, %g7
4388+ sra %g7, 0, %o0
4389+ retl
4390+ nop
4391+2: BACKOFF_SPIN(%o2, %o3, 1b)
4392+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4393+
4394 .globl atomic_sub_ret
4395 .type atomic_sub_ret,#function
4396 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4397 BACKOFF_SETUP(%o2)
4398 1: lduw [%o1], %g1
4399- sub %g1, %o0, %g7
4400+ subcc %g1, %o0, %g7
4401+
4402+#ifdef CONFIG_PAX_REFCOUNT
4403+ tvs %icc, 6
4404+#endif
4405+
4406 cas [%o1], %g1, %g7
4407 cmp %g1, %g7
4408 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4409@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4410 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4411 BACKOFF_SETUP(%o2)
4412 1: ldx [%o1], %g1
4413- add %g1, %o0, %g7
4414+ addcc %g1, %o0, %g7
4415+
4416+#ifdef CONFIG_PAX_REFCOUNT
4417+ tvs %xcc, 6
4418+#endif
4419+
4420 casx [%o1], %g1, %g7
4421 cmp %g1, %g7
4422 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4423@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4424 2: BACKOFF_SPIN(%o2, %o3, 1b)
4425 .size atomic64_add, .-atomic64_add
4426
4427+ .globl atomic64_add_unchecked
4428+ .type atomic64_add_unchecked,#function
4429+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4430+ BACKOFF_SETUP(%o2)
4431+1: ldx [%o1], %g1
4432+ addcc %g1, %o0, %g7
4433+ casx [%o1], %g1, %g7
4434+ cmp %g1, %g7
4435+ bne,pn %xcc, 2f
4436+ nop
4437+ retl
4438+ nop
4439+2: BACKOFF_SPIN(%o2, %o3, 1b)
4440+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
4441+
4442 .globl atomic64_sub
4443 .type atomic64_sub,#function
4444 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4445 BACKOFF_SETUP(%o2)
4446 1: ldx [%o1], %g1
4447- sub %g1, %o0, %g7
4448+ subcc %g1, %o0, %g7
4449+
4450+#ifdef CONFIG_PAX_REFCOUNT
4451+ tvs %xcc, 6
4452+#endif
4453+
4454 casx [%o1], %g1, %g7
4455 cmp %g1, %g7
4456 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4457@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4458 2: BACKOFF_SPIN(%o2, %o3, 1b)
4459 .size atomic64_sub, .-atomic64_sub
4460
4461+ .globl atomic64_sub_unchecked
4462+ .type atomic64_sub_unchecked,#function
4463+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4464+ BACKOFF_SETUP(%o2)
4465+1: ldx [%o1], %g1
4466+ subcc %g1, %o0, %g7
4467+ casx [%o1], %g1, %g7
4468+ cmp %g1, %g7
4469+ bne,pn %xcc, 2f
4470+ nop
4471+ retl
4472+ nop
4473+2: BACKOFF_SPIN(%o2, %o3, 1b)
4474+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
4475+
4476 .globl atomic64_add_ret
4477 .type atomic64_add_ret,#function
4478 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4479 BACKOFF_SETUP(%o2)
4480 1: ldx [%o1], %g1
4481- add %g1, %o0, %g7
4482+ addcc %g1, %o0, %g7
4483+
4484+#ifdef CONFIG_PAX_REFCOUNT
4485+ tvs %xcc, 6
4486+#endif
4487+
4488 casx [%o1], %g1, %g7
4489 cmp %g1, %g7
4490 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4491@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4492 2: BACKOFF_SPIN(%o2, %o3, 1b)
4493 .size atomic64_add_ret, .-atomic64_add_ret
4494
4495+ .globl atomic64_add_ret_unchecked
4496+ .type atomic64_add_ret_unchecked,#function
4497+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4498+ BACKOFF_SETUP(%o2)
4499+1: ldx [%o1], %g1
4500+ addcc %g1, %o0, %g7
4501+ casx [%o1], %g1, %g7
4502+ cmp %g1, %g7
4503+ bne,pn %xcc, 2f
4504+ add %g7, %o0, %g7
4505+ mov %g7, %o0
4506+ retl
4507+ nop
4508+2: BACKOFF_SPIN(%o2, %o3, 1b)
4509+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
4510+
4511 .globl atomic64_sub_ret
4512 .type atomic64_sub_ret,#function
4513 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4514 BACKOFF_SETUP(%o2)
4515 1: ldx [%o1], %g1
4516- sub %g1, %o0, %g7
4517+ subcc %g1, %o0, %g7
4518+
4519+#ifdef CONFIG_PAX_REFCOUNT
4520+ tvs %xcc, 6
4521+#endif
4522+
4523 casx [%o1], %g1, %g7
4524 cmp %g1, %g7
4525 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4526diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
4527index 1b30bb3..b4a16c7 100644
4528--- a/arch/sparc/lib/ksyms.c
4529+++ b/arch/sparc/lib/ksyms.c
4530@@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write);
4531
4532 /* Atomic counter implementation. */
4533 EXPORT_SYMBOL(atomic_add);
4534+EXPORT_SYMBOL(atomic_add_unchecked);
4535 EXPORT_SYMBOL(atomic_add_ret);
4536+EXPORT_SYMBOL(atomic_add_ret_unchecked);
4537 EXPORT_SYMBOL(atomic_sub);
4538+EXPORT_SYMBOL(atomic_sub_unchecked);
4539 EXPORT_SYMBOL(atomic_sub_ret);
4540 EXPORT_SYMBOL(atomic64_add);
4541+EXPORT_SYMBOL(atomic64_add_unchecked);
4542 EXPORT_SYMBOL(atomic64_add_ret);
4543+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
4544 EXPORT_SYMBOL(atomic64_sub);
4545+EXPORT_SYMBOL(atomic64_sub_unchecked);
4546 EXPORT_SYMBOL(atomic64_sub_ret);
4547
4548 /* Atomic bit operations. */
4549diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
4550index e3cda21..a68e4cb 100644
4551--- a/arch/sparc/mm/Makefile
4552+++ b/arch/sparc/mm/Makefile
4553@@ -2,7 +2,7 @@
4554 #
4555
4556 asflags-y := -ansi
4557-ccflags-y := -Werror
4558+#ccflags-y := -Werror
4559
4560 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
4561 obj-y += fault_$(BITS).o
4562diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
4563index aa1c1b1..f93e28f 100644
4564--- a/arch/sparc/mm/fault_32.c
4565+++ b/arch/sparc/mm/fault_32.c
4566@@ -22,6 +22,9 @@
4567 #include <linux/interrupt.h>
4568 #include <linux/module.h>
4569 #include <linux/kdebug.h>
4570+#include <linux/slab.h>
4571+#include <linux/pagemap.h>
4572+#include <linux/compiler.h>
4573
4574 #include <asm/system.h>
4575 #include <asm/page.h>
4576@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
4577 return safe_compute_effective_address(regs, insn);
4578 }
4579
4580+#ifdef CONFIG_PAX_PAGEEXEC
4581+#ifdef CONFIG_PAX_DLRESOLVE
4582+static void pax_emuplt_close(struct vm_area_struct *vma)
4583+{
4584+ vma->vm_mm->call_dl_resolve = 0UL;
4585+}
4586+
4587+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4588+{
4589+ unsigned int *kaddr;
4590+
4591+ vmf->page = alloc_page(GFP_HIGHUSER);
4592+ if (!vmf->page)
4593+ return VM_FAULT_OOM;
4594+
4595+ kaddr = kmap(vmf->page);
4596+ memset(kaddr, 0, PAGE_SIZE);
4597+ kaddr[0] = 0x9DE3BFA8U; /* save */
4598+ flush_dcache_page(vmf->page);
4599+ kunmap(vmf->page);
4600+ return VM_FAULT_MAJOR;
4601+}
4602+
4603+static const struct vm_operations_struct pax_vm_ops = {
4604+ .close = pax_emuplt_close,
4605+ .fault = pax_emuplt_fault
4606+};
4607+
4608+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4609+{
4610+ int ret;
4611+
4612+ INIT_LIST_HEAD(&vma->anon_vma_chain);
4613+ vma->vm_mm = current->mm;
4614+ vma->vm_start = addr;
4615+ vma->vm_end = addr + PAGE_SIZE;
4616+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4617+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4618+ vma->vm_ops = &pax_vm_ops;
4619+
4620+ ret = insert_vm_struct(current->mm, vma);
4621+ if (ret)
4622+ return ret;
4623+
4624+ ++current->mm->total_vm;
4625+ return 0;
4626+}
4627+#endif
4628+
4629+/*
4630+ * PaX: decide what to do with offenders (regs->pc = fault address)
4631+ *
4632+ * returns 1 when task should be killed
4633+ * 2 when patched PLT trampoline was detected
4634+ * 3 when unpatched PLT trampoline was detected
4635+ */
4636+static int pax_handle_fetch_fault(struct pt_regs *regs)
4637+{
4638+
4639+#ifdef CONFIG_PAX_EMUPLT
4640+ int err;
4641+
4642+ do { /* PaX: patched PLT emulation #1 */
4643+ unsigned int sethi1, sethi2, jmpl;
4644+
4645+ err = get_user(sethi1, (unsigned int *)regs->pc);
4646+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4647+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4648+
4649+ if (err)
4650+ break;
4651+
4652+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4653+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
4654+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
4655+ {
4656+ unsigned int addr;
4657+
4658+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4659+ addr = regs->u_regs[UREG_G1];
4660+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4661+ regs->pc = addr;
4662+ regs->npc = addr+4;
4663+ return 2;
4664+ }
4665+ } while (0);
4666+
4667+ { /* PaX: patched PLT emulation #2 */
4668+ unsigned int ba;
4669+
4670+ err = get_user(ba, (unsigned int *)regs->pc);
4671+
4672+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4673+ unsigned int addr;
4674+
4675+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4676+ regs->pc = addr;
4677+ regs->npc = addr+4;
4678+ return 2;
4679+ }
4680+ }
4681+
4682+ do { /* PaX: patched PLT emulation #3 */
4683+ unsigned int sethi, jmpl, nop;
4684+
4685+ err = get_user(sethi, (unsigned int *)regs->pc);
4686+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4687+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
4688+
4689+ if (err)
4690+ break;
4691+
4692+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
4693+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4694+ nop == 0x01000000U)
4695+ {
4696+ unsigned int addr;
4697+
4698+ addr = (sethi & 0x003FFFFFU) << 10;
4699+ regs->u_regs[UREG_G1] = addr;
4700+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4701+ regs->pc = addr;
4702+ regs->npc = addr+4;
4703+ return 2;
4704+ }
4705+ } while (0);
4706+
4707+ do { /* PaX: unpatched PLT emulation step 1 */
4708+ unsigned int sethi, ba, nop;
4709+
4710+ err = get_user(sethi, (unsigned int *)regs->pc);
4711+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
4712+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
4713+
4714+ if (err)
4715+ break;
4716+
4717+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
4718+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4719+ nop == 0x01000000U)
4720+ {
4721+ unsigned int addr, save, call;
4722+
4723+ if ((ba & 0xFFC00000U) == 0x30800000U)
4724+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4725+ else
4726+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4727+
4728+ err = get_user(save, (unsigned int *)addr);
4729+ err |= get_user(call, (unsigned int *)(addr+4));
4730+ err |= get_user(nop, (unsigned int *)(addr+8));
4731+ if (err)
4732+ break;
4733+
4734+#ifdef CONFIG_PAX_DLRESOLVE
4735+ if (save == 0x9DE3BFA8U &&
4736+ (call & 0xC0000000U) == 0x40000000U &&
4737+ nop == 0x01000000U)
4738+ {
4739+ struct vm_area_struct *vma;
4740+ unsigned long call_dl_resolve;
4741+
4742+ down_read(&current->mm->mmap_sem);
4743+ call_dl_resolve = current->mm->call_dl_resolve;
4744+ up_read(&current->mm->mmap_sem);
4745+ if (likely(call_dl_resolve))
4746+ goto emulate;
4747+
4748+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4749+
4750+ down_write(&current->mm->mmap_sem);
4751+ if (current->mm->call_dl_resolve) {
4752+ call_dl_resolve = current->mm->call_dl_resolve;
4753+ up_write(&current->mm->mmap_sem);
4754+ if (vma)
4755+ kmem_cache_free(vm_area_cachep, vma);
4756+ goto emulate;
4757+ }
4758+
4759+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4760+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4761+ up_write(&current->mm->mmap_sem);
4762+ if (vma)
4763+ kmem_cache_free(vm_area_cachep, vma);
4764+ return 1;
4765+ }
4766+
4767+ if (pax_insert_vma(vma, call_dl_resolve)) {
4768+ up_write(&current->mm->mmap_sem);
4769+ kmem_cache_free(vm_area_cachep, vma);
4770+ return 1;
4771+ }
4772+
4773+ current->mm->call_dl_resolve = call_dl_resolve;
4774+ up_write(&current->mm->mmap_sem);
4775+
4776+emulate:
4777+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4778+ regs->pc = call_dl_resolve;
4779+ regs->npc = addr+4;
4780+ return 3;
4781+ }
4782+#endif
4783+
4784+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4785+ if ((save & 0xFFC00000U) == 0x05000000U &&
4786+ (call & 0xFFFFE000U) == 0x85C0A000U &&
4787+ nop == 0x01000000U)
4788+ {
4789+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4790+ regs->u_regs[UREG_G2] = addr + 4;
4791+ addr = (save & 0x003FFFFFU) << 10;
4792+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4793+ regs->pc = addr;
4794+ regs->npc = addr+4;
4795+ return 3;
4796+ }
4797+ }
4798+ } while (0);
4799+
4800+ do { /* PaX: unpatched PLT emulation step 2 */
4801+ unsigned int save, call, nop;
4802+
4803+ err = get_user(save, (unsigned int *)(regs->pc-4));
4804+ err |= get_user(call, (unsigned int *)regs->pc);
4805+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
4806+ if (err)
4807+ break;
4808+
4809+ if (save == 0x9DE3BFA8U &&
4810+ (call & 0xC0000000U) == 0x40000000U &&
4811+ nop == 0x01000000U)
4812+ {
4813+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4814+
4815+ regs->u_regs[UREG_RETPC] = regs->pc;
4816+ regs->pc = dl_resolve;
4817+ regs->npc = dl_resolve+4;
4818+ return 3;
4819+ }
4820+ } while (0);
4821+#endif
4822+
4823+ return 1;
4824+}
4825+
4826+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
4827+{
4828+ unsigned long i;
4829+
4830+ printk(KERN_ERR "PAX: bytes at PC: ");
4831+ for (i = 0; i < 8; i++) {
4832+ unsigned int c;
4833+ if (get_user(c, (unsigned int *)pc+i))
4834+ printk(KERN_CONT "???????? ");
4835+ else
4836+ printk(KERN_CONT "%08x ", c);
4837+ }
4838+ printk("\n");
4839+}
4840+#endif
4841+
4842 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
4843 int text_fault)
4844 {
4845@@ -281,6 +546,24 @@ good_area:
4846 if(!(vma->vm_flags & VM_WRITE))
4847 goto bad_area;
4848 } else {
4849+
4850+#ifdef CONFIG_PAX_PAGEEXEC
4851+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4852+ up_read(&mm->mmap_sem);
4853+ switch (pax_handle_fetch_fault(regs)) {
4854+
4855+#ifdef CONFIG_PAX_EMUPLT
4856+ case 2:
4857+ case 3:
4858+ return;
4859+#endif
4860+
4861+ }
4862+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4863+ do_group_exit(SIGKILL);
4864+ }
4865+#endif
4866+
4867 /* Allow reads even for write-only mappings */
4868 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4869 goto bad_area;
4870diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
4871index 504c062..6fcb9c6 100644
4872--- a/arch/sparc/mm/fault_64.c
4873+++ b/arch/sparc/mm/fault_64.c
4874@@ -21,6 +21,9 @@
4875 #include <linux/kprobes.h>
4876 #include <linux/kdebug.h>
4877 #include <linux/percpu.h>
4878+#include <linux/slab.h>
4879+#include <linux/pagemap.h>
4880+#include <linux/compiler.h>
4881
4882 #include <asm/page.h>
4883 #include <asm/pgtable.h>
4884@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
4885 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
4886 regs->tpc);
4887 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
4888- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
4889+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
4890 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
4891 dump_stack();
4892 unhandled_fault(regs->tpc, current, regs);
4893@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
4894 show_regs(regs);
4895 }
4896
4897+#ifdef CONFIG_PAX_PAGEEXEC
4898+#ifdef CONFIG_PAX_DLRESOLVE
4899+static void pax_emuplt_close(struct vm_area_struct *vma)
4900+{
4901+ vma->vm_mm->call_dl_resolve = 0UL;
4902+}
4903+
4904+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4905+{
4906+ unsigned int *kaddr;
4907+
4908+ vmf->page = alloc_page(GFP_HIGHUSER);
4909+ if (!vmf->page)
4910+ return VM_FAULT_OOM;
4911+
4912+ kaddr = kmap(vmf->page);
4913+ memset(kaddr, 0, PAGE_SIZE);
4914+ kaddr[0] = 0x9DE3BFA8U; /* save */
4915+ flush_dcache_page(vmf->page);
4916+ kunmap(vmf->page);
4917+ return VM_FAULT_MAJOR;
4918+}
4919+
4920+static const struct vm_operations_struct pax_vm_ops = {
4921+ .close = pax_emuplt_close,
4922+ .fault = pax_emuplt_fault
4923+};
4924+
4925+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4926+{
4927+ int ret;
4928+
4929+ INIT_LIST_HEAD(&vma->anon_vma_chain);
4930+ vma->vm_mm = current->mm;
4931+ vma->vm_start = addr;
4932+ vma->vm_end = addr + PAGE_SIZE;
4933+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4934+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4935+ vma->vm_ops = &pax_vm_ops;
4936+
4937+ ret = insert_vm_struct(current->mm, vma);
4938+ if (ret)
4939+ return ret;
4940+
4941+ ++current->mm->total_vm;
4942+ return 0;
4943+}
4944+#endif
4945+
4946+/*
4947+ * PaX: decide what to do with offenders (regs->tpc = fault address)
4948+ *
4949+ * returns 1 when task should be killed
4950+ * 2 when patched PLT trampoline was detected
4951+ * 3 when unpatched PLT trampoline was detected
4952+ */
4953+static int pax_handle_fetch_fault(struct pt_regs *regs)
4954+{
4955+
4956+#ifdef CONFIG_PAX_EMUPLT
4957+ int err;
4958+
4959+ do { /* PaX: patched PLT emulation #1 */
4960+ unsigned int sethi1, sethi2, jmpl;
4961+
4962+ err = get_user(sethi1, (unsigned int *)regs->tpc);
4963+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4964+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4965+
4966+ if (err)
4967+ break;
4968+
4969+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4970+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
4971+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
4972+ {
4973+ unsigned long addr;
4974+
4975+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4976+ addr = regs->u_regs[UREG_G1];
4977+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4978+
4979+ if (test_thread_flag(TIF_32BIT))
4980+ addr &= 0xFFFFFFFFUL;
4981+
4982+ regs->tpc = addr;
4983+ regs->tnpc = addr+4;
4984+ return 2;
4985+ }
4986+ } while (0);
4987+
4988+ { /* PaX: patched PLT emulation #2 */
4989+ unsigned int ba;
4990+
4991+ err = get_user(ba, (unsigned int *)regs->tpc);
4992+
4993+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4994+ unsigned long addr;
4995+
4996+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4997+
4998+ if (test_thread_flag(TIF_32BIT))
4999+ addr &= 0xFFFFFFFFUL;
5000+
5001+ regs->tpc = addr;
5002+ regs->tnpc = addr+4;
5003+ return 2;
5004+ }
5005+ }
5006+
5007+ do { /* PaX: patched PLT emulation #3 */
5008+ unsigned int sethi, jmpl, nop;
5009+
5010+ err = get_user(sethi, (unsigned int *)regs->tpc);
5011+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5012+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5013+
5014+ if (err)
5015+ break;
5016+
5017+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5018+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5019+ nop == 0x01000000U)
5020+ {
5021+ unsigned long addr;
5022+
5023+ addr = (sethi & 0x003FFFFFU) << 10;
5024+ regs->u_regs[UREG_G1] = addr;
5025+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5026+
5027+ if (test_thread_flag(TIF_32BIT))
5028+ addr &= 0xFFFFFFFFUL;
5029+
5030+ regs->tpc = addr;
5031+ regs->tnpc = addr+4;
5032+ return 2;
5033+ }
5034+ } while (0);
5035+
5036+ do { /* PaX: patched PLT emulation #4 */
5037+ unsigned int sethi, mov1, call, mov2;
5038+
5039+ err = get_user(sethi, (unsigned int *)regs->tpc);
5040+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5041+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
5042+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5043+
5044+ if (err)
5045+ break;
5046+
5047+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5048+ mov1 == 0x8210000FU &&
5049+ (call & 0xC0000000U) == 0x40000000U &&
5050+ mov2 == 0x9E100001U)
5051+ {
5052+ unsigned long addr;
5053+
5054+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5055+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5056+
5057+ if (test_thread_flag(TIF_32BIT))
5058+ addr &= 0xFFFFFFFFUL;
5059+
5060+ regs->tpc = addr;
5061+ regs->tnpc = addr+4;
5062+ return 2;
5063+ }
5064+ } while (0);
5065+
5066+ do { /* PaX: patched PLT emulation #5 */
5067+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5068+
5069+ err = get_user(sethi, (unsigned int *)regs->tpc);
5070+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5071+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5072+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5073+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5074+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5075+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5076+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5077+
5078+ if (err)
5079+ break;
5080+
5081+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5082+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5083+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5084+ (or1 & 0xFFFFE000U) == 0x82106000U &&
5085+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5086+ sllx == 0x83287020U &&
5087+ jmpl == 0x81C04005U &&
5088+ nop == 0x01000000U)
5089+ {
5090+ unsigned long addr;
5091+
5092+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5093+ regs->u_regs[UREG_G1] <<= 32;
5094+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5095+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5096+ regs->tpc = addr;
5097+ regs->tnpc = addr+4;
5098+ return 2;
5099+ }
5100+ } while (0);
5101+
5102+ do { /* PaX: patched PLT emulation #6 */
5103+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5104+
5105+ err = get_user(sethi, (unsigned int *)regs->tpc);
5106+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5107+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5108+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5109+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
5110+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5111+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5112+
5113+ if (err)
5114+ break;
5115+
5116+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5117+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5118+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5119+ sllx == 0x83287020U &&
5120+ (or & 0xFFFFE000U) == 0x8A116000U &&
5121+ jmpl == 0x81C04005U &&
5122+ nop == 0x01000000U)
5123+ {
5124+ unsigned long addr;
5125+
5126+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5127+ regs->u_regs[UREG_G1] <<= 32;
5128+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5129+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5130+ regs->tpc = addr;
5131+ regs->tnpc = addr+4;
5132+ return 2;
5133+ }
5134+ } while (0);
5135+
5136+ do { /* PaX: unpatched PLT emulation step 1 */
5137+ unsigned int sethi, ba, nop;
5138+
5139+ err = get_user(sethi, (unsigned int *)regs->tpc);
5140+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5141+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5142+
5143+ if (err)
5144+ break;
5145+
5146+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5147+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5148+ nop == 0x01000000U)
5149+ {
5150+ unsigned long addr;
5151+ unsigned int save, call;
5152+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5153+
5154+ if ((ba & 0xFFC00000U) == 0x30800000U)
5155+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5156+ else
5157+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5158+
5159+ if (test_thread_flag(TIF_32BIT))
5160+ addr &= 0xFFFFFFFFUL;
5161+
5162+ err = get_user(save, (unsigned int *)addr);
5163+ err |= get_user(call, (unsigned int *)(addr+4));
5164+ err |= get_user(nop, (unsigned int *)(addr+8));
5165+ if (err)
5166+ break;
5167+
5168+#ifdef CONFIG_PAX_DLRESOLVE
5169+ if (save == 0x9DE3BFA8U &&
5170+ (call & 0xC0000000U) == 0x40000000U &&
5171+ nop == 0x01000000U)
5172+ {
5173+ struct vm_area_struct *vma;
5174+ unsigned long call_dl_resolve;
5175+
5176+ down_read(&current->mm->mmap_sem);
5177+ call_dl_resolve = current->mm->call_dl_resolve;
5178+ up_read(&current->mm->mmap_sem);
5179+ if (likely(call_dl_resolve))
5180+ goto emulate;
5181+
5182+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5183+
5184+ down_write(&current->mm->mmap_sem);
5185+ if (current->mm->call_dl_resolve) {
5186+ call_dl_resolve = current->mm->call_dl_resolve;
5187+ up_write(&current->mm->mmap_sem);
5188+ if (vma)
5189+ kmem_cache_free(vm_area_cachep, vma);
5190+ goto emulate;
5191+ }
5192+
5193+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5194+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5195+ up_write(&current->mm->mmap_sem);
5196+ if (vma)
5197+ kmem_cache_free(vm_area_cachep, vma);
5198+ return 1;
5199+ }
5200+
5201+ if (pax_insert_vma(vma, call_dl_resolve)) {
5202+ up_write(&current->mm->mmap_sem);
5203+ kmem_cache_free(vm_area_cachep, vma);
5204+ return 1;
5205+ }
5206+
5207+ current->mm->call_dl_resolve = call_dl_resolve;
5208+ up_write(&current->mm->mmap_sem);
5209+
5210+emulate:
5211+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5212+ regs->tpc = call_dl_resolve;
5213+ regs->tnpc = addr+4;
5214+ return 3;
5215+ }
5216+#endif
5217+
5218+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5219+ if ((save & 0xFFC00000U) == 0x05000000U &&
5220+ (call & 0xFFFFE000U) == 0x85C0A000U &&
5221+ nop == 0x01000000U)
5222+ {
5223+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5224+ regs->u_regs[UREG_G2] = addr + 4;
5225+ addr = (save & 0x003FFFFFU) << 10;
5226+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5227+
5228+ if (test_thread_flag(TIF_32BIT))
5229+ addr &= 0xFFFFFFFFUL;
5230+
5231+ regs->tpc = addr;
5232+ regs->tnpc = addr+4;
5233+ return 3;
5234+ }
5235+
5236+ /* PaX: 64-bit PLT stub */
5237+ err = get_user(sethi1, (unsigned int *)addr);
5238+ err |= get_user(sethi2, (unsigned int *)(addr+4));
5239+ err |= get_user(or1, (unsigned int *)(addr+8));
5240+ err |= get_user(or2, (unsigned int *)(addr+12));
5241+ err |= get_user(sllx, (unsigned int *)(addr+16));
5242+ err |= get_user(add, (unsigned int *)(addr+20));
5243+ err |= get_user(jmpl, (unsigned int *)(addr+24));
5244+ err |= get_user(nop, (unsigned int *)(addr+28));
5245+ if (err)
5246+ break;
5247+
5248+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5249+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5250+ (or1 & 0xFFFFE000U) == 0x88112000U &&
5251+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5252+ sllx == 0x89293020U &&
5253+ add == 0x8A010005U &&
5254+ jmpl == 0x89C14000U &&
5255+ nop == 0x01000000U)
5256+ {
5257+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5258+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5259+ regs->u_regs[UREG_G4] <<= 32;
5260+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5261+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5262+ regs->u_regs[UREG_G4] = addr + 24;
5263+ addr = regs->u_regs[UREG_G5];
5264+ regs->tpc = addr;
5265+ regs->tnpc = addr+4;
5266+ return 3;
5267+ }
5268+ }
5269+ } while (0);
5270+
5271+#ifdef CONFIG_PAX_DLRESOLVE
5272+ do { /* PaX: unpatched PLT emulation step 2 */
5273+ unsigned int save, call, nop;
5274+
5275+ err = get_user(save, (unsigned int *)(regs->tpc-4));
5276+ err |= get_user(call, (unsigned int *)regs->tpc);
5277+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5278+ if (err)
5279+ break;
5280+
5281+ if (save == 0x9DE3BFA8U &&
5282+ (call & 0xC0000000U) == 0x40000000U &&
5283+ nop == 0x01000000U)
5284+ {
5285+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5286+
5287+ if (test_thread_flag(TIF_32BIT))
5288+ dl_resolve &= 0xFFFFFFFFUL;
5289+
5290+ regs->u_regs[UREG_RETPC] = regs->tpc;
5291+ regs->tpc = dl_resolve;
5292+ regs->tnpc = dl_resolve+4;
5293+ return 3;
5294+ }
5295+ } while (0);
5296+#endif
5297+
5298+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5299+ unsigned int sethi, ba, nop;
5300+
5301+ err = get_user(sethi, (unsigned int *)regs->tpc);
5302+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5303+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5304+
5305+ if (err)
5306+ break;
5307+
5308+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5309+ (ba & 0xFFF00000U) == 0x30600000U &&
5310+ nop == 0x01000000U)
5311+ {
5312+ unsigned long addr;
5313+
5314+ addr = (sethi & 0x003FFFFFU) << 10;
5315+ regs->u_regs[UREG_G1] = addr;
5316+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5317+
5318+ if (test_thread_flag(TIF_32BIT))
5319+ addr &= 0xFFFFFFFFUL;
5320+
5321+ regs->tpc = addr;
5322+ regs->tnpc = addr+4;
5323+ return 2;
5324+ }
5325+ } while (0);
5326+
5327+#endif
5328+
5329+ return 1;
5330+}
5331+
5332+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5333+{
5334+ unsigned long i;
5335+
5336+ printk(KERN_ERR "PAX: bytes at PC: ");
5337+ for (i = 0; i < 8; i++) {
5338+ unsigned int c;
5339+ if (get_user(c, (unsigned int *)pc+i))
5340+ printk(KERN_CONT "???????? ");
5341+ else
5342+ printk(KERN_CONT "%08x ", c);
5343+ }
5344+ printk("\n");
5345+}
5346+#endif
5347+
5348 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5349 {
5350 struct mm_struct *mm = current->mm;
5351@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5352 if (!vma)
5353 goto bad_area;
5354
5355+#ifdef CONFIG_PAX_PAGEEXEC
5356+ /* PaX: detect ITLB misses on non-exec pages */
5357+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5358+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5359+ {
5360+ if (address != regs->tpc)
5361+ goto good_area;
5362+
5363+ up_read(&mm->mmap_sem);
5364+ switch (pax_handle_fetch_fault(regs)) {
5365+
5366+#ifdef CONFIG_PAX_EMUPLT
5367+ case 2:
5368+ case 3:
5369+ return;
5370+#endif
5371+
5372+ }
5373+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
5374+ do_group_exit(SIGKILL);
5375+ }
5376+#endif
5377+
5378 /* Pure DTLB misses do not tell us whether the fault causing
5379 * load/store/atomic was a write or not, it only says that there
5380 * was no match. So in such a case we (carefully) read the
5381diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
5382index f4e9764..5682724 100644
5383--- a/arch/sparc/mm/hugetlbpage.c
5384+++ b/arch/sparc/mm/hugetlbpage.c
5385@@ -68,7 +68,7 @@ full_search:
5386 }
5387 return -ENOMEM;
5388 }
5389- if (likely(!vma || addr + len <= vma->vm_start)) {
5390+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5391 /*
5392 * Remember the place where we stopped the search:
5393 */
5394@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5395 /* make sure it can fit in the remaining address space */
5396 if (likely(addr > len)) {
5397 vma = find_vma(mm, addr-len);
5398- if (!vma || addr <= vma->vm_start) {
5399+ if (check_heap_stack_gap(vma, addr - len, len)) {
5400 /* remember the address as a hint for next time */
5401 return (mm->free_area_cache = addr-len);
5402 }
5403@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5404 if (unlikely(mm->mmap_base < len))
5405 goto bottomup;
5406
5407- addr = (mm->mmap_base-len) & HPAGE_MASK;
5408+ addr = mm->mmap_base - len;
5409
5410 do {
5411+ addr &= HPAGE_MASK;
5412 /*
5413 * Lookup failure means no vma is above this address,
5414 * else if new region fits below vma->vm_start,
5415 * return with success:
5416 */
5417 vma = find_vma(mm, addr);
5418- if (likely(!vma || addr+len <= vma->vm_start)) {
5419+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5420 /* remember the address as a hint for next time */
5421 return (mm->free_area_cache = addr);
5422 }
5423@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5424 mm->cached_hole_size = vma->vm_start - addr;
5425
5426 /* try just below the current vma->vm_start */
5427- addr = (vma->vm_start-len) & HPAGE_MASK;
5428- } while (likely(len < vma->vm_start));
5429+ addr = skip_heap_stack_gap(vma, len);
5430+ } while (!IS_ERR_VALUE(addr));
5431
5432 bottomup:
5433 /*
5434@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
5435 if (addr) {
5436 addr = ALIGN(addr, HPAGE_SIZE);
5437 vma = find_vma(mm, addr);
5438- if (task_size - len >= addr &&
5439- (!vma || addr + len <= vma->vm_start))
5440+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5441 return addr;
5442 }
5443 if (mm->get_unmapped_area == arch_get_unmapped_area)
5444diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
5445index 7b00de6..78239f4 100644
5446--- a/arch/sparc/mm/init_32.c
5447+++ b/arch/sparc/mm/init_32.c
5448@@ -316,6 +316,9 @@ extern void device_scan(void);
5449 pgprot_t PAGE_SHARED __read_mostly;
5450 EXPORT_SYMBOL(PAGE_SHARED);
5451
5452+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
5453+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
5454+
5455 void __init paging_init(void)
5456 {
5457 switch(sparc_cpu_model) {
5458@@ -344,17 +347,17 @@ void __init paging_init(void)
5459
5460 /* Initialize the protection map with non-constant, MMU dependent values. */
5461 protection_map[0] = PAGE_NONE;
5462- protection_map[1] = PAGE_READONLY;
5463- protection_map[2] = PAGE_COPY;
5464- protection_map[3] = PAGE_COPY;
5465+ protection_map[1] = PAGE_READONLY_NOEXEC;
5466+ protection_map[2] = PAGE_COPY_NOEXEC;
5467+ protection_map[3] = PAGE_COPY_NOEXEC;
5468 protection_map[4] = PAGE_READONLY;
5469 protection_map[5] = PAGE_READONLY;
5470 protection_map[6] = PAGE_COPY;
5471 protection_map[7] = PAGE_COPY;
5472 protection_map[8] = PAGE_NONE;
5473- protection_map[9] = PAGE_READONLY;
5474- protection_map[10] = PAGE_SHARED;
5475- protection_map[11] = PAGE_SHARED;
5476+ protection_map[9] = PAGE_READONLY_NOEXEC;
5477+ protection_map[10] = PAGE_SHARED_NOEXEC;
5478+ protection_map[11] = PAGE_SHARED_NOEXEC;
5479 protection_map[12] = PAGE_READONLY;
5480 protection_map[13] = PAGE_READONLY;
5481 protection_map[14] = PAGE_SHARED;
5482diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
5483index cbef74e..c38fead 100644
5484--- a/arch/sparc/mm/srmmu.c
5485+++ b/arch/sparc/mm/srmmu.c
5486@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
5487 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
5488 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
5489 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
5490+
5491+#ifdef CONFIG_PAX_PAGEEXEC
5492+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
5493+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
5494+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
5495+#endif
5496+
5497 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
5498 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
5499
5500diff --git a/arch/um/Makefile b/arch/um/Makefile
5501index c0f712c..3a5c4c9 100644
5502--- a/arch/um/Makefile
5503+++ b/arch/um/Makefile
5504@@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
5505 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
5506 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
5507
5508+ifdef CONSTIFY_PLUGIN
5509+USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5510+endif
5511+
5512 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
5513
5514 #This will adjust *FLAGS accordingly to the platform.
5515diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
5516index 6c03acd..a5e0215 100644
5517--- a/arch/um/include/asm/kmap_types.h
5518+++ b/arch/um/include/asm/kmap_types.h
5519@@ -23,6 +23,7 @@ enum km_type {
5520 KM_IRQ1,
5521 KM_SOFTIRQ0,
5522 KM_SOFTIRQ1,
5523+ KM_CLEARPAGE,
5524 KM_TYPE_NR
5525 };
5526
5527diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
5528index 4cc9b6c..02e5029 100644
5529--- a/arch/um/include/asm/page.h
5530+++ b/arch/um/include/asm/page.h
5531@@ -14,6 +14,9 @@
5532 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
5533 #define PAGE_MASK (~(PAGE_SIZE-1))
5534
5535+#define ktla_ktva(addr) (addr)
5536+#define ktva_ktla(addr) (addr)
5537+
5538 #ifndef __ASSEMBLY__
5539
5540 struct page;
5541diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
5542index 21c1ae7..4640aaa 100644
5543--- a/arch/um/kernel/process.c
5544+++ b/arch/um/kernel/process.c
5545@@ -404,22 +404,6 @@ int singlestepping(void * t)
5546 return 2;
5547 }
5548
5549-/*
5550- * Only x86 and x86_64 have an arch_align_stack().
5551- * All other arches have "#define arch_align_stack(x) (x)"
5552- * in their asm/system.h
5553- * As this is included in UML from asm-um/system-generic.h,
5554- * we can use it to behave as the subarch does.
5555- */
5556-#ifndef arch_align_stack
5557-unsigned long arch_align_stack(unsigned long sp)
5558-{
5559- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
5560- sp -= get_random_int() % 8192;
5561- return sp & ~0xf;
5562-}
5563-#endif
5564-
5565 unsigned long get_wchan(struct task_struct *p)
5566 {
5567 unsigned long stack_page, sp, ip;
5568diff --git a/arch/um/sys-i386/shared/sysdep/system.h b/arch/um/sys-i386/shared/sysdep/system.h
5569index d1b93c4..ae1b7fd 100644
5570--- a/arch/um/sys-i386/shared/sysdep/system.h
5571+++ b/arch/um/sys-i386/shared/sysdep/system.h
5572@@ -17,7 +17,7 @@
5573 # define AT_VECTOR_SIZE_ARCH 1
5574 #endif
5575
5576-extern unsigned long arch_align_stack(unsigned long sp);
5577+#define arch_align_stack(x) ((x) & ~0xfUL)
5578
5579 void default_idle(void);
5580
5581diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
5582index 70ca357..728d1cc 100644
5583--- a/arch/um/sys-i386/syscalls.c
5584+++ b/arch/um/sys-i386/syscalls.c
5585@@ -11,6 +11,21 @@
5586 #include "asm/uaccess.h"
5587 #include "asm/unistd.h"
5588
5589+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
5590+{
5591+ unsigned long pax_task_size = TASK_SIZE;
5592+
5593+#ifdef CONFIG_PAX_SEGMEXEC
5594+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
5595+ pax_task_size = SEGMEXEC_TASK_SIZE;
5596+#endif
5597+
5598+ if (len > pax_task_size || addr > pax_task_size - len)
5599+ return -EINVAL;
5600+
5601+ return 0;
5602+}
5603+
5604 /*
5605 * The prototype on i386 is:
5606 *
5607diff --git a/arch/um/sys-x86_64/shared/sysdep/system.h b/arch/um/sys-x86_64/shared/sysdep/system.h
5608index d1b93c4..ae1b7fd 100644
5609--- a/arch/um/sys-x86_64/shared/sysdep/system.h
5610+++ b/arch/um/sys-x86_64/shared/sysdep/system.h
5611@@ -17,7 +17,7 @@
5612 # define AT_VECTOR_SIZE_ARCH 1
5613 #endif
5614
5615-extern unsigned long arch_align_stack(unsigned long sp);
5616+#define arch_align_stack(x) ((x) & ~0xfUL)
5617
5618 void default_idle(void);
5619
5620diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
5621index 6a47bb2..dc9a868 100644
5622--- a/arch/x86/Kconfig
5623+++ b/arch/x86/Kconfig
5624@@ -236,7 +236,7 @@ config X86_HT
5625
5626 config X86_32_LAZY_GS
5627 def_bool y
5628- depends on X86_32 && !CC_STACKPROTECTOR
5629+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
5630
5631 config ARCH_HWEIGHT_CFLAGS
5632 string
5633@@ -1019,7 +1019,7 @@ choice
5634
5635 config NOHIGHMEM
5636 bool "off"
5637- depends on !X86_NUMAQ
5638+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5639 ---help---
5640 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
5641 However, the address space of 32-bit x86 processors is only 4
5642@@ -1056,7 +1056,7 @@ config NOHIGHMEM
5643
5644 config HIGHMEM4G
5645 bool "4GB"
5646- depends on !X86_NUMAQ
5647+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5648 ---help---
5649 Select this if you have a 32-bit processor and between 1 and 4
5650 gigabytes of physical RAM.
5651@@ -1110,7 +1110,7 @@ config PAGE_OFFSET
5652 hex
5653 default 0xB0000000 if VMSPLIT_3G_OPT
5654 default 0x80000000 if VMSPLIT_2G
5655- default 0x78000000 if VMSPLIT_2G_OPT
5656+ default 0x70000000 if VMSPLIT_2G_OPT
5657 default 0x40000000 if VMSPLIT_1G
5658 default 0xC0000000
5659 depends on X86_32
5660@@ -1484,6 +1484,7 @@ config SECCOMP
5661
5662 config CC_STACKPROTECTOR
5663 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
5664+ depends on X86_64 || !PAX_MEMORY_UDEREF
5665 ---help---
5666 This option turns on the -fstack-protector GCC feature. This
5667 feature puts, at the beginning of functions, a canary value on
5668@@ -1541,6 +1542,7 @@ config KEXEC_JUMP
5669 config PHYSICAL_START
5670 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
5671 default "0x1000000"
5672+ range 0x400000 0x40000000
5673 ---help---
5674 This gives the physical address where the kernel is loaded.
5675
5676@@ -1604,6 +1606,7 @@ config X86_NEED_RELOCS
5677 config PHYSICAL_ALIGN
5678 hex "Alignment value to which kernel should be aligned" if X86_32
5679 default "0x1000000"
5680+ range 0x400000 0x1000000 if PAX_KERNEXEC
5681 range 0x2000 0x1000000
5682 ---help---
5683 This value puts the alignment restrictions on physical address
5684@@ -1635,9 +1638,10 @@ config HOTPLUG_CPU
5685 Say N if you want to disable CPU hotplug.
5686
5687 config COMPAT_VDSO
5688- def_bool y
5689+ def_bool n
5690 prompt "Compat VDSO support"
5691 depends on X86_32 || IA32_EMULATION
5692+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
5693 ---help---
5694 Map the 32-bit VDSO to the predictable old-style address too.
5695
5696diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
5697index e3ca7e0..b30b28a 100644
5698--- a/arch/x86/Kconfig.cpu
5699+++ b/arch/x86/Kconfig.cpu
5700@@ -341,7 +341,7 @@ config X86_PPRO_FENCE
5701
5702 config X86_F00F_BUG
5703 def_bool y
5704- depends on M586MMX || M586TSC || M586 || M486 || M386
5705+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
5706
5707 config X86_INVD_BUG
5708 def_bool y
5709@@ -365,7 +365,7 @@ config X86_POPAD_OK
5710
5711 config X86_ALIGNMENT_16
5712 def_bool y
5713- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5714+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5715
5716 config X86_INTEL_USERCOPY
5717 def_bool y
5718@@ -411,7 +411,7 @@ config X86_CMPXCHG64
5719 # generates cmov.
5720 config X86_CMOV
5721 def_bool y
5722- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5723+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5724
5725 config X86_MINIMUM_CPU_FAMILY
5726 int
5727diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
5728index c0f8a5c..6404f61 100644
5729--- a/arch/x86/Kconfig.debug
5730+++ b/arch/x86/Kconfig.debug
5731@@ -81,7 +81,7 @@ config X86_PTDUMP
5732 config DEBUG_RODATA
5733 bool "Write protect kernel read-only data structures"
5734 default y
5735- depends on DEBUG_KERNEL
5736+ depends on DEBUG_KERNEL && BROKEN
5737 ---help---
5738 Mark the kernel read-only data as write-protected in the pagetables,
5739 in order to catch accidental (and incorrect) writes to such const
5740@@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST
5741
5742 config DEBUG_SET_MODULE_RONX
5743 bool "Set loadable kernel module data as NX and text as RO"
5744- depends on MODULES
5745+ depends on MODULES && BROKEN
5746 ---help---
5747 This option helps catch unintended modifications to loadable
5748 kernel module's text and read-only data. It also prevents execution
5749diff --git a/arch/x86/Makefile b/arch/x86/Makefile
5750index b02e509..2631e48 100644
5751--- a/arch/x86/Makefile
5752+++ b/arch/x86/Makefile
5753@@ -46,6 +46,7 @@ else
5754 UTS_MACHINE := x86_64
5755 CHECKFLAGS += -D__x86_64__ -m64
5756
5757+ biarch := $(call cc-option,-m64)
5758 KBUILD_AFLAGS += -m64
5759 KBUILD_CFLAGS += -m64
5760
5761@@ -195,3 +196,12 @@ define archhelp
5762 echo ' FDARGS="..." arguments for the booted kernel'
5763 echo ' FDINITRD=file initrd for the booted kernel'
5764 endef
5765+
5766+define OLD_LD
5767+
5768+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
5769+*** Please upgrade your binutils to 2.18 or newer
5770+endef
5771+
5772+archprepare:
5773+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
5774diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
5775index 95365a8..52f857b 100644
5776--- a/arch/x86/boot/Makefile
5777+++ b/arch/x86/boot/Makefile
5778@@ -63,6 +63,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
5779 $(call cc-option, -fno-stack-protector) \
5780 $(call cc-option, -mpreferred-stack-boundary=2)
5781 KBUILD_CFLAGS += $(call cc-option, -m32)
5782+ifdef CONSTIFY_PLUGIN
5783+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5784+endif
5785 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5786 GCOV_PROFILE := n
5787
5788diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
5789index 878e4b9..20537ab 100644
5790--- a/arch/x86/boot/bitops.h
5791+++ b/arch/x86/boot/bitops.h
5792@@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5793 u8 v;
5794 const u32 *p = (const u32 *)addr;
5795
5796- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5797+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5798 return v;
5799 }
5800
5801@@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5802
5803 static inline void set_bit(int nr, void *addr)
5804 {
5805- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5806+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5807 }
5808
5809 #endif /* BOOT_BITOPS_H */
5810diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
5811index c7093bd..d4247ffe0 100644
5812--- a/arch/x86/boot/boot.h
5813+++ b/arch/x86/boot/boot.h
5814@@ -85,7 +85,7 @@ static inline void io_delay(void)
5815 static inline u16 ds(void)
5816 {
5817 u16 seg;
5818- asm("movw %%ds,%0" : "=rm" (seg));
5819+ asm volatile("movw %%ds,%0" : "=rm" (seg));
5820 return seg;
5821 }
5822
5823@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t addr)
5824 static inline int memcmp(const void *s1, const void *s2, size_t len)
5825 {
5826 u8 diff;
5827- asm("repe; cmpsb; setnz %0"
5828+ asm volatile("repe; cmpsb; setnz %0"
5829 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
5830 return diff;
5831 }
5832diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
5833index 09664ef..edc5d03 100644
5834--- a/arch/x86/boot/compressed/Makefile
5835+++ b/arch/x86/boot/compressed/Makefile
5836@@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
5837 KBUILD_CFLAGS += $(cflags-y)
5838 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
5839 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
5840+ifdef CONSTIFY_PLUGIN
5841+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5842+endif
5843
5844 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5845 GCOV_PROFILE := n
5846diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
5847index 67a655a..b924059 100644
5848--- a/arch/x86/boot/compressed/head_32.S
5849+++ b/arch/x86/boot/compressed/head_32.S
5850@@ -76,7 +76,7 @@ ENTRY(startup_32)
5851 notl %eax
5852 andl %eax, %ebx
5853 #else
5854- movl $LOAD_PHYSICAL_ADDR, %ebx
5855+ movl $____LOAD_PHYSICAL_ADDR, %ebx
5856 #endif
5857
5858 /* Target address to relocate to for decompression */
5859@@ -162,7 +162,7 @@ relocated:
5860 * and where it was actually loaded.
5861 */
5862 movl %ebp, %ebx
5863- subl $LOAD_PHYSICAL_ADDR, %ebx
5864+ subl $____LOAD_PHYSICAL_ADDR, %ebx
5865 jz 2f /* Nothing to be done if loaded at compiled addr. */
5866 /*
5867 * Process relocations.
5868@@ -170,8 +170,7 @@ relocated:
5869
5870 1: subl $4, %edi
5871 movl (%edi), %ecx
5872- testl %ecx, %ecx
5873- jz 2f
5874+ jecxz 2f
5875 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5876 jmp 1b
5877 2:
5878diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
5879index 35af09d..99c9676 100644
5880--- a/arch/x86/boot/compressed/head_64.S
5881+++ b/arch/x86/boot/compressed/head_64.S
5882@@ -91,7 +91,7 @@ ENTRY(startup_32)
5883 notl %eax
5884 andl %eax, %ebx
5885 #else
5886- movl $LOAD_PHYSICAL_ADDR, %ebx
5887+ movl $____LOAD_PHYSICAL_ADDR, %ebx
5888 #endif
5889
5890 /* Target address to relocate to for decompression */
5891@@ -233,7 +233,7 @@ ENTRY(startup_64)
5892 notq %rax
5893 andq %rax, %rbp
5894 #else
5895- movq $LOAD_PHYSICAL_ADDR, %rbp
5896+ movq $____LOAD_PHYSICAL_ADDR, %rbp
5897 #endif
5898
5899 /* Target address to relocate to for decompression */
5900diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
5901index 3a19d04..7c1d55a 100644
5902--- a/arch/x86/boot/compressed/misc.c
5903+++ b/arch/x86/boot/compressed/misc.c
5904@@ -310,7 +310,7 @@ static void parse_elf(void *output)
5905 case PT_LOAD:
5906 #ifdef CONFIG_RELOCATABLE
5907 dest = output;
5908- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5909+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5910 #else
5911 dest = (void *)(phdr->p_paddr);
5912 #endif
5913@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
5914 error("Destination address too large");
5915 #endif
5916 #ifndef CONFIG_RELOCATABLE
5917- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5918+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5919 error("Wrong destination address");
5920 #endif
5921
5922diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
5923index 89bbf4e..869908e 100644
5924--- a/arch/x86/boot/compressed/relocs.c
5925+++ b/arch/x86/boot/compressed/relocs.c
5926@@ -13,8 +13,11 @@
5927
5928 static void die(char *fmt, ...);
5929
5930+#include "../../../../include/generated/autoconf.h"
5931+
5932 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5933 static Elf32_Ehdr ehdr;
5934+static Elf32_Phdr *phdr;
5935 static unsigned long reloc_count, reloc_idx;
5936 static unsigned long *relocs;
5937
5938@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5939 }
5940 }
5941
5942+static void read_phdrs(FILE *fp)
5943+{
5944+ unsigned int i;
5945+
5946+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5947+ if (!phdr) {
5948+ die("Unable to allocate %d program headers\n",
5949+ ehdr.e_phnum);
5950+ }
5951+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5952+ die("Seek to %d failed: %s\n",
5953+ ehdr.e_phoff, strerror(errno));
5954+ }
5955+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5956+ die("Cannot read ELF program headers: %s\n",
5957+ strerror(errno));
5958+ }
5959+ for(i = 0; i < ehdr.e_phnum; i++) {
5960+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
5961+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
5962+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
5963+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
5964+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
5965+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
5966+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
5967+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
5968+ }
5969+
5970+}
5971+
5972 static void read_shdrs(FILE *fp)
5973 {
5974- int i;
5975+ unsigned int i;
5976 Elf32_Shdr shdr;
5977
5978 secs = calloc(ehdr.e_shnum, sizeof(struct section));
5979@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5980
5981 static void read_strtabs(FILE *fp)
5982 {
5983- int i;
5984+ unsigned int i;
5985 for (i = 0; i < ehdr.e_shnum; i++) {
5986 struct section *sec = &secs[i];
5987 if (sec->shdr.sh_type != SHT_STRTAB) {
5988@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5989
5990 static void read_symtabs(FILE *fp)
5991 {
5992- int i,j;
5993+ unsigned int i,j;
5994 for (i = 0; i < ehdr.e_shnum; i++) {
5995 struct section *sec = &secs[i];
5996 if (sec->shdr.sh_type != SHT_SYMTAB) {
5997@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5998
5999 static void read_relocs(FILE *fp)
6000 {
6001- int i,j;
6002+ unsigned int i,j;
6003+ uint32_t base;
6004+
6005 for (i = 0; i < ehdr.e_shnum; i++) {
6006 struct section *sec = &secs[i];
6007 if (sec->shdr.sh_type != SHT_REL) {
6008@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
6009 die("Cannot read symbol table: %s\n",
6010 strerror(errno));
6011 }
6012+ base = 0;
6013+ for (j = 0; j < ehdr.e_phnum; j++) {
6014+ if (phdr[j].p_type != PT_LOAD )
6015+ continue;
6016+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6017+ continue;
6018+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6019+ break;
6020+ }
6021 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6022 Elf32_Rel *rel = &sec->reltab[j];
6023- rel->r_offset = elf32_to_cpu(rel->r_offset);
6024+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6025 rel->r_info = elf32_to_cpu(rel->r_info);
6026 }
6027 }
6028@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
6029
6030 static void print_absolute_symbols(void)
6031 {
6032- int i;
6033+ unsigned int i;
6034 printf("Absolute symbols\n");
6035 printf(" Num: Value Size Type Bind Visibility Name\n");
6036 for (i = 0; i < ehdr.e_shnum; i++) {
6037 struct section *sec = &secs[i];
6038 char *sym_strtab;
6039 Elf32_Sym *sh_symtab;
6040- int j;
6041+ unsigned int j;
6042
6043 if (sec->shdr.sh_type != SHT_SYMTAB) {
6044 continue;
6045@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
6046
6047 static void print_absolute_relocs(void)
6048 {
6049- int i, printed = 0;
6050+ unsigned int i, printed = 0;
6051
6052 for (i = 0; i < ehdr.e_shnum; i++) {
6053 struct section *sec = &secs[i];
6054 struct section *sec_applies, *sec_symtab;
6055 char *sym_strtab;
6056 Elf32_Sym *sh_symtab;
6057- int j;
6058+ unsigned int j;
6059 if (sec->shdr.sh_type != SHT_REL) {
6060 continue;
6061 }
6062@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
6063
6064 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6065 {
6066- int i;
6067+ unsigned int i;
6068 /* Walk through the relocations */
6069 for (i = 0; i < ehdr.e_shnum; i++) {
6070 char *sym_strtab;
6071 Elf32_Sym *sh_symtab;
6072 struct section *sec_applies, *sec_symtab;
6073- int j;
6074+ unsigned int j;
6075 struct section *sec = &secs[i];
6076
6077 if (sec->shdr.sh_type != SHT_REL) {
6078@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6079 !is_rel_reloc(sym_name(sym_strtab, sym))) {
6080 continue;
6081 }
6082+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6083+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6084+ continue;
6085+
6086+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6087+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6088+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6089+ continue;
6090+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6091+ continue;
6092+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6093+ continue;
6094+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6095+ continue;
6096+#endif
6097+
6098 switch (r_type) {
6099 case R_386_NONE:
6100 case R_386_PC32:
6101@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, const void *vb)
6102
6103 static void emit_relocs(int as_text)
6104 {
6105- int i;
6106+ unsigned int i;
6107 /* Count how many relocations I have and allocate space for them. */
6108 reloc_count = 0;
6109 walk_relocs(count_reloc);
6110@@ -665,6 +725,7 @@ int main(int argc, char **argv)
6111 fname, strerror(errno));
6112 }
6113 read_ehdr(fp);
6114+ read_phdrs(fp);
6115 read_shdrs(fp);
6116 read_strtabs(fp);
6117 read_symtabs(fp);
6118diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
6119index 4d3ff03..e4972ff 100644
6120--- a/arch/x86/boot/cpucheck.c
6121+++ b/arch/x86/boot/cpucheck.c
6122@@ -74,7 +74,7 @@ static int has_fpu(void)
6123 u16 fcw = -1, fsw = -1;
6124 u32 cr0;
6125
6126- asm("movl %%cr0,%0" : "=r" (cr0));
6127+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
6128 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6129 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6130 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6131@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6132 {
6133 u32 f0, f1;
6134
6135- asm("pushfl ; "
6136+ asm volatile("pushfl ; "
6137 "pushfl ; "
6138 "popl %0 ; "
6139 "movl %0,%1 ; "
6140@@ -115,7 +115,7 @@ static void get_flags(void)
6141 set_bit(X86_FEATURE_FPU, cpu.flags);
6142
6143 if (has_eflag(X86_EFLAGS_ID)) {
6144- asm("cpuid"
6145+ asm volatile("cpuid"
6146 : "=a" (max_intel_level),
6147 "=b" (cpu_vendor[0]),
6148 "=d" (cpu_vendor[1]),
6149@@ -124,7 +124,7 @@ static void get_flags(void)
6150
6151 if (max_intel_level >= 0x00000001 &&
6152 max_intel_level <= 0x0000ffff) {
6153- asm("cpuid"
6154+ asm volatile("cpuid"
6155 : "=a" (tfms),
6156 "=c" (cpu.flags[4]),
6157 "=d" (cpu.flags[0])
6158@@ -136,7 +136,7 @@ static void get_flags(void)
6159 cpu.model += ((tfms >> 16) & 0xf) << 4;
6160 }
6161
6162- asm("cpuid"
6163+ asm volatile("cpuid"
6164 : "=a" (max_amd_level)
6165 : "a" (0x80000000)
6166 : "ebx", "ecx", "edx");
6167@@ -144,7 +144,7 @@ static void get_flags(void)
6168 if (max_amd_level >= 0x80000001 &&
6169 max_amd_level <= 0x8000ffff) {
6170 u32 eax = 0x80000001;
6171- asm("cpuid"
6172+ asm volatile("cpuid"
6173 : "+a" (eax),
6174 "=c" (cpu.flags[6]),
6175 "=d" (cpu.flags[1])
6176@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6177 u32 ecx = MSR_K7_HWCR;
6178 u32 eax, edx;
6179
6180- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6181+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6182 eax &= ~(1 << 15);
6183- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6184+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6185
6186 get_flags(); /* Make sure it really did something */
6187 err = check_flags();
6188@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6189 u32 ecx = MSR_VIA_FCR;
6190 u32 eax, edx;
6191
6192- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6193+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6194 eax |= (1<<1)|(1<<7);
6195- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6196+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6197
6198 set_bit(X86_FEATURE_CX8, cpu.flags);
6199 err = check_flags();
6200@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6201 u32 eax, edx;
6202 u32 level = 1;
6203
6204- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6205- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6206- asm("cpuid"
6207+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6208+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6209+ asm volatile("cpuid"
6210 : "+a" (level), "=d" (cpu.flags[0])
6211 : : "ecx", "ebx");
6212- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6213+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6214
6215 err = check_flags();
6216 }
6217diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
6218index 93e689f..504ba09 100644
6219--- a/arch/x86/boot/header.S
6220+++ b/arch/x86/boot/header.S
6221@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical pointer to
6222 # single linked list of
6223 # struct setup_data
6224
6225-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6226+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6227
6228 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6229 #define VO_INIT_SIZE (VO__end - VO__text)
6230diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
6231index db75d07..8e6d0af 100644
6232--- a/arch/x86/boot/memory.c
6233+++ b/arch/x86/boot/memory.c
6234@@ -19,7 +19,7 @@
6235
6236 static int detect_memory_e820(void)
6237 {
6238- int count = 0;
6239+ unsigned int count = 0;
6240 struct biosregs ireg, oreg;
6241 struct e820entry *desc = boot_params.e820_map;
6242 static struct e820entry buf; /* static so it is zeroed */
6243diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
6244index 11e8c6e..fdbb1ed 100644
6245--- a/arch/x86/boot/video-vesa.c
6246+++ b/arch/x86/boot/video-vesa.c
6247@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6248
6249 boot_params.screen_info.vesapm_seg = oreg.es;
6250 boot_params.screen_info.vesapm_off = oreg.di;
6251+ boot_params.screen_info.vesapm_size = oreg.cx;
6252 }
6253
6254 /*
6255diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
6256index 43eda28..5ab5fdb 100644
6257--- a/arch/x86/boot/video.c
6258+++ b/arch/x86/boot/video.c
6259@@ -96,7 +96,7 @@ static void store_mode_params(void)
6260 static unsigned int get_entry(void)
6261 {
6262 char entry_buf[4];
6263- int i, len = 0;
6264+ unsigned int i, len = 0;
6265 int key;
6266 unsigned int v;
6267
6268diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
6269index 5b577d5..3c1fed4 100644
6270--- a/arch/x86/crypto/aes-x86_64-asm_64.S
6271+++ b/arch/x86/crypto/aes-x86_64-asm_64.S
6272@@ -8,6 +8,8 @@
6273 * including this sentence is retained in full.
6274 */
6275
6276+#include <asm/alternative-asm.h>
6277+
6278 .extern crypto_ft_tab
6279 .extern crypto_it_tab
6280 .extern crypto_fl_tab
6281@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
6282 je B192; \
6283 leaq 32(r9),r9;
6284
6285+#define ret pax_force_retaddr 0, 1; ret
6286+
6287 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
6288 movq r1,r2; \
6289 movq r3,r4; \
6290diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
6291index be6d9e3..21fbbca 100644
6292--- a/arch/x86/crypto/aesni-intel_asm.S
6293+++ b/arch/x86/crypto/aesni-intel_asm.S
6294@@ -31,6 +31,7 @@
6295
6296 #include <linux/linkage.h>
6297 #include <asm/inst.h>
6298+#include <asm/alternative-asm.h>
6299
6300 #ifdef __x86_64__
6301 .data
6302@@ -1436,7 +1437,9 @@ _return_T_done_decrypt:
6303 pop %r14
6304 pop %r13
6305 pop %r12
6306+ pax_force_retaddr 0, 1
6307 ret
6308+ENDPROC(aesni_gcm_dec)
6309
6310
6311 /*****************************************************************************
6312@@ -1699,7 +1702,9 @@ _return_T_done_encrypt:
6313 pop %r14
6314 pop %r13
6315 pop %r12
6316+ pax_force_retaddr 0, 1
6317 ret
6318+ENDPROC(aesni_gcm_enc)
6319
6320 #endif
6321
6322@@ -1714,6 +1719,7 @@ _key_expansion_256a:
6323 pxor %xmm1, %xmm0
6324 movaps %xmm0, (TKEYP)
6325 add $0x10, TKEYP
6326+ pax_force_retaddr_bts
6327 ret
6328
6329 .align 4
6330@@ -1738,6 +1744,7 @@ _key_expansion_192a:
6331 shufps $0b01001110, %xmm2, %xmm1
6332 movaps %xmm1, 0x10(TKEYP)
6333 add $0x20, TKEYP
6334+ pax_force_retaddr_bts
6335 ret
6336
6337 .align 4
6338@@ -1757,6 +1764,7 @@ _key_expansion_192b:
6339
6340 movaps %xmm0, (TKEYP)
6341 add $0x10, TKEYP
6342+ pax_force_retaddr_bts
6343 ret
6344
6345 .align 4
6346@@ -1769,6 +1777,7 @@ _key_expansion_256b:
6347 pxor %xmm1, %xmm2
6348 movaps %xmm2, (TKEYP)
6349 add $0x10, TKEYP
6350+ pax_force_retaddr_bts
6351 ret
6352
6353 /*
6354@@ -1881,7 +1890,9 @@ ENTRY(aesni_set_key)
6355 #ifndef __x86_64__
6356 popl KEYP
6357 #endif
6358+ pax_force_retaddr 0, 1
6359 ret
6360+ENDPROC(aesni_set_key)
6361
6362 /*
6363 * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
6364@@ -1902,7 +1913,9 @@ ENTRY(aesni_enc)
6365 popl KLEN
6366 popl KEYP
6367 #endif
6368+ pax_force_retaddr 0, 1
6369 ret
6370+ENDPROC(aesni_enc)
6371
6372 /*
6373 * _aesni_enc1: internal ABI
6374@@ -1959,6 +1972,7 @@ _aesni_enc1:
6375 AESENC KEY STATE
6376 movaps 0x70(TKEYP), KEY
6377 AESENCLAST KEY STATE
6378+ pax_force_retaddr_bts
6379 ret
6380
6381 /*
6382@@ -2067,6 +2081,7 @@ _aesni_enc4:
6383 AESENCLAST KEY STATE2
6384 AESENCLAST KEY STATE3
6385 AESENCLAST KEY STATE4
6386+ pax_force_retaddr_bts
6387 ret
6388
6389 /*
6390@@ -2089,7 +2104,9 @@ ENTRY(aesni_dec)
6391 popl KLEN
6392 popl KEYP
6393 #endif
6394+ pax_force_retaddr 0, 1
6395 ret
6396+ENDPROC(aesni_dec)
6397
6398 /*
6399 * _aesni_dec1: internal ABI
6400@@ -2146,6 +2163,7 @@ _aesni_dec1:
6401 AESDEC KEY STATE
6402 movaps 0x70(TKEYP), KEY
6403 AESDECLAST KEY STATE
6404+ pax_force_retaddr_bts
6405 ret
6406
6407 /*
6408@@ -2254,6 +2272,7 @@ _aesni_dec4:
6409 AESDECLAST KEY STATE2
6410 AESDECLAST KEY STATE3
6411 AESDECLAST KEY STATE4
6412+ pax_force_retaddr_bts
6413 ret
6414
6415 /*
6416@@ -2311,7 +2330,9 @@ ENTRY(aesni_ecb_enc)
6417 popl KEYP
6418 popl LEN
6419 #endif
6420+ pax_force_retaddr 0, 1
6421 ret
6422+ENDPROC(aesni_ecb_enc)
6423
6424 /*
6425 * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6426@@ -2369,7 +2390,9 @@ ENTRY(aesni_ecb_dec)
6427 popl KEYP
6428 popl LEN
6429 #endif
6430+ pax_force_retaddr 0, 1
6431 ret
6432+ENDPROC(aesni_ecb_dec)
6433
6434 /*
6435 * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6436@@ -2410,7 +2433,9 @@ ENTRY(aesni_cbc_enc)
6437 popl LEN
6438 popl IVP
6439 #endif
6440+ pax_force_retaddr 0, 1
6441 ret
6442+ENDPROC(aesni_cbc_enc)
6443
6444 /*
6445 * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6446@@ -2498,7 +2523,9 @@ ENTRY(aesni_cbc_dec)
6447 popl LEN
6448 popl IVP
6449 #endif
6450+ pax_force_retaddr 0, 1
6451 ret
6452+ENDPROC(aesni_cbc_dec)
6453
6454 #ifdef __x86_64__
6455 .align 16
6456@@ -2524,6 +2551,7 @@ _aesni_inc_init:
6457 mov $1, TCTR_LOW
6458 MOVQ_R64_XMM TCTR_LOW INC
6459 MOVQ_R64_XMM CTR TCTR_LOW
6460+ pax_force_retaddr_bts
6461 ret
6462
6463 /*
6464@@ -2552,6 +2580,7 @@ _aesni_inc:
6465 .Linc_low:
6466 movaps CTR, IV
6467 PSHUFB_XMM BSWAP_MASK IV
6468+ pax_force_retaddr_bts
6469 ret
6470
6471 /*
6472@@ -2612,5 +2641,7 @@ ENTRY(aesni_ctr_enc)
6473 .Lctr_enc_ret:
6474 movups IV, (IVP)
6475 .Lctr_enc_just_ret:
6476+ pax_force_retaddr 0, 1
6477 ret
6478+ENDPROC(aesni_ctr_enc)
6479 #endif
6480diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6481index 6214a9b..1f4fc9a 100644
6482--- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
6483+++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6484@@ -1,3 +1,5 @@
6485+#include <asm/alternative-asm.h>
6486+
6487 # enter ECRYPT_encrypt_bytes
6488 .text
6489 .p2align 5
6490@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
6491 add %r11,%rsp
6492 mov %rdi,%rax
6493 mov %rsi,%rdx
6494+ pax_force_retaddr 0, 1
6495 ret
6496 # bytesatleast65:
6497 ._bytesatleast65:
6498@@ -891,6 +894,7 @@ ECRYPT_keysetup:
6499 add %r11,%rsp
6500 mov %rdi,%rax
6501 mov %rsi,%rdx
6502+ pax_force_retaddr
6503 ret
6504 # enter ECRYPT_ivsetup
6505 .text
6506@@ -917,4 +921,5 @@ ECRYPT_ivsetup:
6507 add %r11,%rsp
6508 mov %rdi,%rax
6509 mov %rsi,%rdx
6510+ pax_force_retaddr
6511 ret
6512diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
6513index 573aa10..b73ad89 100644
6514--- a/arch/x86/crypto/twofish-x86_64-asm_64.S
6515+++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
6516@@ -21,6 +21,7 @@
6517 .text
6518
6519 #include <asm/asm-offsets.h>
6520+#include <asm/alternative-asm.h>
6521
6522 #define a_offset 0
6523 #define b_offset 4
6524@@ -269,6 +270,7 @@ twofish_enc_blk:
6525
6526 popq R1
6527 movq $1,%rax
6528+ pax_force_retaddr 0, 1
6529 ret
6530
6531 twofish_dec_blk:
6532@@ -321,4 +323,5 @@ twofish_dec_blk:
6533
6534 popq R1
6535 movq $1,%rax
6536+ pax_force_retaddr 0, 1
6537 ret
6538diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
6539index fd84387..0b4af7d 100644
6540--- a/arch/x86/ia32/ia32_aout.c
6541+++ b/arch/x86/ia32/ia32_aout.c
6542@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
6543 unsigned long dump_start, dump_size;
6544 struct user32 dump;
6545
6546+ memset(&dump, 0, sizeof(dump));
6547+
6548 fs = get_fs();
6549 set_fs(KERNEL_DS);
6550 has_dumped = 1;
6551diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
6552index 6557769..ef6ae89 100644
6553--- a/arch/x86/ia32/ia32_signal.c
6554+++ b/arch/x86/ia32/ia32_signal.c
6555@@ -169,7 +169,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
6556 }
6557 seg = get_fs();
6558 set_fs(KERNEL_DS);
6559- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
6560+ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
6561 set_fs(seg);
6562 if (ret >= 0 && uoss_ptr) {
6563 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
6564@@ -370,7 +370,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
6565 */
6566 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6567 size_t frame_size,
6568- void **fpstate)
6569+ void __user **fpstate)
6570 {
6571 unsigned long sp;
6572
6573@@ -391,7 +391,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6574
6575 if (used_math()) {
6576 sp = sp - sig_xstate_ia32_size;
6577- *fpstate = (struct _fpstate_ia32 *) sp;
6578+ *fpstate = (struct _fpstate_ia32 __user *) sp;
6579 if (save_i387_xstate_ia32(*fpstate) < 0)
6580 return (void __user *) -1L;
6581 }
6582@@ -399,7 +399,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6583 sp -= frame_size;
6584 /* Align the stack pointer according to the i386 ABI,
6585 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
6586- sp = ((sp + 4) & -16ul) - 4;
6587+ sp = ((sp - 12) & -16ul) - 4;
6588 return (void __user *) sp;
6589 }
6590
6591@@ -457,7 +457,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
6592 * These are actually not used anymore, but left because some
6593 * gdb versions depend on them as a marker.
6594 */
6595- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6596+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6597 } put_user_catch(err);
6598
6599 if (err)
6600@@ -499,7 +499,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6601 0xb8,
6602 __NR_ia32_rt_sigreturn,
6603 0x80cd,
6604- 0,
6605+ 0
6606 };
6607
6608 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
6609@@ -529,16 +529,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6610
6611 if (ka->sa.sa_flags & SA_RESTORER)
6612 restorer = ka->sa.sa_restorer;
6613+ else if (current->mm->context.vdso)
6614+ /* Return stub is in 32bit vsyscall page */
6615+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
6616 else
6617- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
6618- rt_sigreturn);
6619+ restorer = &frame->retcode;
6620 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
6621
6622 /*
6623 * Not actually used anymore, but left because some gdb
6624 * versions need it.
6625 */
6626- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6627+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6628 } put_user_catch(err);
6629
6630 if (err)
6631diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
6632index 54edb207..9335b5f 100644
6633--- a/arch/x86/ia32/ia32entry.S
6634+++ b/arch/x86/ia32/ia32entry.S
6635@@ -13,7 +13,9 @@
6636 #include <asm/thread_info.h>
6637 #include <asm/segment.h>
6638 #include <asm/irqflags.h>
6639+#include <asm/pgtable.h>
6640 #include <linux/linkage.h>
6641+#include <asm/alternative-asm.h>
6642
6643 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6644 #include <linux/elf-em.h>
6645@@ -95,6 +97,30 @@ ENTRY(native_irq_enable_sysexit)
6646 ENDPROC(native_irq_enable_sysexit)
6647 #endif
6648
6649+ .macro pax_enter_kernel_user
6650+ pax_set_fptr_mask
6651+#ifdef CONFIG_PAX_MEMORY_UDEREF
6652+ call pax_enter_kernel_user
6653+#endif
6654+ .endm
6655+
6656+ .macro pax_exit_kernel_user
6657+#ifdef CONFIG_PAX_MEMORY_UDEREF
6658+ call pax_exit_kernel_user
6659+#endif
6660+#ifdef CONFIG_PAX_RANDKSTACK
6661+ pushq %rax
6662+ call pax_randomize_kstack
6663+ popq %rax
6664+#endif
6665+ .endm
6666+
6667+.macro pax_erase_kstack
6668+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6669+ call pax_erase_kstack
6670+#endif
6671+.endm
6672+
6673 /*
6674 * 32bit SYSENTER instruction entry.
6675 *
6676@@ -121,12 +147,6 @@ ENTRY(ia32_sysenter_target)
6677 CFI_REGISTER rsp,rbp
6678 SWAPGS_UNSAFE_STACK
6679 movq PER_CPU_VAR(kernel_stack), %rsp
6680- addq $(KERNEL_STACK_OFFSET),%rsp
6681- /*
6682- * No need to follow this irqs on/off section: the syscall
6683- * disabled irqs, here we enable it straight after entry:
6684- */
6685- ENABLE_INTERRUPTS(CLBR_NONE)
6686 movl %ebp,%ebp /* zero extension */
6687 pushq_cfi $__USER32_DS
6688 /*CFI_REL_OFFSET ss,0*/
6689@@ -134,25 +154,38 @@ ENTRY(ia32_sysenter_target)
6690 CFI_REL_OFFSET rsp,0
6691 pushfq_cfi
6692 /*CFI_REL_OFFSET rflags,0*/
6693- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6694- CFI_REGISTER rip,r10
6695+ GET_THREAD_INFO(%r11)
6696+ movl TI_sysenter_return(%r11), %r11d
6697+ CFI_REGISTER rip,r11
6698 pushq_cfi $__USER32_CS
6699 /*CFI_REL_OFFSET cs,0*/
6700 movl %eax, %eax
6701- pushq_cfi %r10
6702+ pushq_cfi %r11
6703 CFI_REL_OFFSET rip,0
6704 pushq_cfi %rax
6705 cld
6706 SAVE_ARGS 0,1,0
6707+ pax_enter_kernel_user
6708+ /*
6709+ * No need to follow this irqs on/off section: the syscall
6710+ * disabled irqs, here we enable it straight after entry:
6711+ */
6712+ ENABLE_INTERRUPTS(CLBR_NONE)
6713 /* no need to do an access_ok check here because rbp has been
6714 32bit zero extended */
6715+
6716+#ifdef CONFIG_PAX_MEMORY_UDEREF
6717+ mov $PAX_USER_SHADOW_BASE,%r11
6718+ add %r11,%rbp
6719+#endif
6720+
6721 1: movl (%rbp),%ebp
6722 .section __ex_table,"a"
6723 .quad 1b,ia32_badarg
6724 .previous
6725- GET_THREAD_INFO(%r10)
6726- orl $TS_COMPAT,TI_status(%r10)
6727- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6728+ GET_THREAD_INFO(%r11)
6729+ orl $TS_COMPAT,TI_status(%r11)
6730+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6731 CFI_REMEMBER_STATE
6732 jnz sysenter_tracesys
6733 cmpq $(IA32_NR_syscalls-1),%rax
6734@@ -162,13 +195,15 @@ sysenter_do_call:
6735 sysenter_dispatch:
6736 call *ia32_sys_call_table(,%rax,8)
6737 movq %rax,RAX-ARGOFFSET(%rsp)
6738- GET_THREAD_INFO(%r10)
6739+ GET_THREAD_INFO(%r11)
6740 DISABLE_INTERRUPTS(CLBR_NONE)
6741 TRACE_IRQS_OFF
6742- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6743+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6744 jnz sysexit_audit
6745 sysexit_from_sys_call:
6746- andl $~TS_COMPAT,TI_status(%r10)
6747+ pax_exit_kernel_user
6748+ pax_erase_kstack
6749+ andl $~TS_COMPAT,TI_status(%r11)
6750 /* clear IF, that popfq doesn't enable interrupts early */
6751 andl $~0x200,EFLAGS-R11(%rsp)
6752 movl RIP-R11(%rsp),%edx /* User %eip */
6753@@ -194,6 +229,9 @@ sysexit_from_sys_call:
6754 movl %eax,%esi /* 2nd arg: syscall number */
6755 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6756 call audit_syscall_entry
6757+
6758+ pax_erase_kstack
6759+
6760 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6761 cmpq $(IA32_NR_syscalls-1),%rax
6762 ja ia32_badsys
6763@@ -205,7 +243,7 @@ sysexit_from_sys_call:
6764 .endm
6765
6766 .macro auditsys_exit exit
6767- testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6768+ testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6769 jnz ia32_ret_from_sys_call
6770 TRACE_IRQS_ON
6771 sti
6772@@ -215,12 +253,12 @@ sysexit_from_sys_call:
6773 movzbl %al,%edi /* zero-extend that into %edi */
6774 inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
6775 call audit_syscall_exit
6776- GET_THREAD_INFO(%r10)
6777+ GET_THREAD_INFO(%r11)
6778 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
6779 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
6780 cli
6781 TRACE_IRQS_OFF
6782- testl %edi,TI_flags(%r10)
6783+ testl %edi,TI_flags(%r11)
6784 jz \exit
6785 CLEAR_RREGS -ARGOFFSET
6786 jmp int_with_check
6787@@ -238,7 +276,7 @@ sysexit_audit:
6788
6789 sysenter_tracesys:
6790 #ifdef CONFIG_AUDITSYSCALL
6791- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6792+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6793 jz sysenter_auditsys
6794 #endif
6795 SAVE_REST
6796@@ -246,6 +284,9 @@ sysenter_tracesys:
6797 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6798 movq %rsp,%rdi /* &pt_regs -> arg1 */
6799 call syscall_trace_enter
6800+
6801+ pax_erase_kstack
6802+
6803 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6804 RESTORE_REST
6805 cmpq $(IA32_NR_syscalls-1),%rax
6806@@ -277,19 +318,20 @@ ENDPROC(ia32_sysenter_target)
6807 ENTRY(ia32_cstar_target)
6808 CFI_STARTPROC32 simple
6809 CFI_SIGNAL_FRAME
6810- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6811+ CFI_DEF_CFA rsp,0
6812 CFI_REGISTER rip,rcx
6813 /*CFI_REGISTER rflags,r11*/
6814 SWAPGS_UNSAFE_STACK
6815 movl %esp,%r8d
6816 CFI_REGISTER rsp,r8
6817 movq PER_CPU_VAR(kernel_stack),%rsp
6818+ SAVE_ARGS 8*6,0,0
6819+ pax_enter_kernel_user
6820 /*
6821 * No need to follow this irqs on/off section: the syscall
6822 * disabled irqs and here we enable it straight after entry:
6823 */
6824 ENABLE_INTERRUPTS(CLBR_NONE)
6825- SAVE_ARGS 8,0,0
6826 movl %eax,%eax /* zero extension */
6827 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
6828 movq %rcx,RIP-ARGOFFSET(%rsp)
6829@@ -305,13 +347,19 @@ ENTRY(ia32_cstar_target)
6830 /* no need to do an access_ok check here because r8 has been
6831 32bit zero extended */
6832 /* hardware stack frame is complete now */
6833+
6834+#ifdef CONFIG_PAX_MEMORY_UDEREF
6835+ mov $PAX_USER_SHADOW_BASE,%r11
6836+ add %r11,%r8
6837+#endif
6838+
6839 1: movl (%r8),%r9d
6840 .section __ex_table,"a"
6841 .quad 1b,ia32_badarg
6842 .previous
6843- GET_THREAD_INFO(%r10)
6844- orl $TS_COMPAT,TI_status(%r10)
6845- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6846+ GET_THREAD_INFO(%r11)
6847+ orl $TS_COMPAT,TI_status(%r11)
6848+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6849 CFI_REMEMBER_STATE
6850 jnz cstar_tracesys
6851 cmpq $IA32_NR_syscalls-1,%rax
6852@@ -321,13 +369,15 @@ cstar_do_call:
6853 cstar_dispatch:
6854 call *ia32_sys_call_table(,%rax,8)
6855 movq %rax,RAX-ARGOFFSET(%rsp)
6856- GET_THREAD_INFO(%r10)
6857+ GET_THREAD_INFO(%r11)
6858 DISABLE_INTERRUPTS(CLBR_NONE)
6859 TRACE_IRQS_OFF
6860- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6861+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6862 jnz sysretl_audit
6863 sysretl_from_sys_call:
6864- andl $~TS_COMPAT,TI_status(%r10)
6865+ pax_exit_kernel_user
6866+ pax_erase_kstack
6867+ andl $~TS_COMPAT,TI_status(%r11)
6868 RESTORE_ARGS 0,-ARG_SKIP,0,0,0
6869 movl RIP-ARGOFFSET(%rsp),%ecx
6870 CFI_REGISTER rip,rcx
6871@@ -355,7 +405,7 @@ sysretl_audit:
6872
6873 cstar_tracesys:
6874 #ifdef CONFIG_AUDITSYSCALL
6875- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6876+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6877 jz cstar_auditsys
6878 #endif
6879 xchgl %r9d,%ebp
6880@@ -364,6 +414,9 @@ cstar_tracesys:
6881 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6882 movq %rsp,%rdi /* &pt_regs -> arg1 */
6883 call syscall_trace_enter
6884+
6885+ pax_erase_kstack
6886+
6887 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
6888 RESTORE_REST
6889 xchgl %ebp,%r9d
6890@@ -409,20 +462,21 @@ ENTRY(ia32_syscall)
6891 CFI_REL_OFFSET rip,RIP-RIP
6892 PARAVIRT_ADJUST_EXCEPTION_FRAME
6893 SWAPGS
6894- /*
6895- * No need to follow this irqs on/off section: the syscall
6896- * disabled irqs and here we enable it straight after entry:
6897- */
6898- ENABLE_INTERRUPTS(CLBR_NONE)
6899 movl %eax,%eax
6900 pushq_cfi %rax
6901 cld
6902 /* note the registers are not zero extended to the sf.
6903 this could be a problem. */
6904 SAVE_ARGS 0,1,0
6905- GET_THREAD_INFO(%r10)
6906- orl $TS_COMPAT,TI_status(%r10)
6907- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6908+ pax_enter_kernel_user
6909+ /*
6910+ * No need to follow this irqs on/off section: the syscall
6911+ * disabled irqs and here we enable it straight after entry:
6912+ */
6913+ ENABLE_INTERRUPTS(CLBR_NONE)
6914+ GET_THREAD_INFO(%r11)
6915+ orl $TS_COMPAT,TI_status(%r11)
6916+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6917 jnz ia32_tracesys
6918 cmpq $(IA32_NR_syscalls-1),%rax
6919 ja ia32_badsys
6920@@ -441,6 +495,9 @@ ia32_tracesys:
6921 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6922 movq %rsp,%rdi /* &pt_regs -> arg1 */
6923 call syscall_trace_enter
6924+
6925+ pax_erase_kstack
6926+
6927 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6928 RESTORE_REST
6929 cmpq $(IA32_NR_syscalls-1),%rax
6930@@ -455,6 +512,7 @@ ia32_badsys:
6931
6932 quiet_ni_syscall:
6933 movq $-ENOSYS,%rax
6934+ pax_force_retaddr
6935 ret
6936 CFI_ENDPROC
6937
6938diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
6939index f6f5c53..b358b28 100644
6940--- a/arch/x86/ia32/sys_ia32.c
6941+++ b/arch/x86/ia32/sys_ia32.c
6942@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
6943 */
6944 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
6945 {
6946- typeof(ubuf->st_uid) uid = 0;
6947- typeof(ubuf->st_gid) gid = 0;
6948+ typeof(((struct stat64 *)0)->st_uid) uid = 0;
6949+ typeof(((struct stat64 *)0)->st_gid) gid = 0;
6950 SET_UID(uid, stat->uid);
6951 SET_GID(gid, stat->gid);
6952 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
6953@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
6954 }
6955 set_fs(KERNEL_DS);
6956 ret = sys_rt_sigprocmask(how,
6957- set ? (sigset_t __user *)&s : NULL,
6958- oset ? (sigset_t __user *)&s : NULL,
6959+ set ? (sigset_t __force_user *)&s : NULL,
6960+ oset ? (sigset_t __force_user *)&s : NULL,
6961 sigsetsize);
6962 set_fs(old_fs);
6963 if (ret)
6964@@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int seconds)
6965 return alarm_setitimer(seconds);
6966 }
6967
6968-asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
6969+asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
6970 int options)
6971 {
6972 return compat_sys_wait4(pid, stat_addr, options, NULL);
6973@@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
6974 mm_segment_t old_fs = get_fs();
6975
6976 set_fs(KERNEL_DS);
6977- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
6978+ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
6979 set_fs(old_fs);
6980 if (put_compat_timespec(&t, interval))
6981 return -EFAULT;
6982@@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
6983 mm_segment_t old_fs = get_fs();
6984
6985 set_fs(KERNEL_DS);
6986- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
6987+ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
6988 set_fs(old_fs);
6989 if (!ret) {
6990 switch (_NSIG_WORDS) {
6991@@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
6992 if (copy_siginfo_from_user32(&info, uinfo))
6993 return -EFAULT;
6994 set_fs(KERNEL_DS);
6995- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
6996+ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
6997 set_fs(old_fs);
6998 return ret;
6999 }
7000@@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
7001 return -EFAULT;
7002
7003 set_fs(KERNEL_DS);
7004- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
7005+ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
7006 count);
7007 set_fs(old_fs);
7008
7009diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
7010index 091508b..0ee32ec 100644
7011--- a/arch/x86/include/asm/alternative-asm.h
7012+++ b/arch/x86/include/asm/alternative-asm.h
7013@@ -15,6 +15,45 @@
7014 .endm
7015 #endif
7016
7017+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
7018+ .macro pax_force_retaddr_bts rip=0
7019+ btsq $63,\rip(%rsp)
7020+ .endm
7021+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
7022+ .macro pax_force_retaddr rip=0, reload=0
7023+ btsq $63,\rip(%rsp)
7024+ .endm
7025+ .macro pax_force_fptr ptr
7026+ btsq $63,\ptr
7027+ .endm
7028+ .macro pax_set_fptr_mask
7029+ .endm
7030+#endif
7031+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
7032+ .macro pax_force_retaddr rip=0, reload=0
7033+ .if \reload
7034+ pax_set_fptr_mask
7035+ .endif
7036+ orq %r10,\rip(%rsp)
7037+ .endm
7038+ .macro pax_force_fptr ptr
7039+ orq %r10,\ptr
7040+ .endm
7041+ .macro pax_set_fptr_mask
7042+ movabs $0x8000000000000000,%r10
7043+ .endm
7044+#endif
7045+#else
7046+ .macro pax_force_retaddr rip=0, reload=0
7047+ .endm
7048+ .macro pax_force_fptr ptr
7049+ .endm
7050+ .macro pax_force_retaddr_bts rip=0
7051+ .endm
7052+ .macro pax_set_fptr_mask
7053+ .endm
7054+#endif
7055+
7056 .macro altinstruction_entry orig alt feature orig_len alt_len
7057 .long \orig - .
7058 .long \alt - .
7059diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
7060index 37ad100..7d47faa 100644
7061--- a/arch/x86/include/asm/alternative.h
7062+++ b/arch/x86/include/asm/alternative.h
7063@@ -89,7 +89,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
7064 ".section .discard,\"aw\",@progbits\n" \
7065 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
7066 ".previous\n" \
7067- ".section .altinstr_replacement, \"ax\"\n" \
7068+ ".section .altinstr_replacement, \"a\"\n" \
7069 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
7070 ".previous"
7071
7072diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
7073index 9b7273c..e9fcc24 100644
7074--- a/arch/x86/include/asm/apic.h
7075+++ b/arch/x86/include/asm/apic.h
7076@@ -45,7 +45,7 @@ static inline void generic_apic_probe(void)
7077
7078 #ifdef CONFIG_X86_LOCAL_APIC
7079
7080-extern unsigned int apic_verbosity;
7081+extern int apic_verbosity;
7082 extern int local_apic_timer_c2_ok;
7083
7084 extern int disable_apic;
7085diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
7086index 20370c6..a2eb9b0 100644
7087--- a/arch/x86/include/asm/apm.h
7088+++ b/arch/x86/include/asm/apm.h
7089@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
7090 __asm__ __volatile__(APM_DO_ZERO_SEGS
7091 "pushl %%edi\n\t"
7092 "pushl %%ebp\n\t"
7093- "lcall *%%cs:apm_bios_entry\n\t"
7094+ "lcall *%%ss:apm_bios_entry\n\t"
7095 "setc %%al\n\t"
7096 "popl %%ebp\n\t"
7097 "popl %%edi\n\t"
7098@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
7099 __asm__ __volatile__(APM_DO_ZERO_SEGS
7100 "pushl %%edi\n\t"
7101 "pushl %%ebp\n\t"
7102- "lcall *%%cs:apm_bios_entry\n\t"
7103+ "lcall *%%ss:apm_bios_entry\n\t"
7104 "setc %%bl\n\t"
7105 "popl %%ebp\n\t"
7106 "popl %%edi\n\t"
7107diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
7108index 10572e3..2618d91 100644
7109--- a/arch/x86/include/asm/atomic.h
7110+++ b/arch/x86/include/asm/atomic.h
7111@@ -22,7 +22,18 @@
7112 */
7113 static inline int atomic_read(const atomic_t *v)
7114 {
7115- return (*(volatile int *)&(v)->counter);
7116+ return (*(volatile const int *)&(v)->counter);
7117+}
7118+
7119+/**
7120+ * atomic_read_unchecked - read atomic variable
7121+ * @v: pointer of type atomic_unchecked_t
7122+ *
7123+ * Atomically reads the value of @v.
7124+ */
7125+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7126+{
7127+ return (*(volatile const int *)&(v)->counter);
7128 }
7129
7130 /**
7131@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *v, int i)
7132 }
7133
7134 /**
7135+ * atomic_set_unchecked - set atomic variable
7136+ * @v: pointer of type atomic_unchecked_t
7137+ * @i: required value
7138+ *
7139+ * Atomically sets the value of @v to @i.
7140+ */
7141+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7142+{
7143+ v->counter = i;
7144+}
7145+
7146+/**
7147 * atomic_add - add integer to atomic variable
7148 * @i: integer value to add
7149 * @v: pointer of type atomic_t
7150@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *v, int i)
7151 */
7152 static inline void atomic_add(int i, atomic_t *v)
7153 {
7154- asm volatile(LOCK_PREFIX "addl %1,%0"
7155+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7156+
7157+#ifdef CONFIG_PAX_REFCOUNT
7158+ "jno 0f\n"
7159+ LOCK_PREFIX "subl %1,%0\n"
7160+ "int $4\n0:\n"
7161+ _ASM_EXTABLE(0b, 0b)
7162+#endif
7163+
7164+ : "+m" (v->counter)
7165+ : "ir" (i));
7166+}
7167+
7168+/**
7169+ * atomic_add_unchecked - add integer to atomic variable
7170+ * @i: integer value to add
7171+ * @v: pointer of type atomic_unchecked_t
7172+ *
7173+ * Atomically adds @i to @v.
7174+ */
7175+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7176+{
7177+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7178 : "+m" (v->counter)
7179 : "ir" (i));
7180 }
7181@@ -60,7 +105,29 @@ static inline void atomic_add(int i, atomic_t *v)
7182 */
7183 static inline void atomic_sub(int i, atomic_t *v)
7184 {
7185- asm volatile(LOCK_PREFIX "subl %1,%0"
7186+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7187+
7188+#ifdef CONFIG_PAX_REFCOUNT
7189+ "jno 0f\n"
7190+ LOCK_PREFIX "addl %1,%0\n"
7191+ "int $4\n0:\n"
7192+ _ASM_EXTABLE(0b, 0b)
7193+#endif
7194+
7195+ : "+m" (v->counter)
7196+ : "ir" (i));
7197+}
7198+
7199+/**
7200+ * atomic_sub_unchecked - subtract integer from atomic variable
7201+ * @i: integer value to subtract
7202+ * @v: pointer of type atomic_unchecked_t
7203+ *
7204+ * Atomically subtracts @i from @v.
7205+ */
7206+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7207+{
7208+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7209 : "+m" (v->counter)
7210 : "ir" (i));
7211 }
7212@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7213 {
7214 unsigned char c;
7215
7216- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7217+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
7218+
7219+#ifdef CONFIG_PAX_REFCOUNT
7220+ "jno 0f\n"
7221+ LOCK_PREFIX "addl %2,%0\n"
7222+ "int $4\n0:\n"
7223+ _ASM_EXTABLE(0b, 0b)
7224+#endif
7225+
7226+ "sete %1\n"
7227 : "+m" (v->counter), "=qm" (c)
7228 : "ir" (i) : "memory");
7229 return c;
7230@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7231 */
7232 static inline void atomic_inc(atomic_t *v)
7233 {
7234- asm volatile(LOCK_PREFIX "incl %0"
7235+ asm volatile(LOCK_PREFIX "incl %0\n"
7236+
7237+#ifdef CONFIG_PAX_REFCOUNT
7238+ "jno 0f\n"
7239+ LOCK_PREFIX "decl %0\n"
7240+ "int $4\n0:\n"
7241+ _ASM_EXTABLE(0b, 0b)
7242+#endif
7243+
7244+ : "+m" (v->counter));
7245+}
7246+
7247+/**
7248+ * atomic_inc_unchecked - increment atomic variable
7249+ * @v: pointer of type atomic_unchecked_t
7250+ *
7251+ * Atomically increments @v by 1.
7252+ */
7253+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7254+{
7255+ asm volatile(LOCK_PREFIX "incl %0\n"
7256 : "+m" (v->counter));
7257 }
7258
7259@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *v)
7260 */
7261 static inline void atomic_dec(atomic_t *v)
7262 {
7263- asm volatile(LOCK_PREFIX "decl %0"
7264+ asm volatile(LOCK_PREFIX "decl %0\n"
7265+
7266+#ifdef CONFIG_PAX_REFCOUNT
7267+ "jno 0f\n"
7268+ LOCK_PREFIX "incl %0\n"
7269+ "int $4\n0:\n"
7270+ _ASM_EXTABLE(0b, 0b)
7271+#endif
7272+
7273+ : "+m" (v->counter));
7274+}
7275+
7276+/**
7277+ * atomic_dec_unchecked - decrement atomic variable
7278+ * @v: pointer of type atomic_unchecked_t
7279+ *
7280+ * Atomically decrements @v by 1.
7281+ */
7282+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7283+{
7284+ asm volatile(LOCK_PREFIX "decl %0\n"
7285 : "+m" (v->counter));
7286 }
7287
7288@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
7289 {
7290 unsigned char c;
7291
7292- asm volatile(LOCK_PREFIX "decl %0; sete %1"
7293+ asm volatile(LOCK_PREFIX "decl %0\n"
7294+
7295+#ifdef CONFIG_PAX_REFCOUNT
7296+ "jno 0f\n"
7297+ LOCK_PREFIX "incl %0\n"
7298+ "int $4\n0:\n"
7299+ _ASM_EXTABLE(0b, 0b)
7300+#endif
7301+
7302+ "sete %1\n"
7303 : "+m" (v->counter), "=qm" (c)
7304 : : "memory");
7305 return c != 0;
7306@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
7307 {
7308 unsigned char c;
7309
7310- asm volatile(LOCK_PREFIX "incl %0; sete %1"
7311+ asm volatile(LOCK_PREFIX "incl %0\n"
7312+
7313+#ifdef CONFIG_PAX_REFCOUNT
7314+ "jno 0f\n"
7315+ LOCK_PREFIX "decl %0\n"
7316+ "int $4\n0:\n"
7317+ _ASM_EXTABLE(0b, 0b)
7318+#endif
7319+
7320+ "sete %1\n"
7321+ : "+m" (v->counter), "=qm" (c)
7322+ : : "memory");
7323+ return c != 0;
7324+}
7325+
7326+/**
7327+ * atomic_inc_and_test_unchecked - increment and test
7328+ * @v: pointer of type atomic_unchecked_t
7329+ *
7330+ * Atomically increments @v by 1
7331+ * and returns true if the result is zero, or false for all
7332+ * other cases.
7333+ */
7334+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7335+{
7336+ unsigned char c;
7337+
7338+ asm volatile(LOCK_PREFIX "incl %0\n"
7339+ "sete %1\n"
7340 : "+m" (v->counter), "=qm" (c)
7341 : : "memory");
7342 return c != 0;
7343@@ -157,7 +310,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
7344 {
7345 unsigned char c;
7346
7347- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7348+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
7349+
7350+#ifdef CONFIG_PAX_REFCOUNT
7351+ "jno 0f\n"
7352+ LOCK_PREFIX "subl %2,%0\n"
7353+ "int $4\n0:\n"
7354+ _ASM_EXTABLE(0b, 0b)
7355+#endif
7356+
7357+ "sets %1\n"
7358 : "+m" (v->counter), "=qm" (c)
7359 : "ir" (i) : "memory");
7360 return c;
7361@@ -180,6 +342,46 @@ static inline int atomic_add_return(int i, atomic_t *v)
7362 #endif
7363 /* Modern 486+ processor */
7364 __i = i;
7365+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7366+
7367+#ifdef CONFIG_PAX_REFCOUNT
7368+ "jno 0f\n"
7369+ "movl %0, %1\n"
7370+ "int $4\n0:\n"
7371+ _ASM_EXTABLE(0b, 0b)
7372+#endif
7373+
7374+ : "+r" (i), "+m" (v->counter)
7375+ : : "memory");
7376+ return i + __i;
7377+
7378+#ifdef CONFIG_M386
7379+no_xadd: /* Legacy 386 processor */
7380+ local_irq_save(flags);
7381+ __i = atomic_read(v);
7382+ atomic_set(v, i + __i);
7383+ local_irq_restore(flags);
7384+ return i + __i;
7385+#endif
7386+}
7387+
7388+/**
7389+ * atomic_add_return_unchecked - add integer and return
7390+ * @v: pointer of type atomic_unchecked_t
7391+ * @i: integer value to add
7392+ *
7393+ * Atomically adds @i to @v and returns @i + @v
7394+ */
7395+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7396+{
7397+ int __i;
7398+#ifdef CONFIG_M386
7399+ unsigned long flags;
7400+ if (unlikely(boot_cpu_data.x86 <= 3))
7401+ goto no_xadd;
7402+#endif
7403+ /* Modern 486+ processor */
7404+ __i = i;
7405 asm volatile(LOCK_PREFIX "xaddl %0, %1"
7406 : "+r" (i), "+m" (v->counter)
7407 : : "memory");
7408@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
7409 }
7410
7411 #define atomic_inc_return(v) (atomic_add_return(1, v))
7412+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7413+{
7414+ return atomic_add_return_unchecked(1, v);
7415+}
7416 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7417
7418 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7419@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7420 return cmpxchg(&v->counter, old, new);
7421 }
7422
7423+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7424+{
7425+ return cmpxchg(&v->counter, old, new);
7426+}
7427+
7428 static inline int atomic_xchg(atomic_t *v, int new)
7429 {
7430 return xchg(&v->counter, new);
7431 }
7432
7433+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7434+{
7435+ return xchg(&v->counter, new);
7436+}
7437+
7438 /**
7439 * __atomic_add_unless - add unless the number is already a given value
7440 * @v: pointer of type atomic_t
7441@@ -231,12 +447,25 @@ static inline int atomic_xchg(atomic_t *v, int new)
7442 */
7443 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7444 {
7445- int c, old;
7446+ int c, old, new;
7447 c = atomic_read(v);
7448 for (;;) {
7449- if (unlikely(c == (u)))
7450+ if (unlikely(c == u))
7451 break;
7452- old = atomic_cmpxchg((v), c, c + (a));
7453+
7454+ asm volatile("addl %2,%0\n"
7455+
7456+#ifdef CONFIG_PAX_REFCOUNT
7457+ "jno 0f\n"
7458+ "subl %2,%0\n"
7459+ "int $4\n0:\n"
7460+ _ASM_EXTABLE(0b, 0b)
7461+#endif
7462+
7463+ : "=r" (new)
7464+ : "0" (c), "ir" (a));
7465+
7466+ old = atomic_cmpxchg(v, c, new);
7467 if (likely(old == c))
7468 break;
7469 c = old;
7470@@ -244,6 +473,48 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7471 return c;
7472 }
7473
7474+/**
7475+ * atomic_inc_not_zero_hint - increment if not null
7476+ * @v: pointer of type atomic_t
7477+ * @hint: probable value of the atomic before the increment
7478+ *
7479+ * This version of atomic_inc_not_zero() gives a hint of probable
7480+ * value of the atomic. This helps processor to not read the memory
7481+ * before doing the atomic read/modify/write cycle, lowering
7482+ * number of bus transactions on some arches.
7483+ *
7484+ * Returns: 0 if increment was not done, 1 otherwise.
7485+ */
7486+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
7487+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
7488+{
7489+ int val, c = hint, new;
7490+
7491+ /* sanity test, should be removed by compiler if hint is a constant */
7492+ if (!hint)
7493+ return __atomic_add_unless(v, 1, 0);
7494+
7495+ do {
7496+ asm volatile("incl %0\n"
7497+
7498+#ifdef CONFIG_PAX_REFCOUNT
7499+ "jno 0f\n"
7500+ "decl %0\n"
7501+ "int $4\n0:\n"
7502+ _ASM_EXTABLE(0b, 0b)
7503+#endif
7504+
7505+ : "=r" (new)
7506+ : "0" (c));
7507+
7508+ val = atomic_cmpxchg(v, c, new);
7509+ if (val == c)
7510+ return 1;
7511+ c = val;
7512+ } while (c);
7513+
7514+ return 0;
7515+}
7516
7517 /*
7518 * atomic_dec_if_positive - decrement by 1 if old value positive
7519diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
7520index 24098aa..1e37723 100644
7521--- a/arch/x86/include/asm/atomic64_32.h
7522+++ b/arch/x86/include/asm/atomic64_32.h
7523@@ -12,6 +12,14 @@ typedef struct {
7524 u64 __aligned(8) counter;
7525 } atomic64_t;
7526
7527+#ifdef CONFIG_PAX_REFCOUNT
7528+typedef struct {
7529+ u64 __aligned(8) counter;
7530+} atomic64_unchecked_t;
7531+#else
7532+typedef atomic64_t atomic64_unchecked_t;
7533+#endif
7534+
7535 #define ATOMIC64_INIT(val) { (val) }
7536
7537 #ifdef CONFIG_X86_CMPXCHG64
7538@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
7539 }
7540
7541 /**
7542+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
7543+ * @p: pointer to type atomic64_unchecked_t
7544+ * @o: expected value
7545+ * @n: new value
7546+ *
7547+ * Atomically sets @v to @n if it was equal to @o and returns
7548+ * the old value.
7549+ */
7550+
7551+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
7552+{
7553+ return cmpxchg64(&v->counter, o, n);
7554+}
7555+
7556+/**
7557 * atomic64_xchg - xchg atomic64 variable
7558 * @v: pointer to type atomic64_t
7559 * @n: value to assign
7560@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64_t *v, long long i)
7561 }
7562
7563 /**
7564+ * atomic64_set_unchecked - set atomic64 variable
7565+ * @v: pointer to type atomic64_unchecked_t
7566+ * @n: value to assign
7567+ *
7568+ * Atomically sets the value of @v to @n.
7569+ */
7570+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
7571+{
7572+ unsigned high = (unsigned)(i >> 32);
7573+ unsigned low = (unsigned)i;
7574+ asm volatile(ATOMIC64_ALTERNATIVE(set)
7575+ : "+b" (low), "+c" (high)
7576+ : "S" (v)
7577+ : "eax", "edx", "memory"
7578+ );
7579+}
7580+
7581+/**
7582 * atomic64_read - read atomic64 variable
7583 * @v: pointer to type atomic64_t
7584 *
7585@@ -93,6 +134,22 @@ static inline long long atomic64_read(atomic64_t *v)
7586 }
7587
7588 /**
7589+ * atomic64_read_unchecked - read atomic64 variable
7590+ * @v: pointer to type atomic64_unchecked_t
7591+ *
7592+ * Atomically reads the value of @v and returns it.
7593+ */
7594+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
7595+{
7596+ long long r;
7597+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
7598+ : "=A" (r), "+c" (v)
7599+ : : "memory"
7600+ );
7601+ return r;
7602+ }
7603+
7604+/**
7605 * atomic64_add_return - add and return
7606 * @i: integer value to add
7607 * @v: pointer to type atomic64_t
7608@@ -108,6 +165,22 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
7609 return i;
7610 }
7611
7612+/**
7613+ * atomic64_add_return_unchecked - add and return
7614+ * @i: integer value to add
7615+ * @v: pointer to type atomic64_unchecked_t
7616+ *
7617+ * Atomically adds @i to @v and returns @i + *@v
7618+ */
7619+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
7620+{
7621+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
7622+ : "+A" (i), "+c" (v)
7623+ : : "memory"
7624+ );
7625+ return i;
7626+}
7627+
7628 /*
7629 * Other variants with different arithmetic operators:
7630 */
7631@@ -131,6 +204,17 @@ static inline long long atomic64_inc_return(atomic64_t *v)
7632 return a;
7633 }
7634
7635+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7636+{
7637+ long long a;
7638+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
7639+ : "=A" (a)
7640+ : "S" (v)
7641+ : "memory", "ecx"
7642+ );
7643+ return a;
7644+}
7645+
7646 static inline long long atomic64_dec_return(atomic64_t *v)
7647 {
7648 long long a;
7649@@ -159,6 +243,22 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
7650 }
7651
7652 /**
7653+ * atomic64_add_unchecked - add integer to atomic64 variable
7654+ * @i: integer value to add
7655+ * @v: pointer to type atomic64_unchecked_t
7656+ *
7657+ * Atomically adds @i to @v.
7658+ */
7659+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
7660+{
7661+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
7662+ : "+A" (i), "+c" (v)
7663+ : : "memory"
7664+ );
7665+ return i;
7666+}
7667+
7668+/**
7669 * atomic64_sub - subtract the atomic64 variable
7670 * @i: integer value to subtract
7671 * @v: pointer to type atomic64_t
7672diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
7673index 017594d..d3fcf72 100644
7674--- a/arch/x86/include/asm/atomic64_64.h
7675+++ b/arch/x86/include/asm/atomic64_64.h
7676@@ -18,7 +18,19 @@
7677 */
7678 static inline long atomic64_read(const atomic64_t *v)
7679 {
7680- return (*(volatile long *)&(v)->counter);
7681+ return (*(volatile const long *)&(v)->counter);
7682+}
7683+
7684+/**
7685+ * atomic64_read_unchecked - read atomic64 variable
7686+ * @v: pointer of type atomic64_unchecked_t
7687+ *
7688+ * Atomically reads the value of @v.
7689+ * Doesn't imply a read memory barrier.
7690+ */
7691+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
7692+{
7693+ return (*(volatile const long *)&(v)->counter);
7694 }
7695
7696 /**
7697@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
7698 }
7699
7700 /**
7701+ * atomic64_set_unchecked - set atomic64 variable
7702+ * @v: pointer to type atomic64_unchecked_t
7703+ * @i: required value
7704+ *
7705+ * Atomically sets the value of @v to @i.
7706+ */
7707+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
7708+{
7709+ v->counter = i;
7710+}
7711+
7712+/**
7713 * atomic64_add - add integer to atomic64 variable
7714 * @i: integer value to add
7715 * @v: pointer to type atomic64_t
7716@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
7717 */
7718 static inline void atomic64_add(long i, atomic64_t *v)
7719 {
7720+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
7721+
7722+#ifdef CONFIG_PAX_REFCOUNT
7723+ "jno 0f\n"
7724+ LOCK_PREFIX "subq %1,%0\n"
7725+ "int $4\n0:\n"
7726+ _ASM_EXTABLE(0b, 0b)
7727+#endif
7728+
7729+ : "=m" (v->counter)
7730+ : "er" (i), "m" (v->counter));
7731+}
7732+
7733+/**
7734+ * atomic64_add_unchecked - add integer to atomic64 variable
7735+ * @i: integer value to add
7736+ * @v: pointer to type atomic64_unchecked_t
7737+ *
7738+ * Atomically adds @i to @v.
7739+ */
7740+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
7741+{
7742 asm volatile(LOCK_PREFIX "addq %1,%0"
7743 : "=m" (v->counter)
7744 : "er" (i), "m" (v->counter));
7745@@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
7746 */
7747 static inline void atomic64_sub(long i, atomic64_t *v)
7748 {
7749- asm volatile(LOCK_PREFIX "subq %1,%0"
7750+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7751+
7752+#ifdef CONFIG_PAX_REFCOUNT
7753+ "jno 0f\n"
7754+ LOCK_PREFIX "addq %1,%0\n"
7755+ "int $4\n0:\n"
7756+ _ASM_EXTABLE(0b, 0b)
7757+#endif
7758+
7759+ : "=m" (v->counter)
7760+ : "er" (i), "m" (v->counter));
7761+}
7762+
7763+/**
7764+ * atomic64_sub_unchecked - subtract the atomic64 variable
7765+ * @i: integer value to subtract
7766+ * @v: pointer to type atomic64_unchecked_t
7767+ *
7768+ * Atomically subtracts @i from @v.
7769+ */
7770+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
7771+{
7772+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7773 : "=m" (v->counter)
7774 : "er" (i), "m" (v->counter));
7775 }
7776@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7777 {
7778 unsigned char c;
7779
7780- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
7781+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
7782+
7783+#ifdef CONFIG_PAX_REFCOUNT
7784+ "jno 0f\n"
7785+ LOCK_PREFIX "addq %2,%0\n"
7786+ "int $4\n0:\n"
7787+ _ASM_EXTABLE(0b, 0b)
7788+#endif
7789+
7790+ "sete %1\n"
7791 : "=m" (v->counter), "=qm" (c)
7792 : "er" (i), "m" (v->counter) : "memory");
7793 return c;
7794@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7795 */
7796 static inline void atomic64_inc(atomic64_t *v)
7797 {
7798+ asm volatile(LOCK_PREFIX "incq %0\n"
7799+
7800+#ifdef CONFIG_PAX_REFCOUNT
7801+ "jno 0f\n"
7802+ LOCK_PREFIX "decq %0\n"
7803+ "int $4\n0:\n"
7804+ _ASM_EXTABLE(0b, 0b)
7805+#endif
7806+
7807+ : "=m" (v->counter)
7808+ : "m" (v->counter));
7809+}
7810+
7811+/**
7812+ * atomic64_inc_unchecked - increment atomic64 variable
7813+ * @v: pointer to type atomic64_unchecked_t
7814+ *
7815+ * Atomically increments @v by 1.
7816+ */
7817+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
7818+{
7819 asm volatile(LOCK_PREFIX "incq %0"
7820 : "=m" (v->counter)
7821 : "m" (v->counter));
7822@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64_t *v)
7823 */
7824 static inline void atomic64_dec(atomic64_t *v)
7825 {
7826- asm volatile(LOCK_PREFIX "decq %0"
7827+ asm volatile(LOCK_PREFIX "decq %0\n"
7828+
7829+#ifdef CONFIG_PAX_REFCOUNT
7830+ "jno 0f\n"
7831+ LOCK_PREFIX "incq %0\n"
7832+ "int $4\n0:\n"
7833+ _ASM_EXTABLE(0b, 0b)
7834+#endif
7835+
7836+ : "=m" (v->counter)
7837+ : "m" (v->counter));
7838+}
7839+
7840+/**
7841+ * atomic64_dec_unchecked - decrement atomic64 variable
7842+ * @v: pointer to type atomic64_t
7843+ *
7844+ * Atomically decrements @v by 1.
7845+ */
7846+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
7847+{
7848+ asm volatile(LOCK_PREFIX "decq %0\n"
7849 : "=m" (v->counter)
7850 : "m" (v->counter));
7851 }
7852@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
7853 {
7854 unsigned char c;
7855
7856- asm volatile(LOCK_PREFIX "decq %0; sete %1"
7857+ asm volatile(LOCK_PREFIX "decq %0\n"
7858+
7859+#ifdef CONFIG_PAX_REFCOUNT
7860+ "jno 0f\n"
7861+ LOCK_PREFIX "incq %0\n"
7862+ "int $4\n0:\n"
7863+ _ASM_EXTABLE(0b, 0b)
7864+#endif
7865+
7866+ "sete %1\n"
7867 : "=m" (v->counter), "=qm" (c)
7868 : "m" (v->counter) : "memory");
7869 return c != 0;
7870@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
7871 {
7872 unsigned char c;
7873
7874- asm volatile(LOCK_PREFIX "incq %0; sete %1"
7875+ asm volatile(LOCK_PREFIX "incq %0\n"
7876+
7877+#ifdef CONFIG_PAX_REFCOUNT
7878+ "jno 0f\n"
7879+ LOCK_PREFIX "decq %0\n"
7880+ "int $4\n0:\n"
7881+ _ASM_EXTABLE(0b, 0b)
7882+#endif
7883+
7884+ "sete %1\n"
7885 : "=m" (v->counter), "=qm" (c)
7886 : "m" (v->counter) : "memory");
7887 return c != 0;
7888@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7889 {
7890 unsigned char c;
7891
7892- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
7893+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
7894+
7895+#ifdef CONFIG_PAX_REFCOUNT
7896+ "jno 0f\n"
7897+ LOCK_PREFIX "subq %2,%0\n"
7898+ "int $4\n0:\n"
7899+ _ASM_EXTABLE(0b, 0b)
7900+#endif
7901+
7902+ "sets %1\n"
7903 : "=m" (v->counter), "=qm" (c)
7904 : "er" (i), "m" (v->counter) : "memory");
7905 return c;
7906@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7907 static inline long atomic64_add_return(long i, atomic64_t *v)
7908 {
7909 long __i = i;
7910- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
7911+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
7912+
7913+#ifdef CONFIG_PAX_REFCOUNT
7914+ "jno 0f\n"
7915+ "movq %0, %1\n"
7916+ "int $4\n0:\n"
7917+ _ASM_EXTABLE(0b, 0b)
7918+#endif
7919+
7920+ : "+r" (i), "+m" (v->counter)
7921+ : : "memory");
7922+ return i + __i;
7923+}
7924+
7925+/**
7926+ * atomic64_add_return_unchecked - add and return
7927+ * @i: integer value to add
7928+ * @v: pointer to type atomic64_unchecked_t
7929+ *
7930+ * Atomically adds @i to @v and returns @i + @v
7931+ */
7932+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
7933+{
7934+ long __i = i;
7935+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
7936 : "+r" (i), "+m" (v->counter)
7937 : : "memory");
7938 return i + __i;
7939@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
7940 }
7941
7942 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
7943+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7944+{
7945+ return atomic64_add_return_unchecked(1, v);
7946+}
7947 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
7948
7949 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7950@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7951 return cmpxchg(&v->counter, old, new);
7952 }
7953
7954+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
7955+{
7956+ return cmpxchg(&v->counter, old, new);
7957+}
7958+
7959 static inline long atomic64_xchg(atomic64_t *v, long new)
7960 {
7961 return xchg(&v->counter, new);
7962@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
7963 */
7964 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
7965 {
7966- long c, old;
7967+ long c, old, new;
7968 c = atomic64_read(v);
7969 for (;;) {
7970- if (unlikely(c == (u)))
7971+ if (unlikely(c == u))
7972 break;
7973- old = atomic64_cmpxchg((v), c, c + (a));
7974+
7975+ asm volatile("add %2,%0\n"
7976+
7977+#ifdef CONFIG_PAX_REFCOUNT
7978+ "jno 0f\n"
7979+ "sub %2,%0\n"
7980+ "int $4\n0:\n"
7981+ _ASM_EXTABLE(0b, 0b)
7982+#endif
7983+
7984+ : "=r" (new)
7985+ : "0" (c), "ir" (a));
7986+
7987+ old = atomic64_cmpxchg(v, c, new);
7988 if (likely(old == c))
7989 break;
7990 c = old;
7991 }
7992- return c != (u);
7993+ return c != u;
7994 }
7995
7996 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
7997diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
7998index 1775d6e..b65017f 100644
7999--- a/arch/x86/include/asm/bitops.h
8000+++ b/arch/x86/include/asm/bitops.h
8001@@ -38,7 +38,7 @@
8002 * a mask operation on a byte.
8003 */
8004 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8005-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8006+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8007 #define CONST_MASK(nr) (1 << ((nr) & 7))
8008
8009 /**
8010diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
8011index 5e1a2ee..c9f9533 100644
8012--- a/arch/x86/include/asm/boot.h
8013+++ b/arch/x86/include/asm/boot.h
8014@@ -11,10 +11,15 @@
8015 #include <asm/pgtable_types.h>
8016
8017 /* Physical address where kernel should be loaded. */
8018-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8019+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8020 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8021 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8022
8023+#ifndef __ASSEMBLY__
8024+extern unsigned char __LOAD_PHYSICAL_ADDR[];
8025+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8026+#endif
8027+
8028 /* Minimum kernel alignment, as a power of two */
8029 #ifdef CONFIG_X86_64
8030 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8031diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
8032index 48f99f1..d78ebf9 100644
8033--- a/arch/x86/include/asm/cache.h
8034+++ b/arch/x86/include/asm/cache.h
8035@@ -5,12 +5,13 @@
8036
8037 /* L1 cache line size */
8038 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8039-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8040+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8041
8042 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
8043+#define __read_only __attribute__((__section__(".data..read_only")))
8044
8045 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
8046-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
8047+#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
8048
8049 #ifdef CONFIG_X86_VSMP
8050 #ifdef CONFIG_SMP
8051diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
8052index 4e12668..501d239 100644
8053--- a/arch/x86/include/asm/cacheflush.h
8054+++ b/arch/x86/include/asm/cacheflush.h
8055@@ -26,7 +26,7 @@ static inline unsigned long get_page_memtype(struct page *pg)
8056 unsigned long pg_flags = pg->flags & _PGMT_MASK;
8057
8058 if (pg_flags == _PGMT_DEFAULT)
8059- return -1;
8060+ return ~0UL;
8061 else if (pg_flags == _PGMT_WC)
8062 return _PAGE_CACHE_WC;
8063 else if (pg_flags == _PGMT_UC_MINUS)
8064diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
8065index 46fc474..b02b0f9 100644
8066--- a/arch/x86/include/asm/checksum_32.h
8067+++ b/arch/x86/include/asm/checksum_32.h
8068@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
8069 int len, __wsum sum,
8070 int *src_err_ptr, int *dst_err_ptr);
8071
8072+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8073+ int len, __wsum sum,
8074+ int *src_err_ptr, int *dst_err_ptr);
8075+
8076+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8077+ int len, __wsum sum,
8078+ int *src_err_ptr, int *dst_err_ptr);
8079+
8080 /*
8081 * Note: when you get a NULL pointer exception here this means someone
8082 * passed in an incorrect kernel address to one of these functions.
8083@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
8084 int *err_ptr)
8085 {
8086 might_sleep();
8087- return csum_partial_copy_generic((__force void *)src, dst,
8088+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
8089 len, sum, err_ptr, NULL);
8090 }
8091
8092@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
8093 {
8094 might_sleep();
8095 if (access_ok(VERIFY_WRITE, dst, len))
8096- return csum_partial_copy_generic(src, (__force void *)dst,
8097+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8098 len, sum, NULL, err_ptr);
8099
8100 if (len)
8101diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
8102index 88b23a4..d2e5f9f 100644
8103--- a/arch/x86/include/asm/cpufeature.h
8104+++ b/arch/x86/include/asm/cpufeature.h
8105@@ -358,7 +358,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
8106 ".section .discard,\"aw\",@progbits\n"
8107 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
8108 ".previous\n"
8109- ".section .altinstr_replacement,\"ax\"\n"
8110+ ".section .altinstr_replacement,\"a\"\n"
8111 "3: movb $1,%0\n"
8112 "4:\n"
8113 ".previous\n"
8114diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
8115index 41935fa..3b40db8 100644
8116--- a/arch/x86/include/asm/desc.h
8117+++ b/arch/x86/include/asm/desc.h
8118@@ -4,6 +4,7 @@
8119 #include <asm/desc_defs.h>
8120 #include <asm/ldt.h>
8121 #include <asm/mmu.h>
8122+#include <asm/pgtable.h>
8123
8124 #include <linux/smp.h>
8125
8126@@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8127
8128 desc->type = (info->read_exec_only ^ 1) << 1;
8129 desc->type |= info->contents << 2;
8130+ desc->type |= info->seg_not_present ^ 1;
8131
8132 desc->s = 1;
8133 desc->dpl = 0x3;
8134@@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8135 }
8136
8137 extern struct desc_ptr idt_descr;
8138-extern gate_desc idt_table[];
8139-
8140-struct gdt_page {
8141- struct desc_struct gdt[GDT_ENTRIES];
8142-} __attribute__((aligned(PAGE_SIZE)));
8143-
8144-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8145+extern gate_desc idt_table[256];
8146
8147+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8148 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8149 {
8150- return per_cpu(gdt_page, cpu).gdt;
8151+ return cpu_gdt_table[cpu];
8152 }
8153
8154 #ifdef CONFIG_X86_64
8155@@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
8156 unsigned long base, unsigned dpl, unsigned flags,
8157 unsigned short seg)
8158 {
8159- gate->a = (seg << 16) | (base & 0xffff);
8160- gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8161+ gate->gate.offset_low = base;
8162+ gate->gate.seg = seg;
8163+ gate->gate.reserved = 0;
8164+ gate->gate.type = type;
8165+ gate->gate.s = 0;
8166+ gate->gate.dpl = dpl;
8167+ gate->gate.p = 1;
8168+ gate->gate.offset_high = base >> 16;
8169 }
8170
8171 #endif
8172@@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
8173
8174 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
8175 {
8176+ pax_open_kernel();
8177 memcpy(&idt[entry], gate, sizeof(*gate));
8178+ pax_close_kernel();
8179 }
8180
8181 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
8182 {
8183+ pax_open_kernel();
8184 memcpy(&ldt[entry], desc, 8);
8185+ pax_close_kernel();
8186 }
8187
8188 static inline void
8189@@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
8190 default: size = sizeof(*gdt); break;
8191 }
8192
8193+ pax_open_kernel();
8194 memcpy(&gdt[entry], desc, size);
8195+ pax_close_kernel();
8196 }
8197
8198 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8199@@ -207,7 +216,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
8200
8201 static inline void native_load_tr_desc(void)
8202 {
8203+ pax_open_kernel();
8204 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8205+ pax_close_kernel();
8206 }
8207
8208 static inline void native_load_gdt(const struct desc_ptr *dtr)
8209@@ -244,8 +255,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
8210 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8211 unsigned int i;
8212
8213+ pax_open_kernel();
8214 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8215 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8216+ pax_close_kernel();
8217 }
8218
8219 #define _LDT_empty(info) \
8220@@ -307,7 +320,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
8221 desc->limit = (limit >> 16) & 0xf;
8222 }
8223
8224-static inline void _set_gate(int gate, unsigned type, void *addr,
8225+static inline void _set_gate(int gate, unsigned type, const void *addr,
8226 unsigned dpl, unsigned ist, unsigned seg)
8227 {
8228 gate_desc s;
8229@@ -326,7 +339,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
8230 * Pentium F0 0F bugfix can have resulted in the mapped
8231 * IDT being write-protected.
8232 */
8233-static inline void set_intr_gate(unsigned int n, void *addr)
8234+static inline void set_intr_gate(unsigned int n, const void *addr)
8235 {
8236 BUG_ON((unsigned)n > 0xFF);
8237 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8238@@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
8239 /*
8240 * This routine sets up an interrupt gate at directory privilege level 3.
8241 */
8242-static inline void set_system_intr_gate(unsigned int n, void *addr)
8243+static inline void set_system_intr_gate(unsigned int n, const void *addr)
8244 {
8245 BUG_ON((unsigned)n > 0xFF);
8246 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8247 }
8248
8249-static inline void set_system_trap_gate(unsigned int n, void *addr)
8250+static inline void set_system_trap_gate(unsigned int n, const void *addr)
8251 {
8252 BUG_ON((unsigned)n > 0xFF);
8253 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8254 }
8255
8256-static inline void set_trap_gate(unsigned int n, void *addr)
8257+static inline void set_trap_gate(unsigned int n, const void *addr)
8258 {
8259 BUG_ON((unsigned)n > 0xFF);
8260 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8261@@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
8262 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8263 {
8264 BUG_ON((unsigned)n > 0xFF);
8265- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8266+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8267 }
8268
8269-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8270+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8271 {
8272 BUG_ON((unsigned)n > 0xFF);
8273 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8274 }
8275
8276-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8277+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8278 {
8279 BUG_ON((unsigned)n > 0xFF);
8280 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8281 }
8282
8283+#ifdef CONFIG_X86_32
8284+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8285+{
8286+ struct desc_struct d;
8287+
8288+ if (likely(limit))
8289+ limit = (limit - 1UL) >> PAGE_SHIFT;
8290+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
8291+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8292+}
8293+#endif
8294+
8295 #endif /* _ASM_X86_DESC_H */
8296diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
8297index 278441f..b95a174 100644
8298--- a/arch/x86/include/asm/desc_defs.h
8299+++ b/arch/x86/include/asm/desc_defs.h
8300@@ -31,6 +31,12 @@ struct desc_struct {
8301 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8302 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8303 };
8304+ struct {
8305+ u16 offset_low;
8306+ u16 seg;
8307+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8308+ unsigned offset_high: 16;
8309+ } gate;
8310 };
8311 } __attribute__((packed));
8312
8313diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
8314index 908b969..a1f4eb4 100644
8315--- a/arch/x86/include/asm/e820.h
8316+++ b/arch/x86/include/asm/e820.h
8317@@ -69,7 +69,7 @@ struct e820map {
8318 #define ISA_START_ADDRESS 0xa0000
8319 #define ISA_END_ADDRESS 0x100000
8320
8321-#define BIOS_BEGIN 0x000a0000
8322+#define BIOS_BEGIN 0x000c0000
8323 #define BIOS_END 0x00100000
8324
8325 #define BIOS_ROM_BASE 0xffe00000
8326diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
8327index f2ad216..eb24c96 100644
8328--- a/arch/x86/include/asm/elf.h
8329+++ b/arch/x86/include/asm/elf.h
8330@@ -237,7 +237,25 @@ extern int force_personality32;
8331 the loader. We need to make sure that it is out of the way of the program
8332 that it will "exec", and that there is sufficient room for the brk. */
8333
8334+#ifdef CONFIG_PAX_SEGMEXEC
8335+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8336+#else
8337 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8338+#endif
8339+
8340+#ifdef CONFIG_PAX_ASLR
8341+#ifdef CONFIG_X86_32
8342+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8343+
8344+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8345+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8346+#else
8347+#define PAX_ELF_ET_DYN_BASE 0x400000UL
8348+
8349+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8350+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8351+#endif
8352+#endif
8353
8354 /* This yields a mask that user programs can use to figure out what
8355 instruction set this CPU supports. This could be done in user space,
8356@@ -290,9 +308,7 @@ do { \
8357
8358 #define ARCH_DLINFO \
8359 do { \
8360- if (vdso_enabled) \
8361- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8362- (unsigned long)current->mm->context.vdso); \
8363+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8364 } while (0)
8365
8366 #define AT_SYSINFO 32
8367@@ -303,7 +319,7 @@ do { \
8368
8369 #endif /* !CONFIG_X86_32 */
8370
8371-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8372+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8373
8374 #define VDSO_ENTRY \
8375 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8376@@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
8377 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8378 #define compat_arch_setup_additional_pages syscall32_setup_pages
8379
8380-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8381-#define arch_randomize_brk arch_randomize_brk
8382-
8383 #endif /* _ASM_X86_ELF_H */
8384diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
8385index cc70c1c..d96d011 100644
8386--- a/arch/x86/include/asm/emergency-restart.h
8387+++ b/arch/x86/include/asm/emergency-restart.h
8388@@ -15,6 +15,6 @@ enum reboot_type {
8389
8390 extern enum reboot_type reboot_type;
8391
8392-extern void machine_emergency_restart(void);
8393+extern void machine_emergency_restart(void) __noreturn;
8394
8395 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8396diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
8397index d09bb03..4ea4194 100644
8398--- a/arch/x86/include/asm/futex.h
8399+++ b/arch/x86/include/asm/futex.h
8400@@ -12,16 +12,18 @@
8401 #include <asm/system.h>
8402
8403 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8404+ typecheck(u32 __user *, uaddr); \
8405 asm volatile("1:\t" insn "\n" \
8406 "2:\t.section .fixup,\"ax\"\n" \
8407 "3:\tmov\t%3, %1\n" \
8408 "\tjmp\t2b\n" \
8409 "\t.previous\n" \
8410 _ASM_EXTABLE(1b, 3b) \
8411- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8412+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
8413 : "i" (-EFAULT), "0" (oparg), "1" (0))
8414
8415 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8416+ typecheck(u32 __user *, uaddr); \
8417 asm volatile("1:\tmovl %2, %0\n" \
8418 "\tmovl\t%0, %3\n" \
8419 "\t" insn "\n" \
8420@@ -34,7 +36,7 @@
8421 _ASM_EXTABLE(1b, 4b) \
8422 _ASM_EXTABLE(2b, 4b) \
8423 : "=&a" (oldval), "=&r" (ret), \
8424- "+m" (*uaddr), "=&r" (tem) \
8425+ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
8426 : "r" (oparg), "i" (-EFAULT), "1" (0))
8427
8428 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8429@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8430
8431 switch (op) {
8432 case FUTEX_OP_SET:
8433- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8434+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8435 break;
8436 case FUTEX_OP_ADD:
8437- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8438+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8439 uaddr, oparg);
8440 break;
8441 case FUTEX_OP_OR:
8442@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
8443 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
8444 return -EFAULT;
8445
8446- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
8447+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
8448 "2:\t.section .fixup, \"ax\"\n"
8449 "3:\tmov %3, %0\n"
8450 "\tjmp 2b\n"
8451 "\t.previous\n"
8452 _ASM_EXTABLE(1b, 3b)
8453- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
8454+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
8455 : "i" (-EFAULT), "r" (newval), "1" (oldval)
8456 : "memory"
8457 );
8458diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
8459index 0919905..2cf38d6 100644
8460--- a/arch/x86/include/asm/hw_irq.h
8461+++ b/arch/x86/include/asm/hw_irq.h
8462@@ -136,8 +136,8 @@ extern void setup_ioapic_dest(void);
8463 extern void enable_IO_APIC(void);
8464
8465 /* Statistics */
8466-extern atomic_t irq_err_count;
8467-extern atomic_t irq_mis_count;
8468+extern atomic_unchecked_t irq_err_count;
8469+extern atomic_unchecked_t irq_mis_count;
8470
8471 /* EISA */
8472 extern void eisa_set_level_irq(unsigned int irq);
8473diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
8474index c9e09ea..73888df 100644
8475--- a/arch/x86/include/asm/i387.h
8476+++ b/arch/x86/include/asm/i387.h
8477@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
8478 {
8479 int err;
8480
8481+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8482+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8483+ fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
8484+#endif
8485+
8486 /* See comment in fxsave() below. */
8487 #ifdef CONFIG_AS_FXSAVEQ
8488 asm volatile("1: fxrstorq %[fx]\n\t"
8489@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
8490 {
8491 int err;
8492
8493+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8494+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8495+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
8496+#endif
8497+
8498 /*
8499 * Clear the bytes not touched by the fxsave and reserved
8500 * for the SW usage.
8501@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu *fpu)
8502 #endif /* CONFIG_X86_64 */
8503
8504 /* We need a safe address that is cheap to find and that is already
8505- in L1 during context switch. The best choices are unfortunately
8506- different for UP and SMP */
8507-#ifdef CONFIG_SMP
8508-#define safe_address (__per_cpu_offset[0])
8509-#else
8510-#define safe_address (kstat_cpu(0).cpustat.user)
8511-#endif
8512+ in L1 during context switch. */
8513+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
8514
8515 /*
8516 * These must be called with preempt disabled
8517@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void)
8518 struct thread_info *me = current_thread_info();
8519 preempt_disable();
8520 if (me->status & TS_USEDFPU)
8521- __save_init_fpu(me->task);
8522+ __save_init_fpu(current);
8523 else
8524 clts();
8525 }
8526diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
8527index d8e8eef..99f81ae 100644
8528--- a/arch/x86/include/asm/io.h
8529+++ b/arch/x86/include/asm/io.h
8530@@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
8531
8532 #include <linux/vmalloc.h>
8533
8534+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
8535+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
8536+{
8537+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8538+}
8539+
8540+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
8541+{
8542+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8543+}
8544+
8545 /*
8546 * Convert a virtual cached pointer to an uncached pointer
8547 */
8548diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
8549index bba3cf8..06bc8da 100644
8550--- a/arch/x86/include/asm/irqflags.h
8551+++ b/arch/x86/include/asm/irqflags.h
8552@@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
8553 sti; \
8554 sysexit
8555
8556+#define GET_CR0_INTO_RDI mov %cr0, %rdi
8557+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
8558+#define GET_CR3_INTO_RDI mov %cr3, %rdi
8559+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
8560+
8561 #else
8562 #define INTERRUPT_RETURN iret
8563 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
8564diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
8565index 5478825..839e88c 100644
8566--- a/arch/x86/include/asm/kprobes.h
8567+++ b/arch/x86/include/asm/kprobes.h
8568@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
8569 #define RELATIVEJUMP_SIZE 5
8570 #define RELATIVECALL_OPCODE 0xe8
8571 #define RELATIVE_ADDR_SIZE 4
8572-#define MAX_STACK_SIZE 64
8573-#define MIN_STACK_SIZE(ADDR) \
8574- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
8575- THREAD_SIZE - (unsigned long)(ADDR))) \
8576- ? (MAX_STACK_SIZE) \
8577- : (((unsigned long)current_thread_info()) + \
8578- THREAD_SIZE - (unsigned long)(ADDR)))
8579+#define MAX_STACK_SIZE 64UL
8580+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
8581
8582 #define flush_insn_slot(p) do { } while (0)
8583
8584diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
8585index dd51c83..66cbfac 100644
8586--- a/arch/x86/include/asm/kvm_host.h
8587+++ b/arch/x86/include/asm/kvm_host.h
8588@@ -456,7 +456,7 @@ struct kvm_arch {
8589 unsigned int n_requested_mmu_pages;
8590 unsigned int n_max_mmu_pages;
8591 unsigned int indirect_shadow_pages;
8592- atomic_t invlpg_counter;
8593+ atomic_unchecked_t invlpg_counter;
8594 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
8595 /*
8596 * Hash table of struct kvm_mmu_page.
8597@@ -636,7 +636,7 @@ struct kvm_x86_ops {
8598 enum x86_intercept_stage stage);
8599
8600 const struct trace_print_flags *exit_reasons_str;
8601-};
8602+} __do_const;
8603
8604 struct kvm_arch_async_pf {
8605 u32 token;
8606diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
8607index 9cdae5d..300d20f 100644
8608--- a/arch/x86/include/asm/local.h
8609+++ b/arch/x86/include/asm/local.h
8610@@ -18,26 +18,58 @@ typedef struct {
8611
8612 static inline void local_inc(local_t *l)
8613 {
8614- asm volatile(_ASM_INC "%0"
8615+ asm volatile(_ASM_INC "%0\n"
8616+
8617+#ifdef CONFIG_PAX_REFCOUNT
8618+ "jno 0f\n"
8619+ _ASM_DEC "%0\n"
8620+ "int $4\n0:\n"
8621+ _ASM_EXTABLE(0b, 0b)
8622+#endif
8623+
8624 : "+m" (l->a.counter));
8625 }
8626
8627 static inline void local_dec(local_t *l)
8628 {
8629- asm volatile(_ASM_DEC "%0"
8630+ asm volatile(_ASM_DEC "%0\n"
8631+
8632+#ifdef CONFIG_PAX_REFCOUNT
8633+ "jno 0f\n"
8634+ _ASM_INC "%0\n"
8635+ "int $4\n0:\n"
8636+ _ASM_EXTABLE(0b, 0b)
8637+#endif
8638+
8639 : "+m" (l->a.counter));
8640 }
8641
8642 static inline void local_add(long i, local_t *l)
8643 {
8644- asm volatile(_ASM_ADD "%1,%0"
8645+ asm volatile(_ASM_ADD "%1,%0\n"
8646+
8647+#ifdef CONFIG_PAX_REFCOUNT
8648+ "jno 0f\n"
8649+ _ASM_SUB "%1,%0\n"
8650+ "int $4\n0:\n"
8651+ _ASM_EXTABLE(0b, 0b)
8652+#endif
8653+
8654 : "+m" (l->a.counter)
8655 : "ir" (i));
8656 }
8657
8658 static inline void local_sub(long i, local_t *l)
8659 {
8660- asm volatile(_ASM_SUB "%1,%0"
8661+ asm volatile(_ASM_SUB "%1,%0\n"
8662+
8663+#ifdef CONFIG_PAX_REFCOUNT
8664+ "jno 0f\n"
8665+ _ASM_ADD "%1,%0\n"
8666+ "int $4\n0:\n"
8667+ _ASM_EXTABLE(0b, 0b)
8668+#endif
8669+
8670 : "+m" (l->a.counter)
8671 : "ir" (i));
8672 }
8673@@ -55,7 +87,16 @@ static inline int local_sub_and_test(long i, local_t *l)
8674 {
8675 unsigned char c;
8676
8677- asm volatile(_ASM_SUB "%2,%0; sete %1"
8678+ asm volatile(_ASM_SUB "%2,%0\n"
8679+
8680+#ifdef CONFIG_PAX_REFCOUNT
8681+ "jno 0f\n"
8682+ _ASM_ADD "%2,%0\n"
8683+ "int $4\n0:\n"
8684+ _ASM_EXTABLE(0b, 0b)
8685+#endif
8686+
8687+ "sete %1\n"
8688 : "+m" (l->a.counter), "=qm" (c)
8689 : "ir" (i) : "memory");
8690 return c;
8691@@ -73,7 +114,16 @@ static inline int local_dec_and_test(local_t *l)
8692 {
8693 unsigned char c;
8694
8695- asm volatile(_ASM_DEC "%0; sete %1"
8696+ asm volatile(_ASM_DEC "%0\n"
8697+
8698+#ifdef CONFIG_PAX_REFCOUNT
8699+ "jno 0f\n"
8700+ _ASM_INC "%0\n"
8701+ "int $4\n0:\n"
8702+ _ASM_EXTABLE(0b, 0b)
8703+#endif
8704+
8705+ "sete %1\n"
8706 : "+m" (l->a.counter), "=qm" (c)
8707 : : "memory");
8708 return c != 0;
8709@@ -91,7 +141,16 @@ static inline int local_inc_and_test(local_t *l)
8710 {
8711 unsigned char c;
8712
8713- asm volatile(_ASM_INC "%0; sete %1"
8714+ asm volatile(_ASM_INC "%0\n"
8715+
8716+#ifdef CONFIG_PAX_REFCOUNT
8717+ "jno 0f\n"
8718+ _ASM_DEC "%0\n"
8719+ "int $4\n0:\n"
8720+ _ASM_EXTABLE(0b, 0b)
8721+#endif
8722+
8723+ "sete %1\n"
8724 : "+m" (l->a.counter), "=qm" (c)
8725 : : "memory");
8726 return c != 0;
8727@@ -110,7 +169,16 @@ static inline int local_add_negative(long i, local_t *l)
8728 {
8729 unsigned char c;
8730
8731- asm volatile(_ASM_ADD "%2,%0; sets %1"
8732+ asm volatile(_ASM_ADD "%2,%0\n"
8733+
8734+#ifdef CONFIG_PAX_REFCOUNT
8735+ "jno 0f\n"
8736+ _ASM_SUB "%2,%0\n"
8737+ "int $4\n0:\n"
8738+ _ASM_EXTABLE(0b, 0b)
8739+#endif
8740+
8741+ "sets %1\n"
8742 : "+m" (l->a.counter), "=qm" (c)
8743 : "ir" (i) : "memory");
8744 return c;
8745@@ -133,7 +201,15 @@ static inline long local_add_return(long i, local_t *l)
8746 #endif
8747 /* Modern 486+ processor */
8748 __i = i;
8749- asm volatile(_ASM_XADD "%0, %1;"
8750+ asm volatile(_ASM_XADD "%0, %1\n"
8751+
8752+#ifdef CONFIG_PAX_REFCOUNT
8753+ "jno 0f\n"
8754+ _ASM_MOV "%0,%1\n"
8755+ "int $4\n0:\n"
8756+ _ASM_EXTABLE(0b, 0b)
8757+#endif
8758+
8759 : "+r" (i), "+m" (l->a.counter)
8760 : : "memory");
8761 return i + __i;
8762diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
8763index 593e51d..fa69c9a 100644
8764--- a/arch/x86/include/asm/mman.h
8765+++ b/arch/x86/include/asm/mman.h
8766@@ -5,4 +5,14 @@
8767
8768 #include <asm-generic/mman.h>
8769
8770+#ifdef __KERNEL__
8771+#ifndef __ASSEMBLY__
8772+#ifdef CONFIG_X86_32
8773+#define arch_mmap_check i386_mmap_check
8774+int i386_mmap_check(unsigned long addr, unsigned long len,
8775+ unsigned long flags);
8776+#endif
8777+#endif
8778+#endif
8779+
8780 #endif /* _ASM_X86_MMAN_H */
8781diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
8782index 5f55e69..e20bfb1 100644
8783--- a/arch/x86/include/asm/mmu.h
8784+++ b/arch/x86/include/asm/mmu.h
8785@@ -9,7 +9,7 @@
8786 * we put the segment information here.
8787 */
8788 typedef struct {
8789- void *ldt;
8790+ struct desc_struct *ldt;
8791 int size;
8792
8793 #ifdef CONFIG_X86_64
8794@@ -18,7 +18,19 @@ typedef struct {
8795 #endif
8796
8797 struct mutex lock;
8798- void *vdso;
8799+ unsigned long vdso;
8800+
8801+#ifdef CONFIG_X86_32
8802+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
8803+ unsigned long user_cs_base;
8804+ unsigned long user_cs_limit;
8805+
8806+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8807+ cpumask_t cpu_user_cs_mask;
8808+#endif
8809+
8810+#endif
8811+#endif
8812 } mm_context_t;
8813
8814 #ifdef CONFIG_SMP
8815diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
8816index 6902152..399f3a2 100644
8817--- a/arch/x86/include/asm/mmu_context.h
8818+++ b/arch/x86/include/asm/mmu_context.h
8819@@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
8820
8821 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
8822 {
8823+
8824+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8825+ unsigned int i;
8826+ pgd_t *pgd;
8827+
8828+ pax_open_kernel();
8829+ pgd = get_cpu_pgd(smp_processor_id());
8830+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
8831+ set_pgd_batched(pgd+i, native_make_pgd(0));
8832+ pax_close_kernel();
8833+#endif
8834+
8835 #ifdef CONFIG_SMP
8836 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
8837 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
8838@@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8839 struct task_struct *tsk)
8840 {
8841 unsigned cpu = smp_processor_id();
8842+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8843+ int tlbstate = TLBSTATE_OK;
8844+#endif
8845
8846 if (likely(prev != next)) {
8847 #ifdef CONFIG_SMP
8848+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8849+ tlbstate = percpu_read(cpu_tlbstate.state);
8850+#endif
8851 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8852 percpu_write(cpu_tlbstate.active_mm, next);
8853 #endif
8854 cpumask_set_cpu(cpu, mm_cpumask(next));
8855
8856 /* Re-load page tables */
8857+#ifdef CONFIG_PAX_PER_CPU_PGD
8858+ pax_open_kernel();
8859+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8860+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8861+ pax_close_kernel();
8862+ load_cr3(get_cpu_pgd(cpu));
8863+#else
8864 load_cr3(next->pgd);
8865+#endif
8866
8867 /* stop flush ipis for the previous mm */
8868 cpumask_clear_cpu(cpu, mm_cpumask(prev));
8869@@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8870 */
8871 if (unlikely(prev->context.ldt != next->context.ldt))
8872 load_LDT_nolock(&next->context);
8873- }
8874+
8875+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8876+ if (!(__supported_pte_mask & _PAGE_NX)) {
8877+ smp_mb__before_clear_bit();
8878+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
8879+ smp_mb__after_clear_bit();
8880+ cpu_set(cpu, next->context.cpu_user_cs_mask);
8881+ }
8882+#endif
8883+
8884+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8885+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
8886+ prev->context.user_cs_limit != next->context.user_cs_limit))
8887+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8888 #ifdef CONFIG_SMP
8889+ else if (unlikely(tlbstate != TLBSTATE_OK))
8890+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8891+#endif
8892+#endif
8893+
8894+ }
8895 else {
8896+
8897+#ifdef CONFIG_PAX_PER_CPU_PGD
8898+ pax_open_kernel();
8899+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8900+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8901+ pax_close_kernel();
8902+ load_cr3(get_cpu_pgd(cpu));
8903+#endif
8904+
8905+#ifdef CONFIG_SMP
8906 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8907 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
8908
8909@@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8910 * tlb flush IPI delivery. We must reload CR3
8911 * to make sure to use no freed page tables.
8912 */
8913+
8914+#ifndef CONFIG_PAX_PER_CPU_PGD
8915 load_cr3(next->pgd);
8916+#endif
8917+
8918 load_LDT_nolock(&next->context);
8919+
8920+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
8921+ if (!(__supported_pte_mask & _PAGE_NX))
8922+ cpu_set(cpu, next->context.cpu_user_cs_mask);
8923+#endif
8924+
8925+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8926+#ifdef CONFIG_PAX_PAGEEXEC
8927+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
8928+#endif
8929+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8930+#endif
8931+
8932 }
8933+#endif
8934 }
8935-#endif
8936 }
8937
8938 #define activate_mm(prev, next) \
8939diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
8940index 9eae775..c914fea 100644
8941--- a/arch/x86/include/asm/module.h
8942+++ b/arch/x86/include/asm/module.h
8943@@ -5,6 +5,7 @@
8944
8945 #ifdef CONFIG_X86_64
8946 /* X86_64 does not define MODULE_PROC_FAMILY */
8947+#define MODULE_PROC_FAMILY ""
8948 #elif defined CONFIG_M386
8949 #define MODULE_PROC_FAMILY "386 "
8950 #elif defined CONFIG_M486
8951@@ -59,8 +60,20 @@
8952 #error unknown processor family
8953 #endif
8954
8955-#ifdef CONFIG_X86_32
8956-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
8957+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
8958+#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
8959+#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
8960+#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
8961+#else
8962+#define MODULE_PAX_KERNEXEC ""
8963 #endif
8964
8965+#ifdef CONFIG_PAX_MEMORY_UDEREF
8966+#define MODULE_PAX_UDEREF "UDEREF "
8967+#else
8968+#define MODULE_PAX_UDEREF ""
8969+#endif
8970+
8971+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
8972+
8973 #endif /* _ASM_X86_MODULE_H */
8974diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
8975index 7639dbf..e08a58c 100644
8976--- a/arch/x86/include/asm/page_64_types.h
8977+++ b/arch/x86/include/asm/page_64_types.h
8978@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
8979
8980 /* duplicated to the one in bootmem.h */
8981 extern unsigned long max_pfn;
8982-extern unsigned long phys_base;
8983+extern const unsigned long phys_base;
8984
8985 extern unsigned long __phys_addr(unsigned long);
8986 #define __phys_reloc_hide(x) (x)
8987diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
8988index a7d2db9..edb023e 100644
8989--- a/arch/x86/include/asm/paravirt.h
8990+++ b/arch/x86/include/asm/paravirt.h
8991@@ -667,6 +667,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
8992 val);
8993 }
8994
8995+static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
8996+{
8997+ pgdval_t val = native_pgd_val(pgd);
8998+
8999+ if (sizeof(pgdval_t) > sizeof(long))
9000+ PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9001+ val, (u64)val >> 32);
9002+ else
9003+ PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9004+ val);
9005+}
9006+
9007 static inline void pgd_clear(pgd_t *pgdp)
9008 {
9009 set_pgd(pgdp, __pgd(0));
9010@@ -748,6 +760,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
9011 pv_mmu_ops.set_fixmap(idx, phys, flags);
9012 }
9013
9014+#ifdef CONFIG_PAX_KERNEXEC
9015+static inline unsigned long pax_open_kernel(void)
9016+{
9017+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9018+}
9019+
9020+static inline unsigned long pax_close_kernel(void)
9021+{
9022+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9023+}
9024+#else
9025+static inline unsigned long pax_open_kernel(void) { return 0; }
9026+static inline unsigned long pax_close_kernel(void) { return 0; }
9027+#endif
9028+
9029 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9030
9031 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
9032@@ -964,7 +991,7 @@ extern void default_banner(void);
9033
9034 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9035 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9036-#define PARA_INDIRECT(addr) *%cs:addr
9037+#define PARA_INDIRECT(addr) *%ss:addr
9038 #endif
9039
9040 #define INTERRUPT_RETURN \
9041@@ -1041,6 +1068,21 @@ extern void default_banner(void);
9042 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9043 CLBR_NONE, \
9044 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9045+
9046+#define GET_CR0_INTO_RDI \
9047+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9048+ mov %rax,%rdi
9049+
9050+#define SET_RDI_INTO_CR0 \
9051+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9052+
9053+#define GET_CR3_INTO_RDI \
9054+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9055+ mov %rax,%rdi
9056+
9057+#define SET_RDI_INTO_CR3 \
9058+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9059+
9060 #endif /* CONFIG_X86_32 */
9061
9062 #endif /* __ASSEMBLY__ */
9063diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
9064index 8e8b9a4..f07d725 100644
9065--- a/arch/x86/include/asm/paravirt_types.h
9066+++ b/arch/x86/include/asm/paravirt_types.h
9067@@ -84,20 +84,20 @@ struct pv_init_ops {
9068 */
9069 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9070 unsigned long addr, unsigned len);
9071-};
9072+} __no_const;
9073
9074
9075 struct pv_lazy_ops {
9076 /* Set deferred update mode, used for batching operations. */
9077 void (*enter)(void);
9078 void (*leave)(void);
9079-};
9080+} __no_const;
9081
9082 struct pv_time_ops {
9083 unsigned long long (*sched_clock)(void);
9084 unsigned long long (*steal_clock)(int cpu);
9085 unsigned long (*get_tsc_khz)(void);
9086-};
9087+} __no_const;
9088
9089 struct pv_cpu_ops {
9090 /* hooks for various privileged instructions */
9091@@ -193,7 +193,7 @@ struct pv_cpu_ops {
9092
9093 void (*start_context_switch)(struct task_struct *prev);
9094 void (*end_context_switch)(struct task_struct *next);
9095-};
9096+} __no_const;
9097
9098 struct pv_irq_ops {
9099 /*
9100@@ -224,7 +224,7 @@ struct pv_apic_ops {
9101 unsigned long start_eip,
9102 unsigned long start_esp);
9103 #endif
9104-};
9105+} __no_const;
9106
9107 struct pv_mmu_ops {
9108 unsigned long (*read_cr2)(void);
9109@@ -313,6 +313,7 @@ struct pv_mmu_ops {
9110 struct paravirt_callee_save make_pud;
9111
9112 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9113+ void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9114 #endif /* PAGETABLE_LEVELS == 4 */
9115 #endif /* PAGETABLE_LEVELS >= 3 */
9116
9117@@ -324,6 +325,12 @@ struct pv_mmu_ops {
9118 an mfn. We can tell which is which from the index. */
9119 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9120 phys_addr_t phys, pgprot_t flags);
9121+
9122+#ifdef CONFIG_PAX_KERNEXEC
9123+ unsigned long (*pax_open_kernel)(void);
9124+ unsigned long (*pax_close_kernel)(void);
9125+#endif
9126+
9127 };
9128
9129 struct arch_spinlock;
9130@@ -334,7 +341,7 @@ struct pv_lock_ops {
9131 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
9132 int (*spin_trylock)(struct arch_spinlock *lock);
9133 void (*spin_unlock)(struct arch_spinlock *lock);
9134-};
9135+} __no_const;
9136
9137 /* This contains all the paravirt structures: we get a convenient
9138 * number for each function using the offset which we use to indicate
9139diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
9140index b4389a4..b7ff22c 100644
9141--- a/arch/x86/include/asm/pgalloc.h
9142+++ b/arch/x86/include/asm/pgalloc.h
9143@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
9144 pmd_t *pmd, pte_t *pte)
9145 {
9146 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9147+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9148+}
9149+
9150+static inline void pmd_populate_user(struct mm_struct *mm,
9151+ pmd_t *pmd, pte_t *pte)
9152+{
9153+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9154 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9155 }
9156
9157diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
9158index 98391db..8f6984e 100644
9159--- a/arch/x86/include/asm/pgtable-2level.h
9160+++ b/arch/x86/include/asm/pgtable-2level.h
9161@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
9162
9163 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9164 {
9165+ pax_open_kernel();
9166 *pmdp = pmd;
9167+ pax_close_kernel();
9168 }
9169
9170 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9171diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
9172index effff47..f9e4035 100644
9173--- a/arch/x86/include/asm/pgtable-3level.h
9174+++ b/arch/x86/include/asm/pgtable-3level.h
9175@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9176
9177 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9178 {
9179+ pax_open_kernel();
9180 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9181+ pax_close_kernel();
9182 }
9183
9184 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9185 {
9186+ pax_open_kernel();
9187 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9188+ pax_close_kernel();
9189 }
9190
9191 /*
9192diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
9193index 18601c8..3d716d1 100644
9194--- a/arch/x86/include/asm/pgtable.h
9195+++ b/arch/x86/include/asm/pgtable.h
9196@@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9197
9198 #ifndef __PAGETABLE_PUD_FOLDED
9199 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9200+#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9201 #define pgd_clear(pgd) native_pgd_clear(pgd)
9202 #endif
9203
9204@@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9205
9206 #define arch_end_context_switch(prev) do {} while(0)
9207
9208+#define pax_open_kernel() native_pax_open_kernel()
9209+#define pax_close_kernel() native_pax_close_kernel()
9210 #endif /* CONFIG_PARAVIRT */
9211
9212+#define __HAVE_ARCH_PAX_OPEN_KERNEL
9213+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
9214+
9215+#ifdef CONFIG_PAX_KERNEXEC
9216+static inline unsigned long native_pax_open_kernel(void)
9217+{
9218+ unsigned long cr0;
9219+
9220+ preempt_disable();
9221+ barrier();
9222+ cr0 = read_cr0() ^ X86_CR0_WP;
9223+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
9224+ write_cr0(cr0);
9225+ return cr0 ^ X86_CR0_WP;
9226+}
9227+
9228+static inline unsigned long native_pax_close_kernel(void)
9229+{
9230+ unsigned long cr0;
9231+
9232+ cr0 = read_cr0() ^ X86_CR0_WP;
9233+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
9234+ write_cr0(cr0);
9235+ barrier();
9236+ preempt_enable_no_resched();
9237+ return cr0 ^ X86_CR0_WP;
9238+}
9239+#else
9240+static inline unsigned long native_pax_open_kernel(void) { return 0; }
9241+static inline unsigned long native_pax_close_kernel(void) { return 0; }
9242+#endif
9243+
9244 /*
9245 * The following only work if pte_present() is true.
9246 * Undefined behaviour if not..
9247 */
9248+static inline int pte_user(pte_t pte)
9249+{
9250+ return pte_val(pte) & _PAGE_USER;
9251+}
9252+
9253 static inline int pte_dirty(pte_t pte)
9254 {
9255 return pte_flags(pte) & _PAGE_DIRTY;
9256@@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
9257 return pte_clear_flags(pte, _PAGE_RW);
9258 }
9259
9260+static inline pte_t pte_mkread(pte_t pte)
9261+{
9262+ return __pte(pte_val(pte) | _PAGE_USER);
9263+}
9264+
9265 static inline pte_t pte_mkexec(pte_t pte)
9266 {
9267- return pte_clear_flags(pte, _PAGE_NX);
9268+#ifdef CONFIG_X86_PAE
9269+ if (__supported_pte_mask & _PAGE_NX)
9270+ return pte_clear_flags(pte, _PAGE_NX);
9271+ else
9272+#endif
9273+ return pte_set_flags(pte, _PAGE_USER);
9274+}
9275+
9276+static inline pte_t pte_exprotect(pte_t pte)
9277+{
9278+#ifdef CONFIG_X86_PAE
9279+ if (__supported_pte_mask & _PAGE_NX)
9280+ return pte_set_flags(pte, _PAGE_NX);
9281+ else
9282+#endif
9283+ return pte_clear_flags(pte, _PAGE_USER);
9284 }
9285
9286 static inline pte_t pte_mkdirty(pte_t pte)
9287@@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
9288 #endif
9289
9290 #ifndef __ASSEMBLY__
9291+
9292+#ifdef CONFIG_PAX_PER_CPU_PGD
9293+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
9294+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
9295+{
9296+ return cpu_pgd[cpu];
9297+}
9298+#endif
9299+
9300 #include <linux/mm_types.h>
9301
9302 static inline int pte_none(pte_t pte)
9303@@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
9304
9305 static inline int pgd_bad(pgd_t pgd)
9306 {
9307- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
9308+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
9309 }
9310
9311 static inline int pgd_none(pgd_t pgd)
9312@@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
9313 * pgd_offset() returns a (pgd_t *)
9314 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
9315 */
9316-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
9317+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
9318+
9319+#ifdef CONFIG_PAX_PER_CPU_PGD
9320+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
9321+#endif
9322+
9323 /*
9324 * a shortcut which implies the use of the kernel's pgd, instead
9325 * of a process's
9326@@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
9327 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
9328 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
9329
9330+#ifdef CONFIG_X86_32
9331+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
9332+#else
9333+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
9334+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
9335+
9336+#ifdef CONFIG_PAX_MEMORY_UDEREF
9337+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
9338+#else
9339+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
9340+#endif
9341+
9342+#endif
9343+
9344 #ifndef __ASSEMBLY__
9345
9346 extern int direct_gbpages;
9347@@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
9348 * dst and src can be on the same page, but the range must not overlap,
9349 * and must not cross a page boundary.
9350 */
9351-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
9352+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
9353 {
9354- memcpy(dst, src, count * sizeof(pgd_t));
9355+ pax_open_kernel();
9356+ while (count--)
9357+ *dst++ = *src++;
9358+ pax_close_kernel();
9359 }
9360
9361+#ifdef CONFIG_PAX_PER_CPU_PGD
9362+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9363+#endif
9364+
9365+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9366+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9367+#else
9368+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
9369+#endif
9370
9371 #include <asm-generic/pgtable.h>
9372 #endif /* __ASSEMBLY__ */
9373diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
9374index 0c92113..34a77c6 100644
9375--- a/arch/x86/include/asm/pgtable_32.h
9376+++ b/arch/x86/include/asm/pgtable_32.h
9377@@ -25,9 +25,6 @@
9378 struct mm_struct;
9379 struct vm_area_struct;
9380
9381-extern pgd_t swapper_pg_dir[1024];
9382-extern pgd_t initial_page_table[1024];
9383-
9384 static inline void pgtable_cache_init(void) { }
9385 static inline void check_pgt_cache(void) { }
9386 void paging_init(void);
9387@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9388 # include <asm/pgtable-2level.h>
9389 #endif
9390
9391+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9392+extern pgd_t initial_page_table[PTRS_PER_PGD];
9393+#ifdef CONFIG_X86_PAE
9394+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9395+#endif
9396+
9397 #if defined(CONFIG_HIGHPTE)
9398 #define pte_offset_map(dir, address) \
9399 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
9400@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9401 /* Clear a kernel PTE and flush it from the TLB */
9402 #define kpte_clear_flush(ptep, vaddr) \
9403 do { \
9404+ pax_open_kernel(); \
9405 pte_clear(&init_mm, (vaddr), (ptep)); \
9406+ pax_close_kernel(); \
9407 __flush_tlb_one((vaddr)); \
9408 } while (0)
9409
9410@@ -74,6 +79,9 @@ do { \
9411
9412 #endif /* !__ASSEMBLY__ */
9413
9414+#define HAVE_ARCH_UNMAPPED_AREA
9415+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9416+
9417 /*
9418 * kern_addr_valid() is (1) for FLATMEM and (0) for
9419 * SPARSEMEM and DISCONTIGMEM
9420diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
9421index ed5903b..c7fe163 100644
9422--- a/arch/x86/include/asm/pgtable_32_types.h
9423+++ b/arch/x86/include/asm/pgtable_32_types.h
9424@@ -8,7 +8,7 @@
9425 */
9426 #ifdef CONFIG_X86_PAE
9427 # include <asm/pgtable-3level_types.h>
9428-# define PMD_SIZE (1UL << PMD_SHIFT)
9429+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9430 # define PMD_MASK (~(PMD_SIZE - 1))
9431 #else
9432 # include <asm/pgtable-2level_types.h>
9433@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
9434 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9435 #endif
9436
9437+#ifdef CONFIG_PAX_KERNEXEC
9438+#ifndef __ASSEMBLY__
9439+extern unsigned char MODULES_EXEC_VADDR[];
9440+extern unsigned char MODULES_EXEC_END[];
9441+#endif
9442+#include <asm/boot.h>
9443+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9444+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9445+#else
9446+#define ktla_ktva(addr) (addr)
9447+#define ktva_ktla(addr) (addr)
9448+#endif
9449+
9450 #define MODULES_VADDR VMALLOC_START
9451 #define MODULES_END VMALLOC_END
9452 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9453diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
9454index 975f709..107976d 100644
9455--- a/arch/x86/include/asm/pgtable_64.h
9456+++ b/arch/x86/include/asm/pgtable_64.h
9457@@ -16,10 +16,14 @@
9458
9459 extern pud_t level3_kernel_pgt[512];
9460 extern pud_t level3_ident_pgt[512];
9461+extern pud_t level3_vmalloc_start_pgt[512];
9462+extern pud_t level3_vmalloc_end_pgt[512];
9463+extern pud_t level3_vmemmap_pgt[512];
9464+extern pud_t level2_vmemmap_pgt[512];
9465 extern pmd_t level2_kernel_pgt[512];
9466 extern pmd_t level2_fixmap_pgt[512];
9467-extern pmd_t level2_ident_pgt[512];
9468-extern pgd_t init_level4_pgt[];
9469+extern pmd_t level2_ident_pgt[512*2];
9470+extern pgd_t init_level4_pgt[512];
9471
9472 #define swapper_pg_dir init_level4_pgt
9473
9474@@ -61,7 +65,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9475
9476 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9477 {
9478+ pax_open_kernel();
9479 *pmdp = pmd;
9480+ pax_close_kernel();
9481 }
9482
9483 static inline void native_pmd_clear(pmd_t *pmd)
9484@@ -107,6 +113,13 @@ static inline void native_pud_clear(pud_t *pud)
9485
9486 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9487 {
9488+ pax_open_kernel();
9489+ *pgdp = pgd;
9490+ pax_close_kernel();
9491+}
9492+
9493+static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9494+{
9495 *pgdp = pgd;
9496 }
9497
9498diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
9499index 766ea16..5b96cb3 100644
9500--- a/arch/x86/include/asm/pgtable_64_types.h
9501+++ b/arch/x86/include/asm/pgtable_64_types.h
9502@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9503 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9504 #define MODULES_END _AC(0xffffffffff000000, UL)
9505 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9506+#define MODULES_EXEC_VADDR MODULES_VADDR
9507+#define MODULES_EXEC_END MODULES_END
9508+
9509+#define ktla_ktva(addr) (addr)
9510+#define ktva_ktla(addr) (addr)
9511
9512 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9513diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
9514index 013286a..8b42f4f 100644
9515--- a/arch/x86/include/asm/pgtable_types.h
9516+++ b/arch/x86/include/asm/pgtable_types.h
9517@@ -16,13 +16,12 @@
9518 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
9519 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
9520 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
9521-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
9522+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
9523 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
9524 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
9525 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
9526-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
9527-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
9528-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
9529+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
9530+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
9531 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
9532
9533 /* If _PAGE_BIT_PRESENT is clear, we use these: */
9534@@ -40,7 +39,6 @@
9535 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
9536 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
9537 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
9538-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
9539 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
9540 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
9541 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
9542@@ -57,8 +55,10 @@
9543
9544 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
9545 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
9546-#else
9547+#elif defined(CONFIG_KMEMCHECK)
9548 #define _PAGE_NX (_AT(pteval_t, 0))
9549+#else
9550+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
9551 #endif
9552
9553 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
9554@@ -96,6 +96,9 @@
9555 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
9556 _PAGE_ACCESSED)
9557
9558+#define PAGE_READONLY_NOEXEC PAGE_READONLY
9559+#define PAGE_SHARED_NOEXEC PAGE_SHARED
9560+
9561 #define __PAGE_KERNEL_EXEC \
9562 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
9563 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
9564@@ -106,7 +109,7 @@
9565 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
9566 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
9567 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
9568-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
9569+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
9570 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
9571 #define __PAGE_KERNEL_VVAR_NOCACHE (__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
9572 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
9573@@ -168,8 +171,8 @@
9574 * bits are combined, this will alow user to access the high address mapped
9575 * VDSO in the presence of CONFIG_COMPAT_VDSO
9576 */
9577-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
9578-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
9579+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9580+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9581 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
9582 #endif
9583
9584@@ -207,7 +210,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
9585 {
9586 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
9587 }
9588+#endif
9589
9590+#if PAGETABLE_LEVELS == 3
9591+#include <asm-generic/pgtable-nopud.h>
9592+#endif
9593+
9594+#if PAGETABLE_LEVELS == 2
9595+#include <asm-generic/pgtable-nopmd.h>
9596+#endif
9597+
9598+#ifndef __ASSEMBLY__
9599 #if PAGETABLE_LEVELS > 3
9600 typedef struct { pudval_t pud; } pud_t;
9601
9602@@ -221,8 +234,6 @@ static inline pudval_t native_pud_val(pud_t pud)
9603 return pud.pud;
9604 }
9605 #else
9606-#include <asm-generic/pgtable-nopud.h>
9607-
9608 static inline pudval_t native_pud_val(pud_t pud)
9609 {
9610 return native_pgd_val(pud.pgd);
9611@@ -242,8 +253,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
9612 return pmd.pmd;
9613 }
9614 #else
9615-#include <asm-generic/pgtable-nopmd.h>
9616-
9617 static inline pmdval_t native_pmd_val(pmd_t pmd)
9618 {
9619 return native_pgd_val(pmd.pud.pgd);
9620@@ -283,7 +292,6 @@ typedef struct page *pgtable_t;
9621
9622 extern pteval_t __supported_pte_mask;
9623 extern void set_nx(void);
9624-extern int nx_enabled;
9625
9626 #define pgprot_writecombine pgprot_writecombine
9627 extern pgprot_t pgprot_writecombine(pgprot_t prot);
9628diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
9629index 0d1171c..36571a9 100644
9630--- a/arch/x86/include/asm/processor.h
9631+++ b/arch/x86/include/asm/processor.h
9632@@ -266,7 +266,7 @@ struct tss_struct {
9633
9634 } ____cacheline_aligned;
9635
9636-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
9637+extern struct tss_struct init_tss[NR_CPUS];
9638
9639 /*
9640 * Save the original ist values for checking stack pointers during debugging
9641@@ -858,11 +858,18 @@ static inline void spin_lock_prefetch(const void *x)
9642 */
9643 #define TASK_SIZE PAGE_OFFSET
9644 #define TASK_SIZE_MAX TASK_SIZE
9645+
9646+#ifdef CONFIG_PAX_SEGMEXEC
9647+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
9648+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
9649+#else
9650 #define STACK_TOP TASK_SIZE
9651-#define STACK_TOP_MAX STACK_TOP
9652+#endif
9653+
9654+#define STACK_TOP_MAX TASK_SIZE
9655
9656 #define INIT_THREAD { \
9657- .sp0 = sizeof(init_stack) + (long)&init_stack, \
9658+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9659 .vm86_info = NULL, \
9660 .sysenter_cs = __KERNEL_CS, \
9661 .io_bitmap_ptr = NULL, \
9662@@ -876,7 +883,7 @@ static inline void spin_lock_prefetch(const void *x)
9663 */
9664 #define INIT_TSS { \
9665 .x86_tss = { \
9666- .sp0 = sizeof(init_stack) + (long)&init_stack, \
9667+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9668 .ss0 = __KERNEL_DS, \
9669 .ss1 = __KERNEL_CS, \
9670 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
9671@@ -887,11 +894,7 @@ static inline void spin_lock_prefetch(const void *x)
9672 extern unsigned long thread_saved_pc(struct task_struct *tsk);
9673
9674 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
9675-#define KSTK_TOP(info) \
9676-({ \
9677- unsigned long *__ptr = (unsigned long *)(info); \
9678- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
9679-})
9680+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
9681
9682 /*
9683 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
9684@@ -906,7 +909,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9685 #define task_pt_regs(task) \
9686 ({ \
9687 struct pt_regs *__regs__; \
9688- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
9689+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
9690 __regs__ - 1; \
9691 })
9692
9693@@ -916,13 +919,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9694 /*
9695 * User space process size. 47bits minus one guard page.
9696 */
9697-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
9698+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
9699
9700 /* This decides where the kernel will search for a free chunk of vm
9701 * space during mmap's.
9702 */
9703 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
9704- 0xc0000000 : 0xFFFFe000)
9705+ 0xc0000000 : 0xFFFFf000)
9706
9707 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
9708 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
9709@@ -933,11 +936,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9710 #define STACK_TOP_MAX TASK_SIZE_MAX
9711
9712 #define INIT_THREAD { \
9713- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9714+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9715 }
9716
9717 #define INIT_TSS { \
9718- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9719+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9720 }
9721
9722 /*
9723@@ -959,6 +962,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
9724 */
9725 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
9726
9727+#ifdef CONFIG_PAX_SEGMEXEC
9728+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
9729+#endif
9730+
9731 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
9732
9733 /* Get/set a process' ability to use the timestamp counter instruction */
9734diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
9735index 3566454..4bdfb8c 100644
9736--- a/arch/x86/include/asm/ptrace.h
9737+++ b/arch/x86/include/asm/ptrace.h
9738@@ -156,28 +156,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
9739 }
9740
9741 /*
9742- * user_mode_vm(regs) determines whether a register set came from user mode.
9743+ * user_mode(regs) determines whether a register set came from user mode.
9744 * This is true if V8086 mode was enabled OR if the register set was from
9745 * protected mode with RPL-3 CS value. This tricky test checks that with
9746 * one comparison. Many places in the kernel can bypass this full check
9747- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
9748+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
9749+ * be used.
9750 */
9751-static inline int user_mode(struct pt_regs *regs)
9752+static inline int user_mode_novm(struct pt_regs *regs)
9753 {
9754 #ifdef CONFIG_X86_32
9755 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
9756 #else
9757- return !!(regs->cs & 3);
9758+ return !!(regs->cs & SEGMENT_RPL_MASK);
9759 #endif
9760 }
9761
9762-static inline int user_mode_vm(struct pt_regs *regs)
9763+static inline int user_mode(struct pt_regs *regs)
9764 {
9765 #ifdef CONFIG_X86_32
9766 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
9767 USER_RPL;
9768 #else
9769- return user_mode(regs);
9770+ return user_mode_novm(regs);
9771 #endif
9772 }
9773
9774@@ -193,15 +194,16 @@ static inline int v8086_mode(struct pt_regs *regs)
9775 #ifdef CONFIG_X86_64
9776 static inline bool user_64bit_mode(struct pt_regs *regs)
9777 {
9778+ unsigned long cs = regs->cs & 0xffff;
9779 #ifndef CONFIG_PARAVIRT
9780 /*
9781 * On non-paravirt systems, this is the only long mode CPL 3
9782 * selector. We do not allow long mode selectors in the LDT.
9783 */
9784- return regs->cs == __USER_CS;
9785+ return cs == __USER_CS;
9786 #else
9787 /* Headers are too twisted for this to go in paravirt.h. */
9788- return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
9789+ return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
9790 #endif
9791 }
9792 #endif
9793diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
9794index 3250e3d..20db631 100644
9795--- a/arch/x86/include/asm/reboot.h
9796+++ b/arch/x86/include/asm/reboot.h
9797@@ -6,19 +6,19 @@
9798 struct pt_regs;
9799
9800 struct machine_ops {
9801- void (*restart)(char *cmd);
9802- void (*halt)(void);
9803- void (*power_off)(void);
9804+ void (* __noreturn restart)(char *cmd);
9805+ void (* __noreturn halt)(void);
9806+ void (* __noreturn power_off)(void);
9807 void (*shutdown)(void);
9808 void (*crash_shutdown)(struct pt_regs *);
9809- void (*emergency_restart)(void);
9810-};
9811+ void (* __noreturn emergency_restart)(void);
9812+} __no_const;
9813
9814 extern struct machine_ops machine_ops;
9815
9816 void native_machine_crash_shutdown(struct pt_regs *regs);
9817 void native_machine_shutdown(void);
9818-void machine_real_restart(unsigned int type);
9819+void machine_real_restart(unsigned int type) __noreturn;
9820 /* These must match dispatch_table in reboot_32.S */
9821 #define MRR_BIOS 0
9822 #define MRR_APM 1
9823diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
9824index df4cd32..27ae072 100644
9825--- a/arch/x86/include/asm/rwsem.h
9826+++ b/arch/x86/include/asm/rwsem.h
9827@@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
9828 {
9829 asm volatile("# beginning down_read\n\t"
9830 LOCK_PREFIX _ASM_INC "(%1)\n\t"
9831+
9832+#ifdef CONFIG_PAX_REFCOUNT
9833+ "jno 0f\n"
9834+ LOCK_PREFIX _ASM_DEC "(%1)\n"
9835+ "int $4\n0:\n"
9836+ _ASM_EXTABLE(0b, 0b)
9837+#endif
9838+
9839 /* adds 0x00000001 */
9840 " jns 1f\n"
9841 " call call_rwsem_down_read_failed\n"
9842@@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
9843 "1:\n\t"
9844 " mov %1,%2\n\t"
9845 " add %3,%2\n\t"
9846+
9847+#ifdef CONFIG_PAX_REFCOUNT
9848+ "jno 0f\n"
9849+ "sub %3,%2\n"
9850+ "int $4\n0:\n"
9851+ _ASM_EXTABLE(0b, 0b)
9852+#endif
9853+
9854 " jle 2f\n\t"
9855 LOCK_PREFIX " cmpxchg %2,%0\n\t"
9856 " jnz 1b\n\t"
9857@@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
9858 long tmp;
9859 asm volatile("# beginning down_write\n\t"
9860 LOCK_PREFIX " xadd %1,(%2)\n\t"
9861+
9862+#ifdef CONFIG_PAX_REFCOUNT
9863+ "jno 0f\n"
9864+ "mov %1,(%2)\n"
9865+ "int $4\n0:\n"
9866+ _ASM_EXTABLE(0b, 0b)
9867+#endif
9868+
9869 /* adds 0xffff0001, returns the old value */
9870 " test %1,%1\n\t"
9871 /* was the count 0 before? */
9872@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_semaphore *sem)
9873 long tmp;
9874 asm volatile("# beginning __up_read\n\t"
9875 LOCK_PREFIX " xadd %1,(%2)\n\t"
9876+
9877+#ifdef CONFIG_PAX_REFCOUNT
9878+ "jno 0f\n"
9879+ "mov %1,(%2)\n"
9880+ "int $4\n0:\n"
9881+ _ASM_EXTABLE(0b, 0b)
9882+#endif
9883+
9884 /* subtracts 1, returns the old value */
9885 " jns 1f\n\t"
9886 " call call_rwsem_wake\n" /* expects old value in %edx */
9887@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_semaphore *sem)
9888 long tmp;
9889 asm volatile("# beginning __up_write\n\t"
9890 LOCK_PREFIX " xadd %1,(%2)\n\t"
9891+
9892+#ifdef CONFIG_PAX_REFCOUNT
9893+ "jno 0f\n"
9894+ "mov %1,(%2)\n"
9895+ "int $4\n0:\n"
9896+ _ASM_EXTABLE(0b, 0b)
9897+#endif
9898+
9899 /* subtracts 0xffff0001, returns the old value */
9900 " jns 1f\n\t"
9901 " call call_rwsem_wake\n" /* expects old value in %edx */
9902@@ -176,6 +216,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9903 {
9904 asm volatile("# beginning __downgrade_write\n\t"
9905 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
9906+
9907+#ifdef CONFIG_PAX_REFCOUNT
9908+ "jno 0f\n"
9909+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
9910+ "int $4\n0:\n"
9911+ _ASM_EXTABLE(0b, 0b)
9912+#endif
9913+
9914 /*
9915 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
9916 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
9917@@ -194,7 +242,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9918 */
9919 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
9920 {
9921- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
9922+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
9923+
9924+#ifdef CONFIG_PAX_REFCOUNT
9925+ "jno 0f\n"
9926+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
9927+ "int $4\n0:\n"
9928+ _ASM_EXTABLE(0b, 0b)
9929+#endif
9930+
9931 : "+m" (sem->count)
9932 : "er" (delta));
9933 }
9934@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
9935 {
9936 long tmp = delta;
9937
9938- asm volatile(LOCK_PREFIX "xadd %0,%1"
9939+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
9940+
9941+#ifdef CONFIG_PAX_REFCOUNT
9942+ "jno 0f\n"
9943+ "mov %0,%1\n"
9944+ "int $4\n0:\n"
9945+ _ASM_EXTABLE(0b, 0b)
9946+#endif
9947+
9948 : "+r" (tmp), "+m" (sem->count)
9949 : : "memory");
9950
9951diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
9952index 5e64171..f58957e 100644
9953--- a/arch/x86/include/asm/segment.h
9954+++ b/arch/x86/include/asm/segment.h
9955@@ -64,10 +64,15 @@
9956 * 26 - ESPFIX small SS
9957 * 27 - per-cpu [ offset to per-cpu data area ]
9958 * 28 - stack_canary-20 [ for stack protector ]
9959- * 29 - unused
9960- * 30 - unused
9961+ * 29 - PCI BIOS CS
9962+ * 30 - PCI BIOS DS
9963 * 31 - TSS for double fault handler
9964 */
9965+#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
9966+#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
9967+#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
9968+#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
9969+
9970 #define GDT_ENTRY_TLS_MIN 6
9971 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
9972
9973@@ -79,6 +84,8 @@
9974
9975 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
9976
9977+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
9978+
9979 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
9980
9981 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
9982@@ -104,6 +111,12 @@
9983 #define __KERNEL_STACK_CANARY 0
9984 #endif
9985
9986+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
9987+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
9988+
9989+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
9990+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
9991+
9992 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
9993
9994 /*
9995@@ -141,7 +154,7 @@
9996 */
9997
9998 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
9999-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10000+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10001
10002
10003 #else
10004@@ -165,6 +178,8 @@
10005 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8+3)
10006 #define __USER32_DS __USER_DS
10007
10008+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10009+
10010 #define GDT_ENTRY_TSS 8 /* needs two entries */
10011 #define GDT_ENTRY_LDT 10 /* needs two entries */
10012 #define GDT_ENTRY_TLS_MIN 12
10013@@ -185,6 +200,7 @@
10014 #endif
10015
10016 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
10017+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
10018 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
10019 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
10020 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
10021diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
10022index 73b11bc..d4a3b63 100644
10023--- a/arch/x86/include/asm/smp.h
10024+++ b/arch/x86/include/asm/smp.h
10025@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10026 /* cpus sharing the last level cache: */
10027 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
10028 DECLARE_PER_CPU(u16, cpu_llc_id);
10029-DECLARE_PER_CPU(int, cpu_number);
10030+DECLARE_PER_CPU(unsigned int, cpu_number);
10031
10032 static inline struct cpumask *cpu_sibling_mask(int cpu)
10033 {
10034@@ -77,7 +77,7 @@ struct smp_ops {
10035
10036 void (*send_call_func_ipi)(const struct cpumask *mask);
10037 void (*send_call_func_single_ipi)(int cpu);
10038-};
10039+} __no_const;
10040
10041 /* Globals due to paravirt */
10042 extern void set_cpu_sibling_map(int cpu);
10043@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitdata;
10044 extern int safe_smp_processor_id(void);
10045
10046 #elif defined(CONFIG_X86_64_SMP)
10047-#define raw_smp_processor_id() (percpu_read(cpu_number))
10048-
10049-#define stack_smp_processor_id() \
10050-({ \
10051- struct thread_info *ti; \
10052- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10053- ti->cpu; \
10054-})
10055+#define raw_smp_processor_id() (percpu_read(cpu_number))
10056+#define stack_smp_processor_id() raw_smp_processor_id()
10057 #define safe_smp_processor_id() smp_processor_id()
10058
10059 #endif
10060diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
10061index ee67edf..49c796b 100644
10062--- a/arch/x86/include/asm/spinlock.h
10063+++ b/arch/x86/include/asm/spinlock.h
10064@@ -248,6 +248,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock)
10065 static inline void arch_read_lock(arch_rwlock_t *rw)
10066 {
10067 asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t"
10068+
10069+#ifdef CONFIG_PAX_REFCOUNT
10070+ "jno 0f\n"
10071+ LOCK_PREFIX READ_LOCK_SIZE(inc) " (%0)\n"
10072+ "int $4\n0:\n"
10073+ _ASM_EXTABLE(0b, 0b)
10074+#endif
10075+
10076 "jns 1f\n"
10077 "call __read_lock_failed\n\t"
10078 "1:\n"
10079@@ -257,6 +265,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
10080 static inline void arch_write_lock(arch_rwlock_t *rw)
10081 {
10082 asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t"
10083+
10084+#ifdef CONFIG_PAX_REFCOUNT
10085+ "jno 0f\n"
10086+ LOCK_PREFIX WRITE_LOCK_ADD(%1) "(%0)\n"
10087+ "int $4\n0:\n"
10088+ _ASM_EXTABLE(0b, 0b)
10089+#endif
10090+
10091 "jz 1f\n"
10092 "call __write_lock_failed\n\t"
10093 "1:\n"
10094@@ -286,13 +302,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
10095
10096 static inline void arch_read_unlock(arch_rwlock_t *rw)
10097 {
10098- asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0"
10099+ asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0\n"
10100+
10101+#ifdef CONFIG_PAX_REFCOUNT
10102+ "jno 0f\n"
10103+ LOCK_PREFIX READ_LOCK_SIZE(dec) " %0\n"
10104+ "int $4\n0:\n"
10105+ _ASM_EXTABLE(0b, 0b)
10106+#endif
10107+
10108 :"+m" (rw->lock) : : "memory");
10109 }
10110
10111 static inline void arch_write_unlock(arch_rwlock_t *rw)
10112 {
10113- asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0"
10114+ asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0\n"
10115+
10116+#ifdef CONFIG_PAX_REFCOUNT
10117+ "jno 0f\n"
10118+ LOCK_PREFIX WRITE_LOCK_SUB(%1) "%0\n"
10119+ "int $4\n0:\n"
10120+ _ASM_EXTABLE(0b, 0b)
10121+#endif
10122+
10123 : "+m" (rw->write) : "i" (RW_LOCK_BIAS) : "memory");
10124 }
10125
10126diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
10127index 1575177..cb23f52 100644
10128--- a/arch/x86/include/asm/stackprotector.h
10129+++ b/arch/x86/include/asm/stackprotector.h
10130@@ -48,7 +48,7 @@
10131 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10132 */
10133 #define GDT_STACK_CANARY_INIT \
10134- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10135+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10136
10137 /*
10138 * Initialize the stackprotector canary value.
10139@@ -113,7 +113,7 @@ static inline void setup_stack_canary_segment(int cpu)
10140
10141 static inline void load_stack_canary_segment(void)
10142 {
10143-#ifdef CONFIG_X86_32
10144+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10145 asm volatile ("mov %0, %%gs" : : "r" (0));
10146 #endif
10147 }
10148diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
10149index 70bbe39..4ae2bd4 100644
10150--- a/arch/x86/include/asm/stacktrace.h
10151+++ b/arch/x86/include/asm/stacktrace.h
10152@@ -11,28 +11,20 @@
10153
10154 extern int kstack_depth_to_print;
10155
10156-struct thread_info;
10157+struct task_struct;
10158 struct stacktrace_ops;
10159
10160-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
10161- unsigned long *stack,
10162- unsigned long bp,
10163- const struct stacktrace_ops *ops,
10164- void *data,
10165- unsigned long *end,
10166- int *graph);
10167+typedef unsigned long walk_stack_t(struct task_struct *task,
10168+ void *stack_start,
10169+ unsigned long *stack,
10170+ unsigned long bp,
10171+ const struct stacktrace_ops *ops,
10172+ void *data,
10173+ unsigned long *end,
10174+ int *graph);
10175
10176-extern unsigned long
10177-print_context_stack(struct thread_info *tinfo,
10178- unsigned long *stack, unsigned long bp,
10179- const struct stacktrace_ops *ops, void *data,
10180- unsigned long *end, int *graph);
10181-
10182-extern unsigned long
10183-print_context_stack_bp(struct thread_info *tinfo,
10184- unsigned long *stack, unsigned long bp,
10185- const struct stacktrace_ops *ops, void *data,
10186- unsigned long *end, int *graph);
10187+extern walk_stack_t print_context_stack;
10188+extern walk_stack_t print_context_stack_bp;
10189
10190 /* Generic stack tracer with callbacks */
10191
10192@@ -40,7 +32,7 @@ struct stacktrace_ops {
10193 void (*address)(void *data, unsigned long address, int reliable);
10194 /* On negative return stop dumping */
10195 int (*stack)(void *data, char *name);
10196- walk_stack_t walk_stack;
10197+ walk_stack_t *walk_stack;
10198 };
10199
10200 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
10201diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
10202index cb23852..2dde194 100644
10203--- a/arch/x86/include/asm/sys_ia32.h
10204+++ b/arch/x86/include/asm/sys_ia32.h
10205@@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int, compat_sigset_t __user *,
10206 compat_sigset_t __user *, unsigned int);
10207 asmlinkage long sys32_alarm(unsigned int);
10208
10209-asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
10210+asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
10211 asmlinkage long sys32_sysfs(int, u32, u32);
10212
10213 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
10214diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
10215index 2d2f01c..f985723 100644
10216--- a/arch/x86/include/asm/system.h
10217+++ b/arch/x86/include/asm/system.h
10218@@ -129,7 +129,7 @@ do { \
10219 "call __switch_to\n\t" \
10220 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10221 __switch_canary \
10222- "movq %P[thread_info](%%rsi),%%r8\n\t" \
10223+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10224 "movq %%rax,%%rdi\n\t" \
10225 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10226 "jnz ret_from_fork\n\t" \
10227@@ -140,7 +140,7 @@ do { \
10228 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10229 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10230 [_tif_fork] "i" (_TIF_FORK), \
10231- [thread_info] "i" (offsetof(struct task_struct, stack)), \
10232+ [thread_info] "m" (current_tinfo), \
10233 [current_task] "m" (current_task) \
10234 __switch_canary_iparam \
10235 : "memory", "cc" __EXTRA_CLOBBER)
10236@@ -200,7 +200,7 @@ static inline unsigned long get_limit(unsigned long segment)
10237 {
10238 unsigned long __limit;
10239 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10240- return __limit + 1;
10241+ return __limit;
10242 }
10243
10244 static inline void native_clts(void)
10245@@ -397,13 +397,13 @@ void enable_hlt(void);
10246
10247 void cpu_idle_wait(void);
10248
10249-extern unsigned long arch_align_stack(unsigned long sp);
10250+#define arch_align_stack(x) ((x) & ~0xfUL)
10251 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10252
10253 void default_idle(void);
10254 bool set_pm_idle_to_default(void);
10255
10256-void stop_this_cpu(void *dummy);
10257+void stop_this_cpu(void *dummy) __noreturn;
10258
10259 /*
10260 * Force strict CPU ordering.
10261diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
10262index a1fe5c1..ee326d8 100644
10263--- a/arch/x86/include/asm/thread_info.h
10264+++ b/arch/x86/include/asm/thread_info.h
10265@@ -10,6 +10,7 @@
10266 #include <linux/compiler.h>
10267 #include <asm/page.h>
10268 #include <asm/types.h>
10269+#include <asm/percpu.h>
10270
10271 /*
10272 * low level task data that entry.S needs immediate access to
10273@@ -24,7 +25,6 @@ struct exec_domain;
10274 #include <linux/atomic.h>
10275
10276 struct thread_info {
10277- struct task_struct *task; /* main task structure */
10278 struct exec_domain *exec_domain; /* execution domain */
10279 __u32 flags; /* low level flags */
10280 __u32 status; /* thread synchronous flags */
10281@@ -34,18 +34,12 @@ struct thread_info {
10282 mm_segment_t addr_limit;
10283 struct restart_block restart_block;
10284 void __user *sysenter_return;
10285-#ifdef CONFIG_X86_32
10286- unsigned long previous_esp; /* ESP of the previous stack in
10287- case of nested (IRQ) stacks
10288- */
10289- __u8 supervisor_stack[0];
10290-#endif
10291+ unsigned long lowest_stack;
10292 int uaccess_err;
10293 };
10294
10295-#define INIT_THREAD_INFO(tsk) \
10296+#define INIT_THREAD_INFO \
10297 { \
10298- .task = &tsk, \
10299 .exec_domain = &default_exec_domain, \
10300 .flags = 0, \
10301 .cpu = 0, \
10302@@ -56,7 +50,7 @@ struct thread_info {
10303 }, \
10304 }
10305
10306-#define init_thread_info (init_thread_union.thread_info)
10307+#define init_thread_info (init_thread_union.stack)
10308 #define init_stack (init_thread_union.stack)
10309
10310 #else /* !__ASSEMBLY__ */
10311@@ -170,45 +164,40 @@ struct thread_info {
10312 ret; \
10313 })
10314
10315-#ifdef CONFIG_X86_32
10316-
10317-#define STACK_WARN (THREAD_SIZE/8)
10318-/*
10319- * macros/functions for gaining access to the thread information structure
10320- *
10321- * preempt_count needs to be 1 initially, until the scheduler is functional.
10322- */
10323-#ifndef __ASSEMBLY__
10324-
10325-
10326-/* how to get the current stack pointer from C */
10327-register unsigned long current_stack_pointer asm("esp") __used;
10328-
10329-/* how to get the thread information struct from C */
10330-static inline struct thread_info *current_thread_info(void)
10331-{
10332- return (struct thread_info *)
10333- (current_stack_pointer & ~(THREAD_SIZE - 1));
10334-}
10335-
10336-#else /* !__ASSEMBLY__ */
10337-
10338+#ifdef __ASSEMBLY__
10339 /* how to get the thread information struct from ASM */
10340 #define GET_THREAD_INFO(reg) \
10341- movl $-THREAD_SIZE, reg; \
10342- andl %esp, reg
10343+ mov PER_CPU_VAR(current_tinfo), reg
10344
10345 /* use this one if reg already contains %esp */
10346-#define GET_THREAD_INFO_WITH_ESP(reg) \
10347- andl $-THREAD_SIZE, reg
10348+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10349+#else
10350+/* how to get the thread information struct from C */
10351+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10352+
10353+static __always_inline struct thread_info *current_thread_info(void)
10354+{
10355+ return percpu_read_stable(current_tinfo);
10356+}
10357+#endif
10358+
10359+#ifdef CONFIG_X86_32
10360+
10361+#define STACK_WARN (THREAD_SIZE/8)
10362+/*
10363+ * macros/functions for gaining access to the thread information structure
10364+ *
10365+ * preempt_count needs to be 1 initially, until the scheduler is functional.
10366+ */
10367+#ifndef __ASSEMBLY__
10368+
10369+/* how to get the current stack pointer from C */
10370+register unsigned long current_stack_pointer asm("esp") __used;
10371
10372 #endif
10373
10374 #else /* X86_32 */
10375
10376-#include <asm/percpu.h>
10377-#define KERNEL_STACK_OFFSET (5*8)
10378-
10379 /*
10380 * macros/functions for gaining access to the thread information structure
10381 * preempt_count needs to be 1 initially, until the scheduler is functional.
10382@@ -216,21 +205,8 @@ static inline struct thread_info *current_thread_info(void)
10383 #ifndef __ASSEMBLY__
10384 DECLARE_PER_CPU(unsigned long, kernel_stack);
10385
10386-static inline struct thread_info *current_thread_info(void)
10387-{
10388- struct thread_info *ti;
10389- ti = (void *)(percpu_read_stable(kernel_stack) +
10390- KERNEL_STACK_OFFSET - THREAD_SIZE);
10391- return ti;
10392-}
10393-
10394-#else /* !__ASSEMBLY__ */
10395-
10396-/* how to get the thread information struct from ASM */
10397-#define GET_THREAD_INFO(reg) \
10398- movq PER_CPU_VAR(kernel_stack),reg ; \
10399- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10400-
10401+/* how to get the current stack pointer from C */
10402+register unsigned long current_stack_pointer asm("rsp") __used;
10403 #endif
10404
10405 #endif /* !X86_32 */
10406@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
10407 extern void free_thread_info(struct thread_info *ti);
10408 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10409 #define arch_task_cache_init arch_task_cache_init
10410+
10411+#define __HAVE_THREAD_FUNCTIONS
10412+#define task_thread_info(task) (&(task)->tinfo)
10413+#define task_stack_page(task) ((task)->stack)
10414+#define setup_thread_stack(p, org) do {} while (0)
10415+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10416+
10417+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10418+extern struct task_struct *alloc_task_struct_node(int node);
10419+extern void free_task_struct(struct task_struct *);
10420+
10421 #endif
10422 #endif /* _ASM_X86_THREAD_INFO_H */
10423diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
10424index 36361bf..324f262 100644
10425--- a/arch/x86/include/asm/uaccess.h
10426+++ b/arch/x86/include/asm/uaccess.h
10427@@ -7,12 +7,15 @@
10428 #include <linux/compiler.h>
10429 #include <linux/thread_info.h>
10430 #include <linux/string.h>
10431+#include <linux/sched.h>
10432 #include <asm/asm.h>
10433 #include <asm/page.h>
10434
10435 #define VERIFY_READ 0
10436 #define VERIFY_WRITE 1
10437
10438+extern void check_object_size(const void *ptr, unsigned long n, bool to);
10439+
10440 /*
10441 * The fs value determines whether argument validity checking should be
10442 * performed or not. If get_fs() == USER_DS, checking is performed, with
10443@@ -28,7 +31,12 @@
10444
10445 #define get_ds() (KERNEL_DS)
10446 #define get_fs() (current_thread_info()->addr_limit)
10447+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10448+void __set_fs(mm_segment_t x);
10449+void set_fs(mm_segment_t x);
10450+#else
10451 #define set_fs(x) (current_thread_info()->addr_limit = (x))
10452+#endif
10453
10454 #define segment_eq(a, b) ((a).seg == (b).seg)
10455
10456@@ -76,7 +84,33 @@
10457 * checks that the pointer is in the user space range - after calling
10458 * this function, memory access functions may still return -EFAULT.
10459 */
10460-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10461+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10462+#define access_ok(type, addr, size) \
10463+({ \
10464+ long __size = size; \
10465+ unsigned long __addr = (unsigned long)addr; \
10466+ unsigned long __addr_ao = __addr & PAGE_MASK; \
10467+ unsigned long __end_ao = __addr + __size - 1; \
10468+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
10469+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
10470+ while(__addr_ao <= __end_ao) { \
10471+ char __c_ao; \
10472+ __addr_ao += PAGE_SIZE; \
10473+ if (__size > PAGE_SIZE) \
10474+ cond_resched(); \
10475+ if (__get_user(__c_ao, (char __user *)__addr)) \
10476+ break; \
10477+ if (type != VERIFY_WRITE) { \
10478+ __addr = __addr_ao; \
10479+ continue; \
10480+ } \
10481+ if (__put_user(__c_ao, (char __user *)__addr)) \
10482+ break; \
10483+ __addr = __addr_ao; \
10484+ } \
10485+ } \
10486+ __ret_ao; \
10487+})
10488
10489 /*
10490 * The exception table consists of pairs of addresses: the first is the
10491@@ -182,12 +216,20 @@ extern int __get_user_bad(void);
10492 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
10493 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
10494
10495-
10496+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10497+#define __copyuser_seg "gs;"
10498+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
10499+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
10500+#else
10501+#define __copyuser_seg
10502+#define __COPYUSER_SET_ES
10503+#define __COPYUSER_RESTORE_ES
10504+#endif
10505
10506 #ifdef CONFIG_X86_32
10507 #define __put_user_asm_u64(x, addr, err, errret) \
10508- asm volatile("1: movl %%eax,0(%2)\n" \
10509- "2: movl %%edx,4(%2)\n" \
10510+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
10511+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
10512 "3:\n" \
10513 ".section .fixup,\"ax\"\n" \
10514 "4: movl %3,%0\n" \
10515@@ -199,8 +241,8 @@ extern int __get_user_bad(void);
10516 : "A" (x), "r" (addr), "i" (errret), "0" (err))
10517
10518 #define __put_user_asm_ex_u64(x, addr) \
10519- asm volatile("1: movl %%eax,0(%1)\n" \
10520- "2: movl %%edx,4(%1)\n" \
10521+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
10522+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
10523 "3:\n" \
10524 _ASM_EXTABLE(1b, 2b - 1b) \
10525 _ASM_EXTABLE(2b, 3b - 2b) \
10526@@ -252,7 +294,7 @@ extern void __put_user_8(void);
10527 __typeof__(*(ptr)) __pu_val; \
10528 __chk_user_ptr(ptr); \
10529 might_fault(); \
10530- __pu_val = x; \
10531+ __pu_val = (x); \
10532 switch (sizeof(*(ptr))) { \
10533 case 1: \
10534 __put_user_x(1, __pu_val, ptr, __ret_pu); \
10535@@ -373,7 +415,7 @@ do { \
10536 } while (0)
10537
10538 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10539- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
10540+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
10541 "2:\n" \
10542 ".section .fixup,\"ax\"\n" \
10543 "3: mov %3,%0\n" \
10544@@ -381,7 +423,7 @@ do { \
10545 " jmp 2b\n" \
10546 ".previous\n" \
10547 _ASM_EXTABLE(1b, 3b) \
10548- : "=r" (err), ltype(x) \
10549+ : "=r" (err), ltype (x) \
10550 : "m" (__m(addr)), "i" (errret), "0" (err))
10551
10552 #define __get_user_size_ex(x, ptr, size) \
10553@@ -406,7 +448,7 @@ do { \
10554 } while (0)
10555
10556 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
10557- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
10558+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
10559 "2:\n" \
10560 _ASM_EXTABLE(1b, 2b - 1b) \
10561 : ltype(x) : "m" (__m(addr)))
10562@@ -423,13 +465,24 @@ do { \
10563 int __gu_err; \
10564 unsigned long __gu_val; \
10565 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
10566- (x) = (__force __typeof__(*(ptr)))__gu_val; \
10567+ (x) = (__typeof__(*(ptr)))__gu_val; \
10568 __gu_err; \
10569 })
10570
10571 /* FIXME: this hack is definitely wrong -AK */
10572 struct __large_struct { unsigned long buf[100]; };
10573-#define __m(x) (*(struct __large_struct __user *)(x))
10574+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10575+#define ____m(x) \
10576+({ \
10577+ unsigned long ____x = (unsigned long)(x); \
10578+ if (____x < PAX_USER_SHADOW_BASE) \
10579+ ____x += PAX_USER_SHADOW_BASE; \
10580+ (void __user *)____x; \
10581+})
10582+#else
10583+#define ____m(x) (x)
10584+#endif
10585+#define __m(x) (*(struct __large_struct __user *)____m(x))
10586
10587 /*
10588 * Tell gcc we read from memory instead of writing: this is because
10589@@ -437,7 +490,7 @@ struct __large_struct { unsigned long buf[100]; };
10590 * aliasing issues.
10591 */
10592 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10593- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
10594+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
10595 "2:\n" \
10596 ".section .fixup,\"ax\"\n" \
10597 "3: mov %3,%0\n" \
10598@@ -445,10 +498,10 @@ struct __large_struct { unsigned long buf[100]; };
10599 ".previous\n" \
10600 _ASM_EXTABLE(1b, 3b) \
10601 : "=r"(err) \
10602- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
10603+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
10604
10605 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
10606- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
10607+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
10608 "2:\n" \
10609 _ASM_EXTABLE(1b, 2b - 1b) \
10610 : : ltype(x), "m" (__m(addr)))
10611@@ -487,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
10612 * On error, the variable @x is set to zero.
10613 */
10614
10615+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10616+#define __get_user(x, ptr) get_user((x), (ptr))
10617+#else
10618 #define __get_user(x, ptr) \
10619 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
10620+#endif
10621
10622 /**
10623 * __put_user: - Write a simple value into user space, with less checking.
10624@@ -510,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
10625 * Returns zero on success, or -EFAULT on error.
10626 */
10627
10628+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10629+#define __put_user(x, ptr) put_user((x), (ptr))
10630+#else
10631 #define __put_user(x, ptr) \
10632 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
10633+#endif
10634
10635 #define __get_user_unaligned __get_user
10636 #define __put_user_unaligned __put_user
10637@@ -529,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
10638 #define get_user_ex(x, ptr) do { \
10639 unsigned long __gue_val; \
10640 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
10641- (x) = (__force __typeof__(*(ptr)))__gue_val; \
10642+ (x) = (__typeof__(*(ptr)))__gue_val; \
10643 } while (0)
10644
10645 #ifdef CONFIG_X86_WP_WORKS_OK
10646diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
10647index 566e803..89f1e60 100644
10648--- a/arch/x86/include/asm/uaccess_32.h
10649+++ b/arch/x86/include/asm/uaccess_32.h
10650@@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
10651 static __always_inline unsigned long __must_check
10652 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10653 {
10654+ pax_track_stack();
10655+
10656+ if ((long)n < 0)
10657+ return n;
10658+
10659 if (__builtin_constant_p(n)) {
10660 unsigned long ret;
10661
10662@@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10663 return ret;
10664 }
10665 }
10666+ if (!__builtin_constant_p(n))
10667+ check_object_size(from, n, true);
10668 return __copy_to_user_ll(to, from, n);
10669 }
10670
10671@@ -82,12 +89,16 @@ static __always_inline unsigned long __must_check
10672 __copy_to_user(void __user *to, const void *from, unsigned long n)
10673 {
10674 might_fault();
10675+
10676 return __copy_to_user_inatomic(to, from, n);
10677 }
10678
10679 static __always_inline unsigned long
10680 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
10681 {
10682+ if ((long)n < 0)
10683+ return n;
10684+
10685 /* Avoid zeroing the tail if the copy fails..
10686 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
10687 * but as the zeroing behaviour is only significant when n is not
10688@@ -137,6 +148,12 @@ static __always_inline unsigned long
10689 __copy_from_user(void *to, const void __user *from, unsigned long n)
10690 {
10691 might_fault();
10692+
10693+ pax_track_stack();
10694+
10695+ if ((long)n < 0)
10696+ return n;
10697+
10698 if (__builtin_constant_p(n)) {
10699 unsigned long ret;
10700
10701@@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
10702 return ret;
10703 }
10704 }
10705+ if (!__builtin_constant_p(n))
10706+ check_object_size(to, n, false);
10707 return __copy_from_user_ll(to, from, n);
10708 }
10709
10710@@ -159,6 +178,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
10711 const void __user *from, unsigned long n)
10712 {
10713 might_fault();
10714+
10715+ if ((long)n < 0)
10716+ return n;
10717+
10718 if (__builtin_constant_p(n)) {
10719 unsigned long ret;
10720
10721@@ -181,15 +204,19 @@ static __always_inline unsigned long
10722 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
10723 unsigned long n)
10724 {
10725- return __copy_from_user_ll_nocache_nozero(to, from, n);
10726+ if ((long)n < 0)
10727+ return n;
10728+
10729+ return __copy_from_user_ll_nocache_nozero(to, from, n);
10730 }
10731
10732-unsigned long __must_check copy_to_user(void __user *to,
10733- const void *from, unsigned long n);
10734-unsigned long __must_check _copy_from_user(void *to,
10735- const void __user *from,
10736- unsigned long n);
10737-
10738+extern void copy_to_user_overflow(void)
10739+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10740+ __compiletime_error("copy_to_user() buffer size is not provably correct")
10741+#else
10742+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
10743+#endif
10744+;
10745
10746 extern void copy_from_user_overflow(void)
10747 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10748@@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void)
10749 #endif
10750 ;
10751
10752-static inline unsigned long __must_check copy_from_user(void *to,
10753- const void __user *from,
10754- unsigned long n)
10755+/**
10756+ * copy_to_user: - Copy a block of data into user space.
10757+ * @to: Destination address, in user space.
10758+ * @from: Source address, in kernel space.
10759+ * @n: Number of bytes to copy.
10760+ *
10761+ * Context: User context only. This function may sleep.
10762+ *
10763+ * Copy data from kernel space to user space.
10764+ *
10765+ * Returns number of bytes that could not be copied.
10766+ * On success, this will be zero.
10767+ */
10768+static inline unsigned long __must_check
10769+copy_to_user(void __user *to, const void *from, unsigned long n)
10770+{
10771+ int sz = __compiletime_object_size(from);
10772+
10773+ if (unlikely(sz != -1 && sz < n))
10774+ copy_to_user_overflow();
10775+ else if (access_ok(VERIFY_WRITE, to, n))
10776+ n = __copy_to_user(to, from, n);
10777+ return n;
10778+}
10779+
10780+/**
10781+ * copy_from_user: - Copy a block of data from user space.
10782+ * @to: Destination address, in kernel space.
10783+ * @from: Source address, in user space.
10784+ * @n: Number of bytes to copy.
10785+ *
10786+ * Context: User context only. This function may sleep.
10787+ *
10788+ * Copy data from user space to kernel space.
10789+ *
10790+ * Returns number of bytes that could not be copied.
10791+ * On success, this will be zero.
10792+ *
10793+ * If some data could not be copied, this function will pad the copied
10794+ * data to the requested size using zero bytes.
10795+ */
10796+static inline unsigned long __must_check
10797+copy_from_user(void *to, const void __user *from, unsigned long n)
10798 {
10799 int sz = __compiletime_object_size(to);
10800
10801- if (likely(sz == -1 || sz >= n))
10802- n = _copy_from_user(to, from, n);
10803- else
10804+ if (unlikely(sz != -1 && sz < n))
10805 copy_from_user_overflow();
10806-
10807+ else if (access_ok(VERIFY_READ, from, n))
10808+ n = __copy_from_user(to, from, n);
10809+ else if ((long)n > 0) {
10810+ if (!__builtin_constant_p(n))
10811+ check_object_size(to, n, false);
10812+ memset(to, 0, n);
10813+ }
10814 return n;
10815 }
10816
10817diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
10818index 1c66d30..59bd7d4 100644
10819--- a/arch/x86/include/asm/uaccess_64.h
10820+++ b/arch/x86/include/asm/uaccess_64.h
10821@@ -10,6 +10,9 @@
10822 #include <asm/alternative.h>
10823 #include <asm/cpufeature.h>
10824 #include <asm/page.h>
10825+#include <asm/pgtable.h>
10826+
10827+#define set_fs(x) (current_thread_info()->addr_limit = (x))
10828
10829 /*
10830 * Copy To/From Userspace
10831@@ -17,12 +20,12 @@
10832
10833 /* Handles exceptions in both to and from, but doesn't do access_ok */
10834 __must_check unsigned long
10835-copy_user_generic_string(void *to, const void *from, unsigned len);
10836+copy_user_generic_string(void *to, const void *from, unsigned long len);
10837 __must_check unsigned long
10838-copy_user_generic_unrolled(void *to, const void *from, unsigned len);
10839+copy_user_generic_unrolled(void *to, const void *from, unsigned long len);
10840
10841 static __always_inline __must_check unsigned long
10842-copy_user_generic(void *to, const void *from, unsigned len)
10843+copy_user_generic(void *to, const void *from, unsigned long len)
10844 {
10845 unsigned ret;
10846
10847@@ -36,138 +39,226 @@ copy_user_generic(void *to, const void *from, unsigned len)
10848 return ret;
10849 }
10850
10851+static __always_inline __must_check unsigned long
10852+__copy_to_user(void __user *to, const void *from, unsigned long len);
10853+static __always_inline __must_check unsigned long
10854+__copy_from_user(void *to, const void __user *from, unsigned long len);
10855 __must_check unsigned long
10856-_copy_to_user(void __user *to, const void *from, unsigned len);
10857-__must_check unsigned long
10858-_copy_from_user(void *to, const void __user *from, unsigned len);
10859-__must_check unsigned long
10860-copy_in_user(void __user *to, const void __user *from, unsigned len);
10861+copy_in_user(void __user *to, const void __user *from, unsigned long len);
10862
10863 static inline unsigned long __must_check copy_from_user(void *to,
10864 const void __user *from,
10865- unsigned long n)
10866+ unsigned n)
10867 {
10868- int sz = __compiletime_object_size(to);
10869-
10870 might_fault();
10871- if (likely(sz == -1 || sz >= n))
10872- n = _copy_from_user(to, from, n);
10873-#ifdef CONFIG_DEBUG_VM
10874- else
10875- WARN(1, "Buffer overflow detected!\n");
10876-#endif
10877+
10878+ if (access_ok(VERIFY_READ, from, n))
10879+ n = __copy_from_user(to, from, n);
10880+ else if (n < INT_MAX) {
10881+ if (!__builtin_constant_p(n))
10882+ check_object_size(to, n, false);
10883+ memset(to, 0, n);
10884+ }
10885 return n;
10886 }
10887
10888 static __always_inline __must_check
10889-int copy_to_user(void __user *dst, const void *src, unsigned size)
10890+int copy_to_user(void __user *dst, const void *src, unsigned long size)
10891 {
10892 might_fault();
10893
10894- return _copy_to_user(dst, src, size);
10895+ if (access_ok(VERIFY_WRITE, dst, size))
10896+ size = __copy_to_user(dst, src, size);
10897+ return size;
10898 }
10899
10900 static __always_inline __must_check
10901-int __copy_from_user(void *dst, const void __user *src, unsigned size)
10902+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
10903 {
10904- int ret = 0;
10905+ int sz = __compiletime_object_size(dst);
10906+ unsigned ret = 0;
10907
10908 might_fault();
10909- if (!__builtin_constant_p(size))
10910- return copy_user_generic(dst, (__force void *)src, size);
10911+
10912+ pax_track_stack();
10913+
10914+ if (size > INT_MAX)
10915+ return size;
10916+
10917+#ifdef CONFIG_PAX_MEMORY_UDEREF
10918+ if (!__access_ok(VERIFY_READ, src, size))
10919+ return size;
10920+#endif
10921+
10922+ if (unlikely(sz != -1 && sz < size)) {
10923+#ifdef CONFIG_DEBUG_VM
10924+ WARN(1, "Buffer overflow detected!\n");
10925+#endif
10926+ return size;
10927+ }
10928+
10929+ if (!__builtin_constant_p(size)) {
10930+ check_object_size(dst, size, false);
10931+
10932+#ifdef CONFIG_PAX_MEMORY_UDEREF
10933+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10934+ src += PAX_USER_SHADOW_BASE;
10935+#endif
10936+
10937+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
10938+ }
10939 switch (size) {
10940- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
10941+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
10942 ret, "b", "b", "=q", 1);
10943 return ret;
10944- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
10945+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
10946 ret, "w", "w", "=r", 2);
10947 return ret;
10948- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
10949+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
10950 ret, "l", "k", "=r", 4);
10951 return ret;
10952- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
10953+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10954 ret, "q", "", "=r", 8);
10955 return ret;
10956 case 10:
10957- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10958+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10959 ret, "q", "", "=r", 10);
10960 if (unlikely(ret))
10961 return ret;
10962 __get_user_asm(*(u16 *)(8 + (char *)dst),
10963- (u16 __user *)(8 + (char __user *)src),
10964+ (const u16 __user *)(8 + (const char __user *)src),
10965 ret, "w", "w", "=r", 2);
10966 return ret;
10967 case 16:
10968- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10969+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10970 ret, "q", "", "=r", 16);
10971 if (unlikely(ret))
10972 return ret;
10973 __get_user_asm(*(u64 *)(8 + (char *)dst),
10974- (u64 __user *)(8 + (char __user *)src),
10975+ (const u64 __user *)(8 + (const char __user *)src),
10976 ret, "q", "", "=r", 8);
10977 return ret;
10978 default:
10979- return copy_user_generic(dst, (__force void *)src, size);
10980+
10981+#ifdef CONFIG_PAX_MEMORY_UDEREF
10982+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10983+ src += PAX_USER_SHADOW_BASE;
10984+#endif
10985+
10986+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
10987 }
10988 }
10989
10990 static __always_inline __must_check
10991-int __copy_to_user(void __user *dst, const void *src, unsigned size)
10992+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
10993 {
10994- int ret = 0;
10995+ int sz = __compiletime_object_size(src);
10996+ unsigned ret = 0;
10997
10998 might_fault();
10999- if (!__builtin_constant_p(size))
11000- return copy_user_generic((__force void *)dst, src, size);
11001+
11002+ pax_track_stack();
11003+
11004+ if (size > INT_MAX)
11005+ return size;
11006+
11007+#ifdef CONFIG_PAX_MEMORY_UDEREF
11008+ if (!__access_ok(VERIFY_WRITE, dst, size))
11009+ return size;
11010+#endif
11011+
11012+ if (unlikely(sz != -1 && sz < size)) {
11013+#ifdef CONFIG_DEBUG_VM
11014+ WARN(1, "Buffer overflow detected!\n");
11015+#endif
11016+ return size;
11017+ }
11018+
11019+ if (!__builtin_constant_p(size)) {
11020+ check_object_size(src, size, true);
11021+
11022+#ifdef CONFIG_PAX_MEMORY_UDEREF
11023+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11024+ dst += PAX_USER_SHADOW_BASE;
11025+#endif
11026+
11027+ return copy_user_generic((__force_kernel void *)dst, src, size);
11028+ }
11029 switch (size) {
11030- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11031+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11032 ret, "b", "b", "iq", 1);
11033 return ret;
11034- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11035+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11036 ret, "w", "w", "ir", 2);
11037 return ret;
11038- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11039+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11040 ret, "l", "k", "ir", 4);
11041 return ret;
11042- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11043+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11044 ret, "q", "", "er", 8);
11045 return ret;
11046 case 10:
11047- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11048+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11049 ret, "q", "", "er", 10);
11050 if (unlikely(ret))
11051 return ret;
11052 asm("":::"memory");
11053- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11054+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11055 ret, "w", "w", "ir", 2);
11056 return ret;
11057 case 16:
11058- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11059+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11060 ret, "q", "", "er", 16);
11061 if (unlikely(ret))
11062 return ret;
11063 asm("":::"memory");
11064- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11065+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11066 ret, "q", "", "er", 8);
11067 return ret;
11068 default:
11069- return copy_user_generic((__force void *)dst, src, size);
11070+
11071+#ifdef CONFIG_PAX_MEMORY_UDEREF
11072+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11073+ dst += PAX_USER_SHADOW_BASE;
11074+#endif
11075+
11076+ return copy_user_generic((__force_kernel void *)dst, src, size);
11077 }
11078 }
11079
11080 static __always_inline __must_check
11081-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11082+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
11083 {
11084- int ret = 0;
11085+ unsigned ret = 0;
11086
11087 might_fault();
11088- if (!__builtin_constant_p(size))
11089- return copy_user_generic((__force void *)dst,
11090- (__force void *)src, size);
11091+
11092+ if (size > INT_MAX)
11093+ return size;
11094+
11095+#ifdef CONFIG_PAX_MEMORY_UDEREF
11096+ if (!__access_ok(VERIFY_READ, src, size))
11097+ return size;
11098+ if (!__access_ok(VERIFY_WRITE, dst, size))
11099+ return size;
11100+#endif
11101+
11102+ if (!__builtin_constant_p(size)) {
11103+
11104+#ifdef CONFIG_PAX_MEMORY_UDEREF
11105+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11106+ src += PAX_USER_SHADOW_BASE;
11107+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11108+ dst += PAX_USER_SHADOW_BASE;
11109+#endif
11110+
11111+ return copy_user_generic((__force_kernel void *)dst,
11112+ (__force_kernel const void *)src, size);
11113+ }
11114 switch (size) {
11115 case 1: {
11116 u8 tmp;
11117- __get_user_asm(tmp, (u8 __user *)src,
11118+ __get_user_asm(tmp, (const u8 __user *)src,
11119 ret, "b", "b", "=q", 1);
11120 if (likely(!ret))
11121 __put_user_asm(tmp, (u8 __user *)dst,
11122@@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11123 }
11124 case 2: {
11125 u16 tmp;
11126- __get_user_asm(tmp, (u16 __user *)src,
11127+ __get_user_asm(tmp, (const u16 __user *)src,
11128 ret, "w", "w", "=r", 2);
11129 if (likely(!ret))
11130 __put_user_asm(tmp, (u16 __user *)dst,
11131@@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11132
11133 case 4: {
11134 u32 tmp;
11135- __get_user_asm(tmp, (u32 __user *)src,
11136+ __get_user_asm(tmp, (const u32 __user *)src,
11137 ret, "l", "k", "=r", 4);
11138 if (likely(!ret))
11139 __put_user_asm(tmp, (u32 __user *)dst,
11140@@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11141 }
11142 case 8: {
11143 u64 tmp;
11144- __get_user_asm(tmp, (u64 __user *)src,
11145+ __get_user_asm(tmp, (const u64 __user *)src,
11146 ret, "q", "", "=r", 8);
11147 if (likely(!ret))
11148 __put_user_asm(tmp, (u64 __user *)dst,
11149@@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11150 return ret;
11151 }
11152 default:
11153- return copy_user_generic((__force void *)dst,
11154- (__force void *)src, size);
11155+
11156+#ifdef CONFIG_PAX_MEMORY_UDEREF
11157+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11158+ src += PAX_USER_SHADOW_BASE;
11159+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11160+ dst += PAX_USER_SHADOW_BASE;
11161+#endif
11162+
11163+ return copy_user_generic((__force_kernel void *)dst,
11164+ (__force_kernel const void *)src, size);
11165 }
11166 }
11167
11168@@ -219,35 +318,74 @@ __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11169 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11170
11171 static __must_check __always_inline int
11172-__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11173+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
11174 {
11175- return copy_user_generic(dst, (__force const void *)src, size);
11176+ pax_track_stack();
11177+
11178+ if (size > INT_MAX)
11179+ return size;
11180+
11181+#ifdef CONFIG_PAX_MEMORY_UDEREF
11182+ if (!__access_ok(VERIFY_READ, src, size))
11183+ return size;
11184+
11185+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11186+ src += PAX_USER_SHADOW_BASE;
11187+#endif
11188+
11189+ return copy_user_generic(dst, (__force_kernel const void *)src, size);
11190 }
11191
11192-static __must_check __always_inline int
11193-__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11194+static __must_check __always_inline unsigned long
11195+__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
11196 {
11197- return copy_user_generic((__force void *)dst, src, size);
11198+ if (size > INT_MAX)
11199+ return size;
11200+
11201+#ifdef CONFIG_PAX_MEMORY_UDEREF
11202+ if (!__access_ok(VERIFY_WRITE, dst, size))
11203+ return size;
11204+
11205+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11206+ dst += PAX_USER_SHADOW_BASE;
11207+#endif
11208+
11209+ return copy_user_generic((__force_kernel void *)dst, src, size);
11210 }
11211
11212-extern long __copy_user_nocache(void *dst, const void __user *src,
11213- unsigned size, int zerorest);
11214+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11215+ unsigned long size, int zerorest);
11216
11217-static inline int
11218-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11219+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
11220 {
11221 might_sleep();
11222+
11223+ if (size > INT_MAX)
11224+ return size;
11225+
11226+#ifdef CONFIG_PAX_MEMORY_UDEREF
11227+ if (!__access_ok(VERIFY_READ, src, size))
11228+ return size;
11229+#endif
11230+
11231 return __copy_user_nocache(dst, src, size, 1);
11232 }
11233
11234-static inline int
11235-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11236- unsigned size)
11237+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11238+ unsigned long size)
11239 {
11240+ if (size > INT_MAX)
11241+ return size;
11242+
11243+#ifdef CONFIG_PAX_MEMORY_UDEREF
11244+ if (!__access_ok(VERIFY_READ, src, size))
11245+ return size;
11246+#endif
11247+
11248 return __copy_user_nocache(dst, src, size, 0);
11249 }
11250
11251-unsigned long
11252-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11253+extern unsigned long
11254+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest);
11255
11256 #endif /* _ASM_X86_UACCESS_64_H */
11257diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
11258index bb05228..d763d5b 100644
11259--- a/arch/x86/include/asm/vdso.h
11260+++ b/arch/x86/include/asm/vdso.h
11261@@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
11262 #define VDSO32_SYMBOL(base, name) \
11263 ({ \
11264 extern const char VDSO32_##name[]; \
11265- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11266+ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11267 })
11268 #endif
11269
11270diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
11271index d3d8590..d296b5f 100644
11272--- a/arch/x86/include/asm/x86_init.h
11273+++ b/arch/x86/include/asm/x86_init.h
11274@@ -28,7 +28,7 @@ struct x86_init_mpparse {
11275 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11276 void (*find_smp_config)(void);
11277 void (*get_smp_config)(unsigned int early);
11278-};
11279+} __no_const;
11280
11281 /**
11282 * struct x86_init_resources - platform specific resource related ops
11283@@ -42,7 +42,7 @@ struct x86_init_resources {
11284 void (*probe_roms)(void);
11285 void (*reserve_resources)(void);
11286 char *(*memory_setup)(void);
11287-};
11288+} __no_const;
11289
11290 /**
11291 * struct x86_init_irqs - platform specific interrupt setup
11292@@ -55,7 +55,7 @@ struct x86_init_irqs {
11293 void (*pre_vector_init)(void);
11294 void (*intr_init)(void);
11295 void (*trap_init)(void);
11296-};
11297+} __no_const;
11298
11299 /**
11300 * struct x86_init_oem - oem platform specific customizing functions
11301@@ -65,7 +65,7 @@ struct x86_init_irqs {
11302 struct x86_init_oem {
11303 void (*arch_setup)(void);
11304 void (*banner)(void);
11305-};
11306+} __no_const;
11307
11308 /**
11309 * struct x86_init_mapping - platform specific initial kernel pagetable setup
11310@@ -76,7 +76,7 @@ struct x86_init_oem {
11311 */
11312 struct x86_init_mapping {
11313 void (*pagetable_reserve)(u64 start, u64 end);
11314-};
11315+} __no_const;
11316
11317 /**
11318 * struct x86_init_paging - platform specific paging functions
11319@@ -86,7 +86,7 @@ struct x86_init_mapping {
11320 struct x86_init_paging {
11321 void (*pagetable_setup_start)(pgd_t *base);
11322 void (*pagetable_setup_done)(pgd_t *base);
11323-};
11324+} __no_const;
11325
11326 /**
11327 * struct x86_init_timers - platform specific timer setup
11328@@ -101,7 +101,7 @@ struct x86_init_timers {
11329 void (*tsc_pre_init)(void);
11330 void (*timer_init)(void);
11331 void (*wallclock_init)(void);
11332-};
11333+} __no_const;
11334
11335 /**
11336 * struct x86_init_iommu - platform specific iommu setup
11337@@ -109,7 +109,7 @@ struct x86_init_timers {
11338 */
11339 struct x86_init_iommu {
11340 int (*iommu_init)(void);
11341-};
11342+} __no_const;
11343
11344 /**
11345 * struct x86_init_pci - platform specific pci init functions
11346@@ -123,7 +123,7 @@ struct x86_init_pci {
11347 int (*init)(void);
11348 void (*init_irq)(void);
11349 void (*fixup_irqs)(void);
11350-};
11351+} __no_const;
11352
11353 /**
11354 * struct x86_init_ops - functions for platform specific setup
11355@@ -139,7 +139,7 @@ struct x86_init_ops {
11356 struct x86_init_timers timers;
11357 struct x86_init_iommu iommu;
11358 struct x86_init_pci pci;
11359-};
11360+} __no_const;
11361
11362 /**
11363 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11364@@ -147,7 +147,7 @@ struct x86_init_ops {
11365 */
11366 struct x86_cpuinit_ops {
11367 void (*setup_percpu_clockev)(void);
11368-};
11369+} __no_const;
11370
11371 /**
11372 * struct x86_platform_ops - platform specific runtime functions
11373@@ -166,7 +166,7 @@ struct x86_platform_ops {
11374 bool (*is_untracked_pat_range)(u64 start, u64 end);
11375 void (*nmi_init)(void);
11376 int (*i8042_detect)(void);
11377-};
11378+} __no_const;
11379
11380 struct pci_dev;
11381
11382@@ -174,7 +174,7 @@ struct x86_msi_ops {
11383 int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
11384 void (*teardown_msi_irq)(unsigned int irq);
11385 void (*teardown_msi_irqs)(struct pci_dev *dev);
11386-};
11387+} __no_const;
11388
11389 extern struct x86_init_ops x86_init;
11390 extern struct x86_cpuinit_ops x86_cpuinit;
11391diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
11392index c6ce245..ffbdab7 100644
11393--- a/arch/x86/include/asm/xsave.h
11394+++ b/arch/x86/include/asm/xsave.h
11395@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11396 {
11397 int err;
11398
11399+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11400+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11401+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11402+#endif
11403+
11404 /*
11405 * Clear the xsave header first, so that reserved fields are
11406 * initialized to zero.
11407@@ -96,10 +101,15 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11408 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
11409 {
11410 int err;
11411- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
11412+ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
11413 u32 lmask = mask;
11414 u32 hmask = mask >> 32;
11415
11416+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11417+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11418+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11419+#endif
11420+
11421 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11422 "2:\n"
11423 ".section .fixup,\"ax\"\n"
11424diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
11425index 6a564ac..9b1340c 100644
11426--- a/arch/x86/kernel/acpi/realmode/Makefile
11427+++ b/arch/x86/kernel/acpi/realmode/Makefile
11428@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \
11429 $(call cc-option, -fno-stack-protector) \
11430 $(call cc-option, -mpreferred-stack-boundary=2)
11431 KBUILD_CFLAGS += $(call cc-option, -m32)
11432+ifdef CONSTIFY_PLUGIN
11433+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
11434+endif
11435 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
11436 GCOV_PROFILE := n
11437
11438diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
11439index b4fd836..4358fe3 100644
11440--- a/arch/x86/kernel/acpi/realmode/wakeup.S
11441+++ b/arch/x86/kernel/acpi/realmode/wakeup.S
11442@@ -108,6 +108,9 @@ wakeup_code:
11443 /* Do any other stuff... */
11444
11445 #ifndef CONFIG_64BIT
11446+ /* Recheck NX bit overrides (64bit path does this in trampoline */
11447+ call verify_cpu
11448+
11449 /* This could also be done in C code... */
11450 movl pmode_cr3, %eax
11451 movl %eax, %cr3
11452@@ -131,6 +134,7 @@ wakeup_code:
11453 movl pmode_cr0, %eax
11454 movl %eax, %cr0
11455 jmp pmode_return
11456+# include "../../verify_cpu.S"
11457 #else
11458 pushw $0
11459 pushw trampoline_segment
11460diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
11461index 103b6ab..2004d0a 100644
11462--- a/arch/x86/kernel/acpi/sleep.c
11463+++ b/arch/x86/kernel/acpi/sleep.c
11464@@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void)
11465 header->trampoline_segment = trampoline_address() >> 4;
11466 #ifdef CONFIG_SMP
11467 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
11468+
11469+ pax_open_kernel();
11470 early_gdt_descr.address =
11471 (unsigned long)get_cpu_gdt_table(smp_processor_id());
11472+ pax_close_kernel();
11473+
11474 initial_gs = per_cpu_offset(smp_processor_id());
11475 #endif
11476 initial_code = (unsigned long)wakeup_long64;
11477diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
11478index 13ab720..95d5442 100644
11479--- a/arch/x86/kernel/acpi/wakeup_32.S
11480+++ b/arch/x86/kernel/acpi/wakeup_32.S
11481@@ -30,13 +30,11 @@ wakeup_pmode_return:
11482 # and restore the stack ... but you need gdt for this to work
11483 movl saved_context_esp, %esp
11484
11485- movl %cs:saved_magic, %eax
11486- cmpl $0x12345678, %eax
11487+ cmpl $0x12345678, saved_magic
11488 jne bogus_magic
11489
11490 # jump to place where we left off
11491- movl saved_eip, %eax
11492- jmp *%eax
11493+ jmp *(saved_eip)
11494
11495 bogus_magic:
11496 jmp bogus_magic
11497diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
11498index c638228..16dfa8d 100644
11499--- a/arch/x86/kernel/alternative.c
11500+++ b/arch/x86/kernel/alternative.c
11501@@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
11502 */
11503 for (a = start; a < end; a++) {
11504 instr = (u8 *)&a->instr_offset + a->instr_offset;
11505+
11506+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11507+ instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11508+ if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
11509+ instr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11510+#endif
11511+
11512 replacement = (u8 *)&a->repl_offset + a->repl_offset;
11513 BUG_ON(a->replacementlen > a->instrlen);
11514 BUG_ON(a->instrlen > sizeof(insnbuf));
11515@@ -307,10 +314,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
11516 for (poff = start; poff < end; poff++) {
11517 u8 *ptr = (u8 *)poff + *poff;
11518
11519+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11520+ ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11521+ if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11522+ ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11523+#endif
11524+
11525 if (!*poff || ptr < text || ptr >= text_end)
11526 continue;
11527 /* turn DS segment override prefix into lock prefix */
11528- if (*ptr == 0x3e)
11529+ if (*ktla_ktva(ptr) == 0x3e)
11530 text_poke(ptr, ((unsigned char []){0xf0}), 1);
11531 };
11532 mutex_unlock(&text_mutex);
11533@@ -328,10 +341,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
11534 for (poff = start; poff < end; poff++) {
11535 u8 *ptr = (u8 *)poff + *poff;
11536
11537+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11538+ ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11539+ if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11540+ ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11541+#endif
11542+
11543 if (!*poff || ptr < text || ptr >= text_end)
11544 continue;
11545 /* turn lock prefix into DS segment override prefix */
11546- if (*ptr == 0xf0)
11547+ if (*ktla_ktva(ptr) == 0xf0)
11548 text_poke(ptr, ((unsigned char []){0x3E}), 1);
11549 };
11550 mutex_unlock(&text_mutex);
11551@@ -500,7 +519,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
11552
11553 BUG_ON(p->len > MAX_PATCH_LEN);
11554 /* prep the buffer with the original instructions */
11555- memcpy(insnbuf, p->instr, p->len);
11556+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
11557 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
11558 (unsigned long)p->instr, p->len);
11559
11560@@ -568,7 +587,7 @@ void __init alternative_instructions(void)
11561 if (smp_alt_once)
11562 free_init_pages("SMP alternatives",
11563 (unsigned long)__smp_locks,
11564- (unsigned long)__smp_locks_end);
11565+ PAGE_ALIGN((unsigned long)__smp_locks_end));
11566
11567 restart_nmi();
11568 }
11569@@ -585,13 +604,17 @@ void __init alternative_instructions(void)
11570 * instructions. And on the local CPU you need to be protected again NMI or MCE
11571 * handlers seeing an inconsistent instruction while you patch.
11572 */
11573-void *__init_or_module text_poke_early(void *addr, const void *opcode,
11574+void *__kprobes text_poke_early(void *addr, const void *opcode,
11575 size_t len)
11576 {
11577 unsigned long flags;
11578 local_irq_save(flags);
11579- memcpy(addr, opcode, len);
11580+
11581+ pax_open_kernel();
11582+ memcpy(ktla_ktva(addr), opcode, len);
11583 sync_core();
11584+ pax_close_kernel();
11585+
11586 local_irq_restore(flags);
11587 /* Could also do a CLFLUSH here to speed up CPU recovery; but
11588 that causes hangs on some VIA CPUs. */
11589@@ -613,36 +636,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
11590 */
11591 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
11592 {
11593- unsigned long flags;
11594- char *vaddr;
11595+ unsigned char *vaddr = ktla_ktva(addr);
11596 struct page *pages[2];
11597- int i;
11598+ size_t i;
11599
11600 if (!core_kernel_text((unsigned long)addr)) {
11601- pages[0] = vmalloc_to_page(addr);
11602- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
11603+ pages[0] = vmalloc_to_page(vaddr);
11604+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
11605 } else {
11606- pages[0] = virt_to_page(addr);
11607+ pages[0] = virt_to_page(vaddr);
11608 WARN_ON(!PageReserved(pages[0]));
11609- pages[1] = virt_to_page(addr + PAGE_SIZE);
11610+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
11611 }
11612 BUG_ON(!pages[0]);
11613- local_irq_save(flags);
11614- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
11615- if (pages[1])
11616- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
11617- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
11618- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
11619- clear_fixmap(FIX_TEXT_POKE0);
11620- if (pages[1])
11621- clear_fixmap(FIX_TEXT_POKE1);
11622- local_flush_tlb();
11623- sync_core();
11624- /* Could also do a CLFLUSH here to speed up CPU recovery; but
11625- that causes hangs on some VIA CPUs. */
11626+ text_poke_early(addr, opcode, len);
11627 for (i = 0; i < len; i++)
11628- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
11629- local_irq_restore(flags);
11630+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
11631 return addr;
11632 }
11633
11634diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
11635index 52fa563..5de9d9c 100644
11636--- a/arch/x86/kernel/apic/apic.c
11637+++ b/arch/x86/kernel/apic/apic.c
11638@@ -174,7 +174,7 @@ int first_system_vector = 0xfe;
11639 /*
11640 * Debug level, exported for io_apic.c
11641 */
11642-unsigned int apic_verbosity;
11643+int apic_verbosity;
11644
11645 int pic_mode;
11646
11647@@ -1835,7 +1835,7 @@ void smp_error_interrupt(struct pt_regs *regs)
11648 apic_write(APIC_ESR, 0);
11649 v1 = apic_read(APIC_ESR);
11650 ack_APIC_irq();
11651- atomic_inc(&irq_err_count);
11652+ atomic_inc_unchecked(&irq_err_count);
11653
11654 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
11655 smp_processor_id(), v0 , v1);
11656@@ -2209,6 +2209,8 @@ static int __cpuinit apic_cluster_num(void)
11657 u16 *bios_cpu_apicid;
11658 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
11659
11660+ pax_track_stack();
11661+
11662 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
11663 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
11664
11665diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
11666index 8eb863e..32e6934 100644
11667--- a/arch/x86/kernel/apic/io_apic.c
11668+++ b/arch/x86/kernel/apic/io_apic.c
11669@@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
11670 }
11671 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
11672
11673-void lock_vector_lock(void)
11674+void lock_vector_lock(void) __acquires(vector_lock)
11675 {
11676 /* Used to the online set of cpus does not change
11677 * during assign_irq_vector.
11678@@ -1036,7 +1036,7 @@ void lock_vector_lock(void)
11679 raw_spin_lock(&vector_lock);
11680 }
11681
11682-void unlock_vector_lock(void)
11683+void unlock_vector_lock(void) __releases(vector_lock)
11684 {
11685 raw_spin_unlock(&vector_lock);
11686 }
11687@@ -2405,7 +2405,7 @@ static void ack_apic_edge(struct irq_data *data)
11688 ack_APIC_irq();
11689 }
11690
11691-atomic_t irq_mis_count;
11692+atomic_unchecked_t irq_mis_count;
11693
11694 /*
11695 * IO-APIC versions below 0x20 don't support EOI register.
11696@@ -2513,7 +2513,7 @@ static void ack_apic_level(struct irq_data *data)
11697 * at the cpu.
11698 */
11699 if (!(v & (1 << (i & 0x1f)))) {
11700- atomic_inc(&irq_mis_count);
11701+ atomic_inc_unchecked(&irq_mis_count);
11702
11703 eoi_ioapic_irq(irq, cfg);
11704 }
11705diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
11706index 0371c48..54cdf63 100644
11707--- a/arch/x86/kernel/apm_32.c
11708+++ b/arch/x86/kernel/apm_32.c
11709@@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex);
11710 * This is for buggy BIOS's that refer to (real mode) segment 0x40
11711 * even though they are called in protected mode.
11712 */
11713-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
11714+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
11715 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
11716
11717 static const char driver_version[] = "1.16ac"; /* no spaces */
11718@@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call)
11719 BUG_ON(cpu != 0);
11720 gdt = get_cpu_gdt_table(cpu);
11721 save_desc_40 = gdt[0x40 / 8];
11722+
11723+ pax_open_kernel();
11724 gdt[0x40 / 8] = bad_bios_desc;
11725+ pax_close_kernel();
11726
11727 apm_irq_save(flags);
11728 APM_DO_SAVE_SEGS;
11729@@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call)
11730 &call->esi);
11731 APM_DO_RESTORE_SEGS;
11732 apm_irq_restore(flags);
11733+
11734+ pax_open_kernel();
11735 gdt[0x40 / 8] = save_desc_40;
11736+ pax_close_kernel();
11737+
11738 put_cpu();
11739
11740 return call->eax & 0xff;
11741@@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void *_call)
11742 BUG_ON(cpu != 0);
11743 gdt = get_cpu_gdt_table(cpu);
11744 save_desc_40 = gdt[0x40 / 8];
11745+
11746+ pax_open_kernel();
11747 gdt[0x40 / 8] = bad_bios_desc;
11748+ pax_close_kernel();
11749
11750 apm_irq_save(flags);
11751 APM_DO_SAVE_SEGS;
11752@@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void *_call)
11753 &call->eax);
11754 APM_DO_RESTORE_SEGS;
11755 apm_irq_restore(flags);
11756+
11757+ pax_open_kernel();
11758 gdt[0x40 / 8] = save_desc_40;
11759+ pax_close_kernel();
11760+
11761 put_cpu();
11762 return error;
11763 }
11764@@ -2349,12 +2363,15 @@ static int __init apm_init(void)
11765 * code to that CPU.
11766 */
11767 gdt = get_cpu_gdt_table(0);
11768+
11769+ pax_open_kernel();
11770 set_desc_base(&gdt[APM_CS >> 3],
11771 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
11772 set_desc_base(&gdt[APM_CS_16 >> 3],
11773 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
11774 set_desc_base(&gdt[APM_DS >> 3],
11775 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
11776+ pax_close_kernel();
11777
11778 proc_create("apm", 0, NULL, &apm_file_ops);
11779
11780diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
11781index 4f13faf..87db5d2 100644
11782--- a/arch/x86/kernel/asm-offsets.c
11783+++ b/arch/x86/kernel/asm-offsets.c
11784@@ -33,6 +33,8 @@ void common(void) {
11785 OFFSET(TI_status, thread_info, status);
11786 OFFSET(TI_addr_limit, thread_info, addr_limit);
11787 OFFSET(TI_preempt_count, thread_info, preempt_count);
11788+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
11789+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
11790
11791 BLANK();
11792 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
11793@@ -53,8 +55,26 @@ void common(void) {
11794 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
11795 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
11796 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
11797+
11798+#ifdef CONFIG_PAX_KERNEXEC
11799+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
11800 #endif
11801
11802+#ifdef CONFIG_PAX_MEMORY_UDEREF
11803+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
11804+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
11805+#ifdef CONFIG_X86_64
11806+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
11807+#endif
11808+#endif
11809+
11810+#endif
11811+
11812+ BLANK();
11813+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
11814+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
11815+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
11816+
11817 #ifdef CONFIG_XEN
11818 BLANK();
11819 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
11820diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
11821index e72a119..6e2955d 100644
11822--- a/arch/x86/kernel/asm-offsets_64.c
11823+++ b/arch/x86/kernel/asm-offsets_64.c
11824@@ -69,6 +69,7 @@ int main(void)
11825 BLANK();
11826 #undef ENTRY
11827
11828+ DEFINE(TSS_size, sizeof(struct tss_struct));
11829 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
11830 BLANK();
11831
11832diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
11833index 6042981..e638266 100644
11834--- a/arch/x86/kernel/cpu/Makefile
11835+++ b/arch/x86/kernel/cpu/Makefile
11836@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
11837 CFLAGS_REMOVE_perf_event.o = -pg
11838 endif
11839
11840-# Make sure load_percpu_segment has no stackprotector
11841-nostackp := $(call cc-option, -fno-stack-protector)
11842-CFLAGS_common.o := $(nostackp)
11843-
11844 obj-y := intel_cacheinfo.o scattered.o topology.o
11845 obj-y += proc.o capflags.o powerflags.o common.o
11846 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
11847diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
11848index b13ed39..603286c 100644
11849--- a/arch/x86/kernel/cpu/amd.c
11850+++ b/arch/x86/kernel/cpu/amd.c
11851@@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
11852 unsigned int size)
11853 {
11854 /* AMD errata T13 (order #21922) */
11855- if ((c->x86 == 6)) {
11856+ if (c->x86 == 6) {
11857 /* Duron Rev A0 */
11858 if (c->x86_model == 3 && c->x86_mask == 0)
11859 size = 64;
11860diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
11861index 6218439..0f1addc 100644
11862--- a/arch/x86/kernel/cpu/common.c
11863+++ b/arch/x86/kernel/cpu/common.c
11864@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
11865
11866 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
11867
11868-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
11869-#ifdef CONFIG_X86_64
11870- /*
11871- * We need valid kernel segments for data and code in long mode too
11872- * IRET will check the segment types kkeil 2000/10/28
11873- * Also sysret mandates a special GDT layout
11874- *
11875- * TLS descriptors are currently at a different place compared to i386.
11876- * Hopefully nobody expects them at a fixed place (Wine?)
11877- */
11878- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
11879- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
11880- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
11881- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
11882- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
11883- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
11884-#else
11885- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
11886- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11887- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
11888- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
11889- /*
11890- * Segments used for calling PnP BIOS have byte granularity.
11891- * They code segments and data segments have fixed 64k limits,
11892- * the transfer segment sizes are set at run time.
11893- */
11894- /* 32-bit code */
11895- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11896- /* 16-bit code */
11897- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11898- /* 16-bit data */
11899- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
11900- /* 16-bit data */
11901- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
11902- /* 16-bit data */
11903- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
11904- /*
11905- * The APM segments have byte granularity and their bases
11906- * are set at run time. All have 64k limits.
11907- */
11908- /* 32-bit code */
11909- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11910- /* 16-bit code */
11911- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11912- /* data */
11913- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
11914-
11915- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11916- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11917- GDT_STACK_CANARY_INIT
11918-#endif
11919-} };
11920-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
11921-
11922 static int __init x86_xsave_setup(char *s)
11923 {
11924 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
11925@@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu)
11926 {
11927 struct desc_ptr gdt_descr;
11928
11929- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
11930+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
11931 gdt_descr.size = GDT_SIZE - 1;
11932 load_gdt(&gdt_descr);
11933 /* Reload the per-cpu base */
11934@@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
11935 /* Filter out anything that depends on CPUID levels we don't have */
11936 filter_cpuid_features(c, true);
11937
11938+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
11939+ setup_clear_cpu_cap(X86_FEATURE_SEP);
11940+#endif
11941+
11942 /* If the model name is still unset, do table lookup. */
11943 if (!c->x86_model_id[0]) {
11944 const char *p;
11945@@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(char *arg)
11946 }
11947 __setup("clearcpuid=", setup_disablecpuid);
11948
11949+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
11950+EXPORT_PER_CPU_SYMBOL(current_tinfo);
11951+
11952 #ifdef CONFIG_X86_64
11953 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
11954
11955@@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
11956 EXPORT_PER_CPU_SYMBOL(current_task);
11957
11958 DEFINE_PER_CPU(unsigned long, kernel_stack) =
11959- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
11960+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
11961 EXPORT_PER_CPU_SYMBOL(kernel_stack);
11962
11963 DEFINE_PER_CPU(char *, irq_stack_ptr) =
11964@@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
11965 {
11966 memset(regs, 0, sizeof(struct pt_regs));
11967 regs->fs = __KERNEL_PERCPU;
11968- regs->gs = __KERNEL_STACK_CANARY;
11969+ savesegment(gs, regs->gs);
11970
11971 return regs;
11972 }
11973@@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void)
11974 int i;
11975
11976 cpu = stack_smp_processor_id();
11977- t = &per_cpu(init_tss, cpu);
11978+ t = init_tss + cpu;
11979 oist = &per_cpu(orig_ist, cpu);
11980
11981 #ifdef CONFIG_NUMA
11982@@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void)
11983 switch_to_new_gdt(cpu);
11984 loadsegment(fs, 0);
11985
11986- load_idt((const struct desc_ptr *)&idt_descr);
11987+ load_idt(&idt_descr);
11988
11989 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
11990 syscall_init();
11991@@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void)
11992 wrmsrl(MSR_KERNEL_GS_BASE, 0);
11993 barrier();
11994
11995- x86_configure_nx();
11996 if (cpu != 0)
11997 enable_x2apic();
11998
11999@@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void)
12000 {
12001 int cpu = smp_processor_id();
12002 struct task_struct *curr = current;
12003- struct tss_struct *t = &per_cpu(init_tss, cpu);
12004+ struct tss_struct *t = init_tss + cpu;
12005 struct thread_struct *thread = &curr->thread;
12006
12007 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12008diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
12009index ed6086e..a1dcf29 100644
12010--- a/arch/x86/kernel/cpu/intel.c
12011+++ b/arch/x86/kernel/cpu/intel.c
12012@@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug(void)
12013 * Update the IDT descriptor and reload the IDT so that
12014 * it uses the read-only mapped virtual address.
12015 */
12016- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12017+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12018 load_idt(&idt_descr);
12019 }
12020 #endif
12021diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12022index 0ed633c..82cef2a 100644
12023--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
12024+++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12025@@ -215,7 +215,9 @@ static int inject_init(void)
12026 if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
12027 return -ENOMEM;
12028 printk(KERN_INFO "Machine check injector initialized\n");
12029- mce_chrdev_ops.write = mce_write;
12030+ pax_open_kernel();
12031+ *(void **)&mce_chrdev_ops.write = mce_write;
12032+ pax_close_kernel();
12033 register_die_notifier(&mce_raise_nb);
12034 return 0;
12035 }
12036diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
12037index 08363b0..ee26113 100644
12038--- a/arch/x86/kernel/cpu/mcheck/mce.c
12039+++ b/arch/x86/kernel/cpu/mcheck/mce.c
12040@@ -42,6 +42,7 @@
12041 #include <asm/processor.h>
12042 #include <asm/mce.h>
12043 #include <asm/msr.h>
12044+#include <asm/local.h>
12045
12046 #include "mce-internal.h"
12047
12048@@ -205,7 +206,7 @@ static void print_mce(struct mce *m)
12049 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12050 m->cs, m->ip);
12051
12052- if (m->cs == __KERNEL_CS)
12053+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12054 print_symbol("{%s}", m->ip);
12055 pr_cont("\n");
12056 }
12057@@ -233,10 +234,10 @@ static void print_mce(struct mce *m)
12058
12059 #define PANIC_TIMEOUT 5 /* 5 seconds */
12060
12061-static atomic_t mce_paniced;
12062+static atomic_unchecked_t mce_paniced;
12063
12064 static int fake_panic;
12065-static atomic_t mce_fake_paniced;
12066+static atomic_unchecked_t mce_fake_paniced;
12067
12068 /* Panic in progress. Enable interrupts and wait for final IPI */
12069 static void wait_for_panic(void)
12070@@ -260,7 +261,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12071 /*
12072 * Make sure only one CPU runs in machine check panic
12073 */
12074- if (atomic_inc_return(&mce_paniced) > 1)
12075+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12076 wait_for_panic();
12077 barrier();
12078
12079@@ -268,7 +269,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12080 console_verbose();
12081 } else {
12082 /* Don't log too much for fake panic */
12083- if (atomic_inc_return(&mce_fake_paniced) > 1)
12084+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12085 return;
12086 }
12087 /* First print corrected ones that are still unlogged */
12088@@ -610,7 +611,7 @@ static int mce_timed_out(u64 *t)
12089 * might have been modified by someone else.
12090 */
12091 rmb();
12092- if (atomic_read(&mce_paniced))
12093+ if (atomic_read_unchecked(&mce_paniced))
12094 wait_for_panic();
12095 if (!monarch_timeout)
12096 goto out;
12097@@ -1392,7 +1393,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
12098 }
12099
12100 /* Call the installed machine check handler for this CPU setup. */
12101-void (*machine_check_vector)(struct pt_regs *, long error_code) =
12102+void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
12103 unexpected_machine_check;
12104
12105 /*
12106@@ -1415,7 +1416,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12107 return;
12108 }
12109
12110+ pax_open_kernel();
12111 machine_check_vector = do_machine_check;
12112+ pax_close_kernel();
12113
12114 __mcheck_cpu_init_generic();
12115 __mcheck_cpu_init_vendor(c);
12116@@ -1429,7 +1432,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12117 */
12118
12119 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
12120-static int mce_chrdev_open_count; /* #times opened */
12121+static local_t mce_chrdev_open_count; /* #times opened */
12122 static int mce_chrdev_open_exclu; /* already open exclusive? */
12123
12124 static int mce_chrdev_open(struct inode *inode, struct file *file)
12125@@ -1437,7 +1440,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12126 spin_lock(&mce_chrdev_state_lock);
12127
12128 if (mce_chrdev_open_exclu ||
12129- (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
12130+ (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
12131 spin_unlock(&mce_chrdev_state_lock);
12132
12133 return -EBUSY;
12134@@ -1445,7 +1448,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12135
12136 if (file->f_flags & O_EXCL)
12137 mce_chrdev_open_exclu = 1;
12138- mce_chrdev_open_count++;
12139+ local_inc(&mce_chrdev_open_count);
12140
12141 spin_unlock(&mce_chrdev_state_lock);
12142
12143@@ -1456,7 +1459,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
12144 {
12145 spin_lock(&mce_chrdev_state_lock);
12146
12147- mce_chrdev_open_count--;
12148+ local_dec(&mce_chrdev_open_count);
12149 mce_chrdev_open_exclu = 0;
12150
12151 spin_unlock(&mce_chrdev_state_lock);
12152@@ -2147,7 +2150,7 @@ struct dentry *mce_get_debugfs_dir(void)
12153 static void mce_reset(void)
12154 {
12155 cpu_missing = 0;
12156- atomic_set(&mce_fake_paniced, 0);
12157+ atomic_set_unchecked(&mce_fake_paniced, 0);
12158 atomic_set(&mce_executing, 0);
12159 atomic_set(&mce_callin, 0);
12160 atomic_set(&global_nwo, 0);
12161diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
12162index 5c0e653..1e82c7c 100644
12163--- a/arch/x86/kernel/cpu/mcheck/p5.c
12164+++ b/arch/x86/kernel/cpu/mcheck/p5.c
12165@@ -50,7 +50,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
12166 if (!cpu_has(c, X86_FEATURE_MCE))
12167 return;
12168
12169+ pax_open_kernel();
12170 machine_check_vector = pentium_machine_check;
12171+ pax_close_kernel();
12172 /* Make sure the vector pointer is visible before we enable MCEs: */
12173 wmb();
12174
12175diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
12176index 54060f5..e6ba93d 100644
12177--- a/arch/x86/kernel/cpu/mcheck/winchip.c
12178+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
12179@@ -24,7 +24,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
12180 {
12181 u32 lo, hi;
12182
12183+ pax_open_kernel();
12184 machine_check_vector = winchip_machine_check;
12185+ pax_close_kernel();
12186 /* Make sure the vector pointer is visible before we enable MCEs: */
12187 wmb();
12188
12189diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
12190index 6b96110..0da73eb 100644
12191--- a/arch/x86/kernel/cpu/mtrr/main.c
12192+++ b/arch/x86/kernel/cpu/mtrr/main.c
12193@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
12194 u64 size_or_mask, size_and_mask;
12195 static bool mtrr_aps_delayed_init;
12196
12197-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12198+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12199
12200 const struct mtrr_ops *mtrr_if;
12201
12202diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
12203index df5e41f..816c719 100644
12204--- a/arch/x86/kernel/cpu/mtrr/mtrr.h
12205+++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
12206@@ -25,7 +25,7 @@ struct mtrr_ops {
12207 int (*validate_add_page)(unsigned long base, unsigned long size,
12208 unsigned int type);
12209 int (*have_wrcomb)(void);
12210-};
12211+} __do_const;
12212
12213 extern int generic_get_free_region(unsigned long base, unsigned long size,
12214 int replace_reg);
12215diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
12216index cfa62ec..9250dd7 100644
12217--- a/arch/x86/kernel/cpu/perf_event.c
12218+++ b/arch/x86/kernel/cpu/perf_event.c
12219@@ -795,6 +795,8 @@ static int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
12220 int i, j, w, wmax, num = 0;
12221 struct hw_perf_event *hwc;
12222
12223+ pax_track_stack();
12224+
12225 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
12226
12227 for (i = 0; i < n; i++) {
12228@@ -1919,7 +1921,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
12229 break;
12230
12231 perf_callchain_store(entry, frame.return_address);
12232- fp = frame.next_frame;
12233+ fp = (const void __force_user *)frame.next_frame;
12234 }
12235 }
12236
12237diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
12238index 764c7c2..c5d9c7b 100644
12239--- a/arch/x86/kernel/crash.c
12240+++ b/arch/x86/kernel/crash.c
12241@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, struct die_args *args)
12242 regs = args->regs;
12243
12244 #ifdef CONFIG_X86_32
12245- if (!user_mode_vm(regs)) {
12246+ if (!user_mode(regs)) {
12247 crash_fixup_ss_esp(&fixed_regs, regs);
12248 regs = &fixed_regs;
12249 }
12250diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
12251index 37250fe..bf2ec74 100644
12252--- a/arch/x86/kernel/doublefault_32.c
12253+++ b/arch/x86/kernel/doublefault_32.c
12254@@ -11,7 +11,7 @@
12255
12256 #define DOUBLEFAULT_STACKSIZE (1024)
12257 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
12258-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
12259+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
12260
12261 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
12262
12263@@ -21,7 +21,7 @@ static void doublefault_fn(void)
12264 unsigned long gdt, tss;
12265
12266 store_gdt(&gdt_desc);
12267- gdt = gdt_desc.address;
12268+ gdt = (unsigned long)gdt_desc.address;
12269
12270 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
12271
12272@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
12273 /* 0x2 bit is always set */
12274 .flags = X86_EFLAGS_SF | 0x2,
12275 .sp = STACK_START,
12276- .es = __USER_DS,
12277+ .es = __KERNEL_DS,
12278 .cs = __KERNEL_CS,
12279 .ss = __KERNEL_DS,
12280- .ds = __USER_DS,
12281+ .ds = __KERNEL_DS,
12282 .fs = __KERNEL_PERCPU,
12283
12284 .__cr3 = __pa_nodebug(swapper_pg_dir),
12285diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
12286index 1aae78f..aab3a3d 100644
12287--- a/arch/x86/kernel/dumpstack.c
12288+++ b/arch/x86/kernel/dumpstack.c
12289@@ -2,6 +2,9 @@
12290 * Copyright (C) 1991, 1992 Linus Torvalds
12291 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
12292 */
12293+#ifdef CONFIG_GRKERNSEC_HIDESYM
12294+#define __INCLUDED_BY_HIDESYM 1
12295+#endif
12296 #include <linux/kallsyms.h>
12297 #include <linux/kprobes.h>
12298 #include <linux/uaccess.h>
12299@@ -35,9 +38,8 @@ void printk_address(unsigned long address, int reliable)
12300 static void
12301 print_ftrace_graph_addr(unsigned long addr, void *data,
12302 const struct stacktrace_ops *ops,
12303- struct thread_info *tinfo, int *graph)
12304+ struct task_struct *task, int *graph)
12305 {
12306- struct task_struct *task = tinfo->task;
12307 unsigned long ret_addr;
12308 int index = task->curr_ret_stack;
12309
12310@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12311 static inline void
12312 print_ftrace_graph_addr(unsigned long addr, void *data,
12313 const struct stacktrace_ops *ops,
12314- struct thread_info *tinfo, int *graph)
12315+ struct task_struct *task, int *graph)
12316 { }
12317 #endif
12318
12319@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12320 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
12321 */
12322
12323-static inline int valid_stack_ptr(struct thread_info *tinfo,
12324- void *p, unsigned int size, void *end)
12325+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
12326 {
12327- void *t = tinfo;
12328 if (end) {
12329 if (p < end && p >= (end-THREAD_SIZE))
12330 return 1;
12331@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
12332 }
12333
12334 unsigned long
12335-print_context_stack(struct thread_info *tinfo,
12336+print_context_stack(struct task_struct *task, void *stack_start,
12337 unsigned long *stack, unsigned long bp,
12338 const struct stacktrace_ops *ops, void *data,
12339 unsigned long *end, int *graph)
12340 {
12341 struct stack_frame *frame = (struct stack_frame *)bp;
12342
12343- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
12344+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
12345 unsigned long addr;
12346
12347 addr = *stack;
12348@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *tinfo,
12349 } else {
12350 ops->address(data, addr, 0);
12351 }
12352- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12353+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12354 }
12355 stack++;
12356 }
12357@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *tinfo,
12358 EXPORT_SYMBOL_GPL(print_context_stack);
12359
12360 unsigned long
12361-print_context_stack_bp(struct thread_info *tinfo,
12362+print_context_stack_bp(struct task_struct *task, void *stack_start,
12363 unsigned long *stack, unsigned long bp,
12364 const struct stacktrace_ops *ops, void *data,
12365 unsigned long *end, int *graph)
12366@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12367 struct stack_frame *frame = (struct stack_frame *)bp;
12368 unsigned long *ret_addr = &frame->return_address;
12369
12370- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
12371+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
12372 unsigned long addr = *ret_addr;
12373
12374 if (!__kernel_text_address(addr))
12375@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12376 ops->address(data, addr, 1);
12377 frame = frame->next_frame;
12378 ret_addr = &frame->return_address;
12379- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12380+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12381 }
12382
12383 return (unsigned long)frame;
12384@@ -186,7 +186,7 @@ void dump_stack(void)
12385
12386 bp = stack_frame(current, NULL);
12387 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
12388- current->pid, current->comm, print_tainted(),
12389+ task_pid_nr(current), current->comm, print_tainted(),
12390 init_utsname()->release,
12391 (int)strcspn(init_utsname()->version, " "),
12392 init_utsname()->version);
12393@@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void)
12394 }
12395 EXPORT_SYMBOL_GPL(oops_begin);
12396
12397+extern void gr_handle_kernel_exploit(void);
12398+
12399 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12400 {
12401 if (regs && kexec_should_crash(current))
12402@@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12403 panic("Fatal exception in interrupt");
12404 if (panic_on_oops)
12405 panic("Fatal exception");
12406- do_exit(signr);
12407+
12408+ gr_handle_kernel_exploit();
12409+
12410+ do_group_exit(signr);
12411 }
12412
12413 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12414@@ -269,7 +274,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12415
12416 show_registers(regs);
12417 #ifdef CONFIG_X86_32
12418- if (user_mode_vm(regs)) {
12419+ if (user_mode(regs)) {
12420 sp = regs->sp;
12421 ss = regs->ss & 0xffff;
12422 } else {
12423@@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs *regs, long err)
12424 unsigned long flags = oops_begin();
12425 int sig = SIGSEGV;
12426
12427- if (!user_mode_vm(regs))
12428+ if (!user_mode(regs))
12429 report_bug(regs->ip, regs);
12430
12431 if (__die(str, regs, err))
12432diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
12433index 3b97a80..667ce7a 100644
12434--- a/arch/x86/kernel/dumpstack_32.c
12435+++ b/arch/x86/kernel/dumpstack_32.c
12436@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12437 bp = stack_frame(task, regs);
12438
12439 for (;;) {
12440- struct thread_info *context;
12441+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12442
12443- context = (struct thread_info *)
12444- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
12445- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
12446+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12447
12448- stack = (unsigned long *)context->previous_esp;
12449- if (!stack)
12450+ if (stack_start == task_stack_page(task))
12451 break;
12452+ stack = *(unsigned long **)stack_start;
12453 if (ops->stack(data, "IRQ") < 0)
12454 break;
12455 touch_nmi_watchdog();
12456@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs)
12457 * When in-kernel, we also print out the stack and code at the
12458 * time of the fault..
12459 */
12460- if (!user_mode_vm(regs)) {
12461+ if (!user_mode(regs)) {
12462 unsigned int code_prologue = code_bytes * 43 / 64;
12463 unsigned int code_len = code_bytes;
12464 unsigned char c;
12465 u8 *ip;
12466+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
12467
12468 printk(KERN_EMERG "Stack:\n");
12469 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
12470
12471 printk(KERN_EMERG "Code: ");
12472
12473- ip = (u8 *)regs->ip - code_prologue;
12474+ ip = (u8 *)regs->ip - code_prologue + cs_base;
12475 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
12476 /* try starting at IP */
12477- ip = (u8 *)regs->ip;
12478+ ip = (u8 *)regs->ip + cs_base;
12479 code_len = code_len - code_prologue + 1;
12480 }
12481 for (i = 0; i < code_len; i++, ip++) {
12482@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs)
12483 printk(" Bad EIP value.");
12484 break;
12485 }
12486- if (ip == (u8 *)regs->ip)
12487+ if (ip == (u8 *)regs->ip + cs_base)
12488 printk("<%02x> ", c);
12489 else
12490 printk("%02x ", c);
12491@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
12492 {
12493 unsigned short ud2;
12494
12495+ ip = ktla_ktva(ip);
12496 if (ip < PAGE_OFFSET)
12497 return 0;
12498 if (probe_kernel_address((unsigned short *)ip, ud2))
12499@@ -139,3 +139,15 @@ int is_valid_bugaddr(unsigned long ip)
12500
12501 return ud2 == 0x0b0f;
12502 }
12503+
12504+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12505+void pax_check_alloca(unsigned long size)
12506+{
12507+ unsigned long sp = (unsigned long)&sp, stack_left;
12508+
12509+ /* all kernel stacks are of the same size */
12510+ stack_left = sp & (THREAD_SIZE - 1);
12511+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12512+}
12513+EXPORT_SYMBOL(pax_check_alloca);
12514+#endif
12515diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
12516index 19853ad..508ca79 100644
12517--- a/arch/x86/kernel/dumpstack_64.c
12518+++ b/arch/x86/kernel/dumpstack_64.c
12519@@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12520 unsigned long *irq_stack_end =
12521 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
12522 unsigned used = 0;
12523- struct thread_info *tinfo;
12524 int graph = 0;
12525 unsigned long dummy;
12526+ void *stack_start;
12527
12528 if (!task)
12529 task = current;
12530@@ -142,10 +142,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12531 * current stack address. If the stacks consist of nested
12532 * exceptions
12533 */
12534- tinfo = task_thread_info(task);
12535 for (;;) {
12536 char *id;
12537 unsigned long *estack_end;
12538+
12539 estack_end = in_exception_stack(cpu, (unsigned long)stack,
12540 &used, &id);
12541
12542@@ -153,7 +153,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12543 if (ops->stack(data, id) < 0)
12544 break;
12545
12546- bp = ops->walk_stack(tinfo, stack, bp, ops,
12547+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
12548 data, estack_end, &graph);
12549 ops->stack(data, "<EOE>");
12550 /*
12551@@ -172,7 +172,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12552 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
12553 if (ops->stack(data, "IRQ") < 0)
12554 break;
12555- bp = ops->walk_stack(tinfo, stack, bp,
12556+ bp = ops->walk_stack(task, irq_stack, stack, bp,
12557 ops, data, irq_stack_end, &graph);
12558 /*
12559 * We link to the next stack (which would be
12560@@ -191,7 +191,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12561 /*
12562 * This handles the process stack:
12563 */
12564- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
12565+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12566+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12567 put_cpu();
12568 }
12569 EXPORT_SYMBOL(dump_trace);
12570@@ -305,3 +306,50 @@ int is_valid_bugaddr(unsigned long ip)
12571
12572 return ud2 == 0x0b0f;
12573 }
12574+
12575+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12576+void pax_check_alloca(unsigned long size)
12577+{
12578+ unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
12579+ unsigned cpu, used;
12580+ char *id;
12581+
12582+ /* check the process stack first */
12583+ stack_start = (unsigned long)task_stack_page(current);
12584+ stack_end = stack_start + THREAD_SIZE;
12585+ if (likely(stack_start <= sp && sp < stack_end)) {
12586+ unsigned long stack_left = sp & (THREAD_SIZE - 1);
12587+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12588+ return;
12589+ }
12590+
12591+ cpu = get_cpu();
12592+
12593+ /* check the irq stacks */
12594+ stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
12595+ stack_start = stack_end - IRQ_STACK_SIZE;
12596+ if (stack_start <= sp && sp < stack_end) {
12597+ unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
12598+ put_cpu();
12599+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12600+ return;
12601+ }
12602+
12603+ /* check the exception stacks */
12604+ used = 0;
12605+ stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
12606+ stack_start = stack_end - EXCEPTION_STKSZ;
12607+ if (stack_end && stack_start <= sp && sp < stack_end) {
12608+ unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
12609+ put_cpu();
12610+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
12611+ return;
12612+ }
12613+
12614+ put_cpu();
12615+
12616+ /* unknown stack */
12617+ BUG();
12618+}
12619+EXPORT_SYMBOL(pax_check_alloca);
12620+#endif
12621diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
12622index cd28a35..2601699 100644
12623--- a/arch/x86/kernel/early_printk.c
12624+++ b/arch/x86/kernel/early_printk.c
12625@@ -7,6 +7,7 @@
12626 #include <linux/pci_regs.h>
12627 #include <linux/pci_ids.h>
12628 #include <linux/errno.h>
12629+#include <linux/sched.h>
12630 #include <asm/io.h>
12631 #include <asm/processor.h>
12632 #include <asm/fcntl.h>
12633@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char *fmt, ...)
12634 int n;
12635 va_list ap;
12636
12637+ pax_track_stack();
12638+
12639 va_start(ap, fmt);
12640 n = vscnprintf(buf, sizeof(buf), fmt, ap);
12641 early_console->write(early_console, buf, n);
12642diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
12643index f3f6f53..0841b66 100644
12644--- a/arch/x86/kernel/entry_32.S
12645+++ b/arch/x86/kernel/entry_32.S
12646@@ -186,13 +186,146 @@
12647 /*CFI_REL_OFFSET gs, PT_GS*/
12648 .endm
12649 .macro SET_KERNEL_GS reg
12650+
12651+#ifdef CONFIG_CC_STACKPROTECTOR
12652 movl $(__KERNEL_STACK_CANARY), \reg
12653+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
12654+ movl $(__USER_DS), \reg
12655+#else
12656+ xorl \reg, \reg
12657+#endif
12658+
12659 movl \reg, %gs
12660 .endm
12661
12662 #endif /* CONFIG_X86_32_LAZY_GS */
12663
12664-.macro SAVE_ALL
12665+.macro pax_enter_kernel
12666+#ifdef CONFIG_PAX_KERNEXEC
12667+ call pax_enter_kernel
12668+#endif
12669+.endm
12670+
12671+.macro pax_exit_kernel
12672+#ifdef CONFIG_PAX_KERNEXEC
12673+ call pax_exit_kernel
12674+#endif
12675+.endm
12676+
12677+#ifdef CONFIG_PAX_KERNEXEC
12678+ENTRY(pax_enter_kernel)
12679+#ifdef CONFIG_PARAVIRT
12680+ pushl %eax
12681+ pushl %ecx
12682+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
12683+ mov %eax, %esi
12684+#else
12685+ mov %cr0, %esi
12686+#endif
12687+ bts $16, %esi
12688+ jnc 1f
12689+ mov %cs, %esi
12690+ cmp $__KERNEL_CS, %esi
12691+ jz 3f
12692+ ljmp $__KERNEL_CS, $3f
12693+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
12694+2:
12695+#ifdef CONFIG_PARAVIRT
12696+ mov %esi, %eax
12697+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
12698+#else
12699+ mov %esi, %cr0
12700+#endif
12701+3:
12702+#ifdef CONFIG_PARAVIRT
12703+ popl %ecx
12704+ popl %eax
12705+#endif
12706+ ret
12707+ENDPROC(pax_enter_kernel)
12708+
12709+ENTRY(pax_exit_kernel)
12710+#ifdef CONFIG_PARAVIRT
12711+ pushl %eax
12712+ pushl %ecx
12713+#endif
12714+ mov %cs, %esi
12715+ cmp $__KERNEXEC_KERNEL_CS, %esi
12716+ jnz 2f
12717+#ifdef CONFIG_PARAVIRT
12718+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
12719+ mov %eax, %esi
12720+#else
12721+ mov %cr0, %esi
12722+#endif
12723+ btr $16, %esi
12724+ ljmp $__KERNEL_CS, $1f
12725+1:
12726+#ifdef CONFIG_PARAVIRT
12727+ mov %esi, %eax
12728+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
12729+#else
12730+ mov %esi, %cr0
12731+#endif
12732+2:
12733+#ifdef CONFIG_PARAVIRT
12734+ popl %ecx
12735+ popl %eax
12736+#endif
12737+ ret
12738+ENDPROC(pax_exit_kernel)
12739+#endif
12740+
12741+.macro pax_erase_kstack
12742+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12743+ call pax_erase_kstack
12744+#endif
12745+.endm
12746+
12747+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12748+/*
12749+ * ebp: thread_info
12750+ * ecx, edx: can be clobbered
12751+ */
12752+ENTRY(pax_erase_kstack)
12753+ pushl %edi
12754+ pushl %eax
12755+
12756+ mov TI_lowest_stack(%ebp), %edi
12757+ mov $-0xBEEF, %eax
12758+ std
12759+
12760+1: mov %edi, %ecx
12761+ and $THREAD_SIZE_asm - 1, %ecx
12762+ shr $2, %ecx
12763+ repne scasl
12764+ jecxz 2f
12765+
12766+ cmp $2*16, %ecx
12767+ jc 2f
12768+
12769+ mov $2*16, %ecx
12770+ repe scasl
12771+ jecxz 2f
12772+ jne 1b
12773+
12774+2: cld
12775+ mov %esp, %ecx
12776+ sub %edi, %ecx
12777+ shr $2, %ecx
12778+ rep stosl
12779+
12780+ mov TI_task_thread_sp0(%ebp), %edi
12781+ sub $128, %edi
12782+ mov %edi, TI_lowest_stack(%ebp)
12783+
12784+ popl %eax
12785+ popl %edi
12786+ ret
12787+ENDPROC(pax_erase_kstack)
12788+#endif
12789+
12790+.macro __SAVE_ALL _DS
12791 cld
12792 PUSH_GS
12793 pushl_cfi %fs
12794@@ -215,7 +348,7 @@
12795 CFI_REL_OFFSET ecx, 0
12796 pushl_cfi %ebx
12797 CFI_REL_OFFSET ebx, 0
12798- movl $(__USER_DS), %edx
12799+ movl $\_DS, %edx
12800 movl %edx, %ds
12801 movl %edx, %es
12802 movl $(__KERNEL_PERCPU), %edx
12803@@ -223,6 +356,15 @@
12804 SET_KERNEL_GS %edx
12805 .endm
12806
12807+.macro SAVE_ALL
12808+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
12809+ __SAVE_ALL __KERNEL_DS
12810+ pax_enter_kernel
12811+#else
12812+ __SAVE_ALL __USER_DS
12813+#endif
12814+.endm
12815+
12816 .macro RESTORE_INT_REGS
12817 popl_cfi %ebx
12818 CFI_RESTORE ebx
12819@@ -308,7 +450,7 @@ ENTRY(ret_from_fork)
12820 popfl_cfi
12821 jmp syscall_exit
12822 CFI_ENDPROC
12823-END(ret_from_fork)
12824+ENDPROC(ret_from_fork)
12825
12826 /*
12827 * Interrupt exit functions should be protected against kprobes
12828@@ -333,7 +475,15 @@ check_userspace:
12829 movb PT_CS(%esp), %al
12830 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
12831 cmpl $USER_RPL, %eax
12832+
12833+#ifdef CONFIG_PAX_KERNEXEC
12834+ jae resume_userspace
12835+
12836+ PAX_EXIT_KERNEL
12837+ jmp resume_kernel
12838+#else
12839 jb resume_kernel # not returning to v8086 or userspace
12840+#endif
12841
12842 ENTRY(resume_userspace)
12843 LOCKDEP_SYS_EXIT
12844@@ -345,8 +495,8 @@ ENTRY(resume_userspace)
12845 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
12846 # int/exception return?
12847 jne work_pending
12848- jmp restore_all
12849-END(ret_from_exception)
12850+ jmp restore_all_pax
12851+ENDPROC(ret_from_exception)
12852
12853 #ifdef CONFIG_PREEMPT
12854 ENTRY(resume_kernel)
12855@@ -361,7 +511,7 @@ need_resched:
12856 jz restore_all
12857 call preempt_schedule_irq
12858 jmp need_resched
12859-END(resume_kernel)
12860+ENDPROC(resume_kernel)
12861 #endif
12862 CFI_ENDPROC
12863 /*
12864@@ -395,23 +545,34 @@ sysenter_past_esp:
12865 /*CFI_REL_OFFSET cs, 0*/
12866 /*
12867 * Push current_thread_info()->sysenter_return to the stack.
12868- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
12869- * pushed above; +8 corresponds to copy_thread's esp0 setting.
12870 */
12871- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
12872+ pushl_cfi $0
12873 CFI_REL_OFFSET eip, 0
12874
12875 pushl_cfi %eax
12876 SAVE_ALL
12877+ GET_THREAD_INFO(%ebp)
12878+ movl TI_sysenter_return(%ebp),%ebp
12879+ movl %ebp,PT_EIP(%esp)
12880 ENABLE_INTERRUPTS(CLBR_NONE)
12881
12882 /*
12883 * Load the potential sixth argument from user stack.
12884 * Careful about security.
12885 */
12886+ movl PT_OLDESP(%esp),%ebp
12887+
12888+#ifdef CONFIG_PAX_MEMORY_UDEREF
12889+ mov PT_OLDSS(%esp),%ds
12890+1: movl %ds:(%ebp),%ebp
12891+ push %ss
12892+ pop %ds
12893+#else
12894 cmpl $__PAGE_OFFSET-3,%ebp
12895 jae syscall_fault
12896 1: movl (%ebp),%ebp
12897+#endif
12898+
12899 movl %ebp,PT_EBP(%esp)
12900 .section __ex_table,"a"
12901 .align 4
12902@@ -434,12 +595,24 @@ sysenter_do_call:
12903 testl $_TIF_ALLWORK_MASK, %ecx
12904 jne sysexit_audit
12905 sysenter_exit:
12906+
12907+#ifdef CONFIG_PAX_RANDKSTACK
12908+ pushl_cfi %eax
12909+ movl %esp, %eax
12910+ call pax_randomize_kstack
12911+ popl_cfi %eax
12912+#endif
12913+
12914+ pax_erase_kstack
12915+
12916 /* if something modifies registers it must also disable sysexit */
12917 movl PT_EIP(%esp), %edx
12918 movl PT_OLDESP(%esp), %ecx
12919 xorl %ebp,%ebp
12920 TRACE_IRQS_ON
12921 1: mov PT_FS(%esp), %fs
12922+2: mov PT_DS(%esp), %ds
12923+3: mov PT_ES(%esp), %es
12924 PTGS_TO_GS
12925 ENABLE_INTERRUPTS_SYSEXIT
12926
12927@@ -456,6 +629,9 @@ sysenter_audit:
12928 movl %eax,%edx /* 2nd arg: syscall number */
12929 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
12930 call audit_syscall_entry
12931+
12932+ pax_erase_kstack
12933+
12934 pushl_cfi %ebx
12935 movl PT_EAX(%esp),%eax /* reload syscall number */
12936 jmp sysenter_do_call
12937@@ -482,11 +658,17 @@ sysexit_audit:
12938
12939 CFI_ENDPROC
12940 .pushsection .fixup,"ax"
12941-2: movl $0,PT_FS(%esp)
12942+4: movl $0,PT_FS(%esp)
12943+ jmp 1b
12944+5: movl $0,PT_DS(%esp)
12945+ jmp 1b
12946+6: movl $0,PT_ES(%esp)
12947 jmp 1b
12948 .section __ex_table,"a"
12949 .align 4
12950- .long 1b,2b
12951+ .long 1b,4b
12952+ .long 2b,5b
12953+ .long 3b,6b
12954 .popsection
12955 PTGS_TO_GS_EX
12956 ENDPROC(ia32_sysenter_target)
12957@@ -519,6 +701,15 @@ syscall_exit:
12958 testl $_TIF_ALLWORK_MASK, %ecx # current->work
12959 jne syscall_exit_work
12960
12961+restore_all_pax:
12962+
12963+#ifdef CONFIG_PAX_RANDKSTACK
12964+ movl %esp, %eax
12965+ call pax_randomize_kstack
12966+#endif
12967+
12968+ pax_erase_kstack
12969+
12970 restore_all:
12971 TRACE_IRQS_IRET
12972 restore_all_notrace:
12973@@ -578,14 +769,34 @@ ldt_ss:
12974 * compensating for the offset by changing to the ESPFIX segment with
12975 * a base address that matches for the difference.
12976 */
12977-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
12978+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
12979 mov %esp, %edx /* load kernel esp */
12980 mov PT_OLDESP(%esp), %eax /* load userspace esp */
12981 mov %dx, %ax /* eax: new kernel esp */
12982 sub %eax, %edx /* offset (low word is 0) */
12983+#ifdef CONFIG_SMP
12984+ movl PER_CPU_VAR(cpu_number), %ebx
12985+ shll $PAGE_SHIFT_asm, %ebx
12986+ addl $cpu_gdt_table, %ebx
12987+#else
12988+ movl $cpu_gdt_table, %ebx
12989+#endif
12990 shr $16, %edx
12991- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
12992- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
12993+
12994+#ifdef CONFIG_PAX_KERNEXEC
12995+ mov %cr0, %esi
12996+ btr $16, %esi
12997+ mov %esi, %cr0
12998+#endif
12999+
13000+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13001+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
13002+
13003+#ifdef CONFIG_PAX_KERNEXEC
13004+ bts $16, %esi
13005+ mov %esi, %cr0
13006+#endif
13007+
13008 pushl_cfi $__ESPFIX_SS
13009 pushl_cfi %eax /* new kernel esp */
13010 /* Disable interrupts, but do not irqtrace this section: we
13011@@ -614,34 +825,28 @@ work_resched:
13012 movl TI_flags(%ebp), %ecx
13013 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13014 # than syscall tracing?
13015- jz restore_all
13016+ jz restore_all_pax
13017 testb $_TIF_NEED_RESCHED, %cl
13018 jnz work_resched
13019
13020 work_notifysig: # deal with pending signals and
13021 # notify-resume requests
13022+ movl %esp, %eax
13023 #ifdef CONFIG_VM86
13024 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13025- movl %esp, %eax
13026- jne work_notifysig_v86 # returning to kernel-space or
13027+ jz 1f # returning to kernel-space or
13028 # vm86-space
13029- xorl %edx, %edx
13030- call do_notify_resume
13031- jmp resume_userspace_sig
13032
13033- ALIGN
13034-work_notifysig_v86:
13035 pushl_cfi %ecx # save ti_flags for do_notify_resume
13036 call save_v86_state # %eax contains pt_regs pointer
13037 popl_cfi %ecx
13038 movl %eax, %esp
13039-#else
13040- movl %esp, %eax
13041+1:
13042 #endif
13043 xorl %edx, %edx
13044 call do_notify_resume
13045 jmp resume_userspace_sig
13046-END(work_pending)
13047+ENDPROC(work_pending)
13048
13049 # perform syscall exit tracing
13050 ALIGN
13051@@ -649,11 +854,14 @@ syscall_trace_entry:
13052 movl $-ENOSYS,PT_EAX(%esp)
13053 movl %esp, %eax
13054 call syscall_trace_enter
13055+
13056+ pax_erase_kstack
13057+
13058 /* What it returned is what we'll actually use. */
13059 cmpl $(nr_syscalls), %eax
13060 jnae syscall_call
13061 jmp syscall_exit
13062-END(syscall_trace_entry)
13063+ENDPROC(syscall_trace_entry)
13064
13065 # perform syscall exit tracing
13066 ALIGN
13067@@ -666,20 +874,24 @@ syscall_exit_work:
13068 movl %esp, %eax
13069 call syscall_trace_leave
13070 jmp resume_userspace
13071-END(syscall_exit_work)
13072+ENDPROC(syscall_exit_work)
13073 CFI_ENDPROC
13074
13075 RING0_INT_FRAME # can't unwind into user space anyway
13076 syscall_fault:
13077+#ifdef CONFIG_PAX_MEMORY_UDEREF
13078+ push %ss
13079+ pop %ds
13080+#endif
13081 GET_THREAD_INFO(%ebp)
13082 movl $-EFAULT,PT_EAX(%esp)
13083 jmp resume_userspace
13084-END(syscall_fault)
13085+ENDPROC(syscall_fault)
13086
13087 syscall_badsys:
13088 movl $-ENOSYS,PT_EAX(%esp)
13089 jmp resume_userspace
13090-END(syscall_badsys)
13091+ENDPROC(syscall_badsys)
13092 CFI_ENDPROC
13093 /*
13094 * End of kprobes section
13095@@ -753,6 +965,36 @@ ptregs_clone:
13096 CFI_ENDPROC
13097 ENDPROC(ptregs_clone)
13098
13099+ ALIGN;
13100+ENTRY(kernel_execve)
13101+ CFI_STARTPROC
13102+ pushl_cfi %ebp
13103+ sub $PT_OLDSS+4,%esp
13104+ pushl_cfi %edi
13105+ pushl_cfi %ecx
13106+ pushl_cfi %eax
13107+ lea 3*4(%esp),%edi
13108+ mov $PT_OLDSS/4+1,%ecx
13109+ xorl %eax,%eax
13110+ rep stosl
13111+ popl_cfi %eax
13112+ popl_cfi %ecx
13113+ popl_cfi %edi
13114+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13115+ pushl_cfi %esp
13116+ call sys_execve
13117+ add $4,%esp
13118+ CFI_ADJUST_CFA_OFFSET -4
13119+ GET_THREAD_INFO(%ebp)
13120+ test %eax,%eax
13121+ jz syscall_exit
13122+ add $PT_OLDSS+4,%esp
13123+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13124+ popl_cfi %ebp
13125+ ret
13126+ CFI_ENDPROC
13127+ENDPROC(kernel_execve)
13128+
13129 .macro FIXUP_ESPFIX_STACK
13130 /*
13131 * Switch back for ESPFIX stack to the normal zerobased stack
13132@@ -762,8 +1004,15 @@ ENDPROC(ptregs_clone)
13133 * normal stack and adjusts ESP with the matching offset.
13134 */
13135 /* fixup the stack */
13136- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13137- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
13138+#ifdef CONFIG_SMP
13139+ movl PER_CPU_VAR(cpu_number), %ebx
13140+ shll $PAGE_SHIFT_asm, %ebx
13141+ addl $cpu_gdt_table, %ebx
13142+#else
13143+ movl $cpu_gdt_table, %ebx
13144+#endif
13145+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
13146+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
13147 shl $16, %eax
13148 addl %esp, %eax /* the adjusted stack pointer */
13149 pushl_cfi $__KERNEL_DS
13150@@ -816,7 +1065,7 @@ vector=vector+1
13151 .endr
13152 2: jmp common_interrupt
13153 .endr
13154-END(irq_entries_start)
13155+ENDPROC(irq_entries_start)
13156
13157 .previous
13158 END(interrupt)
13159@@ -864,7 +1113,7 @@ ENTRY(coprocessor_error)
13160 pushl_cfi $do_coprocessor_error
13161 jmp error_code
13162 CFI_ENDPROC
13163-END(coprocessor_error)
13164+ENDPROC(coprocessor_error)
13165
13166 ENTRY(simd_coprocessor_error)
13167 RING0_INT_FRAME
13168@@ -885,7 +1134,7 @@ ENTRY(simd_coprocessor_error)
13169 #endif
13170 jmp error_code
13171 CFI_ENDPROC
13172-END(simd_coprocessor_error)
13173+ENDPROC(simd_coprocessor_error)
13174
13175 ENTRY(device_not_available)
13176 RING0_INT_FRAME
13177@@ -893,7 +1142,7 @@ ENTRY(device_not_available)
13178 pushl_cfi $do_device_not_available
13179 jmp error_code
13180 CFI_ENDPROC
13181-END(device_not_available)
13182+ENDPROC(device_not_available)
13183
13184 #ifdef CONFIG_PARAVIRT
13185 ENTRY(native_iret)
13186@@ -902,12 +1151,12 @@ ENTRY(native_iret)
13187 .align 4
13188 .long native_iret, iret_exc
13189 .previous
13190-END(native_iret)
13191+ENDPROC(native_iret)
13192
13193 ENTRY(native_irq_enable_sysexit)
13194 sti
13195 sysexit
13196-END(native_irq_enable_sysexit)
13197+ENDPROC(native_irq_enable_sysexit)
13198 #endif
13199
13200 ENTRY(overflow)
13201@@ -916,7 +1165,7 @@ ENTRY(overflow)
13202 pushl_cfi $do_overflow
13203 jmp error_code
13204 CFI_ENDPROC
13205-END(overflow)
13206+ENDPROC(overflow)
13207
13208 ENTRY(bounds)
13209 RING0_INT_FRAME
13210@@ -924,7 +1173,7 @@ ENTRY(bounds)
13211 pushl_cfi $do_bounds
13212 jmp error_code
13213 CFI_ENDPROC
13214-END(bounds)
13215+ENDPROC(bounds)
13216
13217 ENTRY(invalid_op)
13218 RING0_INT_FRAME
13219@@ -932,7 +1181,7 @@ ENTRY(invalid_op)
13220 pushl_cfi $do_invalid_op
13221 jmp error_code
13222 CFI_ENDPROC
13223-END(invalid_op)
13224+ENDPROC(invalid_op)
13225
13226 ENTRY(coprocessor_segment_overrun)
13227 RING0_INT_FRAME
13228@@ -940,35 +1189,35 @@ ENTRY(coprocessor_segment_overrun)
13229 pushl_cfi $do_coprocessor_segment_overrun
13230 jmp error_code
13231 CFI_ENDPROC
13232-END(coprocessor_segment_overrun)
13233+ENDPROC(coprocessor_segment_overrun)
13234
13235 ENTRY(invalid_TSS)
13236 RING0_EC_FRAME
13237 pushl_cfi $do_invalid_TSS
13238 jmp error_code
13239 CFI_ENDPROC
13240-END(invalid_TSS)
13241+ENDPROC(invalid_TSS)
13242
13243 ENTRY(segment_not_present)
13244 RING0_EC_FRAME
13245 pushl_cfi $do_segment_not_present
13246 jmp error_code
13247 CFI_ENDPROC
13248-END(segment_not_present)
13249+ENDPROC(segment_not_present)
13250
13251 ENTRY(stack_segment)
13252 RING0_EC_FRAME
13253 pushl_cfi $do_stack_segment
13254 jmp error_code
13255 CFI_ENDPROC
13256-END(stack_segment)
13257+ENDPROC(stack_segment)
13258
13259 ENTRY(alignment_check)
13260 RING0_EC_FRAME
13261 pushl_cfi $do_alignment_check
13262 jmp error_code
13263 CFI_ENDPROC
13264-END(alignment_check)
13265+ENDPROC(alignment_check)
13266
13267 ENTRY(divide_error)
13268 RING0_INT_FRAME
13269@@ -976,7 +1225,7 @@ ENTRY(divide_error)
13270 pushl_cfi $do_divide_error
13271 jmp error_code
13272 CFI_ENDPROC
13273-END(divide_error)
13274+ENDPROC(divide_error)
13275
13276 #ifdef CONFIG_X86_MCE
13277 ENTRY(machine_check)
13278@@ -985,7 +1234,7 @@ ENTRY(machine_check)
13279 pushl_cfi machine_check_vector
13280 jmp error_code
13281 CFI_ENDPROC
13282-END(machine_check)
13283+ENDPROC(machine_check)
13284 #endif
13285
13286 ENTRY(spurious_interrupt_bug)
13287@@ -994,7 +1243,7 @@ ENTRY(spurious_interrupt_bug)
13288 pushl_cfi $do_spurious_interrupt_bug
13289 jmp error_code
13290 CFI_ENDPROC
13291-END(spurious_interrupt_bug)
13292+ENDPROC(spurious_interrupt_bug)
13293 /*
13294 * End of kprobes section
13295 */
13296@@ -1109,7 +1358,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
13297
13298 ENTRY(mcount)
13299 ret
13300-END(mcount)
13301+ENDPROC(mcount)
13302
13303 ENTRY(ftrace_caller)
13304 cmpl $0, function_trace_stop
13305@@ -1138,7 +1387,7 @@ ftrace_graph_call:
13306 .globl ftrace_stub
13307 ftrace_stub:
13308 ret
13309-END(ftrace_caller)
13310+ENDPROC(ftrace_caller)
13311
13312 #else /* ! CONFIG_DYNAMIC_FTRACE */
13313
13314@@ -1174,7 +1423,7 @@ trace:
13315 popl %ecx
13316 popl %eax
13317 jmp ftrace_stub
13318-END(mcount)
13319+ENDPROC(mcount)
13320 #endif /* CONFIG_DYNAMIC_FTRACE */
13321 #endif /* CONFIG_FUNCTION_TRACER */
13322
13323@@ -1195,7 +1444,7 @@ ENTRY(ftrace_graph_caller)
13324 popl %ecx
13325 popl %eax
13326 ret
13327-END(ftrace_graph_caller)
13328+ENDPROC(ftrace_graph_caller)
13329
13330 .globl return_to_handler
13331 return_to_handler:
13332@@ -1209,7 +1458,6 @@ return_to_handler:
13333 jmp *%ecx
13334 #endif
13335
13336-.section .rodata,"a"
13337 #include "syscall_table_32.S"
13338
13339 syscall_table_size=(.-sys_call_table)
13340@@ -1255,15 +1503,18 @@ error_code:
13341 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13342 REG_TO_PTGS %ecx
13343 SET_KERNEL_GS %ecx
13344- movl $(__USER_DS), %ecx
13345+ movl $(__KERNEL_DS), %ecx
13346 movl %ecx, %ds
13347 movl %ecx, %es
13348+
13349+ pax_enter_kernel
13350+
13351 TRACE_IRQS_OFF
13352 movl %esp,%eax # pt_regs pointer
13353 call *%edi
13354 jmp ret_from_exception
13355 CFI_ENDPROC
13356-END(page_fault)
13357+ENDPROC(page_fault)
13358
13359 /*
13360 * Debug traps and NMI can happen at the one SYSENTER instruction
13361@@ -1305,7 +1556,7 @@ debug_stack_correct:
13362 call do_debug
13363 jmp ret_from_exception
13364 CFI_ENDPROC
13365-END(debug)
13366+ENDPROC(debug)
13367
13368 /*
13369 * NMI is doubly nasty. It can happen _while_ we're handling
13370@@ -1342,6 +1593,9 @@ nmi_stack_correct:
13371 xorl %edx,%edx # zero error code
13372 movl %esp,%eax # pt_regs pointer
13373 call do_nmi
13374+
13375+ pax_exit_kernel
13376+
13377 jmp restore_all_notrace
13378 CFI_ENDPROC
13379
13380@@ -1378,12 +1632,15 @@ nmi_espfix_stack:
13381 FIXUP_ESPFIX_STACK # %eax == %esp
13382 xorl %edx,%edx # zero error code
13383 call do_nmi
13384+
13385+ pax_exit_kernel
13386+
13387 RESTORE_REGS
13388 lss 12+4(%esp), %esp # back to espfix stack
13389 CFI_ADJUST_CFA_OFFSET -24
13390 jmp irq_return
13391 CFI_ENDPROC
13392-END(nmi)
13393+ENDPROC(nmi)
13394
13395 ENTRY(int3)
13396 RING0_INT_FRAME
13397@@ -1395,14 +1652,14 @@ ENTRY(int3)
13398 call do_int3
13399 jmp ret_from_exception
13400 CFI_ENDPROC
13401-END(int3)
13402+ENDPROC(int3)
13403
13404 ENTRY(general_protection)
13405 RING0_EC_FRAME
13406 pushl_cfi $do_general_protection
13407 jmp error_code
13408 CFI_ENDPROC
13409-END(general_protection)
13410+ENDPROC(general_protection)
13411
13412 #ifdef CONFIG_KVM_GUEST
13413 ENTRY(async_page_fault)
13414@@ -1410,7 +1667,7 @@ ENTRY(async_page_fault)
13415 pushl_cfi $do_async_page_fault
13416 jmp error_code
13417 CFI_ENDPROC
13418-END(async_page_fault)
13419+ENDPROC(async_page_fault)
13420 #endif
13421
13422 /*
13423diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
13424index 6419bb0..00440bf 100644
13425--- a/arch/x86/kernel/entry_64.S
13426+++ b/arch/x86/kernel/entry_64.S
13427@@ -55,6 +55,8 @@
13428 #include <asm/paravirt.h>
13429 #include <asm/ftrace.h>
13430 #include <asm/percpu.h>
13431+#include <asm/pgtable.h>
13432+#include <asm/alternative-asm.h>
13433
13434 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
13435 #include <linux/elf-em.h>
13436@@ -68,8 +70,9 @@
13437 #ifdef CONFIG_FUNCTION_TRACER
13438 #ifdef CONFIG_DYNAMIC_FTRACE
13439 ENTRY(mcount)
13440+ pax_force_retaddr
13441 retq
13442-END(mcount)
13443+ENDPROC(mcount)
13444
13445 ENTRY(ftrace_caller)
13446 cmpl $0, function_trace_stop
13447@@ -92,8 +95,9 @@ GLOBAL(ftrace_graph_call)
13448 #endif
13449
13450 GLOBAL(ftrace_stub)
13451+ pax_force_retaddr
13452 retq
13453-END(ftrace_caller)
13454+ENDPROC(ftrace_caller)
13455
13456 #else /* ! CONFIG_DYNAMIC_FTRACE */
13457 ENTRY(mcount)
13458@@ -112,6 +116,7 @@ ENTRY(mcount)
13459 #endif
13460
13461 GLOBAL(ftrace_stub)
13462+ pax_force_retaddr
13463 retq
13464
13465 trace:
13466@@ -121,12 +126,13 @@ trace:
13467 movq 8(%rbp), %rsi
13468 subq $MCOUNT_INSN_SIZE, %rdi
13469
13470+ pax_force_fptr ftrace_trace_function
13471 call *ftrace_trace_function
13472
13473 MCOUNT_RESTORE_FRAME
13474
13475 jmp ftrace_stub
13476-END(mcount)
13477+ENDPROC(mcount)
13478 #endif /* CONFIG_DYNAMIC_FTRACE */
13479 #endif /* CONFIG_FUNCTION_TRACER */
13480
13481@@ -146,8 +152,9 @@ ENTRY(ftrace_graph_caller)
13482
13483 MCOUNT_RESTORE_FRAME
13484
13485+ pax_force_retaddr
13486 retq
13487-END(ftrace_graph_caller)
13488+ENDPROC(ftrace_graph_caller)
13489
13490 GLOBAL(return_to_handler)
13491 subq $24, %rsp
13492@@ -163,6 +170,7 @@ GLOBAL(return_to_handler)
13493 movq 8(%rsp), %rdx
13494 movq (%rsp), %rax
13495 addq $24, %rsp
13496+ pax_force_fptr %rdi
13497 jmp *%rdi
13498 #endif
13499
13500@@ -178,6 +186,282 @@ ENTRY(native_usergs_sysret64)
13501 ENDPROC(native_usergs_sysret64)
13502 #endif /* CONFIG_PARAVIRT */
13503
13504+ .macro ljmpq sel, off
13505+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
13506+ .byte 0x48; ljmp *1234f(%rip)
13507+ .pushsection .rodata
13508+ .align 16
13509+ 1234: .quad \off; .word \sel
13510+ .popsection
13511+#else
13512+ pushq $\sel
13513+ pushq $\off
13514+ lretq
13515+#endif
13516+ .endm
13517+
13518+ .macro pax_enter_kernel
13519+ pax_set_fptr_mask
13520+#ifdef CONFIG_PAX_KERNEXEC
13521+ call pax_enter_kernel
13522+#endif
13523+ .endm
13524+
13525+ .macro pax_exit_kernel
13526+#ifdef CONFIG_PAX_KERNEXEC
13527+ call pax_exit_kernel
13528+#endif
13529+ .endm
13530+
13531+#ifdef CONFIG_PAX_KERNEXEC
13532+ENTRY(pax_enter_kernel)
13533+ pushq %rdi
13534+
13535+#ifdef CONFIG_PARAVIRT
13536+ PV_SAVE_REGS(CLBR_RDI)
13537+#endif
13538+
13539+ GET_CR0_INTO_RDI
13540+ bts $16,%rdi
13541+ jnc 3f
13542+ mov %cs,%edi
13543+ cmp $__KERNEL_CS,%edi
13544+ jnz 2f
13545+1:
13546+
13547+#ifdef CONFIG_PARAVIRT
13548+ PV_RESTORE_REGS(CLBR_RDI)
13549+#endif
13550+
13551+ popq %rdi
13552+ pax_force_retaddr
13553+ retq
13554+
13555+2: ljmpq __KERNEL_CS,1f
13556+3: ljmpq __KERNEXEC_KERNEL_CS,4f
13557+4: SET_RDI_INTO_CR0
13558+ jmp 1b
13559+ENDPROC(pax_enter_kernel)
13560+
13561+ENTRY(pax_exit_kernel)
13562+ pushq %rdi
13563+
13564+#ifdef CONFIG_PARAVIRT
13565+ PV_SAVE_REGS(CLBR_RDI)
13566+#endif
13567+
13568+ mov %cs,%rdi
13569+ cmp $__KERNEXEC_KERNEL_CS,%edi
13570+ jz 2f
13571+1:
13572+
13573+#ifdef CONFIG_PARAVIRT
13574+ PV_RESTORE_REGS(CLBR_RDI);
13575+#endif
13576+
13577+ popq %rdi
13578+ pax_force_retaddr
13579+ retq
13580+
13581+2: GET_CR0_INTO_RDI
13582+ btr $16,%rdi
13583+ ljmpq __KERNEL_CS,3f
13584+3: SET_RDI_INTO_CR0
13585+ jmp 1b
13586+#ifdef CONFIG_PARAVIRT
13587+ PV_RESTORE_REGS(CLBR_RDI);
13588+#endif
13589+
13590+ popq %rdi
13591+ pax_force_retaddr
13592+ retq
13593+ENDPROC(pax_exit_kernel)
13594+#endif
13595+
13596+ .macro pax_enter_kernel_user
13597+ pax_set_fptr_mask
13598+#ifdef CONFIG_PAX_MEMORY_UDEREF
13599+ call pax_enter_kernel_user
13600+#endif
13601+ .endm
13602+
13603+ .macro pax_exit_kernel_user
13604+#ifdef CONFIG_PAX_MEMORY_UDEREF
13605+ call pax_exit_kernel_user
13606+#endif
13607+#ifdef CONFIG_PAX_RANDKSTACK
13608+ push %rax
13609+ call pax_randomize_kstack
13610+ pop %rax
13611+#endif
13612+ .endm
13613+
13614+#ifdef CONFIG_PAX_MEMORY_UDEREF
13615+ENTRY(pax_enter_kernel_user)
13616+ pushq %rdi
13617+ pushq %rbx
13618+
13619+#ifdef CONFIG_PARAVIRT
13620+ PV_SAVE_REGS(CLBR_RDI)
13621+#endif
13622+
13623+ GET_CR3_INTO_RDI
13624+ mov %rdi,%rbx
13625+ add $__START_KERNEL_map,%rbx
13626+ sub phys_base(%rip),%rbx
13627+
13628+#ifdef CONFIG_PARAVIRT
13629+ pushq %rdi
13630+ cmpl $0, pv_info+PARAVIRT_enabled
13631+ jz 1f
13632+ i = 0
13633+ .rept USER_PGD_PTRS
13634+ mov i*8(%rbx),%rsi
13635+ mov $0,%sil
13636+ lea i*8(%rbx),%rdi
13637+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13638+ i = i + 1
13639+ .endr
13640+ jmp 2f
13641+1:
13642+#endif
13643+
13644+ i = 0
13645+ .rept USER_PGD_PTRS
13646+ movb $0,i*8(%rbx)
13647+ i = i + 1
13648+ .endr
13649+
13650+#ifdef CONFIG_PARAVIRT
13651+2: popq %rdi
13652+#endif
13653+ SET_RDI_INTO_CR3
13654+
13655+#ifdef CONFIG_PAX_KERNEXEC
13656+ GET_CR0_INTO_RDI
13657+ bts $16,%rdi
13658+ SET_RDI_INTO_CR0
13659+#endif
13660+
13661+#ifdef CONFIG_PARAVIRT
13662+ PV_RESTORE_REGS(CLBR_RDI)
13663+#endif
13664+
13665+ popq %rbx
13666+ popq %rdi
13667+ pax_force_retaddr
13668+ retq
13669+ENDPROC(pax_enter_kernel_user)
13670+
13671+ENTRY(pax_exit_kernel_user)
13672+ push %rdi
13673+
13674+#ifdef CONFIG_PARAVIRT
13675+ pushq %rbx
13676+ PV_SAVE_REGS(CLBR_RDI)
13677+#endif
13678+
13679+#ifdef CONFIG_PAX_KERNEXEC
13680+ GET_CR0_INTO_RDI
13681+ btr $16,%rdi
13682+ SET_RDI_INTO_CR0
13683+#endif
13684+
13685+ GET_CR3_INTO_RDI
13686+ add $__START_KERNEL_map,%rdi
13687+ sub phys_base(%rip),%rdi
13688+
13689+#ifdef CONFIG_PARAVIRT
13690+ cmpl $0, pv_info+PARAVIRT_enabled
13691+ jz 1f
13692+ mov %rdi,%rbx
13693+ i = 0
13694+ .rept USER_PGD_PTRS
13695+ mov i*8(%rbx),%rsi
13696+ mov $0x67,%sil
13697+ lea i*8(%rbx),%rdi
13698+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13699+ i = i + 1
13700+ .endr
13701+ jmp 2f
13702+1:
13703+#endif
13704+
13705+ i = 0
13706+ .rept USER_PGD_PTRS
13707+ movb $0x67,i*8(%rdi)
13708+ i = i + 1
13709+ .endr
13710+
13711+#ifdef CONFIG_PARAVIRT
13712+2: PV_RESTORE_REGS(CLBR_RDI)
13713+ popq %rbx
13714+#endif
13715+
13716+ popq %rdi
13717+ pax_force_retaddr
13718+ retq
13719+ENDPROC(pax_exit_kernel_user)
13720+#endif
13721+
13722+.macro pax_erase_kstack
13723+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13724+ call pax_erase_kstack
13725+#endif
13726+.endm
13727+
13728+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13729+/*
13730+ * r11: thread_info
13731+ * rcx, rdx: can be clobbered
13732+ */
13733+ENTRY(pax_erase_kstack)
13734+ pushq %rdi
13735+ pushq %rax
13736+ pushq %r11
13737+
13738+ GET_THREAD_INFO(%r11)
13739+ mov TI_lowest_stack(%r11), %rdi
13740+ mov $-0xBEEF, %rax
13741+ std
13742+
13743+1: mov %edi, %ecx
13744+ and $THREAD_SIZE_asm - 1, %ecx
13745+ shr $3, %ecx
13746+ repne scasq
13747+ jecxz 2f
13748+
13749+ cmp $2*8, %ecx
13750+ jc 2f
13751+
13752+ mov $2*8, %ecx
13753+ repe scasq
13754+ jecxz 2f
13755+ jne 1b
13756+
13757+2: cld
13758+ mov %esp, %ecx
13759+ sub %edi, %ecx
13760+
13761+ cmp $THREAD_SIZE_asm, %rcx
13762+ jb 3f
13763+ ud2
13764+3:
13765+
13766+ shr $3, %ecx
13767+ rep stosq
13768+
13769+ mov TI_task_thread_sp0(%r11), %rdi
13770+ sub $256, %rdi
13771+ mov %rdi, TI_lowest_stack(%r11)
13772+
13773+ popq %r11
13774+ popq %rax
13775+ popq %rdi
13776+ pax_force_retaddr
13777+ ret
13778+ENDPROC(pax_erase_kstack)
13779+#endif
13780
13781 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
13782 #ifdef CONFIG_TRACE_IRQFLAGS
13783@@ -231,8 +515,8 @@ ENDPROC(native_usergs_sysret64)
13784 .endm
13785
13786 .macro UNFAKE_STACK_FRAME
13787- addq $8*6, %rsp
13788- CFI_ADJUST_CFA_OFFSET -(6*8)
13789+ addq $8*6 + ARG_SKIP, %rsp
13790+ CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
13791 .endm
13792
13793 /*
13794@@ -319,7 +603,7 @@ ENDPROC(native_usergs_sysret64)
13795 movq %rsp, %rsi
13796
13797 leaq -RBP(%rsp),%rdi /* arg1 for handler */
13798- testl $3, CS(%rdi)
13799+ testb $3, CS(%rdi)
13800 je 1f
13801 SWAPGS
13802 /*
13803@@ -350,9 +634,10 @@ ENTRY(save_rest)
13804 movq_cfi r15, R15+16
13805 movq %r11, 8(%rsp) /* return address */
13806 FIXUP_TOP_OF_STACK %r11, 16
13807+ pax_force_retaddr
13808 ret
13809 CFI_ENDPROC
13810-END(save_rest)
13811+ENDPROC(save_rest)
13812
13813 /* save complete stack frame */
13814 .pushsection .kprobes.text, "ax"
13815@@ -381,9 +666,10 @@ ENTRY(save_paranoid)
13816 js 1f /* negative -> in kernel */
13817 SWAPGS
13818 xorl %ebx,%ebx
13819-1: ret
13820+1: pax_force_retaddr_bts
13821+ ret
13822 CFI_ENDPROC
13823-END(save_paranoid)
13824+ENDPROC(save_paranoid)
13825 .popsection
13826
13827 /*
13828@@ -405,7 +691,7 @@ ENTRY(ret_from_fork)
13829
13830 RESTORE_REST
13831
13832- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13833+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13834 je int_ret_from_sys_call
13835
13836 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
13837@@ -415,7 +701,7 @@ ENTRY(ret_from_fork)
13838 jmp ret_from_sys_call # go to the SYSRET fastpath
13839
13840 CFI_ENDPROC
13841-END(ret_from_fork)
13842+ENDPROC(ret_from_fork)
13843
13844 /*
13845 * System call entry. Up to 6 arguments in registers are supported.
13846@@ -451,7 +737,7 @@ END(ret_from_fork)
13847 ENTRY(system_call)
13848 CFI_STARTPROC simple
13849 CFI_SIGNAL_FRAME
13850- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
13851+ CFI_DEF_CFA rsp,0
13852 CFI_REGISTER rip,rcx
13853 /*CFI_REGISTER rflags,r11*/
13854 SWAPGS_UNSAFE_STACK
13855@@ -464,12 +750,13 @@ ENTRY(system_call_after_swapgs)
13856
13857 movq %rsp,PER_CPU_VAR(old_rsp)
13858 movq PER_CPU_VAR(kernel_stack),%rsp
13859+ SAVE_ARGS 8*6,0
13860+ pax_enter_kernel_user
13861 /*
13862 * No need to follow this irqs off/on section - it's straight
13863 * and short:
13864 */
13865 ENABLE_INTERRUPTS(CLBR_NONE)
13866- SAVE_ARGS 8,0
13867 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
13868 movq %rcx,RIP-ARGOFFSET(%rsp)
13869 CFI_REL_OFFSET rip,RIP-ARGOFFSET
13870@@ -479,7 +766,7 @@ ENTRY(system_call_after_swapgs)
13871 system_call_fastpath:
13872 cmpq $__NR_syscall_max,%rax
13873 ja badsys
13874- movq %r10,%rcx
13875+ movq R10-ARGOFFSET(%rsp),%rcx
13876 call *sys_call_table(,%rax,8) # XXX: rip relative
13877 movq %rax,RAX-ARGOFFSET(%rsp)
13878 /*
13879@@ -498,6 +785,8 @@ sysret_check:
13880 andl %edi,%edx
13881 jnz sysret_careful
13882 CFI_REMEMBER_STATE
13883+ pax_exit_kernel_user
13884+ pax_erase_kstack
13885 /*
13886 * sysretq will re-enable interrupts:
13887 */
13888@@ -549,14 +838,18 @@ badsys:
13889 * jump back to the normal fast path.
13890 */
13891 auditsys:
13892- movq %r10,%r9 /* 6th arg: 4th syscall arg */
13893+ movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
13894 movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
13895 movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
13896 movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
13897 movq %rax,%rsi /* 2nd arg: syscall number */
13898 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
13899 call audit_syscall_entry
13900+
13901+ pax_erase_kstack
13902+
13903 LOAD_ARGS 0 /* reload call-clobbered registers */
13904+ pax_set_fptr_mask
13905 jmp system_call_fastpath
13906
13907 /*
13908@@ -586,16 +879,20 @@ tracesys:
13909 FIXUP_TOP_OF_STACK %rdi
13910 movq %rsp,%rdi
13911 call syscall_trace_enter
13912+
13913+ pax_erase_kstack
13914+
13915 /*
13916 * Reload arg registers from stack in case ptrace changed them.
13917 * We don't reload %rax because syscall_trace_enter() returned
13918 * the value it wants us to use in the table lookup.
13919 */
13920 LOAD_ARGS ARGOFFSET, 1
13921+ pax_set_fptr_mask
13922 RESTORE_REST
13923 cmpq $__NR_syscall_max,%rax
13924 ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
13925- movq %r10,%rcx /* fixup for C */
13926+ movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
13927 call *sys_call_table(,%rax,8)
13928 movq %rax,RAX-ARGOFFSET(%rsp)
13929 /* Use IRET because user could have changed frame */
13930@@ -607,7 +904,7 @@ tracesys:
13931 GLOBAL(int_ret_from_sys_call)
13932 DISABLE_INTERRUPTS(CLBR_NONE)
13933 TRACE_IRQS_OFF
13934- testl $3,CS-ARGOFFSET(%rsp)
13935+ testb $3,CS-ARGOFFSET(%rsp)
13936 je retint_restore_args
13937 movl $_TIF_ALLWORK_MASK,%edi
13938 /* edi: mask to check */
13939@@ -664,7 +961,7 @@ int_restore_rest:
13940 TRACE_IRQS_OFF
13941 jmp int_with_check
13942 CFI_ENDPROC
13943-END(system_call)
13944+ENDPROC(system_call)
13945
13946 /*
13947 * Certain special system calls that need to save a complete full stack frame.
13948@@ -680,7 +977,7 @@ ENTRY(\label)
13949 call \func
13950 jmp ptregscall_common
13951 CFI_ENDPROC
13952-END(\label)
13953+ENDPROC(\label)
13954 .endm
13955
13956 PTREGSCALL stub_clone, sys_clone, %r8
13957@@ -698,9 +995,10 @@ ENTRY(ptregscall_common)
13958 movq_cfi_restore R12+8, r12
13959 movq_cfi_restore RBP+8, rbp
13960 movq_cfi_restore RBX+8, rbx
13961+ pax_force_retaddr
13962 ret $REST_SKIP /* pop extended registers */
13963 CFI_ENDPROC
13964-END(ptregscall_common)
13965+ENDPROC(ptregscall_common)
13966
13967 ENTRY(stub_execve)
13968 CFI_STARTPROC
13969@@ -715,7 +1013,7 @@ ENTRY(stub_execve)
13970 RESTORE_REST
13971 jmp int_ret_from_sys_call
13972 CFI_ENDPROC
13973-END(stub_execve)
13974+ENDPROC(stub_execve)
13975
13976 /*
13977 * sigreturn is special because it needs to restore all registers on return.
13978@@ -733,7 +1031,7 @@ ENTRY(stub_rt_sigreturn)
13979 RESTORE_REST
13980 jmp int_ret_from_sys_call
13981 CFI_ENDPROC
13982-END(stub_rt_sigreturn)
13983+ENDPROC(stub_rt_sigreturn)
13984
13985 /*
13986 * Build the entry stubs and pointer table with some assembler magic.
13987@@ -768,7 +1066,7 @@ vector=vector+1
13988 2: jmp common_interrupt
13989 .endr
13990 CFI_ENDPROC
13991-END(irq_entries_start)
13992+ENDPROC(irq_entries_start)
13993
13994 .previous
13995 END(interrupt)
13996@@ -789,6 +1087,16 @@ END(interrupt)
13997 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
13998 SAVE_ARGS_IRQ
13999 PARTIAL_FRAME 0
14000+#ifdef CONFIG_PAX_MEMORY_UDEREF
14001+ testb $3, CS(%rdi)
14002+ jnz 1f
14003+ pax_enter_kernel
14004+ jmp 2f
14005+1: pax_enter_kernel_user
14006+2:
14007+#else
14008+ pax_enter_kernel
14009+#endif
14010 call \func
14011 .endm
14012
14013@@ -820,7 +1128,7 @@ ret_from_intr:
14014
14015 exit_intr:
14016 GET_THREAD_INFO(%rcx)
14017- testl $3,CS-ARGOFFSET(%rsp)
14018+ testb $3,CS-ARGOFFSET(%rsp)
14019 je retint_kernel
14020
14021 /* Interrupt came from user space */
14022@@ -842,12 +1150,16 @@ retint_swapgs: /* return to user-space */
14023 * The iretq could re-enable interrupts:
14024 */
14025 DISABLE_INTERRUPTS(CLBR_ANY)
14026+ pax_exit_kernel_user
14027+ pax_erase_kstack
14028 TRACE_IRQS_IRETQ
14029 SWAPGS
14030 jmp restore_args
14031
14032 retint_restore_args: /* return to kernel space */
14033 DISABLE_INTERRUPTS(CLBR_ANY)
14034+ pax_exit_kernel
14035+ pax_force_retaddr RIP-ARGOFFSET
14036 /*
14037 * The iretq could re-enable interrupts:
14038 */
14039@@ -936,7 +1248,7 @@ ENTRY(retint_kernel)
14040 #endif
14041
14042 CFI_ENDPROC
14043-END(common_interrupt)
14044+ENDPROC(common_interrupt)
14045 /*
14046 * End of kprobes section
14047 */
14048@@ -952,7 +1264,7 @@ ENTRY(\sym)
14049 interrupt \do_sym
14050 jmp ret_from_intr
14051 CFI_ENDPROC
14052-END(\sym)
14053+ENDPROC(\sym)
14054 .endm
14055
14056 #ifdef CONFIG_SMP
14057@@ -1017,12 +1329,22 @@ ENTRY(\sym)
14058 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14059 call error_entry
14060 DEFAULT_FRAME 0
14061+#ifdef CONFIG_PAX_MEMORY_UDEREF
14062+ testb $3, CS(%rsp)
14063+ jnz 1f
14064+ pax_enter_kernel
14065+ jmp 2f
14066+1: pax_enter_kernel_user
14067+2:
14068+#else
14069+ pax_enter_kernel
14070+#endif
14071 movq %rsp,%rdi /* pt_regs pointer */
14072 xorl %esi,%esi /* no error code */
14073 call \do_sym
14074 jmp error_exit /* %ebx: no swapgs flag */
14075 CFI_ENDPROC
14076-END(\sym)
14077+ENDPROC(\sym)
14078 .endm
14079
14080 .macro paranoidzeroentry sym do_sym
14081@@ -1034,15 +1356,25 @@ ENTRY(\sym)
14082 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14083 call save_paranoid
14084 TRACE_IRQS_OFF
14085+#ifdef CONFIG_PAX_MEMORY_UDEREF
14086+ testb $3, CS(%rsp)
14087+ jnz 1f
14088+ pax_enter_kernel
14089+ jmp 2f
14090+1: pax_enter_kernel_user
14091+2:
14092+#else
14093+ pax_enter_kernel
14094+#endif
14095 movq %rsp,%rdi /* pt_regs pointer */
14096 xorl %esi,%esi /* no error code */
14097 call \do_sym
14098 jmp paranoid_exit /* %ebx: no swapgs flag */
14099 CFI_ENDPROC
14100-END(\sym)
14101+ENDPROC(\sym)
14102 .endm
14103
14104-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14105+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14106 .macro paranoidzeroentry_ist sym do_sym ist
14107 ENTRY(\sym)
14108 INTR_FRAME
14109@@ -1052,14 +1384,30 @@ ENTRY(\sym)
14110 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14111 call save_paranoid
14112 TRACE_IRQS_OFF
14113+#ifdef CONFIG_PAX_MEMORY_UDEREF
14114+ testb $3, CS(%rsp)
14115+ jnz 1f
14116+ pax_enter_kernel
14117+ jmp 2f
14118+1: pax_enter_kernel_user
14119+2:
14120+#else
14121+ pax_enter_kernel
14122+#endif
14123 movq %rsp,%rdi /* pt_regs pointer */
14124 xorl %esi,%esi /* no error code */
14125+#ifdef CONFIG_SMP
14126+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14127+ lea init_tss(%r12), %r12
14128+#else
14129+ lea init_tss(%rip), %r12
14130+#endif
14131 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14132 call \do_sym
14133 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14134 jmp paranoid_exit /* %ebx: no swapgs flag */
14135 CFI_ENDPROC
14136-END(\sym)
14137+ENDPROC(\sym)
14138 .endm
14139
14140 .macro errorentry sym do_sym
14141@@ -1070,13 +1418,23 @@ ENTRY(\sym)
14142 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14143 call error_entry
14144 DEFAULT_FRAME 0
14145+#ifdef CONFIG_PAX_MEMORY_UDEREF
14146+ testb $3, CS(%rsp)
14147+ jnz 1f
14148+ pax_enter_kernel
14149+ jmp 2f
14150+1: pax_enter_kernel_user
14151+2:
14152+#else
14153+ pax_enter_kernel
14154+#endif
14155 movq %rsp,%rdi /* pt_regs pointer */
14156 movq ORIG_RAX(%rsp),%rsi /* get error code */
14157 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14158 call \do_sym
14159 jmp error_exit /* %ebx: no swapgs flag */
14160 CFI_ENDPROC
14161-END(\sym)
14162+ENDPROC(\sym)
14163 .endm
14164
14165 /* error code is on the stack already */
14166@@ -1089,13 +1447,23 @@ ENTRY(\sym)
14167 call save_paranoid
14168 DEFAULT_FRAME 0
14169 TRACE_IRQS_OFF
14170+#ifdef CONFIG_PAX_MEMORY_UDEREF
14171+ testb $3, CS(%rsp)
14172+ jnz 1f
14173+ pax_enter_kernel
14174+ jmp 2f
14175+1: pax_enter_kernel_user
14176+2:
14177+#else
14178+ pax_enter_kernel
14179+#endif
14180 movq %rsp,%rdi /* pt_regs pointer */
14181 movq ORIG_RAX(%rsp),%rsi /* get error code */
14182 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14183 call \do_sym
14184 jmp paranoid_exit /* %ebx: no swapgs flag */
14185 CFI_ENDPROC
14186-END(\sym)
14187+ENDPROC(\sym)
14188 .endm
14189
14190 zeroentry divide_error do_divide_error
14191@@ -1125,9 +1493,10 @@ gs_change:
14192 2: mfence /* workaround */
14193 SWAPGS
14194 popfq_cfi
14195+ pax_force_retaddr
14196 ret
14197 CFI_ENDPROC
14198-END(native_load_gs_index)
14199+ENDPROC(native_load_gs_index)
14200
14201 .section __ex_table,"a"
14202 .align 8
14203@@ -1149,13 +1518,14 @@ ENTRY(kernel_thread_helper)
14204 * Here we are in the child and the registers are set as they were
14205 * at kernel_thread() invocation in the parent.
14206 */
14207+ pax_force_fptr %rsi
14208 call *%rsi
14209 # exit
14210 mov %eax, %edi
14211 call do_exit
14212 ud2 # padding for call trace
14213 CFI_ENDPROC
14214-END(kernel_thread_helper)
14215+ENDPROC(kernel_thread_helper)
14216
14217 /*
14218 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
14219@@ -1182,11 +1552,11 @@ ENTRY(kernel_execve)
14220 RESTORE_REST
14221 testq %rax,%rax
14222 je int_ret_from_sys_call
14223- RESTORE_ARGS
14224 UNFAKE_STACK_FRAME
14225+ pax_force_retaddr
14226 ret
14227 CFI_ENDPROC
14228-END(kernel_execve)
14229+ENDPROC(kernel_execve)
14230
14231 /* Call softirq on interrupt stack. Interrupts are off. */
14232 ENTRY(call_softirq)
14233@@ -1204,9 +1574,10 @@ ENTRY(call_softirq)
14234 CFI_DEF_CFA_REGISTER rsp
14235 CFI_ADJUST_CFA_OFFSET -8
14236 decl PER_CPU_VAR(irq_count)
14237+ pax_force_retaddr
14238 ret
14239 CFI_ENDPROC
14240-END(call_softirq)
14241+ENDPROC(call_softirq)
14242
14243 #ifdef CONFIG_XEN
14244 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
14245@@ -1244,7 +1615,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
14246 decl PER_CPU_VAR(irq_count)
14247 jmp error_exit
14248 CFI_ENDPROC
14249-END(xen_do_hypervisor_callback)
14250+ENDPROC(xen_do_hypervisor_callback)
14251
14252 /*
14253 * Hypervisor uses this for application faults while it executes.
14254@@ -1303,7 +1674,7 @@ ENTRY(xen_failsafe_callback)
14255 SAVE_ALL
14256 jmp error_exit
14257 CFI_ENDPROC
14258-END(xen_failsafe_callback)
14259+ENDPROC(xen_failsafe_callback)
14260
14261 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
14262 xen_hvm_callback_vector xen_evtchn_do_upcall
14263@@ -1352,16 +1723,31 @@ ENTRY(paranoid_exit)
14264 TRACE_IRQS_OFF
14265 testl %ebx,%ebx /* swapgs needed? */
14266 jnz paranoid_restore
14267- testl $3,CS(%rsp)
14268+ testb $3,CS(%rsp)
14269 jnz paranoid_userspace
14270+#ifdef CONFIG_PAX_MEMORY_UDEREF
14271+ pax_exit_kernel
14272+ TRACE_IRQS_IRETQ 0
14273+ SWAPGS_UNSAFE_STACK
14274+ RESTORE_ALL 8
14275+ pax_force_retaddr_bts
14276+ jmp irq_return
14277+#endif
14278 paranoid_swapgs:
14279+#ifdef CONFIG_PAX_MEMORY_UDEREF
14280+ pax_exit_kernel_user
14281+#else
14282+ pax_exit_kernel
14283+#endif
14284 TRACE_IRQS_IRETQ 0
14285 SWAPGS_UNSAFE_STACK
14286 RESTORE_ALL 8
14287 jmp irq_return
14288 paranoid_restore:
14289+ pax_exit_kernel
14290 TRACE_IRQS_IRETQ 0
14291 RESTORE_ALL 8
14292+ pax_force_retaddr_bts
14293 jmp irq_return
14294 paranoid_userspace:
14295 GET_THREAD_INFO(%rcx)
14296@@ -1390,7 +1776,7 @@ paranoid_schedule:
14297 TRACE_IRQS_OFF
14298 jmp paranoid_userspace
14299 CFI_ENDPROC
14300-END(paranoid_exit)
14301+ENDPROC(paranoid_exit)
14302
14303 /*
14304 * Exception entry point. This expects an error code/orig_rax on the stack.
14305@@ -1417,12 +1803,13 @@ ENTRY(error_entry)
14306 movq_cfi r14, R14+8
14307 movq_cfi r15, R15+8
14308 xorl %ebx,%ebx
14309- testl $3,CS+8(%rsp)
14310+ testb $3,CS+8(%rsp)
14311 je error_kernelspace
14312 error_swapgs:
14313 SWAPGS
14314 error_sti:
14315 TRACE_IRQS_OFF
14316+ pax_force_retaddr_bts
14317 ret
14318
14319 /*
14320@@ -1449,7 +1836,7 @@ bstep_iret:
14321 movq %rcx,RIP+8(%rsp)
14322 jmp error_swapgs
14323 CFI_ENDPROC
14324-END(error_entry)
14325+ENDPROC(error_entry)
14326
14327
14328 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
14329@@ -1469,7 +1856,7 @@ ENTRY(error_exit)
14330 jnz retint_careful
14331 jmp retint_swapgs
14332 CFI_ENDPROC
14333-END(error_exit)
14334+ENDPROC(error_exit)
14335
14336
14337 /* runs on exception stack */
14338@@ -1481,6 +1868,16 @@ ENTRY(nmi)
14339 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14340 call save_paranoid
14341 DEFAULT_FRAME 0
14342+#ifdef CONFIG_PAX_MEMORY_UDEREF
14343+ testb $3, CS(%rsp)
14344+ jnz 1f
14345+ pax_enter_kernel
14346+ jmp 2f
14347+1: pax_enter_kernel_user
14348+2:
14349+#else
14350+ pax_enter_kernel
14351+#endif
14352 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14353 movq %rsp,%rdi
14354 movq $-1,%rsi
14355@@ -1491,12 +1888,28 @@ ENTRY(nmi)
14356 DISABLE_INTERRUPTS(CLBR_NONE)
14357 testl %ebx,%ebx /* swapgs needed? */
14358 jnz nmi_restore
14359- testl $3,CS(%rsp)
14360+ testb $3,CS(%rsp)
14361 jnz nmi_userspace
14362+#ifdef CONFIG_PAX_MEMORY_UDEREF
14363+ pax_exit_kernel
14364+ SWAPGS_UNSAFE_STACK
14365+ RESTORE_ALL 8
14366+ pax_force_retaddr_bts
14367+ jmp irq_return
14368+#endif
14369 nmi_swapgs:
14370+#ifdef CONFIG_PAX_MEMORY_UDEREF
14371+ pax_exit_kernel_user
14372+#else
14373+ pax_exit_kernel
14374+#endif
14375 SWAPGS_UNSAFE_STACK
14376+ RESTORE_ALL 8
14377+ jmp irq_return
14378 nmi_restore:
14379+ pax_exit_kernel
14380 RESTORE_ALL 8
14381+ pax_force_retaddr_bts
14382 jmp irq_return
14383 nmi_userspace:
14384 GET_THREAD_INFO(%rcx)
14385@@ -1525,14 +1938,14 @@ nmi_schedule:
14386 jmp paranoid_exit
14387 CFI_ENDPROC
14388 #endif
14389-END(nmi)
14390+ENDPROC(nmi)
14391
14392 ENTRY(ignore_sysret)
14393 CFI_STARTPROC
14394 mov $-ENOSYS,%eax
14395 sysret
14396 CFI_ENDPROC
14397-END(ignore_sysret)
14398+ENDPROC(ignore_sysret)
14399
14400 /*
14401 * End of kprobes section
14402diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
14403index c9a281f..ce2f317 100644
14404--- a/arch/x86/kernel/ftrace.c
14405+++ b/arch/x86/kernel/ftrace.c
14406@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the IP to write to */
14407 static const void *mod_code_newcode; /* holds the text to write to the IP */
14408
14409 static unsigned nmi_wait_count;
14410-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14411+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14412
14413 int ftrace_arch_read_dyn_info(char *buf, int size)
14414 {
14415@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size)
14416
14417 r = snprintf(buf, size, "%u %u",
14418 nmi_wait_count,
14419- atomic_read(&nmi_update_count));
14420+ atomic_read_unchecked(&nmi_update_count));
14421 return r;
14422 }
14423
14424@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14425
14426 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14427 smp_rmb();
14428+ pax_open_kernel();
14429 ftrace_mod_code();
14430- atomic_inc(&nmi_update_count);
14431+ pax_close_kernel();
14432+ atomic_inc_unchecked(&nmi_update_count);
14433 }
14434 /* Must have previous changes seen before executions */
14435 smp_mb();
14436@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code,
14437 {
14438 unsigned char replaced[MCOUNT_INSN_SIZE];
14439
14440+ ip = ktla_ktva(ip);
14441+
14442 /*
14443 * Note: Due to modules and __init, code can
14444 * disappear and change, we need to protect against faulting
14445@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
14446 unsigned char old[MCOUNT_INSN_SIZE], *new;
14447 int ret;
14448
14449- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14450+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14451 new = ftrace_call_replace(ip, (unsigned long)func);
14452 ret = ftrace_modify_code(ip, old, new);
14453
14454@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long ip,
14455 {
14456 unsigned char code[MCOUNT_INSN_SIZE];
14457
14458+ ip = ktla_ktva(ip);
14459+
14460 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14461 return -EFAULT;
14462
14463diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
14464index 3bb0850..55a56f4 100644
14465--- a/arch/x86/kernel/head32.c
14466+++ b/arch/x86/kernel/head32.c
14467@@ -19,6 +19,7 @@
14468 #include <asm/io_apic.h>
14469 #include <asm/bios_ebda.h>
14470 #include <asm/tlbflush.h>
14471+#include <asm/boot.h>
14472
14473 static void __init i386_default_early_setup(void)
14474 {
14475@@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
14476 {
14477 memblock_init();
14478
14479- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14480+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14481
14482 #ifdef CONFIG_BLK_DEV_INITRD
14483 /* Reserve INITRD */
14484diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
14485index ce0be7c..c41476e 100644
14486--- a/arch/x86/kernel/head_32.S
14487+++ b/arch/x86/kernel/head_32.S
14488@@ -25,6 +25,12 @@
14489 /* Physical address */
14490 #define pa(X) ((X) - __PAGE_OFFSET)
14491
14492+#ifdef CONFIG_PAX_KERNEXEC
14493+#define ta(X) (X)
14494+#else
14495+#define ta(X) ((X) - __PAGE_OFFSET)
14496+#endif
14497+
14498 /*
14499 * References to members of the new_cpu_data structure.
14500 */
14501@@ -54,11 +60,7 @@
14502 * and small than max_low_pfn, otherwise will waste some page table entries
14503 */
14504
14505-#if PTRS_PER_PMD > 1
14506-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14507-#else
14508-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14509-#endif
14510+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14511
14512 /* Number of possible pages in the lowmem region */
14513 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14514@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
14515 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14516
14517 /*
14518+ * Real beginning of normal "text" segment
14519+ */
14520+ENTRY(stext)
14521+ENTRY(_stext)
14522+
14523+/*
14524 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14525 * %esi points to the real-mode code as a 32-bit pointer.
14526 * CS and DS must be 4 GB flat segments, but we don't depend on
14527@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14528 * can.
14529 */
14530 __HEAD
14531+
14532+#ifdef CONFIG_PAX_KERNEXEC
14533+ jmp startup_32
14534+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14535+.fill PAGE_SIZE-5,1,0xcc
14536+#endif
14537+
14538 ENTRY(startup_32)
14539 movl pa(stack_start),%ecx
14540
14541@@ -105,6 +120,57 @@ ENTRY(startup_32)
14542 2:
14543 leal -__PAGE_OFFSET(%ecx),%esp
14544
14545+#ifdef CONFIG_SMP
14546+ movl $pa(cpu_gdt_table),%edi
14547+ movl $__per_cpu_load,%eax
14548+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14549+ rorl $16,%eax
14550+ movb %al,__KERNEL_PERCPU + 4(%edi)
14551+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14552+ movl $__per_cpu_end - 1,%eax
14553+ subl $__per_cpu_start,%eax
14554+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14555+#endif
14556+
14557+#ifdef CONFIG_PAX_MEMORY_UDEREF
14558+ movl $NR_CPUS,%ecx
14559+ movl $pa(cpu_gdt_table),%edi
14560+1:
14561+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14562+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14563+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14564+ addl $PAGE_SIZE_asm,%edi
14565+ loop 1b
14566+#endif
14567+
14568+#ifdef CONFIG_PAX_KERNEXEC
14569+ movl $pa(boot_gdt),%edi
14570+ movl $__LOAD_PHYSICAL_ADDR,%eax
14571+ movw %ax,__BOOT_CS + 2(%edi)
14572+ rorl $16,%eax
14573+ movb %al,__BOOT_CS + 4(%edi)
14574+ movb %ah,__BOOT_CS + 7(%edi)
14575+ rorl $16,%eax
14576+
14577+ ljmp $(__BOOT_CS),$1f
14578+1:
14579+
14580+ movl $NR_CPUS,%ecx
14581+ movl $pa(cpu_gdt_table),%edi
14582+ addl $__PAGE_OFFSET,%eax
14583+1:
14584+ movw %ax,__KERNEL_CS + 2(%edi)
14585+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14586+ rorl $16,%eax
14587+ movb %al,__KERNEL_CS + 4(%edi)
14588+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14589+ movb %ah,__KERNEL_CS + 7(%edi)
14590+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14591+ rorl $16,%eax
14592+ addl $PAGE_SIZE_asm,%edi
14593+ loop 1b
14594+#endif
14595+
14596 /*
14597 * Clear BSS first so that there are no surprises...
14598 */
14599@@ -195,8 +261,11 @@ ENTRY(startup_32)
14600 movl %eax, pa(max_pfn_mapped)
14601
14602 /* Do early initialization of the fixmap area */
14603- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14604- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14605+#ifdef CONFIG_COMPAT_VDSO
14606+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14607+#else
14608+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14609+#endif
14610 #else /* Not PAE */
14611
14612 page_pde_offset = (__PAGE_OFFSET >> 20);
14613@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14614 movl %eax, pa(max_pfn_mapped)
14615
14616 /* Do early initialization of the fixmap area */
14617- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14618- movl %eax,pa(initial_page_table+0xffc)
14619+#ifdef CONFIG_COMPAT_VDSO
14620+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14621+#else
14622+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14623+#endif
14624 #endif
14625
14626 #ifdef CONFIG_PARAVIRT
14627@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14628 cmpl $num_subarch_entries, %eax
14629 jae bad_subarch
14630
14631- movl pa(subarch_entries)(,%eax,4), %eax
14632- subl $__PAGE_OFFSET, %eax
14633- jmp *%eax
14634+ jmp *pa(subarch_entries)(,%eax,4)
14635
14636 bad_subarch:
14637 WEAK(lguest_entry)
14638@@ -255,10 +325,10 @@ WEAK(xen_entry)
14639 __INITDATA
14640
14641 subarch_entries:
14642- .long default_entry /* normal x86/PC */
14643- .long lguest_entry /* lguest hypervisor */
14644- .long xen_entry /* Xen hypervisor */
14645- .long default_entry /* Moorestown MID */
14646+ .long ta(default_entry) /* normal x86/PC */
14647+ .long ta(lguest_entry) /* lguest hypervisor */
14648+ .long ta(xen_entry) /* Xen hypervisor */
14649+ .long ta(default_entry) /* Moorestown MID */
14650 num_subarch_entries = (. - subarch_entries) / 4
14651 .previous
14652 #else
14653@@ -312,6 +382,7 @@ default_entry:
14654 orl %edx,%eax
14655 movl %eax,%cr4
14656
14657+#ifdef CONFIG_X86_PAE
14658 testb $X86_CR4_PAE, %al # check if PAE is enabled
14659 jz 6f
14660
14661@@ -340,6 +411,9 @@ default_entry:
14662 /* Make changes effective */
14663 wrmsr
14664
14665+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14666+#endif
14667+
14668 6:
14669
14670 /*
14671@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
14672 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14673 movl %eax,%ss # after changing gdt.
14674
14675- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14676+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14677 movl %eax,%ds
14678 movl %eax,%es
14679
14680@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
14681 */
14682 cmpb $0,ready
14683 jne 1f
14684- movl $gdt_page,%eax
14685+ movl $cpu_gdt_table,%eax
14686 movl $stack_canary,%ecx
14687+#ifdef CONFIG_SMP
14688+ addl $__per_cpu_load,%ecx
14689+#endif
14690 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14691 shrl $16, %ecx
14692 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14693 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14694 1:
14695-#endif
14696 movl $(__KERNEL_STACK_CANARY),%eax
14697+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14698+ movl $(__USER_DS),%eax
14699+#else
14700+ xorl %eax,%eax
14701+#endif
14702 movl %eax,%gs
14703
14704 xorl %eax,%eax # Clear LDT
14705@@ -558,22 +639,22 @@ early_page_fault:
14706 jmp early_fault
14707
14708 early_fault:
14709- cld
14710 #ifdef CONFIG_PRINTK
14711+ cmpl $1,%ss:early_recursion_flag
14712+ je hlt_loop
14713+ incl %ss:early_recursion_flag
14714+ cld
14715 pusha
14716 movl $(__KERNEL_DS),%eax
14717 movl %eax,%ds
14718 movl %eax,%es
14719- cmpl $2,early_recursion_flag
14720- je hlt_loop
14721- incl early_recursion_flag
14722 movl %cr2,%eax
14723 pushl %eax
14724 pushl %edx /* trapno */
14725 pushl $fault_msg
14726 call printk
14727+; call dump_stack
14728 #endif
14729- call dump_stack
14730 hlt_loop:
14731 hlt
14732 jmp hlt_loop
14733@@ -581,8 +662,11 @@ hlt_loop:
14734 /* This is the default interrupt "handler" :-) */
14735 ALIGN
14736 ignore_int:
14737- cld
14738 #ifdef CONFIG_PRINTK
14739+ cmpl $2,%ss:early_recursion_flag
14740+ je hlt_loop
14741+ incl %ss:early_recursion_flag
14742+ cld
14743 pushl %eax
14744 pushl %ecx
14745 pushl %edx
14746@@ -591,9 +675,6 @@ ignore_int:
14747 movl $(__KERNEL_DS),%eax
14748 movl %eax,%ds
14749 movl %eax,%es
14750- cmpl $2,early_recursion_flag
14751- je hlt_loop
14752- incl early_recursion_flag
14753 pushl 16(%esp)
14754 pushl 24(%esp)
14755 pushl 32(%esp)
14756@@ -622,29 +703,43 @@ ENTRY(initial_code)
14757 /*
14758 * BSS section
14759 */
14760-__PAGE_ALIGNED_BSS
14761- .align PAGE_SIZE
14762 #ifdef CONFIG_X86_PAE
14763+.section .initial_pg_pmd,"a",@progbits
14764 initial_pg_pmd:
14765 .fill 1024*KPMDS,4,0
14766 #else
14767+.section .initial_page_table,"a",@progbits
14768 ENTRY(initial_page_table)
14769 .fill 1024,4,0
14770 #endif
14771+.section .initial_pg_fixmap,"a",@progbits
14772 initial_pg_fixmap:
14773 .fill 1024,4,0
14774+.section .empty_zero_page,"a",@progbits
14775 ENTRY(empty_zero_page)
14776 .fill 4096,1,0
14777+.section .swapper_pg_dir,"a",@progbits
14778 ENTRY(swapper_pg_dir)
14779+#ifdef CONFIG_X86_PAE
14780+ .fill 4,8,0
14781+#else
14782 .fill 1024,4,0
14783+#endif
14784+
14785+/*
14786+ * The IDT has to be page-aligned to simplify the Pentium
14787+ * F0 0F bug workaround.. We have a special link segment
14788+ * for this.
14789+ */
14790+.section .idt,"a",@progbits
14791+ENTRY(idt_table)
14792+ .fill 256,8,0
14793
14794 /*
14795 * This starts the data section.
14796 */
14797 #ifdef CONFIG_X86_PAE
14798-__PAGE_ALIGNED_DATA
14799- /* Page-aligned for the benefit of paravirt? */
14800- .align PAGE_SIZE
14801+.section .initial_page_table,"a",@progbits
14802 ENTRY(initial_page_table)
14803 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
14804 # if KPMDS == 3
14805@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
14806 # error "Kernel PMDs should be 1, 2 or 3"
14807 # endif
14808 .align PAGE_SIZE /* needs to be page-sized too */
14809+
14810+#ifdef CONFIG_PAX_PER_CPU_PGD
14811+ENTRY(cpu_pgd)
14812+ .rept NR_CPUS
14813+ .fill 4,8,0
14814+ .endr
14815+#endif
14816+
14817 #endif
14818
14819 .data
14820 .balign 4
14821 ENTRY(stack_start)
14822- .long init_thread_union+THREAD_SIZE
14823+ .long init_thread_union+THREAD_SIZE-8
14824
14825+ready: .byte 0
14826+
14827+.section .rodata,"a",@progbits
14828 early_recursion_flag:
14829 .long 0
14830
14831-ready: .byte 0
14832-
14833 int_msg:
14834 .asciz "Unknown interrupt or fault at: %p %p %p\n"
14835
14836@@ -707,7 +811,7 @@ fault_msg:
14837 .word 0 # 32 bit align gdt_desc.address
14838 boot_gdt_descr:
14839 .word __BOOT_DS+7
14840- .long boot_gdt - __PAGE_OFFSET
14841+ .long pa(boot_gdt)
14842
14843 .word 0 # 32-bit align idt_desc.address
14844 idt_descr:
14845@@ -718,7 +822,7 @@ idt_descr:
14846 .word 0 # 32 bit align gdt_desc.address
14847 ENTRY(early_gdt_descr)
14848 .word GDT_ENTRIES*8-1
14849- .long gdt_page /* Overwritten for secondary CPUs */
14850+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
14851
14852 /*
14853 * The boot_gdt must mirror the equivalent in setup.S and is
14854@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
14855 .align L1_CACHE_BYTES
14856 ENTRY(boot_gdt)
14857 .fill GDT_ENTRY_BOOT_CS,8,0
14858- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
14859- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
14860+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
14861+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
14862+
14863+ .align PAGE_SIZE_asm
14864+ENTRY(cpu_gdt_table)
14865+ .rept NR_CPUS
14866+ .quad 0x0000000000000000 /* NULL descriptor */
14867+ .quad 0x0000000000000000 /* 0x0b reserved */
14868+ .quad 0x0000000000000000 /* 0x13 reserved */
14869+ .quad 0x0000000000000000 /* 0x1b reserved */
14870+
14871+#ifdef CONFIG_PAX_KERNEXEC
14872+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
14873+#else
14874+ .quad 0x0000000000000000 /* 0x20 unused */
14875+#endif
14876+
14877+ .quad 0x0000000000000000 /* 0x28 unused */
14878+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
14879+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
14880+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
14881+ .quad 0x0000000000000000 /* 0x4b reserved */
14882+ .quad 0x0000000000000000 /* 0x53 reserved */
14883+ .quad 0x0000000000000000 /* 0x5b reserved */
14884+
14885+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
14886+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
14887+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
14888+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
14889+
14890+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
14891+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
14892+
14893+ /*
14894+ * Segments used for calling PnP BIOS have byte granularity.
14895+ * The code segments and data segments have fixed 64k limits,
14896+ * the transfer segment sizes are set at run time.
14897+ */
14898+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
14899+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
14900+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
14901+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
14902+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
14903+
14904+ /*
14905+ * The APM segments have byte granularity and their bases
14906+ * are set at run time. All have 64k limits.
14907+ */
14908+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
14909+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
14910+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
14911+
14912+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
14913+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
14914+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
14915+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
14916+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
14917+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
14918+
14919+ /* Be sure this is zeroed to avoid false validations in Xen */
14920+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
14921+ .endr
14922diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
14923index e11e394..9aebc5d 100644
14924--- a/arch/x86/kernel/head_64.S
14925+++ b/arch/x86/kernel/head_64.S
14926@@ -19,6 +19,8 @@
14927 #include <asm/cache.h>
14928 #include <asm/processor-flags.h>
14929 #include <asm/percpu.h>
14930+#include <asm/cpufeature.h>
14931+#include <asm/alternative-asm.h>
14932
14933 #ifdef CONFIG_PARAVIRT
14934 #include <asm/asm-offsets.h>
14935@@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
14936 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
14937 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
14938 L3_START_KERNEL = pud_index(__START_KERNEL_map)
14939+L4_VMALLOC_START = pgd_index(VMALLOC_START)
14940+L3_VMALLOC_START = pud_index(VMALLOC_START)
14941+L4_VMALLOC_END = pgd_index(VMALLOC_END)
14942+L3_VMALLOC_END = pud_index(VMALLOC_END)
14943+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
14944+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
14945
14946 .text
14947 __HEAD
14948@@ -85,35 +93,23 @@ startup_64:
14949 */
14950 addq %rbp, init_level4_pgt + 0(%rip)
14951 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
14952+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
14953+ addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
14954+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
14955 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
14956
14957 addq %rbp, level3_ident_pgt + 0(%rip)
14958+#ifndef CONFIG_XEN
14959+ addq %rbp, level3_ident_pgt + 8(%rip)
14960+#endif
14961
14962- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
14963- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
14964+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
14965+
14966+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
14967+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
14968
14969 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
14970-
14971- /* Add an Identity mapping if I am above 1G */
14972- leaq _text(%rip), %rdi
14973- andq $PMD_PAGE_MASK, %rdi
14974-
14975- movq %rdi, %rax
14976- shrq $PUD_SHIFT, %rax
14977- andq $(PTRS_PER_PUD - 1), %rax
14978- jz ident_complete
14979-
14980- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
14981- leaq level3_ident_pgt(%rip), %rbx
14982- movq %rdx, 0(%rbx, %rax, 8)
14983-
14984- movq %rdi, %rax
14985- shrq $PMD_SHIFT, %rax
14986- andq $(PTRS_PER_PMD - 1), %rax
14987- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
14988- leaq level2_spare_pgt(%rip), %rbx
14989- movq %rdx, 0(%rbx, %rax, 8)
14990-ident_complete:
14991+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
14992
14993 /*
14994 * Fixup the kernel text+data virtual addresses. Note that
14995@@ -160,8 +156,8 @@ ENTRY(secondary_startup_64)
14996 * after the boot processor executes this code.
14997 */
14998
14999- /* Enable PAE mode and PGE */
15000- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15001+ /* Enable PAE mode and PSE/PGE */
15002+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15003 movq %rax, %cr4
15004
15005 /* Setup early boot stage 4 level pagetables. */
15006@@ -183,9 +179,17 @@ ENTRY(secondary_startup_64)
15007 movl $MSR_EFER, %ecx
15008 rdmsr
15009 btsl $_EFER_SCE, %eax /* Enable System Call */
15010- btl $20,%edi /* No Execute supported? */
15011+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15012 jnc 1f
15013 btsl $_EFER_NX, %eax
15014+ leaq init_level4_pgt(%rip), %rdi
15015+#ifndef CONFIG_EFI
15016+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15017+#endif
15018+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15019+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
15020+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15021+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15022 1: wrmsr /* Make changes effective */
15023
15024 /* Setup cr0 */
15025@@ -247,6 +251,7 @@ ENTRY(secondary_startup_64)
15026 * jump. In addition we need to ensure %cs is set so we make this
15027 * a far return.
15028 */
15029+ pax_set_fptr_mask
15030 movq initial_code(%rip),%rax
15031 pushq $0 # fake return address to stop unwinder
15032 pushq $__KERNEL_CS # set correct cs
15033@@ -269,7 +274,7 @@ ENTRY(secondary_startup_64)
15034 bad_address:
15035 jmp bad_address
15036
15037- .section ".init.text","ax"
15038+ __INIT
15039 #ifdef CONFIG_EARLY_PRINTK
15040 .globl early_idt_handlers
15041 early_idt_handlers:
15042@@ -314,18 +319,23 @@ ENTRY(early_idt_handler)
15043 #endif /* EARLY_PRINTK */
15044 1: hlt
15045 jmp 1b
15046+ .previous
15047
15048 #ifdef CONFIG_EARLY_PRINTK
15049+ __INITDATA
15050 early_recursion_flag:
15051 .long 0
15052+ .previous
15053
15054+ .section .rodata,"a",@progbits
15055 early_idt_msg:
15056 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15057 early_idt_ripmsg:
15058 .asciz "RIP %s\n"
15059+ .previous
15060 #endif /* CONFIG_EARLY_PRINTK */
15061- .previous
15062
15063+ .section .rodata,"a",@progbits
15064 #define NEXT_PAGE(name) \
15065 .balign PAGE_SIZE; \
15066 ENTRY(name)
15067@@ -338,7 +348,6 @@ ENTRY(name)
15068 i = i + 1 ; \
15069 .endr
15070
15071- .data
15072 /*
15073 * This default setting generates an ident mapping at address 0x100000
15074 * and a mapping for the kernel that precisely maps virtual address
15075@@ -349,13 +358,41 @@ NEXT_PAGE(init_level4_pgt)
15076 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15077 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15078 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15079+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15080+ .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
15081+ .org init_level4_pgt + L4_VMALLOC_END*8, 0
15082+ .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
15083+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15084+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15085 .org init_level4_pgt + L4_START_KERNEL*8, 0
15086 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15087 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15088
15089+#ifdef CONFIG_PAX_PER_CPU_PGD
15090+NEXT_PAGE(cpu_pgd)
15091+ .rept NR_CPUS
15092+ .fill 512,8,0
15093+ .endr
15094+#endif
15095+
15096 NEXT_PAGE(level3_ident_pgt)
15097 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15098+#ifdef CONFIG_XEN
15099 .fill 511,8,0
15100+#else
15101+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15102+ .fill 510,8,0
15103+#endif
15104+
15105+NEXT_PAGE(level3_vmalloc_start_pgt)
15106+ .fill 512,8,0
15107+
15108+NEXT_PAGE(level3_vmalloc_end_pgt)
15109+ .fill 512,8,0
15110+
15111+NEXT_PAGE(level3_vmemmap_pgt)
15112+ .fill L3_VMEMMAP_START,8,0
15113+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15114
15115 NEXT_PAGE(level3_kernel_pgt)
15116 .fill L3_START_KERNEL,8,0
15117@@ -363,20 +400,23 @@ NEXT_PAGE(level3_kernel_pgt)
15118 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15119 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15120
15121+NEXT_PAGE(level2_vmemmap_pgt)
15122+ .fill 512,8,0
15123+
15124 NEXT_PAGE(level2_fixmap_pgt)
15125- .fill 506,8,0
15126- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15127- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15128- .fill 5,8,0
15129+ .fill 507,8,0
15130+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15131+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15132+ .fill 4,8,0
15133
15134-NEXT_PAGE(level1_fixmap_pgt)
15135+NEXT_PAGE(level1_vsyscall_pgt)
15136 .fill 512,8,0
15137
15138-NEXT_PAGE(level2_ident_pgt)
15139- /* Since I easily can, map the first 1G.
15140+ /* Since I easily can, map the first 2G.
15141 * Don't set NX because code runs from these pages.
15142 */
15143- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15144+NEXT_PAGE(level2_ident_pgt)
15145+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15146
15147 NEXT_PAGE(level2_kernel_pgt)
15148 /*
15149@@ -389,33 +429,55 @@ NEXT_PAGE(level2_kernel_pgt)
15150 * If you want to increase this then increase MODULES_VADDR
15151 * too.)
15152 */
15153- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15154- KERNEL_IMAGE_SIZE/PMD_SIZE)
15155-
15156-NEXT_PAGE(level2_spare_pgt)
15157- .fill 512, 8, 0
15158+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15159
15160 #undef PMDS
15161 #undef NEXT_PAGE
15162
15163- .data
15164+ .align PAGE_SIZE
15165+ENTRY(cpu_gdt_table)
15166+ .rept NR_CPUS
15167+ .quad 0x0000000000000000 /* NULL descriptor */
15168+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15169+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15170+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15171+ .quad 0x00cffb000000ffff /* __USER32_CS */
15172+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15173+ .quad 0x00affb000000ffff /* __USER_CS */
15174+
15175+#ifdef CONFIG_PAX_KERNEXEC
15176+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15177+#else
15178+ .quad 0x0 /* unused */
15179+#endif
15180+
15181+ .quad 0,0 /* TSS */
15182+ .quad 0,0 /* LDT */
15183+ .quad 0,0,0 /* three TLS descriptors */
15184+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15185+ /* asm/segment.h:GDT_ENTRIES must match this */
15186+
15187+ /* zero the remaining page */
15188+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15189+ .endr
15190+
15191 .align 16
15192 .globl early_gdt_descr
15193 early_gdt_descr:
15194 .word GDT_ENTRIES*8-1
15195 early_gdt_descr_base:
15196- .quad INIT_PER_CPU_VAR(gdt_page)
15197+ .quad cpu_gdt_table
15198
15199 ENTRY(phys_base)
15200 /* This must match the first entry in level2_kernel_pgt */
15201 .quad 0x0000000000000000
15202
15203 #include "../../x86/xen/xen-head.S"
15204-
15205- .section .bss, "aw", @nobits
15206+
15207+ .section .rodata,"a",@progbits
15208 .align L1_CACHE_BYTES
15209 ENTRY(idt_table)
15210- .skip IDT_ENTRIES * 16
15211+ .fill 512,8,0
15212
15213 __PAGE_ALIGNED_BSS
15214 .align PAGE_SIZE
15215diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
15216index 9c3bd4a..e1d9b35 100644
15217--- a/arch/x86/kernel/i386_ksyms_32.c
15218+++ b/arch/x86/kernel/i386_ksyms_32.c
15219@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15220 EXPORT_SYMBOL(cmpxchg8b_emu);
15221 #endif
15222
15223+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15224+
15225 /* Networking helper routines. */
15226 EXPORT_SYMBOL(csum_partial_copy_generic);
15227+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15228+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15229
15230 EXPORT_SYMBOL(__get_user_1);
15231 EXPORT_SYMBOL(__get_user_2);
15232@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15233
15234 EXPORT_SYMBOL(csum_partial);
15235 EXPORT_SYMBOL(empty_zero_page);
15236+
15237+#ifdef CONFIG_PAX_KERNEXEC
15238+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15239+#endif
15240diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
15241index 6104852..6114160 100644
15242--- a/arch/x86/kernel/i8259.c
15243+++ b/arch/x86/kernel/i8259.c
15244@@ -210,7 +210,7 @@ spurious_8259A_irq:
15245 "spurious 8259A interrupt: IRQ%d.\n", irq);
15246 spurious_irq_mask |= irqmask;
15247 }
15248- atomic_inc(&irq_err_count);
15249+ atomic_inc_unchecked(&irq_err_count);
15250 /*
15251 * Theoretically we do not have to handle this IRQ,
15252 * but in Linux this does not cause problems and is
15253diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c
15254index 43e9ccf..44ccf6f 100644
15255--- a/arch/x86/kernel/init_task.c
15256+++ b/arch/x86/kernel/init_task.c
15257@@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
15258 * way process stacks are handled. This is done by having a special
15259 * "init_task" linker map entry..
15260 */
15261-union thread_union init_thread_union __init_task_data =
15262- { INIT_THREAD_INFO(init_task) };
15263+union thread_union init_thread_union __init_task_data;
15264
15265 /*
15266 * Initial task structure.
15267@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15268 * section. Since TSS's are completely CPU-local, we want them
15269 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15270 */
15271-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15272-
15273+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15274+EXPORT_SYMBOL(init_tss);
15275diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
15276index 8c96897..be66bfa 100644
15277--- a/arch/x86/kernel/ioport.c
15278+++ b/arch/x86/kernel/ioport.c
15279@@ -6,6 +6,7 @@
15280 #include <linux/sched.h>
15281 #include <linux/kernel.h>
15282 #include <linux/capability.h>
15283+#include <linux/security.h>
15284 #include <linux/errno.h>
15285 #include <linux/types.h>
15286 #include <linux/ioport.h>
15287@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15288
15289 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15290 return -EINVAL;
15291+#ifdef CONFIG_GRKERNSEC_IO
15292+ if (turn_on && grsec_disable_privio) {
15293+ gr_handle_ioperm();
15294+ return -EPERM;
15295+ }
15296+#endif
15297 if (turn_on && !capable(CAP_SYS_RAWIO))
15298 return -EPERM;
15299
15300@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15301 * because the ->io_bitmap_max value must match the bitmap
15302 * contents:
15303 */
15304- tss = &per_cpu(init_tss, get_cpu());
15305+ tss = init_tss + get_cpu();
15306
15307 if (turn_on)
15308 bitmap_clear(t->io_bitmap_ptr, from, num);
15309@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct pt_regs *regs)
15310 return -EINVAL;
15311 /* Trying to gain more privileges? */
15312 if (level > old) {
15313+#ifdef CONFIG_GRKERNSEC_IO
15314+ if (grsec_disable_privio) {
15315+ gr_handle_iopl();
15316+ return -EPERM;
15317+ }
15318+#endif
15319 if (!capable(CAP_SYS_RAWIO))
15320 return -EPERM;
15321 }
15322diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
15323index 6c0802e..bea25ae 100644
15324--- a/arch/x86/kernel/irq.c
15325+++ b/arch/x86/kernel/irq.c
15326@@ -17,7 +17,7 @@
15327 #include <asm/mce.h>
15328 #include <asm/hw_irq.h>
15329
15330-atomic_t irq_err_count;
15331+atomic_unchecked_t irq_err_count;
15332
15333 /* Function pointer for generic interrupt vector handling */
15334 void (*x86_platform_ipi_callback)(void) = NULL;
15335@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
15336 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15337 seq_printf(p, " Machine check polls\n");
15338 #endif
15339- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15340+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15341 #if defined(CONFIG_X86_IO_APIC)
15342- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15343+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15344 #endif
15345 return 0;
15346 }
15347@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15348
15349 u64 arch_irq_stat(void)
15350 {
15351- u64 sum = atomic_read(&irq_err_count);
15352+ u64 sum = atomic_read_unchecked(&irq_err_count);
15353
15354 #ifdef CONFIG_X86_IO_APIC
15355- sum += atomic_read(&irq_mis_count);
15356+ sum += atomic_read_unchecked(&irq_mis_count);
15357 #endif
15358 return sum;
15359 }
15360diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
15361index 7209070..cbcd71a 100644
15362--- a/arch/x86/kernel/irq_32.c
15363+++ b/arch/x86/kernel/irq_32.c
15364@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15365 __asm__ __volatile__("andl %%esp,%0" :
15366 "=r" (sp) : "0" (THREAD_SIZE - 1));
15367
15368- return sp < (sizeof(struct thread_info) + STACK_WARN);
15369+ return sp < STACK_WARN;
15370 }
15371
15372 static void print_stack_overflow(void)
15373@@ -54,8 +54,8 @@ static inline void print_stack_overflow(void) { }
15374 * per-CPU IRQ handling contexts (thread information and stack)
15375 */
15376 union irq_ctx {
15377- struct thread_info tinfo;
15378- u32 stack[THREAD_SIZE/sizeof(u32)];
15379+ unsigned long previous_esp;
15380+ u32 stack[THREAD_SIZE/sizeof(u32)];
15381 } __attribute__((aligned(THREAD_SIZE)));
15382
15383 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15384@@ -75,10 +75,9 @@ static void call_on_stack(void *func, void *stack)
15385 static inline int
15386 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15387 {
15388- union irq_ctx *curctx, *irqctx;
15389+ union irq_ctx *irqctx;
15390 u32 *isp, arg1, arg2;
15391
15392- curctx = (union irq_ctx *) current_thread_info();
15393 irqctx = __this_cpu_read(hardirq_ctx);
15394
15395 /*
15396@@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15397 * handler) we can't do that and just have to keep using the
15398 * current stack (which is the irq stack already after all)
15399 */
15400- if (unlikely(curctx == irqctx))
15401+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15402 return 0;
15403
15404 /* build the stack frame on the IRQ stack */
15405- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15406- irqctx->tinfo.task = curctx->tinfo.task;
15407- irqctx->tinfo.previous_esp = current_stack_pointer;
15408+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15409+ irqctx->previous_esp = current_stack_pointer;
15410
15411- /*
15412- * Copy the softirq bits in preempt_count so that the
15413- * softirq checks work in the hardirq context.
15414- */
15415- irqctx->tinfo.preempt_count =
15416- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15417- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15418+#ifdef CONFIG_PAX_MEMORY_UDEREF
15419+ __set_fs(MAKE_MM_SEG(0));
15420+#endif
15421
15422 if (unlikely(overflow))
15423 call_on_stack(print_stack_overflow, isp);
15424@@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15425 : "0" (irq), "1" (desc), "2" (isp),
15426 "D" (desc->handle_irq)
15427 : "memory", "cc", "ecx");
15428+
15429+#ifdef CONFIG_PAX_MEMORY_UDEREF
15430+ __set_fs(current_thread_info()->addr_limit);
15431+#endif
15432+
15433 return 1;
15434 }
15435
15436@@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15437 */
15438 void __cpuinit irq_ctx_init(int cpu)
15439 {
15440- union irq_ctx *irqctx;
15441-
15442 if (per_cpu(hardirq_ctx, cpu))
15443 return;
15444
15445- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15446- THREAD_FLAGS,
15447- THREAD_ORDER));
15448- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15449- irqctx->tinfo.cpu = cpu;
15450- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15451- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15452-
15453- per_cpu(hardirq_ctx, cpu) = irqctx;
15454-
15455- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15456- THREAD_FLAGS,
15457- THREAD_ORDER));
15458- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15459- irqctx->tinfo.cpu = cpu;
15460- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15461-
15462- per_cpu(softirq_ctx, cpu) = irqctx;
15463+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15464+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15465
15466 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15467 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15468@@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu)
15469 asmlinkage void do_softirq(void)
15470 {
15471 unsigned long flags;
15472- struct thread_info *curctx;
15473 union irq_ctx *irqctx;
15474 u32 *isp;
15475
15476@@ -162,15 +142,22 @@ asmlinkage void do_softirq(void)
15477 local_irq_save(flags);
15478
15479 if (local_softirq_pending()) {
15480- curctx = current_thread_info();
15481 irqctx = __this_cpu_read(softirq_ctx);
15482- irqctx->tinfo.task = curctx->task;
15483- irqctx->tinfo.previous_esp = current_stack_pointer;
15484+ irqctx->previous_esp = current_stack_pointer;
15485
15486 /* build the stack frame on the softirq stack */
15487- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15488+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15489+
15490+#ifdef CONFIG_PAX_MEMORY_UDEREF
15491+ __set_fs(MAKE_MM_SEG(0));
15492+#endif
15493
15494 call_on_stack(__do_softirq, isp);
15495+
15496+#ifdef CONFIG_PAX_MEMORY_UDEREF
15497+ __set_fs(current_thread_info()->addr_limit);
15498+#endif
15499+
15500 /*
15501 * Shouldn't happen, we returned above if in_interrupt():
15502 */
15503diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
15504index 00354d4..187ae44 100644
15505--- a/arch/x86/kernel/kgdb.c
15506+++ b/arch/x86/kernel/kgdb.c
15507@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
15508 #ifdef CONFIG_X86_32
15509 switch (regno) {
15510 case GDB_SS:
15511- if (!user_mode_vm(regs))
15512+ if (!user_mode(regs))
15513 *(unsigned long *)mem = __KERNEL_DS;
15514 break;
15515 case GDB_SP:
15516- if (!user_mode_vm(regs))
15517+ if (!user_mode(regs))
15518 *(unsigned long *)mem = kernel_stack_pointer(regs);
15519 break;
15520 case GDB_GS:
15521@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
15522 case 'k':
15523 /* clear the trace bit */
15524 linux_regs->flags &= ~X86_EFLAGS_TF;
15525- atomic_set(&kgdb_cpu_doing_single_step, -1);
15526+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15527
15528 /* set the trace bit if we're stepping */
15529 if (remcomInBuffer[0] == 's') {
15530 linux_regs->flags |= X86_EFLAGS_TF;
15531- atomic_set(&kgdb_cpu_doing_single_step,
15532+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15533 raw_smp_processor_id());
15534 }
15535
15536@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
15537 return NOTIFY_DONE;
15538
15539 case DIE_DEBUG:
15540- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15541+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15542 if (user_mode(regs))
15543 return single_step_cont(regs, args);
15544 break;
15545diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
15546index 794bc95..c6e29e9 100644
15547--- a/arch/x86/kernel/kprobes.c
15548+++ b/arch/x86/kernel/kprobes.c
15549@@ -117,8 +117,11 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op)
15550 } __attribute__((packed)) *insn;
15551
15552 insn = (struct __arch_relative_insn *)from;
15553+
15554+ pax_open_kernel();
15555 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15556 insn->op = op;
15557+ pax_close_kernel();
15558 }
15559
15560 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15561@@ -155,7 +158,7 @@ static int __kprobes can_boost(kprobe_opcode_t *opcodes)
15562 kprobe_opcode_t opcode;
15563 kprobe_opcode_t *orig_opcodes = opcodes;
15564
15565- if (search_exception_tables((unsigned long)opcodes))
15566+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15567 return 0; /* Page fault may occur on this address. */
15568
15569 retry:
15570@@ -316,7 +319,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15571 }
15572 }
15573 insn_get_length(&insn);
15574+ pax_open_kernel();
15575 memcpy(dest, insn.kaddr, insn.length);
15576+ pax_close_kernel();
15577
15578 #ifdef CONFIG_X86_64
15579 if (insn_rip_relative(&insn)) {
15580@@ -340,7 +345,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15581 (u8 *) dest;
15582 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15583 disp = (u8 *) dest + insn_offset_displacement(&insn);
15584+ pax_open_kernel();
15585 *(s32 *) disp = (s32) newdisp;
15586+ pax_close_kernel();
15587 }
15588 #endif
15589 return insn.length;
15590@@ -354,12 +361,12 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
15591 */
15592 __copy_instruction(p->ainsn.insn, p->addr, 0);
15593
15594- if (can_boost(p->addr))
15595+ if (can_boost(ktla_ktva(p->addr)))
15596 p->ainsn.boostable = 0;
15597 else
15598 p->ainsn.boostable = -1;
15599
15600- p->opcode = *p->addr;
15601+ p->opcode = *(ktla_ktva(p->addr));
15602 }
15603
15604 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15605@@ -476,7 +483,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15606 * nor set current_kprobe, because it doesn't use single
15607 * stepping.
15608 */
15609- regs->ip = (unsigned long)p->ainsn.insn;
15610+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15611 preempt_enable_no_resched();
15612 return;
15613 }
15614@@ -495,7 +502,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15615 if (p->opcode == BREAKPOINT_INSTRUCTION)
15616 regs->ip = (unsigned long)p->addr;
15617 else
15618- regs->ip = (unsigned long)p->ainsn.insn;
15619+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15620 }
15621
15622 /*
15623@@ -574,7 +581,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
15624 setup_singlestep(p, regs, kcb, 0);
15625 return 1;
15626 }
15627- } else if (*addr != BREAKPOINT_INSTRUCTION) {
15628+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15629 /*
15630 * The breakpoint instruction was removed right
15631 * after we hit it. Another cpu has removed
15632@@ -682,6 +689,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
15633 " movq %rax, 152(%rsp)\n"
15634 RESTORE_REGS_STRING
15635 " popfq\n"
15636+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
15637+ " btsq $63,(%rsp)\n"
15638+#endif
15639 #else
15640 " pushf\n"
15641 SAVE_REGS_STRING
15642@@ -819,7 +829,7 @@ static void __kprobes resume_execution(struct kprobe *p,
15643 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15644 {
15645 unsigned long *tos = stack_addr(regs);
15646- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15647+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15648 unsigned long orig_ip = (unsigned long)p->addr;
15649 kprobe_opcode_t *insn = p->ainsn.insn;
15650
15651@@ -1001,7 +1011,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
15652 struct die_args *args = data;
15653 int ret = NOTIFY_DONE;
15654
15655- if (args->regs && user_mode_vm(args->regs))
15656+ if (args->regs && user_mode(args->regs))
15657 return ret;
15658
15659 switch (val) {
15660@@ -1383,7 +1393,7 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15661 * Verify if the address gap is in 2GB range, because this uses
15662 * a relative jump.
15663 */
15664- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15665+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15666 if (abs(rel) > 0x7fffffff)
15667 return -ERANGE;
15668
15669@@ -1404,11 +1414,11 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15670 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15671
15672 /* Set probe function call */
15673- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15674+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15675
15676 /* Set returning jmp instruction at the tail of out-of-line buffer */
15677 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15678- (u8 *)op->kp.addr + op->optinsn.size);
15679+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15680
15681 flush_icache_range((unsigned long) buf,
15682 (unsigned long) buf + TMPL_END_IDX +
15683@@ -1430,7 +1440,7 @@ static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
15684 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15685
15686 /* Backup instructions which will be replaced by jump address */
15687- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15688+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15689 RELATIVE_ADDR_SIZE);
15690
15691 insn_buf[0] = RELATIVEJUMP_OPCODE;
15692diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
15693index a9c2116..a52d4fc 100644
15694--- a/arch/x86/kernel/kvm.c
15695+++ b/arch/x86/kernel/kvm.c
15696@@ -437,6 +437,7 @@ static void __init paravirt_ops_setup(void)
15697 pv_mmu_ops.set_pud = kvm_set_pud;
15698 #if PAGETABLE_LEVELS == 4
15699 pv_mmu_ops.set_pgd = kvm_set_pgd;
15700+ pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
15701 #endif
15702 #endif
15703 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
15704diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
15705index ea69726..604d066 100644
15706--- a/arch/x86/kernel/ldt.c
15707+++ b/arch/x86/kernel/ldt.c
15708@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
15709 if (reload) {
15710 #ifdef CONFIG_SMP
15711 preempt_disable();
15712- load_LDT(pc);
15713+ load_LDT_nolock(pc);
15714 if (!cpumask_equal(mm_cpumask(current->mm),
15715 cpumask_of(smp_processor_id())))
15716 smp_call_function(flush_ldt, current->mm, 1);
15717 preempt_enable();
15718 #else
15719- load_LDT(pc);
15720+ load_LDT_nolock(pc);
15721 #endif
15722 }
15723 if (oldsize) {
15724@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
15725 return err;
15726
15727 for (i = 0; i < old->size; i++)
15728- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15729+ write_ldt_entry(new->ldt, i, old->ldt + i);
15730 return 0;
15731 }
15732
15733@@ -116,6 +116,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
15734 retval = copy_ldt(&mm->context, &old_mm->context);
15735 mutex_unlock(&old_mm->context.lock);
15736 }
15737+
15738+ if (tsk == current) {
15739+ mm->context.vdso = 0;
15740+
15741+#ifdef CONFIG_X86_32
15742+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15743+ mm->context.user_cs_base = 0UL;
15744+ mm->context.user_cs_limit = ~0UL;
15745+
15746+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15747+ cpus_clear(mm->context.cpu_user_cs_mask);
15748+#endif
15749+
15750+#endif
15751+#endif
15752+
15753+ }
15754+
15755 return retval;
15756 }
15757
15758@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
15759 }
15760 }
15761
15762+#ifdef CONFIG_PAX_SEGMEXEC
15763+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15764+ error = -EINVAL;
15765+ goto out_unlock;
15766+ }
15767+#endif
15768+
15769 fill_ldt(&ldt, &ldt_info);
15770 if (oldmode)
15771 ldt.avl = 0;
15772diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
15773index a3fa43b..8966f4c 100644
15774--- a/arch/x86/kernel/machine_kexec_32.c
15775+++ b/arch/x86/kernel/machine_kexec_32.c
15776@@ -27,7 +27,7 @@
15777 #include <asm/cacheflush.h>
15778 #include <asm/debugreg.h>
15779
15780-static void set_idt(void *newidt, __u16 limit)
15781+static void set_idt(struct desc_struct *newidt, __u16 limit)
15782 {
15783 struct desc_ptr curidt;
15784
15785@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16 limit)
15786 }
15787
15788
15789-static void set_gdt(void *newgdt, __u16 limit)
15790+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15791 {
15792 struct desc_ptr curgdt;
15793
15794@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15795 }
15796
15797 control_page = page_address(image->control_code_page);
15798- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15799+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15800
15801 relocate_kernel_ptr = control_page;
15802 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15803diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
15804index 1a1b606..5c89b55 100644
15805--- a/arch/x86/kernel/microcode_intel.c
15806+++ b/arch/x86/kernel/microcode_intel.c
15807@@ -440,13 +440,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
15808
15809 static int get_ucode_user(void *to, const void *from, size_t n)
15810 {
15811- return copy_from_user(to, from, n);
15812+ return copy_from_user(to, (const void __force_user *)from, n);
15813 }
15814
15815 static enum ucode_state
15816 request_microcode_user(int cpu, const void __user *buf, size_t size)
15817 {
15818- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
15819+ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
15820 }
15821
15822 static void microcode_fini_cpu(int cpu)
15823diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
15824index 925179f..85bec6c 100644
15825--- a/arch/x86/kernel/module.c
15826+++ b/arch/x86/kernel/module.c
15827@@ -36,15 +36,60 @@
15828 #define DEBUGP(fmt...)
15829 #endif
15830
15831-void *module_alloc(unsigned long size)
15832+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
15833 {
15834 if (PAGE_ALIGN(size) > MODULES_LEN)
15835 return NULL;
15836 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
15837- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
15838+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
15839 -1, __builtin_return_address(0));
15840 }
15841
15842+void *module_alloc(unsigned long size)
15843+{
15844+
15845+#ifdef CONFIG_PAX_KERNEXEC
15846+ return __module_alloc(size, PAGE_KERNEL);
15847+#else
15848+ return __module_alloc(size, PAGE_KERNEL_EXEC);
15849+#endif
15850+
15851+}
15852+
15853+#ifdef CONFIG_PAX_KERNEXEC
15854+#ifdef CONFIG_X86_32
15855+void *module_alloc_exec(unsigned long size)
15856+{
15857+ struct vm_struct *area;
15858+
15859+ if (size == 0)
15860+ return NULL;
15861+
15862+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
15863+ return area ? area->addr : NULL;
15864+}
15865+EXPORT_SYMBOL(module_alloc_exec);
15866+
15867+void module_free_exec(struct module *mod, void *module_region)
15868+{
15869+ vunmap(module_region);
15870+}
15871+EXPORT_SYMBOL(module_free_exec);
15872+#else
15873+void module_free_exec(struct module *mod, void *module_region)
15874+{
15875+ module_free(mod, module_region);
15876+}
15877+EXPORT_SYMBOL(module_free_exec);
15878+
15879+void *module_alloc_exec(unsigned long size)
15880+{
15881+ return __module_alloc(size, PAGE_KERNEL_RX);
15882+}
15883+EXPORT_SYMBOL(module_alloc_exec);
15884+#endif
15885+#endif
15886+
15887 #ifdef CONFIG_X86_32
15888 int apply_relocate(Elf32_Shdr *sechdrs,
15889 const char *strtab,
15890@@ -55,14 +100,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15891 unsigned int i;
15892 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
15893 Elf32_Sym *sym;
15894- uint32_t *location;
15895+ uint32_t *plocation, location;
15896
15897 DEBUGP("Applying relocate section %u to %u\n", relsec,
15898 sechdrs[relsec].sh_info);
15899 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
15900 /* This is where to make the change */
15901- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
15902- + rel[i].r_offset;
15903+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
15904+ location = (uint32_t)plocation;
15905+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
15906+ plocation = ktla_ktva((void *)plocation);
15907 /* This is the symbol it is referring to. Note that all
15908 undefined symbols have been resolved. */
15909 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
15910@@ -71,11 +118,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15911 switch (ELF32_R_TYPE(rel[i].r_info)) {
15912 case R_386_32:
15913 /* We add the value into the location given */
15914- *location += sym->st_value;
15915+ pax_open_kernel();
15916+ *plocation += sym->st_value;
15917+ pax_close_kernel();
15918 break;
15919 case R_386_PC32:
15920 /* Add the value, subtract its postition */
15921- *location += sym->st_value - (uint32_t)location;
15922+ pax_open_kernel();
15923+ *plocation += sym->st_value - location;
15924+ pax_close_kernel();
15925 break;
15926 default:
15927 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
15928@@ -120,21 +171,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
15929 case R_X86_64_NONE:
15930 break;
15931 case R_X86_64_64:
15932+ pax_open_kernel();
15933 *(u64 *)loc = val;
15934+ pax_close_kernel();
15935 break;
15936 case R_X86_64_32:
15937+ pax_open_kernel();
15938 *(u32 *)loc = val;
15939+ pax_close_kernel();
15940 if (val != *(u32 *)loc)
15941 goto overflow;
15942 break;
15943 case R_X86_64_32S:
15944+ pax_open_kernel();
15945 *(s32 *)loc = val;
15946+ pax_close_kernel();
15947 if ((s64)val != *(s32 *)loc)
15948 goto overflow;
15949 break;
15950 case R_X86_64_PC32:
15951 val -= (u64)loc;
15952+ pax_open_kernel();
15953 *(u32 *)loc = val;
15954+ pax_close_kernel();
15955+
15956 #if 0
15957 if ((s64)val != *(s32 *)loc)
15958 goto overflow;
15959diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
15960index 676b8c7..870ba04 100644
15961--- a/arch/x86/kernel/paravirt-spinlocks.c
15962+++ b/arch/x86/kernel/paravirt-spinlocks.c
15963@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
15964 arch_spin_lock(lock);
15965 }
15966
15967-struct pv_lock_ops pv_lock_ops = {
15968+struct pv_lock_ops pv_lock_ops __read_only = {
15969 #ifdef CONFIG_SMP
15970 .spin_is_locked = __ticket_spin_is_locked,
15971 .spin_is_contended = __ticket_spin_is_contended,
15972diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
15973index d90272e..2d54e8e 100644
15974--- a/arch/x86/kernel/paravirt.c
15975+++ b/arch/x86/kernel/paravirt.c
15976@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
15977 {
15978 return x;
15979 }
15980+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
15981+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
15982+#endif
15983
15984 void __init default_banner(void)
15985 {
15986@@ -133,6 +136,9 @@ static void *get_call_destination(u8 type)
15987 .pv_lock_ops = pv_lock_ops,
15988 #endif
15989 };
15990+
15991+ pax_track_stack();
15992+
15993 return *((void **)&tmpl + type);
15994 }
15995
15996@@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
15997 if (opfunc == NULL)
15998 /* If there's no function, patch it with a ud2a (BUG) */
15999 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16000- else if (opfunc == _paravirt_nop)
16001+ else if (opfunc == (void *)_paravirt_nop)
16002 /* If the operation is a nop, then nop the callsite */
16003 ret = paravirt_patch_nop();
16004
16005 /* identity functions just return their single argument */
16006- else if (opfunc == _paravirt_ident_32)
16007+ else if (opfunc == (void *)_paravirt_ident_32)
16008 ret = paravirt_patch_ident_32(insnbuf, len);
16009- else if (opfunc == _paravirt_ident_64)
16010+ else if (opfunc == (void *)_paravirt_ident_64)
16011 ret = paravirt_patch_ident_64(insnbuf, len);
16012+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16013+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
16014+ ret = paravirt_patch_ident_64(insnbuf, len);
16015+#endif
16016
16017 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16018 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
16019@@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
16020 if (insn_len > len || start == NULL)
16021 insn_len = len;
16022 else
16023- memcpy(insnbuf, start, insn_len);
16024+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16025
16026 return insn_len;
16027 }
16028@@ -302,7 +312,7 @@ void arch_flush_lazy_mmu_mode(void)
16029 preempt_enable();
16030 }
16031
16032-struct pv_info pv_info = {
16033+struct pv_info pv_info __read_only = {
16034 .name = "bare hardware",
16035 .paravirt_enabled = 0,
16036 .kernel_rpl = 0,
16037@@ -313,16 +323,16 @@ struct pv_info pv_info = {
16038 #endif
16039 };
16040
16041-struct pv_init_ops pv_init_ops = {
16042+struct pv_init_ops pv_init_ops __read_only = {
16043 .patch = native_patch,
16044 };
16045
16046-struct pv_time_ops pv_time_ops = {
16047+struct pv_time_ops pv_time_ops __read_only = {
16048 .sched_clock = native_sched_clock,
16049 .steal_clock = native_steal_clock,
16050 };
16051
16052-struct pv_irq_ops pv_irq_ops = {
16053+struct pv_irq_ops pv_irq_ops __read_only = {
16054 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16055 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16056 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16057@@ -334,7 +344,7 @@ struct pv_irq_ops pv_irq_ops = {
16058 #endif
16059 };
16060
16061-struct pv_cpu_ops pv_cpu_ops = {
16062+struct pv_cpu_ops pv_cpu_ops __read_only = {
16063 .cpuid = native_cpuid,
16064 .get_debugreg = native_get_debugreg,
16065 .set_debugreg = native_set_debugreg,
16066@@ -395,21 +405,26 @@ struct pv_cpu_ops pv_cpu_ops = {
16067 .end_context_switch = paravirt_nop,
16068 };
16069
16070-struct pv_apic_ops pv_apic_ops = {
16071+struct pv_apic_ops pv_apic_ops __read_only = {
16072 #ifdef CONFIG_X86_LOCAL_APIC
16073 .startup_ipi_hook = paravirt_nop,
16074 #endif
16075 };
16076
16077-#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
16078+#ifdef CONFIG_X86_32
16079+#ifdef CONFIG_X86_PAE
16080+/* 64-bit pagetable entries */
16081+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
16082+#else
16083 /* 32-bit pagetable entries */
16084 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
16085+#endif
16086 #else
16087 /* 64-bit pagetable entries */
16088 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16089 #endif
16090
16091-struct pv_mmu_ops pv_mmu_ops = {
16092+struct pv_mmu_ops pv_mmu_ops __read_only = {
16093
16094 .read_cr2 = native_read_cr2,
16095 .write_cr2 = native_write_cr2,
16096@@ -459,6 +474,7 @@ struct pv_mmu_ops pv_mmu_ops = {
16097 .make_pud = PTE_IDENT,
16098
16099 .set_pgd = native_set_pgd,
16100+ .set_pgd_batched = native_set_pgd_batched,
16101 #endif
16102 #endif /* PAGETABLE_LEVELS >= 3 */
16103
16104@@ -478,6 +494,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16105 },
16106
16107 .set_fixmap = native_set_fixmap,
16108+
16109+#ifdef CONFIG_PAX_KERNEXEC
16110+ .pax_open_kernel = native_pax_open_kernel,
16111+ .pax_close_kernel = native_pax_close_kernel,
16112+#endif
16113+
16114 };
16115
16116 EXPORT_SYMBOL_GPL(pv_time_ops);
16117diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
16118index 35ccf75..67e7d4d 100644
16119--- a/arch/x86/kernel/pci-iommu_table.c
16120+++ b/arch/x86/kernel/pci-iommu_table.c
16121@@ -2,7 +2,7 @@
16122 #include <asm/iommu_table.h>
16123 #include <linux/string.h>
16124 #include <linux/kallsyms.h>
16125-
16126+#include <linux/sched.h>
16127
16128 #define DEBUG 1
16129
16130@@ -51,6 +51,8 @@ void __init check_iommu_entries(struct iommu_table_entry *start,
16131 {
16132 struct iommu_table_entry *p, *q, *x;
16133
16134+ pax_track_stack();
16135+
16136 /* Simple cyclic dependency checker. */
16137 for (p = start; p < finish; p++) {
16138 q = find_dependents_of(start, finish, p);
16139diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
16140index 30eb651..0758167 100644
16141--- a/arch/x86/kernel/process.c
16142+++ b/arch/x86/kernel/process.c
16143@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_struct *tsk)
16144
16145 void free_thread_info(struct thread_info *ti)
16146 {
16147- free_thread_xstate(ti->task);
16148 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16149 }
16150
16151+static struct kmem_cache *task_struct_cachep;
16152+
16153 void arch_task_cache_init(void)
16154 {
16155- task_xstate_cachep =
16156- kmem_cache_create("task_xstate", xstate_size,
16157+ /* create a slab on which task_structs can be allocated */
16158+ task_struct_cachep =
16159+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16160+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16161+
16162+ task_xstate_cachep =
16163+ kmem_cache_create("task_xstate", xstate_size,
16164 __alignof__(union thread_xstate),
16165- SLAB_PANIC | SLAB_NOTRACK, NULL);
16166+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16167+}
16168+
16169+struct task_struct *alloc_task_struct_node(int node)
16170+{
16171+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16172+}
16173+
16174+void free_task_struct(struct task_struct *task)
16175+{
16176+ free_thread_xstate(task);
16177+ kmem_cache_free(task_struct_cachep, task);
16178 }
16179
16180 /*
16181@@ -70,7 +87,7 @@ void exit_thread(void)
16182 unsigned long *bp = t->io_bitmap_ptr;
16183
16184 if (bp) {
16185- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16186+ struct tss_struct *tss = init_tss + get_cpu();
16187
16188 t->io_bitmap_ptr = NULL;
16189 clear_thread_flag(TIF_IO_BITMAP);
16190@@ -106,7 +123,7 @@ void show_regs_common(void)
16191
16192 printk(KERN_CONT "\n");
16193 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16194- current->pid, current->comm, print_tainted(),
16195+ task_pid_nr(current), current->comm, print_tainted(),
16196 init_utsname()->release,
16197 (int)strcspn(init_utsname()->version, " "),
16198 init_utsname()->version);
16199@@ -120,6 +137,9 @@ void flush_thread(void)
16200 {
16201 struct task_struct *tsk = current;
16202
16203+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16204+ loadsegment(gs, 0);
16205+#endif
16206 flush_ptrace_hw_breakpoint(tsk);
16207 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16208 /*
16209@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
16210 regs.di = (unsigned long) arg;
16211
16212 #ifdef CONFIG_X86_32
16213- regs.ds = __USER_DS;
16214- regs.es = __USER_DS;
16215+ regs.ds = __KERNEL_DS;
16216+ regs.es = __KERNEL_DS;
16217 regs.fs = __KERNEL_PERCPU;
16218- regs.gs = __KERNEL_STACK_CANARY;
16219+ savesegment(gs, regs.gs);
16220 #else
16221 regs.ss = __KERNEL_DS;
16222 #endif
16223@@ -411,7 +431,8 @@ bool set_pm_idle_to_default(void)
16224
16225 return ret;
16226 }
16227-void stop_this_cpu(void *dummy)
16228+
16229+__noreturn void stop_this_cpu(void *dummy)
16230 {
16231 local_irq_disable();
16232 /*
16233@@ -653,16 +674,37 @@ static int __init idle_setup(char *str)
16234 }
16235 early_param("idle", idle_setup);
16236
16237-unsigned long arch_align_stack(unsigned long sp)
16238+#ifdef CONFIG_PAX_RANDKSTACK
16239+void pax_randomize_kstack(struct pt_regs *regs)
16240 {
16241- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16242- sp -= get_random_int() % 8192;
16243- return sp & ~0xf;
16244-}
16245+ struct thread_struct *thread = &current->thread;
16246+ unsigned long time;
16247
16248-unsigned long arch_randomize_brk(struct mm_struct *mm)
16249-{
16250- unsigned long range_end = mm->brk + 0x02000000;
16251- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16252-}
16253+ if (!randomize_va_space)
16254+ return;
16255+
16256+ if (v8086_mode(regs))
16257+ return;
16258
16259+ rdtscl(time);
16260+
16261+ /* P4 seems to return a 0 LSB, ignore it */
16262+#ifdef CONFIG_MPENTIUM4
16263+ time &= 0x3EUL;
16264+ time <<= 2;
16265+#elif defined(CONFIG_X86_64)
16266+ time &= 0xFUL;
16267+ time <<= 4;
16268+#else
16269+ time &= 0x1FUL;
16270+ time <<= 3;
16271+#endif
16272+
16273+ thread->sp0 ^= time;
16274+ load_sp0(init_tss + smp_processor_id(), thread);
16275+
16276+#ifdef CONFIG_X86_64
16277+ percpu_write(kernel_stack, thread->sp0);
16278+#endif
16279+}
16280+#endif
16281diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
16282index 7a3b651..5a946f6 100644
16283--- a/arch/x86/kernel/process_32.c
16284+++ b/arch/x86/kernel/process_32.c
16285@@ -66,6 +66,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
16286 unsigned long thread_saved_pc(struct task_struct *tsk)
16287 {
16288 return ((unsigned long *)tsk->thread.sp)[3];
16289+//XXX return tsk->thread.eip;
16290 }
16291
16292 #ifndef CONFIG_SMP
16293@@ -128,15 +129,14 @@ void __show_regs(struct pt_regs *regs, int all)
16294 unsigned long sp;
16295 unsigned short ss, gs;
16296
16297- if (user_mode_vm(regs)) {
16298+ if (user_mode(regs)) {
16299 sp = regs->sp;
16300 ss = regs->ss & 0xffff;
16301- gs = get_user_gs(regs);
16302 } else {
16303 sp = kernel_stack_pointer(regs);
16304 savesegment(ss, ss);
16305- savesegment(gs, gs);
16306 }
16307+ gs = get_user_gs(regs);
16308
16309 show_regs_common();
16310
16311@@ -198,13 +198,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16312 struct task_struct *tsk;
16313 int err;
16314
16315- childregs = task_pt_regs(p);
16316+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16317 *childregs = *regs;
16318 childregs->ax = 0;
16319 childregs->sp = sp;
16320
16321 p->thread.sp = (unsigned long) childregs;
16322 p->thread.sp0 = (unsigned long) (childregs+1);
16323+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16324
16325 p->thread.ip = (unsigned long) ret_from_fork;
16326
16327@@ -294,7 +295,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16328 struct thread_struct *prev = &prev_p->thread,
16329 *next = &next_p->thread;
16330 int cpu = smp_processor_id();
16331- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16332+ struct tss_struct *tss = init_tss + cpu;
16333 bool preload_fpu;
16334
16335 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16336@@ -329,6 +330,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16337 */
16338 lazy_save_gs(prev->gs);
16339
16340+#ifdef CONFIG_PAX_MEMORY_UDEREF
16341+ __set_fs(task_thread_info(next_p)->addr_limit);
16342+#endif
16343+
16344 /*
16345 * Load the per-thread Thread-Local Storage descriptor.
16346 */
16347@@ -364,6 +369,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16348 */
16349 arch_end_context_switch(next_p);
16350
16351+ percpu_write(current_task, next_p);
16352+ percpu_write(current_tinfo, &next_p->tinfo);
16353+
16354 if (preload_fpu)
16355 __math_state_restore();
16356
16357@@ -373,8 +381,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16358 if (prev->gs | next->gs)
16359 lazy_load_gs(next->gs);
16360
16361- percpu_write(current_task, next_p);
16362-
16363 return prev_p;
16364 }
16365
16366@@ -404,4 +410,3 @@ unsigned long get_wchan(struct task_struct *p)
16367 } while (count++ < 16);
16368 return 0;
16369 }
16370-
16371diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
16372index f693e44..3c979b2 100644
16373--- a/arch/x86/kernel/process_64.c
16374+++ b/arch/x86/kernel/process_64.c
16375@@ -88,7 +88,7 @@ static void __exit_idle(void)
16376 void exit_idle(void)
16377 {
16378 /* idle loop has pid 0 */
16379- if (current->pid)
16380+ if (task_pid_nr(current))
16381 return;
16382 __exit_idle();
16383 }
16384@@ -262,8 +262,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16385 struct pt_regs *childregs;
16386 struct task_struct *me = current;
16387
16388- childregs = ((struct pt_regs *)
16389- (THREAD_SIZE + task_stack_page(p))) - 1;
16390+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16391 *childregs = *regs;
16392
16393 childregs->ax = 0;
16394@@ -275,6 +274,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16395 p->thread.sp = (unsigned long) childregs;
16396 p->thread.sp0 = (unsigned long) (childregs+1);
16397 p->thread.usersp = me->thread.usersp;
16398+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16399
16400 set_tsk_thread_flag(p, TIF_FORK);
16401
16402@@ -377,7 +377,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16403 struct thread_struct *prev = &prev_p->thread;
16404 struct thread_struct *next = &next_p->thread;
16405 int cpu = smp_processor_id();
16406- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16407+ struct tss_struct *tss = init_tss + cpu;
16408 unsigned fsindex, gsindex;
16409 bool preload_fpu;
16410
16411@@ -473,10 +473,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16412 prev->usersp = percpu_read(old_rsp);
16413 percpu_write(old_rsp, next->usersp);
16414 percpu_write(current_task, next_p);
16415+ percpu_write(current_tinfo, &next_p->tinfo);
16416
16417- percpu_write(kernel_stack,
16418- (unsigned long)task_stack_page(next_p) +
16419- THREAD_SIZE - KERNEL_STACK_OFFSET);
16420+ percpu_write(kernel_stack, next->sp0);
16421
16422 /*
16423 * Now maybe reload the debug registers and handle I/O bitmaps
16424@@ -538,12 +537,11 @@ unsigned long get_wchan(struct task_struct *p)
16425 if (!p || p == current || p->state == TASK_RUNNING)
16426 return 0;
16427 stack = (unsigned long)task_stack_page(p);
16428- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16429+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16430 return 0;
16431 fp = *(u64 *)(p->thread.sp);
16432 do {
16433- if (fp < (unsigned long)stack ||
16434- fp >= (unsigned long)stack+THREAD_SIZE)
16435+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16436 return 0;
16437 ip = *(u64 *)(fp+8);
16438 if (!in_sched_functions(ip))
16439diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
16440index 8252879..d3219e0 100644
16441--- a/arch/x86/kernel/ptrace.c
16442+++ b/arch/x86/kernel/ptrace.c
16443@@ -822,7 +822,7 @@ long arch_ptrace(struct task_struct *child, long request,
16444 unsigned long addr, unsigned long data)
16445 {
16446 int ret;
16447- unsigned long __user *datap = (unsigned long __user *)data;
16448+ unsigned long __user *datap = (__force unsigned long __user *)data;
16449
16450 switch (request) {
16451 /* read the word at location addr in the USER area. */
16452@@ -907,14 +907,14 @@ long arch_ptrace(struct task_struct *child, long request,
16453 if ((int) addr < 0)
16454 return -EIO;
16455 ret = do_get_thread_area(child, addr,
16456- (struct user_desc __user *)data);
16457+ (__force struct user_desc __user *) data);
16458 break;
16459
16460 case PTRACE_SET_THREAD_AREA:
16461 if ((int) addr < 0)
16462 return -EIO;
16463 ret = do_set_thread_area(child, addr,
16464- (struct user_desc __user *)data, 0);
16465+ (__force struct user_desc __user *) data, 0);
16466 break;
16467 #endif
16468
16469@@ -1331,7 +1331,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
16470 memset(info, 0, sizeof(*info));
16471 info->si_signo = SIGTRAP;
16472 info->si_code = si_code;
16473- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16474+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16475 }
16476
16477 void user_single_step_siginfo(struct task_struct *tsk,
16478diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
16479index 42eb330..139955c 100644
16480--- a/arch/x86/kernel/pvclock.c
16481+++ b/arch/x86/kernel/pvclock.c
16482@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
16483 return pv_tsc_khz;
16484 }
16485
16486-static atomic64_t last_value = ATOMIC64_INIT(0);
16487+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16488
16489 void pvclock_resume(void)
16490 {
16491- atomic64_set(&last_value, 0);
16492+ atomic64_set_unchecked(&last_value, 0);
16493 }
16494
16495 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16496@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16497 * updating at the same time, and one of them could be slightly behind,
16498 * making the assumption that last_value always go forward fail to hold.
16499 */
16500- last = atomic64_read(&last_value);
16501+ last = atomic64_read_unchecked(&last_value);
16502 do {
16503 if (ret < last)
16504 return last;
16505- last = atomic64_cmpxchg(&last_value, last, ret);
16506+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16507 } while (unlikely(last != ret));
16508
16509 return ret;
16510diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
16511index d4a705f..ef8f1a9 100644
16512--- a/arch/x86/kernel/reboot.c
16513+++ b/arch/x86/kernel/reboot.c
16514@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16515 EXPORT_SYMBOL(pm_power_off);
16516
16517 static const struct desc_ptr no_idt = {};
16518-static int reboot_mode;
16519+static unsigned short reboot_mode;
16520 enum reboot_type reboot_type = BOOT_ACPI;
16521 int reboot_force;
16522
16523@@ -324,13 +324,17 @@ core_initcall(reboot_init);
16524 extern const unsigned char machine_real_restart_asm[];
16525 extern const u64 machine_real_restart_gdt[3];
16526
16527-void machine_real_restart(unsigned int type)
16528+__noreturn void machine_real_restart(unsigned int type)
16529 {
16530 void *restart_va;
16531 unsigned long restart_pa;
16532- void (*restart_lowmem)(unsigned int);
16533+ void (* __noreturn restart_lowmem)(unsigned int);
16534 u64 *lowmem_gdt;
16535
16536+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16537+ struct desc_struct *gdt;
16538+#endif
16539+
16540 local_irq_disable();
16541
16542 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16543@@ -356,14 +360,14 @@ void machine_real_restart(unsigned int type)
16544 boot)". This seems like a fairly standard thing that gets set by
16545 REBOOT.COM programs, and the previous reset routine did this
16546 too. */
16547- *((unsigned short *)0x472) = reboot_mode;
16548+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16549
16550 /* Patch the GDT in the low memory trampoline */
16551 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16552
16553 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16554 restart_pa = virt_to_phys(restart_va);
16555- restart_lowmem = (void (*)(unsigned int))restart_pa;
16556+ restart_lowmem = (void *)restart_pa;
16557
16558 /* GDT[0]: GDT self-pointer */
16559 lowmem_gdt[0] =
16560@@ -374,7 +378,33 @@ void machine_real_restart(unsigned int type)
16561 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16562
16563 /* Jump to the identity-mapped low memory code */
16564+
16565+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16566+ gdt = get_cpu_gdt_table(smp_processor_id());
16567+ pax_open_kernel();
16568+#ifdef CONFIG_PAX_MEMORY_UDEREF
16569+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16570+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16571+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16572+#endif
16573+#ifdef CONFIG_PAX_KERNEXEC
16574+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16575+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16576+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16577+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16578+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16579+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16580+#endif
16581+ pax_close_kernel();
16582+#endif
16583+
16584+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16585+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16586+ unreachable();
16587+#else
16588 restart_lowmem(type);
16589+#endif
16590+
16591 }
16592 #ifdef CONFIG_APM_MODULE
16593 EXPORT_SYMBOL(machine_real_restart);
16594@@ -532,7 +562,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
16595 * try to force a triple fault and then cycle between hitting the keyboard
16596 * controller and doing that
16597 */
16598-static void native_machine_emergency_restart(void)
16599+__noreturn static void native_machine_emergency_restart(void)
16600 {
16601 int i;
16602 int attempt = 0;
16603@@ -656,13 +686,13 @@ void native_machine_shutdown(void)
16604 #endif
16605 }
16606
16607-static void __machine_emergency_restart(int emergency)
16608+static __noreturn void __machine_emergency_restart(int emergency)
16609 {
16610 reboot_emergency = emergency;
16611 machine_ops.emergency_restart();
16612 }
16613
16614-static void native_machine_restart(char *__unused)
16615+static __noreturn void native_machine_restart(char *__unused)
16616 {
16617 printk("machine restart\n");
16618
16619@@ -671,7 +701,7 @@ static void native_machine_restart(char *__unused)
16620 __machine_emergency_restart(0);
16621 }
16622
16623-static void native_machine_halt(void)
16624+static __noreturn void native_machine_halt(void)
16625 {
16626 /* stop other cpus and apics */
16627 machine_shutdown();
16628@@ -682,7 +712,7 @@ static void native_machine_halt(void)
16629 stop_this_cpu(NULL);
16630 }
16631
16632-static void native_machine_power_off(void)
16633+__noreturn static void native_machine_power_off(void)
16634 {
16635 if (pm_power_off) {
16636 if (!reboot_force)
16637@@ -691,6 +721,7 @@ static void native_machine_power_off(void)
16638 }
16639 /* a fallback in case there is no PM info available */
16640 tboot_shutdown(TB_SHUTDOWN_HALT);
16641+ unreachable();
16642 }
16643
16644 struct machine_ops machine_ops = {
16645diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
16646index 7a6f3b3..bed145d7 100644
16647--- a/arch/x86/kernel/relocate_kernel_64.S
16648+++ b/arch/x86/kernel/relocate_kernel_64.S
16649@@ -11,6 +11,7 @@
16650 #include <asm/kexec.h>
16651 #include <asm/processor-flags.h>
16652 #include <asm/pgtable_types.h>
16653+#include <asm/alternative-asm.h>
16654
16655 /*
16656 * Must be relocatable PIC code callable as a C function
16657@@ -160,13 +161,14 @@ identity_mapped:
16658 xorq %rbp, %rbp
16659 xorq %r8, %r8
16660 xorq %r9, %r9
16661- xorq %r10, %r9
16662+ xorq %r10, %r10
16663 xorq %r11, %r11
16664 xorq %r12, %r12
16665 xorq %r13, %r13
16666 xorq %r14, %r14
16667 xorq %r15, %r15
16668
16669+ pax_force_retaddr 0, 1
16670 ret
16671
16672 1:
16673diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
16674index afaf384..1a101fe 100644
16675--- a/arch/x86/kernel/setup.c
16676+++ b/arch/x86/kernel/setup.c
16677@@ -447,7 +447,7 @@ static void __init parse_setup_data(void)
16678
16679 switch (data->type) {
16680 case SETUP_E820_EXT:
16681- parse_e820_ext(data);
16682+ parse_e820_ext((struct setup_data __force_kernel *)data);
16683 break;
16684 case SETUP_DTB:
16685 add_dtb(pa_data);
16686@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
16687 * area (640->1Mb) as ram even though it is not.
16688 * take them out.
16689 */
16690- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16691+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16692 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16693 }
16694
16695@@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p)
16696
16697 if (!boot_params.hdr.root_flags)
16698 root_mountflags &= ~MS_RDONLY;
16699- init_mm.start_code = (unsigned long) _text;
16700- init_mm.end_code = (unsigned long) _etext;
16701+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16702+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16703 init_mm.end_data = (unsigned long) _edata;
16704 init_mm.brk = _brk_end;
16705
16706- code_resource.start = virt_to_phys(_text);
16707- code_resource.end = virt_to_phys(_etext)-1;
16708- data_resource.start = virt_to_phys(_etext);
16709+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16710+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16711+ data_resource.start = virt_to_phys(_sdata);
16712 data_resource.end = virt_to_phys(_edata)-1;
16713 bss_resource.start = virt_to_phys(&__bss_start);
16714 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16715diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
16716index 71f4727..16dc9f7 100644
16717--- a/arch/x86/kernel/setup_percpu.c
16718+++ b/arch/x86/kernel/setup_percpu.c
16719@@ -21,19 +21,17 @@
16720 #include <asm/cpu.h>
16721 #include <asm/stackprotector.h>
16722
16723-DEFINE_PER_CPU(int, cpu_number);
16724+#ifdef CONFIG_SMP
16725+DEFINE_PER_CPU(unsigned int, cpu_number);
16726 EXPORT_PER_CPU_SYMBOL(cpu_number);
16727+#endif
16728
16729-#ifdef CONFIG_X86_64
16730 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16731-#else
16732-#define BOOT_PERCPU_OFFSET 0
16733-#endif
16734
16735 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16736 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16737
16738-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16739+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16740 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16741 };
16742 EXPORT_SYMBOL(__per_cpu_offset);
16743@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
16744 {
16745 #ifdef CONFIG_X86_32
16746 struct desc_struct gdt;
16747+ unsigned long base = per_cpu_offset(cpu);
16748
16749- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16750- 0x2 | DESCTYPE_S, 0x8);
16751- gdt.s = 1;
16752+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16753+ 0x83 | DESCTYPE_S, 0xC);
16754 write_gdt_entry(get_cpu_gdt_table(cpu),
16755 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
16756 #endif
16757@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
16758 /* alrighty, percpu areas up and running */
16759 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16760 for_each_possible_cpu(cpu) {
16761+#ifdef CONFIG_CC_STACKPROTECTOR
16762+#ifdef CONFIG_X86_32
16763+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
16764+#endif
16765+#endif
16766 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
16767 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
16768 per_cpu(cpu_number, cpu) = cpu;
16769@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
16770 */
16771 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
16772 #endif
16773+#ifdef CONFIG_CC_STACKPROTECTOR
16774+#ifdef CONFIG_X86_32
16775+ if (!cpu)
16776+ per_cpu(stack_canary.canary, cpu) = canary;
16777+#endif
16778+#endif
16779 /*
16780 * Up to this point, the boot CPU has been using .init.data
16781 * area. Reload any changed state for the boot CPU.
16782diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
16783index 54ddaeb2..a6aa4d2 100644
16784--- a/arch/x86/kernel/signal.c
16785+++ b/arch/x86/kernel/signal.c
16786@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsigned long sp)
16787 * Align the stack pointer according to the i386 ABI,
16788 * i.e. so that on function entry ((sp + 4) & 15) == 0.
16789 */
16790- sp = ((sp + 4) & -16ul) - 4;
16791+ sp = ((sp - 12) & -16ul) - 4;
16792 #else /* !CONFIG_X86_32 */
16793 sp = round_down(sp, 16) - 8;
16794 #endif
16795@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
16796 * Return an always-bogus address instead so we will die with SIGSEGV.
16797 */
16798 if (onsigstack && !likely(on_sig_stack(sp)))
16799- return (void __user *)-1L;
16800+ return (__force void __user *)-1L;
16801
16802 /* save i387 state */
16803 if (used_math() && save_i387_xstate(*fpstate) < 0)
16804- return (void __user *)-1L;
16805+ return (__force void __user *)-1L;
16806
16807 return (void __user *)sp;
16808 }
16809@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16810 }
16811
16812 if (current->mm->context.vdso)
16813- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16814+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16815 else
16816- restorer = &frame->retcode;
16817+ restorer = (void __user *)&frame->retcode;
16818 if (ka->sa.sa_flags & SA_RESTORER)
16819 restorer = ka->sa.sa_restorer;
16820
16821@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16822 * reasons and because gdb uses it as a signature to notice
16823 * signal handler stack frames.
16824 */
16825- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
16826+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
16827
16828 if (err)
16829 return -EFAULT;
16830@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16831 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
16832
16833 /* Set up to return from userspace. */
16834- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16835+ if (current->mm->context.vdso)
16836+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16837+ else
16838+ restorer = (void __user *)&frame->retcode;
16839 if (ka->sa.sa_flags & SA_RESTORER)
16840 restorer = ka->sa.sa_restorer;
16841 put_user_ex(restorer, &frame->pretcode);
16842@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16843 * reasons and because gdb uses it as a signature to notice
16844 * signal handler stack frames.
16845 */
16846- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
16847+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
16848 } put_user_catch(err);
16849
16850 if (err)
16851@@ -762,6 +765,8 @@ static void do_signal(struct pt_regs *regs)
16852 siginfo_t info;
16853 int signr;
16854
16855+ pax_track_stack();
16856+
16857 /*
16858 * We want the common case to go fast, which is why we may in certain
16859 * cases get here from kernel mode. Just return without doing anything
16860@@ -769,7 +774,7 @@ static void do_signal(struct pt_regs *regs)
16861 * X86_32: vm86 regs switched out by assembly code before reaching
16862 * here, so testing against kernel CS suffices.
16863 */
16864- if (!user_mode(regs))
16865+ if (!user_mode_novm(regs))
16866 return;
16867
16868 signr = get_signal_to_deliver(&info, &ka, regs, NULL);
16869diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
16870index 9f548cb..caf76f7 100644
16871--- a/arch/x86/kernel/smpboot.c
16872+++ b/arch/x86/kernel/smpboot.c
16873@@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
16874 set_idle_for_cpu(cpu, c_idle.idle);
16875 do_rest:
16876 per_cpu(current_task, cpu) = c_idle.idle;
16877+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
16878 #ifdef CONFIG_X86_32
16879 /* Stack for startup_32 can be just as for start_secondary onwards */
16880 irq_ctx_init(cpu);
16881 #else
16882 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
16883 initial_gs = per_cpu_offset(cpu);
16884- per_cpu(kernel_stack, cpu) =
16885- (unsigned long)task_stack_page(c_idle.idle) -
16886- KERNEL_STACK_OFFSET + THREAD_SIZE;
16887+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
16888 #endif
16889+
16890+ pax_open_kernel();
16891 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
16892+ pax_close_kernel();
16893+
16894 initial_code = (unsigned long)start_secondary;
16895 stack_start = c_idle.idle->thread.sp;
16896
16897@@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
16898
16899 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
16900
16901+#ifdef CONFIG_PAX_PER_CPU_PGD
16902+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
16903+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16904+ KERNEL_PGD_PTRS);
16905+#endif
16906+
16907 err = do_boot_cpu(apicid, cpu);
16908 if (err) {
16909 pr_debug("do_boot_cpu failed %d\n", err);
16910diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
16911index c346d11..d43b163 100644
16912--- a/arch/x86/kernel/step.c
16913+++ b/arch/x86/kernel/step.c
16914@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16915 struct desc_struct *desc;
16916 unsigned long base;
16917
16918- seg &= ~7UL;
16919+ seg >>= 3;
16920
16921 mutex_lock(&child->mm->context.lock);
16922- if (unlikely((seg >> 3) >= child->mm->context.size))
16923+ if (unlikely(seg >= child->mm->context.size))
16924 addr = -1L; /* bogus selector, access would fault */
16925 else {
16926 desc = child->mm->context.ldt + seg;
16927@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16928 addr += base;
16929 }
16930 mutex_unlock(&child->mm->context.lock);
16931- }
16932+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
16933+ addr = ktla_ktva(addr);
16934
16935 return addr;
16936 }
16937@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
16938 unsigned char opcode[15];
16939 unsigned long addr = convert_ip_to_linear(child, regs);
16940
16941+ if (addr == -EINVAL)
16942+ return 0;
16943+
16944 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
16945 for (i = 0; i < copied; i++) {
16946 switch (opcode[i]) {
16947diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
16948index 0b0cb5f..db6b9ed 100644
16949--- a/arch/x86/kernel/sys_i386_32.c
16950+++ b/arch/x86/kernel/sys_i386_32.c
16951@@ -24,17 +24,224 @@
16952
16953 #include <asm/syscalls.h>
16954
16955-/*
16956- * Do a system call from kernel instead of calling sys_execve so we
16957- * end up with proper pt_regs.
16958- */
16959-int kernel_execve(const char *filename,
16960- const char *const argv[],
16961- const char *const envp[])
16962+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
16963 {
16964- long __res;
16965- asm volatile ("int $0x80"
16966- : "=a" (__res)
16967- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
16968- return __res;
16969+ unsigned long pax_task_size = TASK_SIZE;
16970+
16971+#ifdef CONFIG_PAX_SEGMEXEC
16972+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
16973+ pax_task_size = SEGMEXEC_TASK_SIZE;
16974+#endif
16975+
16976+ if (len > pax_task_size || addr > pax_task_size - len)
16977+ return -EINVAL;
16978+
16979+ return 0;
16980+}
16981+
16982+unsigned long
16983+arch_get_unmapped_area(struct file *filp, unsigned long addr,
16984+ unsigned long len, unsigned long pgoff, unsigned long flags)
16985+{
16986+ struct mm_struct *mm = current->mm;
16987+ struct vm_area_struct *vma;
16988+ unsigned long start_addr, pax_task_size = TASK_SIZE;
16989+
16990+#ifdef CONFIG_PAX_SEGMEXEC
16991+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
16992+ pax_task_size = SEGMEXEC_TASK_SIZE;
16993+#endif
16994+
16995+ pax_task_size -= PAGE_SIZE;
16996+
16997+ if (len > pax_task_size)
16998+ return -ENOMEM;
16999+
17000+ if (flags & MAP_FIXED)
17001+ return addr;
17002+
17003+#ifdef CONFIG_PAX_RANDMMAP
17004+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17005+#endif
17006+
17007+ if (addr) {
17008+ addr = PAGE_ALIGN(addr);
17009+ if (pax_task_size - len >= addr) {
17010+ vma = find_vma(mm, addr);
17011+ if (check_heap_stack_gap(vma, addr, len))
17012+ return addr;
17013+ }
17014+ }
17015+ if (len > mm->cached_hole_size) {
17016+ start_addr = addr = mm->free_area_cache;
17017+ } else {
17018+ start_addr = addr = mm->mmap_base;
17019+ mm->cached_hole_size = 0;
17020+ }
17021+
17022+#ifdef CONFIG_PAX_PAGEEXEC
17023+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17024+ start_addr = 0x00110000UL;
17025+
17026+#ifdef CONFIG_PAX_RANDMMAP
17027+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17028+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17029+#endif
17030+
17031+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17032+ start_addr = addr = mm->mmap_base;
17033+ else
17034+ addr = start_addr;
17035+ }
17036+#endif
17037+
17038+full_search:
17039+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17040+ /* At this point: (!vma || addr < vma->vm_end). */
17041+ if (pax_task_size - len < addr) {
17042+ /*
17043+ * Start a new search - just in case we missed
17044+ * some holes.
17045+ */
17046+ if (start_addr != mm->mmap_base) {
17047+ start_addr = addr = mm->mmap_base;
17048+ mm->cached_hole_size = 0;
17049+ goto full_search;
17050+ }
17051+ return -ENOMEM;
17052+ }
17053+ if (check_heap_stack_gap(vma, addr, len))
17054+ break;
17055+ if (addr + mm->cached_hole_size < vma->vm_start)
17056+ mm->cached_hole_size = vma->vm_start - addr;
17057+ addr = vma->vm_end;
17058+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17059+ start_addr = addr = mm->mmap_base;
17060+ mm->cached_hole_size = 0;
17061+ goto full_search;
17062+ }
17063+ }
17064+
17065+ /*
17066+ * Remember the place where we stopped the search:
17067+ */
17068+ mm->free_area_cache = addr + len;
17069+ return addr;
17070+}
17071+
17072+unsigned long
17073+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17074+ const unsigned long len, const unsigned long pgoff,
17075+ const unsigned long flags)
17076+{
17077+ struct vm_area_struct *vma;
17078+ struct mm_struct *mm = current->mm;
17079+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17080+
17081+#ifdef CONFIG_PAX_SEGMEXEC
17082+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17083+ pax_task_size = SEGMEXEC_TASK_SIZE;
17084+#endif
17085+
17086+ pax_task_size -= PAGE_SIZE;
17087+
17088+ /* requested length too big for entire address space */
17089+ if (len > pax_task_size)
17090+ return -ENOMEM;
17091+
17092+ if (flags & MAP_FIXED)
17093+ return addr;
17094+
17095+#ifdef CONFIG_PAX_PAGEEXEC
17096+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17097+ goto bottomup;
17098+#endif
17099+
17100+#ifdef CONFIG_PAX_RANDMMAP
17101+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17102+#endif
17103+
17104+ /* requesting a specific address */
17105+ if (addr) {
17106+ addr = PAGE_ALIGN(addr);
17107+ if (pax_task_size - len >= addr) {
17108+ vma = find_vma(mm, addr);
17109+ if (check_heap_stack_gap(vma, addr, len))
17110+ return addr;
17111+ }
17112+ }
17113+
17114+ /* check if free_area_cache is useful for us */
17115+ if (len <= mm->cached_hole_size) {
17116+ mm->cached_hole_size = 0;
17117+ mm->free_area_cache = mm->mmap_base;
17118+ }
17119+
17120+ /* either no address requested or can't fit in requested address hole */
17121+ addr = mm->free_area_cache;
17122+
17123+ /* make sure it can fit in the remaining address space */
17124+ if (addr > len) {
17125+ vma = find_vma(mm, addr-len);
17126+ if (check_heap_stack_gap(vma, addr - len, len))
17127+ /* remember the address as a hint for next time */
17128+ return (mm->free_area_cache = addr-len);
17129+ }
17130+
17131+ if (mm->mmap_base < len)
17132+ goto bottomup;
17133+
17134+ addr = mm->mmap_base-len;
17135+
17136+ do {
17137+ /*
17138+ * Lookup failure means no vma is above this address,
17139+ * else if new region fits below vma->vm_start,
17140+ * return with success:
17141+ */
17142+ vma = find_vma(mm, addr);
17143+ if (check_heap_stack_gap(vma, addr, len))
17144+ /* remember the address as a hint for next time */
17145+ return (mm->free_area_cache = addr);
17146+
17147+ /* remember the largest hole we saw so far */
17148+ if (addr + mm->cached_hole_size < vma->vm_start)
17149+ mm->cached_hole_size = vma->vm_start - addr;
17150+
17151+ /* try just below the current vma->vm_start */
17152+ addr = skip_heap_stack_gap(vma, len);
17153+ } while (!IS_ERR_VALUE(addr));
17154+
17155+bottomup:
17156+ /*
17157+ * A failed mmap() very likely causes application failure,
17158+ * so fall back to the bottom-up function here. This scenario
17159+ * can happen with large stack limits and large mmap()
17160+ * allocations.
17161+ */
17162+
17163+#ifdef CONFIG_PAX_SEGMEXEC
17164+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17165+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17166+ else
17167+#endif
17168+
17169+ mm->mmap_base = TASK_UNMAPPED_BASE;
17170+
17171+#ifdef CONFIG_PAX_RANDMMAP
17172+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17173+ mm->mmap_base += mm->delta_mmap;
17174+#endif
17175+
17176+ mm->free_area_cache = mm->mmap_base;
17177+ mm->cached_hole_size = ~0UL;
17178+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17179+ /*
17180+ * Restore the topdown base:
17181+ */
17182+ mm->mmap_base = base;
17183+ mm->free_area_cache = base;
17184+ mm->cached_hole_size = ~0UL;
17185+
17186+ return addr;
17187 }
17188diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
17189index ff14a50..35626c3 100644
17190--- a/arch/x86/kernel/sys_x86_64.c
17191+++ b/arch/x86/kernel/sys_x86_64.c
17192@@ -32,8 +32,8 @@ out:
17193 return error;
17194 }
17195
17196-static void find_start_end(unsigned long flags, unsigned long *begin,
17197- unsigned long *end)
17198+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17199+ unsigned long *begin, unsigned long *end)
17200 {
17201 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17202 unsigned long new_begin;
17203@@ -52,7 +52,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
17204 *begin = new_begin;
17205 }
17206 } else {
17207- *begin = TASK_UNMAPPED_BASE;
17208+ *begin = mm->mmap_base;
17209 *end = TASK_SIZE;
17210 }
17211 }
17212@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
17213 if (flags & MAP_FIXED)
17214 return addr;
17215
17216- find_start_end(flags, &begin, &end);
17217+ find_start_end(mm, flags, &begin, &end);
17218
17219 if (len > end)
17220 return -ENOMEM;
17221
17222+#ifdef CONFIG_PAX_RANDMMAP
17223+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17224+#endif
17225+
17226 if (addr) {
17227 addr = PAGE_ALIGN(addr);
17228 vma = find_vma(mm, addr);
17229- if (end - len >= addr &&
17230- (!vma || addr + len <= vma->vm_start))
17231+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17232 return addr;
17233 }
17234 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17235@@ -106,7 +109,7 @@ full_search:
17236 }
17237 return -ENOMEM;
17238 }
17239- if (!vma || addr + len <= vma->vm_start) {
17240+ if (check_heap_stack_gap(vma, addr, len)) {
17241 /*
17242 * Remember the place where we stopped the search:
17243 */
17244@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17245 {
17246 struct vm_area_struct *vma;
17247 struct mm_struct *mm = current->mm;
17248- unsigned long addr = addr0;
17249+ unsigned long base = mm->mmap_base, addr = addr0;
17250
17251 /* requested length too big for entire address space */
17252 if (len > TASK_SIZE)
17253@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17254 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17255 goto bottomup;
17256
17257+#ifdef CONFIG_PAX_RANDMMAP
17258+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17259+#endif
17260+
17261 /* requesting a specific address */
17262 if (addr) {
17263 addr = PAGE_ALIGN(addr);
17264- vma = find_vma(mm, addr);
17265- if (TASK_SIZE - len >= addr &&
17266- (!vma || addr + len <= vma->vm_start))
17267- return addr;
17268+ if (TASK_SIZE - len >= addr) {
17269+ vma = find_vma(mm, addr);
17270+ if (check_heap_stack_gap(vma, addr, len))
17271+ return addr;
17272+ }
17273 }
17274
17275 /* check if free_area_cache is useful for us */
17276@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17277 /* make sure it can fit in the remaining address space */
17278 if (addr > len) {
17279 vma = find_vma(mm, addr-len);
17280- if (!vma || addr <= vma->vm_start)
17281+ if (check_heap_stack_gap(vma, addr - len, len))
17282 /* remember the address as a hint for next time */
17283 return mm->free_area_cache = addr-len;
17284 }
17285@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17286 * return with success:
17287 */
17288 vma = find_vma(mm, addr);
17289- if (!vma || addr+len <= vma->vm_start)
17290+ if (check_heap_stack_gap(vma, addr, len))
17291 /* remember the address as a hint for next time */
17292 return mm->free_area_cache = addr;
17293
17294@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17295 mm->cached_hole_size = vma->vm_start - addr;
17296
17297 /* try just below the current vma->vm_start */
17298- addr = vma->vm_start-len;
17299- } while (len < vma->vm_start);
17300+ addr = skip_heap_stack_gap(vma, len);
17301+ } while (!IS_ERR_VALUE(addr));
17302
17303 bottomup:
17304 /*
17305@@ -198,13 +206,21 @@ bottomup:
17306 * can happen with large stack limits and large mmap()
17307 * allocations.
17308 */
17309+ mm->mmap_base = TASK_UNMAPPED_BASE;
17310+
17311+#ifdef CONFIG_PAX_RANDMMAP
17312+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17313+ mm->mmap_base += mm->delta_mmap;
17314+#endif
17315+
17316+ mm->free_area_cache = mm->mmap_base;
17317 mm->cached_hole_size = ~0UL;
17318- mm->free_area_cache = TASK_UNMAPPED_BASE;
17319 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17320 /*
17321 * Restore the topdown base:
17322 */
17323- mm->free_area_cache = mm->mmap_base;
17324+ mm->mmap_base = base;
17325+ mm->free_area_cache = base;
17326 mm->cached_hole_size = ~0UL;
17327
17328 return addr;
17329diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
17330index bc19be3..0f5fbf7 100644
17331--- a/arch/x86/kernel/syscall_table_32.S
17332+++ b/arch/x86/kernel/syscall_table_32.S
17333@@ -1,3 +1,4 @@
17334+.section .rodata,"a",@progbits
17335 ENTRY(sys_call_table)
17336 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17337 .long sys_exit
17338diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
17339index e07a2fc..db0369d 100644
17340--- a/arch/x86/kernel/tboot.c
17341+++ b/arch/x86/kernel/tboot.c
17342@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17343
17344 void tboot_shutdown(u32 shutdown_type)
17345 {
17346- void (*shutdown)(void);
17347+ void (* __noreturn shutdown)(void);
17348
17349 if (!tboot_enabled())
17350 return;
17351@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17352
17353 switch_to_tboot_pt();
17354
17355- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17356+ shutdown = (void *)tboot->shutdown_entry;
17357 shutdown();
17358
17359 /* should not reach here */
17360@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
17361 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17362 }
17363
17364-static atomic_t ap_wfs_count;
17365+static atomic_unchecked_t ap_wfs_count;
17366
17367 static int tboot_wait_for_aps(int num_aps)
17368 {
17369@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
17370 {
17371 switch (action) {
17372 case CPU_DYING:
17373- atomic_inc(&ap_wfs_count);
17374+ atomic_inc_unchecked(&ap_wfs_count);
17375 if (num_online_cpus() == 1)
17376- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17377+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17378 return NOTIFY_BAD;
17379 break;
17380 }
17381@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17382
17383 tboot_create_trampoline();
17384
17385- atomic_set(&ap_wfs_count, 0);
17386+ atomic_set_unchecked(&ap_wfs_count, 0);
17387 register_hotcpu_notifier(&tboot_cpu_notifier);
17388 return 0;
17389 }
17390diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
17391index 5a64d05..804587b 100644
17392--- a/arch/x86/kernel/time.c
17393+++ b/arch/x86/kernel/time.c
17394@@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs)
17395 {
17396 unsigned long pc = instruction_pointer(regs);
17397
17398- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17399+ if (!user_mode(regs) && in_lock_functions(pc)) {
17400 #ifdef CONFIG_FRAME_POINTER
17401- return *(unsigned long *)(regs->bp + sizeof(long));
17402+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17403 #else
17404 unsigned long *sp =
17405 (unsigned long *)kernel_stack_pointer(regs);
17406@@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
17407 * or above a saved flags. Eflags has bits 22-31 zero,
17408 * kernel addresses don't.
17409 */
17410+
17411+#ifdef CONFIG_PAX_KERNEXEC
17412+ return ktla_ktva(sp[0]);
17413+#else
17414 if (sp[0] >> 22)
17415 return sp[0];
17416 if (sp[1] >> 22)
17417 return sp[1];
17418 #endif
17419+
17420+#endif
17421 }
17422 return pc;
17423 }
17424diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
17425index 6bb7b85..dd853e1 100644
17426--- a/arch/x86/kernel/tls.c
17427+++ b/arch/x86/kernel/tls.c
17428@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
17429 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17430 return -EINVAL;
17431
17432+#ifdef CONFIG_PAX_SEGMEXEC
17433+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17434+ return -EINVAL;
17435+#endif
17436+
17437 set_tls_desc(p, idx, &info, 1);
17438
17439 return 0;
17440diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
17441index 451c0a7..e57f551 100644
17442--- a/arch/x86/kernel/trampoline_32.S
17443+++ b/arch/x86/kernel/trampoline_32.S
17444@@ -32,6 +32,12 @@
17445 #include <asm/segment.h>
17446 #include <asm/page_types.h>
17447
17448+#ifdef CONFIG_PAX_KERNEXEC
17449+#define ta(X) (X)
17450+#else
17451+#define ta(X) ((X) - __PAGE_OFFSET)
17452+#endif
17453+
17454 #ifdef CONFIG_SMP
17455
17456 .section ".x86_trampoline","a"
17457@@ -62,7 +68,7 @@ r_base = .
17458 inc %ax # protected mode (PE) bit
17459 lmsw %ax # into protected mode
17460 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17461- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17462+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17463
17464 # These need to be in the same 64K segment as the above;
17465 # hence we don't use the boot_gdt_descr defined in head.S
17466diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
17467index 09ff517..df19fbff 100644
17468--- a/arch/x86/kernel/trampoline_64.S
17469+++ b/arch/x86/kernel/trampoline_64.S
17470@@ -90,7 +90,7 @@ startup_32:
17471 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17472 movl %eax, %ds
17473
17474- movl $X86_CR4_PAE, %eax
17475+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17476 movl %eax, %cr4 # Enable PAE mode
17477
17478 # Setup trampoline 4 level pagetables
17479@@ -138,7 +138,7 @@ tidt:
17480 # so the kernel can live anywhere
17481 .balign 4
17482 tgdt:
17483- .short tgdt_end - tgdt # gdt limit
17484+ .short tgdt_end - tgdt - 1 # gdt limit
17485 .long tgdt - r_base
17486 .short 0
17487 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17488diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
17489index 6913369..7e7dff6 100644
17490--- a/arch/x86/kernel/traps.c
17491+++ b/arch/x86/kernel/traps.c
17492@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17493
17494 /* Do we ignore FPU interrupts ? */
17495 char ignore_fpu_irq;
17496-
17497-/*
17498- * The IDT has to be page-aligned to simplify the Pentium
17499- * F0 0F bug workaround.
17500- */
17501-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17502 #endif
17503
17504 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17505@@ -117,13 +111,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
17506 }
17507
17508 static void __kprobes
17509-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17510+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17511 long error_code, siginfo_t *info)
17512 {
17513 struct task_struct *tsk = current;
17514
17515 #ifdef CONFIG_X86_32
17516- if (regs->flags & X86_VM_MASK) {
17517+ if (v8086_mode(regs)) {
17518 /*
17519 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17520 * On nmi (interrupt 2), do_trap should not be called.
17521@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17522 }
17523 #endif
17524
17525- if (!user_mode(regs))
17526+ if (!user_mode_novm(regs))
17527 goto kernel_trap;
17528
17529 #ifdef CONFIG_X86_32
17530@@ -157,7 +151,7 @@ trap_signal:
17531 printk_ratelimit()) {
17532 printk(KERN_INFO
17533 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17534- tsk->comm, tsk->pid, str,
17535+ tsk->comm, task_pid_nr(tsk), str,
17536 regs->ip, regs->sp, error_code);
17537 print_vma_addr(" in ", regs->ip);
17538 printk("\n");
17539@@ -174,8 +168,20 @@ kernel_trap:
17540 if (!fixup_exception(regs)) {
17541 tsk->thread.error_code = error_code;
17542 tsk->thread.trap_no = trapnr;
17543+
17544+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17545+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17546+ str = "PAX: suspicious stack segment fault";
17547+#endif
17548+
17549 die(str, regs, error_code);
17550 }
17551+
17552+#ifdef CONFIG_PAX_REFCOUNT
17553+ if (trapnr == 4)
17554+ pax_report_refcount_overflow(regs);
17555+#endif
17556+
17557 return;
17558
17559 #ifdef CONFIG_X86_32
17560@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
17561 conditional_sti(regs);
17562
17563 #ifdef CONFIG_X86_32
17564- if (regs->flags & X86_VM_MASK)
17565+ if (v8086_mode(regs))
17566 goto gp_in_vm86;
17567 #endif
17568
17569 tsk = current;
17570- if (!user_mode(regs))
17571+ if (!user_mode_novm(regs))
17572 goto gp_in_kernel;
17573
17574+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17575+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17576+ struct mm_struct *mm = tsk->mm;
17577+ unsigned long limit;
17578+
17579+ down_write(&mm->mmap_sem);
17580+ limit = mm->context.user_cs_limit;
17581+ if (limit < TASK_SIZE) {
17582+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17583+ up_write(&mm->mmap_sem);
17584+ return;
17585+ }
17586+ up_write(&mm->mmap_sem);
17587+ }
17588+#endif
17589+
17590 tsk->thread.error_code = error_code;
17591 tsk->thread.trap_no = 13;
17592
17593@@ -304,6 +326,13 @@ gp_in_kernel:
17594 if (notify_die(DIE_GPF, "general protection fault", regs,
17595 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17596 return;
17597+
17598+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17599+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17600+ die("PAX: suspicious general protection fault", regs, error_code);
17601+ else
17602+#endif
17603+
17604 die("general protection fault", regs, error_code);
17605 }
17606
17607@@ -433,6 +462,17 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
17608 dotraplinkage notrace __kprobes void
17609 do_nmi(struct pt_regs *regs, long error_code)
17610 {
17611+
17612+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17613+ if (!user_mode(regs)) {
17614+ unsigned long cs = regs->cs & 0xFFFF;
17615+ unsigned long ip = ktva_ktla(regs->ip);
17616+
17617+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
17618+ regs->ip = ip;
17619+ }
17620+#endif
17621+
17622 nmi_enter();
17623
17624 inc_irq_stat(__nmi_count);
17625@@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17626 /* It's safe to allow irq's after DR6 has been saved */
17627 preempt_conditional_sti(regs);
17628
17629- if (regs->flags & X86_VM_MASK) {
17630+ if (v8086_mode(regs)) {
17631 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17632 error_code, 1);
17633 preempt_conditional_cli(regs);
17634@@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17635 * We already checked v86 mode above, so we can check for kernel mode
17636 * by just checking the CPL of CS.
17637 */
17638- if ((dr6 & DR_STEP) && !user_mode(regs)) {
17639+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17640 tsk->thread.debugreg6 &= ~DR_STEP;
17641 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17642 regs->flags &= ~X86_EFLAGS_TF;
17643@@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr)
17644 return;
17645 conditional_sti(regs);
17646
17647- if (!user_mode_vm(regs))
17648+ if (!user_mode(regs))
17649 {
17650 if (!fixup_exception(regs)) {
17651 task->thread.error_code = error_code;
17652@@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
17653 void __math_state_restore(void)
17654 {
17655 struct thread_info *thread = current_thread_info();
17656- struct task_struct *tsk = thread->task;
17657+ struct task_struct *tsk = current;
17658
17659 /*
17660 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17661@@ -750,8 +790,7 @@ void __math_state_restore(void)
17662 */
17663 asmlinkage void math_state_restore(void)
17664 {
17665- struct thread_info *thread = current_thread_info();
17666- struct task_struct *tsk = thread->task;
17667+ struct task_struct *tsk = current;
17668
17669 if (!tsk_used_math(tsk)) {
17670 local_irq_enable();
17671diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
17672index b9242ba..50c5edd 100644
17673--- a/arch/x86/kernel/verify_cpu.S
17674+++ b/arch/x86/kernel/verify_cpu.S
17675@@ -20,6 +20,7 @@
17676 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
17677 * arch/x86/kernel/trampoline_64.S: secondary processor verification
17678 * arch/x86/kernel/head_32.S: processor startup
17679+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
17680 *
17681 * verify_cpu, returns the status of longmode and SSE in register %eax.
17682 * 0: Success 1: Failure
17683diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
17684index 863f875..4307295 100644
17685--- a/arch/x86/kernel/vm86_32.c
17686+++ b/arch/x86/kernel/vm86_32.c
17687@@ -41,6 +41,7 @@
17688 #include <linux/ptrace.h>
17689 #include <linux/audit.h>
17690 #include <linux/stddef.h>
17691+#include <linux/grsecurity.h>
17692
17693 #include <asm/uaccess.h>
17694 #include <asm/io.h>
17695@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
17696 do_exit(SIGSEGV);
17697 }
17698
17699- tss = &per_cpu(init_tss, get_cpu());
17700+ tss = init_tss + get_cpu();
17701 current->thread.sp0 = current->thread.saved_sp0;
17702 current->thread.sysenter_cs = __KERNEL_CS;
17703 load_sp0(tss, &current->thread);
17704@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __user *v86, struct pt_regs *regs)
17705 struct task_struct *tsk;
17706 int tmp, ret = -EPERM;
17707
17708+#ifdef CONFIG_GRKERNSEC_VM86
17709+ if (!capable(CAP_SYS_RAWIO)) {
17710+ gr_handle_vm86();
17711+ goto out;
17712+ }
17713+#endif
17714+
17715 tsk = current;
17716 if (tsk->thread.saved_sp0)
17717 goto out;
17718@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned long arg, struct pt_regs *regs)
17719 int tmp, ret;
17720 struct vm86plus_struct __user *v86;
17721
17722+#ifdef CONFIG_GRKERNSEC_VM86
17723+ if (!capable(CAP_SYS_RAWIO)) {
17724+ gr_handle_vm86();
17725+ ret = -EPERM;
17726+ goto out;
17727+ }
17728+#endif
17729+
17730 tsk = current;
17731 switch (cmd) {
17732 case VM86_REQUEST_IRQ:
17733@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
17734 tsk->thread.saved_fs = info->regs32->fs;
17735 tsk->thread.saved_gs = get_user_gs(info->regs32);
17736
17737- tss = &per_cpu(init_tss, get_cpu());
17738+ tss = init_tss + get_cpu();
17739 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17740 if (cpu_has_sep)
17741 tsk->thread.sysenter_cs = 0;
17742@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
17743 goto cannot_handle;
17744 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17745 goto cannot_handle;
17746- intr_ptr = (unsigned long __user *) (i << 2);
17747+ intr_ptr = (__force unsigned long __user *) (i << 2);
17748 if (get_user(segoffs, intr_ptr))
17749 goto cannot_handle;
17750 if ((segoffs >> 16) == BIOSSEG)
17751diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
17752index 0f703f1..9e15f64 100644
17753--- a/arch/x86/kernel/vmlinux.lds.S
17754+++ b/arch/x86/kernel/vmlinux.lds.S
17755@@ -26,6 +26,13 @@
17756 #include <asm/page_types.h>
17757 #include <asm/cache.h>
17758 #include <asm/boot.h>
17759+#include <asm/segment.h>
17760+
17761+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17762+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17763+#else
17764+#define __KERNEL_TEXT_OFFSET 0
17765+#endif
17766
17767 #undef i386 /* in case the preprocessor is a 32bit one */
17768
17769@@ -69,30 +76,43 @@ jiffies_64 = jiffies;
17770
17771 PHDRS {
17772 text PT_LOAD FLAGS(5); /* R_E */
17773+#ifdef CONFIG_X86_32
17774+ module PT_LOAD FLAGS(5); /* R_E */
17775+#endif
17776+#ifdef CONFIG_XEN
17777+ rodata PT_LOAD FLAGS(5); /* R_E */
17778+#else
17779+ rodata PT_LOAD FLAGS(4); /* R__ */
17780+#endif
17781 data PT_LOAD FLAGS(6); /* RW_ */
17782-#ifdef CONFIG_X86_64
17783+ init.begin PT_LOAD FLAGS(6); /* RW_ */
17784 #ifdef CONFIG_SMP
17785 percpu PT_LOAD FLAGS(6); /* RW_ */
17786 #endif
17787+ text.init PT_LOAD FLAGS(5); /* R_E */
17788+ text.exit PT_LOAD FLAGS(5); /* R_E */
17789 init PT_LOAD FLAGS(7); /* RWE */
17790-#endif
17791 note PT_NOTE FLAGS(0); /* ___ */
17792 }
17793
17794 SECTIONS
17795 {
17796 #ifdef CONFIG_X86_32
17797- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
17798- phys_startup_32 = startup_32 - LOAD_OFFSET;
17799+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
17800 #else
17801- . = __START_KERNEL;
17802- phys_startup_64 = startup_64 - LOAD_OFFSET;
17803+ . = __START_KERNEL;
17804 #endif
17805
17806 /* Text and read-only data */
17807- .text : AT(ADDR(.text) - LOAD_OFFSET) {
17808- _text = .;
17809+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17810 /* bootstrapping code */
17811+#ifdef CONFIG_X86_32
17812+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17813+#else
17814+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17815+#endif
17816+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17817+ _text = .;
17818 HEAD_TEXT
17819 #ifdef CONFIG_X86_32
17820 . = ALIGN(PAGE_SIZE);
17821@@ -108,13 +128,47 @@ SECTIONS
17822 IRQENTRY_TEXT
17823 *(.fixup)
17824 *(.gnu.warning)
17825- /* End of text section */
17826- _etext = .;
17827 } :text = 0x9090
17828
17829- NOTES :text :note
17830+ . += __KERNEL_TEXT_OFFSET;
17831
17832- EXCEPTION_TABLE(16) :text = 0x9090
17833+#ifdef CONFIG_X86_32
17834+ . = ALIGN(PAGE_SIZE);
17835+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
17836+
17837+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
17838+ MODULES_EXEC_VADDR = .;
17839+ BYTE(0)
17840+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
17841+ . = ALIGN(HPAGE_SIZE);
17842+ MODULES_EXEC_END = . - 1;
17843+#endif
17844+
17845+ } :module
17846+#endif
17847+
17848+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
17849+ /* End of text section */
17850+ _etext = . - __KERNEL_TEXT_OFFSET;
17851+ }
17852+
17853+#ifdef CONFIG_X86_32
17854+ . = ALIGN(PAGE_SIZE);
17855+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
17856+ *(.idt)
17857+ . = ALIGN(PAGE_SIZE);
17858+ *(.empty_zero_page)
17859+ *(.initial_pg_fixmap)
17860+ *(.initial_pg_pmd)
17861+ *(.initial_page_table)
17862+ *(.swapper_pg_dir)
17863+ } :rodata
17864+#endif
17865+
17866+ . = ALIGN(PAGE_SIZE);
17867+ NOTES :rodata :note
17868+
17869+ EXCEPTION_TABLE(16) :rodata
17870
17871 #if defined(CONFIG_DEBUG_RODATA)
17872 /* .text should occupy whole number of pages */
17873@@ -126,16 +180,20 @@ SECTIONS
17874
17875 /* Data */
17876 .data : AT(ADDR(.data) - LOAD_OFFSET) {
17877+
17878+#ifdef CONFIG_PAX_KERNEXEC
17879+ . = ALIGN(HPAGE_SIZE);
17880+#else
17881+ . = ALIGN(PAGE_SIZE);
17882+#endif
17883+
17884 /* Start of data section */
17885 _sdata = .;
17886
17887 /* init_task */
17888 INIT_TASK_DATA(THREAD_SIZE)
17889
17890-#ifdef CONFIG_X86_32
17891- /* 32 bit has nosave before _edata */
17892 NOSAVE_DATA
17893-#endif
17894
17895 PAGE_ALIGNED_DATA(PAGE_SIZE)
17896
17897@@ -176,12 +234,19 @@ SECTIONS
17898 #endif /* CONFIG_X86_64 */
17899
17900 /* Init code and data - will be freed after init */
17901- . = ALIGN(PAGE_SIZE);
17902 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
17903+ BYTE(0)
17904+
17905+#ifdef CONFIG_PAX_KERNEXEC
17906+ . = ALIGN(HPAGE_SIZE);
17907+#else
17908+ . = ALIGN(PAGE_SIZE);
17909+#endif
17910+
17911 __init_begin = .; /* paired with __init_end */
17912- }
17913+ } :init.begin
17914
17915-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
17916+#ifdef CONFIG_SMP
17917 /*
17918 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
17919 * output PHDR, so the next output section - .init.text - should
17920@@ -190,12 +255,27 @@ SECTIONS
17921 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
17922 #endif
17923
17924- INIT_TEXT_SECTION(PAGE_SIZE)
17925-#ifdef CONFIG_X86_64
17926- :init
17927-#endif
17928+ . = ALIGN(PAGE_SIZE);
17929+ init_begin = .;
17930+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
17931+ VMLINUX_SYMBOL(_sinittext) = .;
17932+ INIT_TEXT
17933+ VMLINUX_SYMBOL(_einittext) = .;
17934+ . = ALIGN(PAGE_SIZE);
17935+ } :text.init
17936
17937- INIT_DATA_SECTION(16)
17938+ /*
17939+ * .exit.text is discard at runtime, not link time, to deal with
17940+ * references from .altinstructions and .eh_frame
17941+ */
17942+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17943+ EXIT_TEXT
17944+ . = ALIGN(16);
17945+ } :text.exit
17946+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
17947+
17948+ . = ALIGN(PAGE_SIZE);
17949+ INIT_DATA_SECTION(16) :init
17950
17951 /*
17952 * Code and data for a variety of lowlevel trampolines, to be
17953@@ -269,19 +349,12 @@ SECTIONS
17954 }
17955
17956 . = ALIGN(8);
17957- /*
17958- * .exit.text is discard at runtime, not link time, to deal with
17959- * references from .altinstructions and .eh_frame
17960- */
17961- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
17962- EXIT_TEXT
17963- }
17964
17965 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
17966 EXIT_DATA
17967 }
17968
17969-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
17970+#ifndef CONFIG_SMP
17971 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
17972 #endif
17973
17974@@ -300,16 +373,10 @@ SECTIONS
17975 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
17976 __smp_locks = .;
17977 *(.smp_locks)
17978- . = ALIGN(PAGE_SIZE);
17979 __smp_locks_end = .;
17980+ . = ALIGN(PAGE_SIZE);
17981 }
17982
17983-#ifdef CONFIG_X86_64
17984- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
17985- NOSAVE_DATA
17986- }
17987-#endif
17988-
17989 /* BSS */
17990 . = ALIGN(PAGE_SIZE);
17991 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
17992@@ -325,6 +392,7 @@ SECTIONS
17993 __brk_base = .;
17994 . += 64 * 1024; /* 64k alignment slop space */
17995 *(.brk_reservation) /* areas brk users have reserved */
17996+ . = ALIGN(HPAGE_SIZE);
17997 __brk_limit = .;
17998 }
17999
18000@@ -351,13 +419,12 @@ SECTIONS
18001 * for the boot processor.
18002 */
18003 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18004-INIT_PER_CPU(gdt_page);
18005 INIT_PER_CPU(irq_stack_union);
18006
18007 /*
18008 * Build-time check on the image size:
18009 */
18010-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18011+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18012 "kernel image bigger than KERNEL_IMAGE_SIZE");
18013
18014 #ifdef CONFIG_SMP
18015diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
18016index b56c65de..561a55b 100644
18017--- a/arch/x86/kernel/vsyscall_64.c
18018+++ b/arch/x86/kernel/vsyscall_64.c
18019@@ -56,15 +56,13 @@ DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
18020 .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
18021 };
18022
18023-static enum { EMULATE, NATIVE, NONE } vsyscall_mode = NATIVE;
18024+static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
18025
18026 static int __init vsyscall_setup(char *str)
18027 {
18028 if (str) {
18029 if (!strcmp("emulate", str))
18030 vsyscall_mode = EMULATE;
18031- else if (!strcmp("native", str))
18032- vsyscall_mode = NATIVE;
18033 else if (!strcmp("none", str))
18034 vsyscall_mode = NONE;
18035 else
18036@@ -177,7 +175,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18037
18038 tsk = current;
18039 if (seccomp_mode(&tsk->seccomp))
18040- do_exit(SIGKILL);
18041+ do_group_exit(SIGKILL);
18042
18043 switch (vsyscall_nr) {
18044 case 0:
18045@@ -219,8 +217,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18046 return true;
18047
18048 sigsegv:
18049- force_sig(SIGSEGV, current);
18050- return true;
18051+ do_group_exit(SIGKILL);
18052 }
18053
18054 /*
18055@@ -273,10 +270,7 @@ void __init map_vsyscall(void)
18056 extern char __vvar_page;
18057 unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
18058
18059- __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
18060- vsyscall_mode == NATIVE
18061- ? PAGE_KERNEL_VSYSCALL
18062- : PAGE_KERNEL_VVAR);
18063+ __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
18064 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
18065 (unsigned long)VSYSCALL_START);
18066
18067diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
18068index 9796c2f..f686fbf 100644
18069--- a/arch/x86/kernel/x8664_ksyms_64.c
18070+++ b/arch/x86/kernel/x8664_ksyms_64.c
18071@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18072 EXPORT_SYMBOL(copy_user_generic_string);
18073 EXPORT_SYMBOL(copy_user_generic_unrolled);
18074 EXPORT_SYMBOL(__copy_user_nocache);
18075-EXPORT_SYMBOL(_copy_from_user);
18076-EXPORT_SYMBOL(_copy_to_user);
18077
18078 EXPORT_SYMBOL(copy_page);
18079 EXPORT_SYMBOL(clear_page);
18080diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
18081index a391134..d0b63b6e 100644
18082--- a/arch/x86/kernel/xsave.c
18083+++ b/arch/x86/kernel/xsave.c
18084@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
18085 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18086 return -EINVAL;
18087
18088- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18089+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18090 fx_sw_user->extended_size -
18091 FP_XSTATE_MAGIC2_SIZE));
18092 if (err)
18093@@ -267,7 +267,7 @@ fx_only:
18094 * the other extended state.
18095 */
18096 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18097- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18098+ return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
18099 }
18100
18101 /*
18102@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf)
18103 if (use_xsave())
18104 err = restore_user_xstate(buf);
18105 else
18106- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18107+ err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
18108 buf);
18109 if (unlikely(err)) {
18110 /*
18111diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
18112index 8b4cc5f..f086b5b 100644
18113--- a/arch/x86/kvm/emulate.c
18114+++ b/arch/x86/kvm/emulate.c
18115@@ -96,7 +96,7 @@
18116 #define Src2ImmByte (2<<29)
18117 #define Src2One (3<<29)
18118 #define Src2Imm (4<<29)
18119-#define Src2Mask (7<<29)
18120+#define Src2Mask (7U<<29)
18121
18122 #define X2(x...) x, x
18123 #define X3(x...) X2(x), x
18124@@ -207,6 +207,7 @@ struct gprefix {
18125
18126 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18127 do { \
18128+ unsigned long _tmp; \
18129 __asm__ __volatile__ ( \
18130 _PRE_EFLAGS("0", "4", "2") \
18131 _op _suffix " %"_x"3,%1; " \
18132@@ -220,8 +221,6 @@ struct gprefix {
18133 /* Raw emulation: instruction has two explicit operands. */
18134 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18135 do { \
18136- unsigned long _tmp; \
18137- \
18138 switch ((_dst).bytes) { \
18139 case 2: \
18140 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18141@@ -237,7 +236,6 @@ struct gprefix {
18142
18143 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18144 do { \
18145- unsigned long _tmp; \
18146 switch ((_dst).bytes) { \
18147 case 1: \
18148 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18149diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
18150index 57dcbd4..79aba9b 100644
18151--- a/arch/x86/kvm/lapic.c
18152+++ b/arch/x86/kvm/lapic.c
18153@@ -53,7 +53,7 @@
18154 #define APIC_BUS_CYCLE_NS 1
18155
18156 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18157-#define apic_debug(fmt, arg...)
18158+#define apic_debug(fmt, arg...) do {} while (0)
18159
18160 #define APIC_LVT_NUM 6
18161 /* 14 is the version for Xeon and Pentium 8.4.8*/
18162diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
18163index 8e8da79..13bc641 100644
18164--- a/arch/x86/kvm/mmu.c
18165+++ b/arch/x86/kvm/mmu.c
18166@@ -3552,7 +3552,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18167
18168 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18169
18170- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18171+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18172
18173 /*
18174 * Assume that the pte write on a page table of the same type
18175@@ -3584,7 +3584,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18176 }
18177
18178 spin_lock(&vcpu->kvm->mmu_lock);
18179- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18180+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18181 gentry = 0;
18182 kvm_mmu_free_some_pages(vcpu);
18183 ++vcpu->kvm->stat.mmu_pte_write;
18184diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
18185index 507e2b8..fc55f89 100644
18186--- a/arch/x86/kvm/paging_tmpl.h
18187+++ b/arch/x86/kvm/paging_tmpl.h
18188@@ -197,7 +197,7 @@ retry_walk:
18189 if (unlikely(kvm_is_error_hva(host_addr)))
18190 goto error;
18191
18192- ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
18193+ ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
18194 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
18195 goto error;
18196
18197@@ -575,6 +575,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
18198 unsigned long mmu_seq;
18199 bool map_writable;
18200
18201+ pax_track_stack();
18202+
18203 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18204
18205 if (unlikely(error_code & PFERR_RSVD_MASK))
18206@@ -701,7 +703,7 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
18207 if (need_flush)
18208 kvm_flush_remote_tlbs(vcpu->kvm);
18209
18210- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18211+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18212
18213 spin_unlock(&vcpu->kvm->mmu_lock);
18214
18215diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
18216index 475d1c9..33658ff 100644
18217--- a/arch/x86/kvm/svm.c
18218+++ b/arch/x86/kvm/svm.c
18219@@ -3381,7 +3381,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
18220 int cpu = raw_smp_processor_id();
18221
18222 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18223+
18224+ pax_open_kernel();
18225 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18226+ pax_close_kernel();
18227+
18228 load_TR_desc();
18229 }
18230
18231@@ -3759,6 +3763,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
18232 #endif
18233 #endif
18234
18235+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18236+ __set_fs(current_thread_info()->addr_limit);
18237+#endif
18238+
18239 reload_tss(vcpu);
18240
18241 local_irq_disable();
18242diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
18243index e65a158..656dc24 100644
18244--- a/arch/x86/kvm/vmx.c
18245+++ b/arch/x86/kvm/vmx.c
18246@@ -1251,7 +1251,11 @@ static void reload_tss(void)
18247 struct desc_struct *descs;
18248
18249 descs = (void *)gdt->address;
18250+
18251+ pax_open_kernel();
18252 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18253+ pax_close_kernel();
18254+
18255 load_TR_desc();
18256 }
18257
18258@@ -2520,8 +2524,11 @@ static __init int hardware_setup(void)
18259 if (!cpu_has_vmx_flexpriority())
18260 flexpriority_enabled = 0;
18261
18262- if (!cpu_has_vmx_tpr_shadow())
18263- kvm_x86_ops->update_cr8_intercept = NULL;
18264+ if (!cpu_has_vmx_tpr_shadow()) {
18265+ pax_open_kernel();
18266+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18267+ pax_close_kernel();
18268+ }
18269
18270 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18271 kvm_disable_largepages();
18272@@ -3535,7 +3542,7 @@ static void vmx_set_constant_host_state(void)
18273 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18274
18275 asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
18276- vmcs_writel(HOST_RIP, tmpl); /* 22.2.5 */
18277+ vmcs_writel(HOST_RIP, ktla_ktva(tmpl)); /* 22.2.5 */
18278
18279 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
18280 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
18281@@ -6021,6 +6028,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18282 "jmp .Lkvm_vmx_return \n\t"
18283 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18284 ".Lkvm_vmx_return: "
18285+
18286+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18287+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18288+ ".Lkvm_vmx_return2: "
18289+#endif
18290+
18291 /* Save guest registers, load host registers, keep flags */
18292 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18293 "pop %0 \n\t"
18294@@ -6069,6 +6082,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18295 #endif
18296 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18297 [wordsize]"i"(sizeof(ulong))
18298+
18299+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18300+ ,[cs]"i"(__KERNEL_CS)
18301+#endif
18302+
18303 : "cc", "memory"
18304 , R"ax", R"bx", R"di", R"si"
18305 #ifdef CONFIG_X86_64
18306@@ -6097,7 +6115,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18307 }
18308 }
18309
18310- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18311+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18312+
18313+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18314+ loadsegment(fs, __KERNEL_PERCPU);
18315+#endif
18316+
18317+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18318+ __set_fs(current_thread_info()->addr_limit);
18319+#endif
18320+
18321 vmx->loaded_vmcs->launched = 1;
18322
18323 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18324diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
18325index 84a28ea..9326501 100644
18326--- a/arch/x86/kvm/x86.c
18327+++ b/arch/x86/kvm/x86.c
18328@@ -1334,8 +1334,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
18329 {
18330 struct kvm *kvm = vcpu->kvm;
18331 int lm = is_long_mode(vcpu);
18332- u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18333- : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18334+ u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18335+ : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18336 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
18337 : kvm->arch.xen_hvm_config.blob_size_32;
18338 u32 page_num = data & ~PAGE_MASK;
18339@@ -2137,6 +2137,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
18340 if (n < msr_list.nmsrs)
18341 goto out;
18342 r = -EFAULT;
18343+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18344+ goto out;
18345 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18346 num_msrs_to_save * sizeof(u32)))
18347 goto out;
18348@@ -2312,15 +2314,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
18349 struct kvm_cpuid2 *cpuid,
18350 struct kvm_cpuid_entry2 __user *entries)
18351 {
18352- int r;
18353+ int r, i;
18354
18355 r = -E2BIG;
18356 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18357 goto out;
18358 r = -EFAULT;
18359- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18360- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18361+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18362 goto out;
18363+ for (i = 0; i < cpuid->nent; ++i) {
18364+ struct kvm_cpuid_entry2 cpuid_entry;
18365+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18366+ goto out;
18367+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18368+ }
18369 vcpu->arch.cpuid_nent = cpuid->nent;
18370 kvm_apic_set_version(vcpu);
18371 kvm_x86_ops->cpuid_update(vcpu);
18372@@ -2335,15 +2342,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
18373 struct kvm_cpuid2 *cpuid,
18374 struct kvm_cpuid_entry2 __user *entries)
18375 {
18376- int r;
18377+ int r, i;
18378
18379 r = -E2BIG;
18380 if (cpuid->nent < vcpu->arch.cpuid_nent)
18381 goto out;
18382 r = -EFAULT;
18383- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18384- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18385+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18386 goto out;
18387+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18388+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18389+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18390+ goto out;
18391+ }
18392 return 0;
18393
18394 out:
18395@@ -2718,7 +2729,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
18396 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18397 struct kvm_interrupt *irq)
18398 {
18399- if (irq->irq < 0 || irq->irq >= 256)
18400+ if (irq->irq >= 256)
18401 return -EINVAL;
18402 if (irqchip_in_kernel(vcpu->kvm))
18403 return -ENXIO;
18404@@ -5089,7 +5100,7 @@ static void kvm_set_mmio_spte_mask(void)
18405 kvm_mmu_set_mmio_spte_mask(mask);
18406 }
18407
18408-int kvm_arch_init(void *opaque)
18409+int kvm_arch_init(const void *opaque)
18410 {
18411 int r;
18412 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18413diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
18414index 13ee258..b9632f6 100644
18415--- a/arch/x86/lguest/boot.c
18416+++ b/arch/x86/lguest/boot.c
18417@@ -1184,9 +1184,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
18418 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
18419 * Launcher to reboot us.
18420 */
18421-static void lguest_restart(char *reason)
18422+static __noreturn void lguest_restart(char *reason)
18423 {
18424 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
18425+ BUG();
18426 }
18427
18428 /*G:050
18429diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
18430index 042f682..c92afb6 100644
18431--- a/arch/x86/lib/atomic64_32.c
18432+++ b/arch/x86/lib/atomic64_32.c
18433@@ -8,18 +8,30 @@
18434
18435 long long atomic64_read_cx8(long long, const atomic64_t *v);
18436 EXPORT_SYMBOL(atomic64_read_cx8);
18437+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18438+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18439 long long atomic64_set_cx8(long long, const atomic64_t *v);
18440 EXPORT_SYMBOL(atomic64_set_cx8);
18441+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18442+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18443 long long atomic64_xchg_cx8(long long, unsigned high);
18444 EXPORT_SYMBOL(atomic64_xchg_cx8);
18445 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18446 EXPORT_SYMBOL(atomic64_add_return_cx8);
18447+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18448+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18449 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18450 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18451+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18452+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18453 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18454 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18455+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18456+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18457 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18458 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18459+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18460+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18461 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18462 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18463 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18464@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18465 #ifndef CONFIG_X86_CMPXCHG64
18466 long long atomic64_read_386(long long, const atomic64_t *v);
18467 EXPORT_SYMBOL(atomic64_read_386);
18468+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18469+EXPORT_SYMBOL(atomic64_read_unchecked_386);
18470 long long atomic64_set_386(long long, const atomic64_t *v);
18471 EXPORT_SYMBOL(atomic64_set_386);
18472+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18473+EXPORT_SYMBOL(atomic64_set_unchecked_386);
18474 long long atomic64_xchg_386(long long, unsigned high);
18475 EXPORT_SYMBOL(atomic64_xchg_386);
18476 long long atomic64_add_return_386(long long a, atomic64_t *v);
18477 EXPORT_SYMBOL(atomic64_add_return_386);
18478+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18479+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18480 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18481 EXPORT_SYMBOL(atomic64_sub_return_386);
18482+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18483+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18484 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18485 EXPORT_SYMBOL(atomic64_inc_return_386);
18486+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18487+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18488 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18489 EXPORT_SYMBOL(atomic64_dec_return_386);
18490+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18491+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18492 long long atomic64_add_386(long long a, atomic64_t *v);
18493 EXPORT_SYMBOL(atomic64_add_386);
18494+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18495+EXPORT_SYMBOL(atomic64_add_unchecked_386);
18496 long long atomic64_sub_386(long long a, atomic64_t *v);
18497 EXPORT_SYMBOL(atomic64_sub_386);
18498+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18499+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18500 long long atomic64_inc_386(long long a, atomic64_t *v);
18501 EXPORT_SYMBOL(atomic64_inc_386);
18502+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18503+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18504 long long atomic64_dec_386(long long a, atomic64_t *v);
18505 EXPORT_SYMBOL(atomic64_dec_386);
18506+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18507+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18508 long long atomic64_dec_if_positive_386(atomic64_t *v);
18509 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18510 int atomic64_inc_not_zero_386(atomic64_t *v);
18511diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
18512index e8e7e0d..56fd1b0 100644
18513--- a/arch/x86/lib/atomic64_386_32.S
18514+++ b/arch/x86/lib/atomic64_386_32.S
18515@@ -48,6 +48,10 @@ BEGIN(read)
18516 movl (v), %eax
18517 movl 4(v), %edx
18518 RET_ENDP
18519+BEGIN(read_unchecked)
18520+ movl (v), %eax
18521+ movl 4(v), %edx
18522+RET_ENDP
18523 #undef v
18524
18525 #define v %esi
18526@@ -55,6 +59,10 @@ BEGIN(set)
18527 movl %ebx, (v)
18528 movl %ecx, 4(v)
18529 RET_ENDP
18530+BEGIN(set_unchecked)
18531+ movl %ebx, (v)
18532+ movl %ecx, 4(v)
18533+RET_ENDP
18534 #undef v
18535
18536 #define v %esi
18537@@ -70,6 +78,20 @@ RET_ENDP
18538 BEGIN(add)
18539 addl %eax, (v)
18540 adcl %edx, 4(v)
18541+
18542+#ifdef CONFIG_PAX_REFCOUNT
18543+ jno 0f
18544+ subl %eax, (v)
18545+ sbbl %edx, 4(v)
18546+ int $4
18547+0:
18548+ _ASM_EXTABLE(0b, 0b)
18549+#endif
18550+
18551+RET_ENDP
18552+BEGIN(add_unchecked)
18553+ addl %eax, (v)
18554+ adcl %edx, 4(v)
18555 RET_ENDP
18556 #undef v
18557
18558@@ -77,6 +99,24 @@ RET_ENDP
18559 BEGIN(add_return)
18560 addl (v), %eax
18561 adcl 4(v), %edx
18562+
18563+#ifdef CONFIG_PAX_REFCOUNT
18564+ into
18565+1234:
18566+ _ASM_EXTABLE(1234b, 2f)
18567+#endif
18568+
18569+ movl %eax, (v)
18570+ movl %edx, 4(v)
18571+
18572+#ifdef CONFIG_PAX_REFCOUNT
18573+2:
18574+#endif
18575+
18576+RET_ENDP
18577+BEGIN(add_return_unchecked)
18578+ addl (v), %eax
18579+ adcl 4(v), %edx
18580 movl %eax, (v)
18581 movl %edx, 4(v)
18582 RET_ENDP
18583@@ -86,6 +126,20 @@ RET_ENDP
18584 BEGIN(sub)
18585 subl %eax, (v)
18586 sbbl %edx, 4(v)
18587+
18588+#ifdef CONFIG_PAX_REFCOUNT
18589+ jno 0f
18590+ addl %eax, (v)
18591+ adcl %edx, 4(v)
18592+ int $4
18593+0:
18594+ _ASM_EXTABLE(0b, 0b)
18595+#endif
18596+
18597+RET_ENDP
18598+BEGIN(sub_unchecked)
18599+ subl %eax, (v)
18600+ sbbl %edx, 4(v)
18601 RET_ENDP
18602 #undef v
18603
18604@@ -96,6 +150,27 @@ BEGIN(sub_return)
18605 sbbl $0, %edx
18606 addl (v), %eax
18607 adcl 4(v), %edx
18608+
18609+#ifdef CONFIG_PAX_REFCOUNT
18610+ into
18611+1234:
18612+ _ASM_EXTABLE(1234b, 2f)
18613+#endif
18614+
18615+ movl %eax, (v)
18616+ movl %edx, 4(v)
18617+
18618+#ifdef CONFIG_PAX_REFCOUNT
18619+2:
18620+#endif
18621+
18622+RET_ENDP
18623+BEGIN(sub_return_unchecked)
18624+ negl %edx
18625+ negl %eax
18626+ sbbl $0, %edx
18627+ addl (v), %eax
18628+ adcl 4(v), %edx
18629 movl %eax, (v)
18630 movl %edx, 4(v)
18631 RET_ENDP
18632@@ -105,6 +180,20 @@ RET_ENDP
18633 BEGIN(inc)
18634 addl $1, (v)
18635 adcl $0, 4(v)
18636+
18637+#ifdef CONFIG_PAX_REFCOUNT
18638+ jno 0f
18639+ subl $1, (v)
18640+ sbbl $0, 4(v)
18641+ int $4
18642+0:
18643+ _ASM_EXTABLE(0b, 0b)
18644+#endif
18645+
18646+RET_ENDP
18647+BEGIN(inc_unchecked)
18648+ addl $1, (v)
18649+ adcl $0, 4(v)
18650 RET_ENDP
18651 #undef v
18652
18653@@ -114,6 +203,26 @@ BEGIN(inc_return)
18654 movl 4(v), %edx
18655 addl $1, %eax
18656 adcl $0, %edx
18657+
18658+#ifdef CONFIG_PAX_REFCOUNT
18659+ into
18660+1234:
18661+ _ASM_EXTABLE(1234b, 2f)
18662+#endif
18663+
18664+ movl %eax, (v)
18665+ movl %edx, 4(v)
18666+
18667+#ifdef CONFIG_PAX_REFCOUNT
18668+2:
18669+#endif
18670+
18671+RET_ENDP
18672+BEGIN(inc_return_unchecked)
18673+ movl (v), %eax
18674+ movl 4(v), %edx
18675+ addl $1, %eax
18676+ adcl $0, %edx
18677 movl %eax, (v)
18678 movl %edx, 4(v)
18679 RET_ENDP
18680@@ -123,6 +232,20 @@ RET_ENDP
18681 BEGIN(dec)
18682 subl $1, (v)
18683 sbbl $0, 4(v)
18684+
18685+#ifdef CONFIG_PAX_REFCOUNT
18686+ jno 0f
18687+ addl $1, (v)
18688+ adcl $0, 4(v)
18689+ int $4
18690+0:
18691+ _ASM_EXTABLE(0b, 0b)
18692+#endif
18693+
18694+RET_ENDP
18695+BEGIN(dec_unchecked)
18696+ subl $1, (v)
18697+ sbbl $0, 4(v)
18698 RET_ENDP
18699 #undef v
18700
18701@@ -132,6 +255,26 @@ BEGIN(dec_return)
18702 movl 4(v), %edx
18703 subl $1, %eax
18704 sbbl $0, %edx
18705+
18706+#ifdef CONFIG_PAX_REFCOUNT
18707+ into
18708+1234:
18709+ _ASM_EXTABLE(1234b, 2f)
18710+#endif
18711+
18712+ movl %eax, (v)
18713+ movl %edx, 4(v)
18714+
18715+#ifdef CONFIG_PAX_REFCOUNT
18716+2:
18717+#endif
18718+
18719+RET_ENDP
18720+BEGIN(dec_return_unchecked)
18721+ movl (v), %eax
18722+ movl 4(v), %edx
18723+ subl $1, %eax
18724+ sbbl $0, %edx
18725 movl %eax, (v)
18726 movl %edx, 4(v)
18727 RET_ENDP
18728@@ -143,6 +286,13 @@ BEGIN(add_unless)
18729 adcl %edx, %edi
18730 addl (v), %eax
18731 adcl 4(v), %edx
18732+
18733+#ifdef CONFIG_PAX_REFCOUNT
18734+ into
18735+1234:
18736+ _ASM_EXTABLE(1234b, 2f)
18737+#endif
18738+
18739 cmpl %eax, %esi
18740 je 3f
18741 1:
18742@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18743 1:
18744 addl $1, %eax
18745 adcl $0, %edx
18746+
18747+#ifdef CONFIG_PAX_REFCOUNT
18748+ into
18749+1234:
18750+ _ASM_EXTABLE(1234b, 2f)
18751+#endif
18752+
18753 movl %eax, (v)
18754 movl %edx, 4(v)
18755 movl $1, %eax
18756@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18757 movl 4(v), %edx
18758 subl $1, %eax
18759 sbbl $0, %edx
18760+
18761+#ifdef CONFIG_PAX_REFCOUNT
18762+ into
18763+1234:
18764+ _ASM_EXTABLE(1234b, 1f)
18765+#endif
18766+
18767 js 1f
18768 movl %eax, (v)
18769 movl %edx, 4(v)
18770diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
18771index 391a083..d658e9f 100644
18772--- a/arch/x86/lib/atomic64_cx8_32.S
18773+++ b/arch/x86/lib/atomic64_cx8_32.S
18774@@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
18775 CFI_STARTPROC
18776
18777 read64 %ecx
18778+ pax_force_retaddr
18779 ret
18780 CFI_ENDPROC
18781 ENDPROC(atomic64_read_cx8)
18782
18783+ENTRY(atomic64_read_unchecked_cx8)
18784+ CFI_STARTPROC
18785+
18786+ read64 %ecx
18787+ pax_force_retaddr
18788+ ret
18789+ CFI_ENDPROC
18790+ENDPROC(atomic64_read_unchecked_cx8)
18791+
18792 ENTRY(atomic64_set_cx8)
18793 CFI_STARTPROC
18794
18795@@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
18796 cmpxchg8b (%esi)
18797 jne 1b
18798
18799+ pax_force_retaddr
18800 ret
18801 CFI_ENDPROC
18802 ENDPROC(atomic64_set_cx8)
18803
18804+ENTRY(atomic64_set_unchecked_cx8)
18805+ CFI_STARTPROC
18806+
18807+1:
18808+/* we don't need LOCK_PREFIX since aligned 64-bit writes
18809+ * are atomic on 586 and newer */
18810+ cmpxchg8b (%esi)
18811+ jne 1b
18812+
18813+ pax_force_retaddr
18814+ ret
18815+ CFI_ENDPROC
18816+ENDPROC(atomic64_set_unchecked_cx8)
18817+
18818 ENTRY(atomic64_xchg_cx8)
18819 CFI_STARTPROC
18820
18821@@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8)
18822 cmpxchg8b (%esi)
18823 jne 1b
18824
18825+ pax_force_retaddr
18826 ret
18827 CFI_ENDPROC
18828 ENDPROC(atomic64_xchg_cx8)
18829
18830-.macro addsub_return func ins insc
18831-ENTRY(atomic64_\func\()_return_cx8)
18832+.macro addsub_return func ins insc unchecked=""
18833+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18834 CFI_STARTPROC
18835 SAVE ebp
18836 SAVE ebx
18837@@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8)
18838 movl %edx, %ecx
18839 \ins\()l %esi, %ebx
18840 \insc\()l %edi, %ecx
18841+
18842+.ifb \unchecked
18843+#ifdef CONFIG_PAX_REFCOUNT
18844+ into
18845+2:
18846+ _ASM_EXTABLE(2b, 3f)
18847+#endif
18848+.endif
18849+
18850 LOCK_PREFIX
18851 cmpxchg8b (%ebp)
18852 jne 1b
18853-
18854-10:
18855 movl %ebx, %eax
18856 movl %ecx, %edx
18857+
18858+.ifb \unchecked
18859+#ifdef CONFIG_PAX_REFCOUNT
18860+3:
18861+#endif
18862+.endif
18863+
18864 RESTORE edi
18865 RESTORE esi
18866 RESTORE ebx
18867 RESTORE ebp
18868+ pax_force_retaddr
18869 ret
18870 CFI_ENDPROC
18871-ENDPROC(atomic64_\func\()_return_cx8)
18872+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18873 .endm
18874
18875 addsub_return add add adc
18876 addsub_return sub sub sbb
18877+addsub_return add add adc _unchecked
18878+addsub_return sub sub sbb _unchecked
18879
18880-.macro incdec_return func ins insc
18881-ENTRY(atomic64_\func\()_return_cx8)
18882+.macro incdec_return func ins insc unchecked
18883+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18884 CFI_STARTPROC
18885 SAVE ebx
18886
18887@@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8)
18888 movl %edx, %ecx
18889 \ins\()l $1, %ebx
18890 \insc\()l $0, %ecx
18891+
18892+.ifb \unchecked
18893+#ifdef CONFIG_PAX_REFCOUNT
18894+ into
18895+2:
18896+ _ASM_EXTABLE(2b, 3f)
18897+#endif
18898+.endif
18899+
18900 LOCK_PREFIX
18901 cmpxchg8b (%esi)
18902 jne 1b
18903
18904-10:
18905 movl %ebx, %eax
18906 movl %ecx, %edx
18907+
18908+.ifb \unchecked
18909+#ifdef CONFIG_PAX_REFCOUNT
18910+3:
18911+#endif
18912+.endif
18913+
18914 RESTORE ebx
18915+ pax_force_retaddr
18916 ret
18917 CFI_ENDPROC
18918-ENDPROC(atomic64_\func\()_return_cx8)
18919+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18920 .endm
18921
18922 incdec_return inc add adc
18923 incdec_return dec sub sbb
18924+incdec_return inc add adc _unchecked
18925+incdec_return dec sub sbb _unchecked
18926
18927 ENTRY(atomic64_dec_if_positive_cx8)
18928 CFI_STARTPROC
18929@@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
18930 movl %edx, %ecx
18931 subl $1, %ebx
18932 sbb $0, %ecx
18933+
18934+#ifdef CONFIG_PAX_REFCOUNT
18935+ into
18936+1234:
18937+ _ASM_EXTABLE(1234b, 2f)
18938+#endif
18939+
18940 js 2f
18941 LOCK_PREFIX
18942 cmpxchg8b (%esi)
18943@@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
18944 movl %ebx, %eax
18945 movl %ecx, %edx
18946 RESTORE ebx
18947+ pax_force_retaddr
18948 ret
18949 CFI_ENDPROC
18950 ENDPROC(atomic64_dec_if_positive_cx8)
18951@@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8)
18952 movl %edx, %ecx
18953 addl %esi, %ebx
18954 adcl %edi, %ecx
18955+
18956+#ifdef CONFIG_PAX_REFCOUNT
18957+ into
18958+1234:
18959+ _ASM_EXTABLE(1234b, 3f)
18960+#endif
18961+
18962 LOCK_PREFIX
18963 cmpxchg8b (%ebp)
18964 jne 1b
18965@@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8)
18966 CFI_ADJUST_CFA_OFFSET -8
18967 RESTORE ebx
18968 RESTORE ebp
18969+ pax_force_retaddr
18970 ret
18971 4:
18972 cmpl %edx, 4(%esp)
18973@@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
18974 movl %edx, %ecx
18975 addl $1, %ebx
18976 adcl $0, %ecx
18977+
18978+#ifdef CONFIG_PAX_REFCOUNT
18979+ into
18980+1234:
18981+ _ASM_EXTABLE(1234b, 3f)
18982+#endif
18983+
18984 LOCK_PREFIX
18985 cmpxchg8b (%esi)
18986 jne 1b
18987@@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
18988 movl $1, %eax
18989 3:
18990 RESTORE ebx
18991+ pax_force_retaddr
18992 ret
18993 4:
18994 testl %edx, %edx
18995diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
18996index 78d16a5..fbcf666 100644
18997--- a/arch/x86/lib/checksum_32.S
18998+++ b/arch/x86/lib/checksum_32.S
18999@@ -28,7 +28,8 @@
19000 #include <linux/linkage.h>
19001 #include <asm/dwarf2.h>
19002 #include <asm/errno.h>
19003-
19004+#include <asm/segment.h>
19005+
19006 /*
19007 * computes a partial checksum, e.g. for TCP/UDP fragments
19008 */
19009@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
19010
19011 #define ARGBASE 16
19012 #define FP 12
19013-
19014-ENTRY(csum_partial_copy_generic)
19015+
19016+ENTRY(csum_partial_copy_generic_to_user)
19017 CFI_STARTPROC
19018+
19019+#ifdef CONFIG_PAX_MEMORY_UDEREF
19020+ pushl_cfi %gs
19021+ popl_cfi %es
19022+ jmp csum_partial_copy_generic
19023+#endif
19024+
19025+ENTRY(csum_partial_copy_generic_from_user)
19026+
19027+#ifdef CONFIG_PAX_MEMORY_UDEREF
19028+ pushl_cfi %gs
19029+ popl_cfi %ds
19030+#endif
19031+
19032+ENTRY(csum_partial_copy_generic)
19033 subl $4,%esp
19034 CFI_ADJUST_CFA_OFFSET 4
19035 pushl_cfi %edi
19036@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19037 jmp 4f
19038 SRC(1: movw (%esi), %bx )
19039 addl $2, %esi
19040-DST( movw %bx, (%edi) )
19041+DST( movw %bx, %es:(%edi) )
19042 addl $2, %edi
19043 addw %bx, %ax
19044 adcl $0, %eax
19045@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19046 SRC(1: movl (%esi), %ebx )
19047 SRC( movl 4(%esi), %edx )
19048 adcl %ebx, %eax
19049-DST( movl %ebx, (%edi) )
19050+DST( movl %ebx, %es:(%edi) )
19051 adcl %edx, %eax
19052-DST( movl %edx, 4(%edi) )
19053+DST( movl %edx, %es:4(%edi) )
19054
19055 SRC( movl 8(%esi), %ebx )
19056 SRC( movl 12(%esi), %edx )
19057 adcl %ebx, %eax
19058-DST( movl %ebx, 8(%edi) )
19059+DST( movl %ebx, %es:8(%edi) )
19060 adcl %edx, %eax
19061-DST( movl %edx, 12(%edi) )
19062+DST( movl %edx, %es:12(%edi) )
19063
19064 SRC( movl 16(%esi), %ebx )
19065 SRC( movl 20(%esi), %edx )
19066 adcl %ebx, %eax
19067-DST( movl %ebx, 16(%edi) )
19068+DST( movl %ebx, %es:16(%edi) )
19069 adcl %edx, %eax
19070-DST( movl %edx, 20(%edi) )
19071+DST( movl %edx, %es:20(%edi) )
19072
19073 SRC( movl 24(%esi), %ebx )
19074 SRC( movl 28(%esi), %edx )
19075 adcl %ebx, %eax
19076-DST( movl %ebx, 24(%edi) )
19077+DST( movl %ebx, %es:24(%edi) )
19078 adcl %edx, %eax
19079-DST( movl %edx, 28(%edi) )
19080+DST( movl %edx, %es:28(%edi) )
19081
19082 lea 32(%esi), %esi
19083 lea 32(%edi), %edi
19084@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19085 shrl $2, %edx # This clears CF
19086 SRC(3: movl (%esi), %ebx )
19087 adcl %ebx, %eax
19088-DST( movl %ebx, (%edi) )
19089+DST( movl %ebx, %es:(%edi) )
19090 lea 4(%esi), %esi
19091 lea 4(%edi), %edi
19092 dec %edx
19093@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19094 jb 5f
19095 SRC( movw (%esi), %cx )
19096 leal 2(%esi), %esi
19097-DST( movw %cx, (%edi) )
19098+DST( movw %cx, %es:(%edi) )
19099 leal 2(%edi), %edi
19100 je 6f
19101 shll $16,%ecx
19102 SRC(5: movb (%esi), %cl )
19103-DST( movb %cl, (%edi) )
19104+DST( movb %cl, %es:(%edi) )
19105 6: addl %ecx, %eax
19106 adcl $0, %eax
19107 7:
19108@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19109
19110 6001:
19111 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19112- movl $-EFAULT, (%ebx)
19113+ movl $-EFAULT, %ss:(%ebx)
19114
19115 # zero the complete destination - computing the rest
19116 # is too much work
19117@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19118
19119 6002:
19120 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19121- movl $-EFAULT,(%ebx)
19122+ movl $-EFAULT,%ss:(%ebx)
19123 jmp 5000b
19124
19125 .previous
19126
19127+ pushl_cfi %ss
19128+ popl_cfi %ds
19129+ pushl_cfi %ss
19130+ popl_cfi %es
19131 popl_cfi %ebx
19132 CFI_RESTORE ebx
19133 popl_cfi %esi
19134@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19135 popl_cfi %ecx # equivalent to addl $4,%esp
19136 ret
19137 CFI_ENDPROC
19138-ENDPROC(csum_partial_copy_generic)
19139+ENDPROC(csum_partial_copy_generic_to_user)
19140
19141 #else
19142
19143 /* Version for PentiumII/PPro */
19144
19145 #define ROUND1(x) \
19146+ nop; nop; nop; \
19147 SRC(movl x(%esi), %ebx ) ; \
19148 addl %ebx, %eax ; \
19149- DST(movl %ebx, x(%edi) ) ;
19150+ DST(movl %ebx, %es:x(%edi)) ;
19151
19152 #define ROUND(x) \
19153+ nop; nop; nop; \
19154 SRC(movl x(%esi), %ebx ) ; \
19155 adcl %ebx, %eax ; \
19156- DST(movl %ebx, x(%edi) ) ;
19157+ DST(movl %ebx, %es:x(%edi)) ;
19158
19159 #define ARGBASE 12
19160-
19161-ENTRY(csum_partial_copy_generic)
19162+
19163+ENTRY(csum_partial_copy_generic_to_user)
19164 CFI_STARTPROC
19165+
19166+#ifdef CONFIG_PAX_MEMORY_UDEREF
19167+ pushl_cfi %gs
19168+ popl_cfi %es
19169+ jmp csum_partial_copy_generic
19170+#endif
19171+
19172+ENTRY(csum_partial_copy_generic_from_user)
19173+
19174+#ifdef CONFIG_PAX_MEMORY_UDEREF
19175+ pushl_cfi %gs
19176+ popl_cfi %ds
19177+#endif
19178+
19179+ENTRY(csum_partial_copy_generic)
19180 pushl_cfi %ebx
19181 CFI_REL_OFFSET ebx, 0
19182 pushl_cfi %edi
19183@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19184 subl %ebx, %edi
19185 lea -1(%esi),%edx
19186 andl $-32,%edx
19187- lea 3f(%ebx,%ebx), %ebx
19188+ lea 3f(%ebx,%ebx,2), %ebx
19189 testl %esi, %esi
19190 jmp *%ebx
19191 1: addl $64,%esi
19192@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19193 jb 5f
19194 SRC( movw (%esi), %dx )
19195 leal 2(%esi), %esi
19196-DST( movw %dx, (%edi) )
19197+DST( movw %dx, %es:(%edi) )
19198 leal 2(%edi), %edi
19199 je 6f
19200 shll $16,%edx
19201 5:
19202 SRC( movb (%esi), %dl )
19203-DST( movb %dl, (%edi) )
19204+DST( movb %dl, %es:(%edi) )
19205 6: addl %edx, %eax
19206 adcl $0, %eax
19207 7:
19208 .section .fixup, "ax"
19209 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19210- movl $-EFAULT, (%ebx)
19211+ movl $-EFAULT, %ss:(%ebx)
19212 # zero the complete destination (computing the rest is too much work)
19213 movl ARGBASE+8(%esp),%edi # dst
19214 movl ARGBASE+12(%esp),%ecx # len
19215@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19216 rep; stosb
19217 jmp 7b
19218 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19219- movl $-EFAULT, (%ebx)
19220+ movl $-EFAULT, %ss:(%ebx)
19221 jmp 7b
19222 .previous
19223
19224+#ifdef CONFIG_PAX_MEMORY_UDEREF
19225+ pushl_cfi %ss
19226+ popl_cfi %ds
19227+ pushl_cfi %ss
19228+ popl_cfi %es
19229+#endif
19230+
19231 popl_cfi %esi
19232 CFI_RESTORE esi
19233 popl_cfi %edi
19234@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19235 CFI_RESTORE ebx
19236 ret
19237 CFI_ENDPROC
19238-ENDPROC(csum_partial_copy_generic)
19239+ENDPROC(csum_partial_copy_generic_to_user)
19240
19241 #undef ROUND
19242 #undef ROUND1
19243diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
19244index f2145cf..cea889d 100644
19245--- a/arch/x86/lib/clear_page_64.S
19246+++ b/arch/x86/lib/clear_page_64.S
19247@@ -11,6 +11,7 @@ ENTRY(clear_page_c)
19248 movl $4096/8,%ecx
19249 xorl %eax,%eax
19250 rep stosq
19251+ pax_force_retaddr
19252 ret
19253 CFI_ENDPROC
19254 ENDPROC(clear_page_c)
19255@@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
19256 movl $4096,%ecx
19257 xorl %eax,%eax
19258 rep stosb
19259+ pax_force_retaddr
19260 ret
19261 CFI_ENDPROC
19262 ENDPROC(clear_page_c_e)
19263@@ -43,6 +45,7 @@ ENTRY(clear_page)
19264 leaq 64(%rdi),%rdi
19265 jnz .Lloop
19266 nop
19267+ pax_force_retaddr
19268 ret
19269 CFI_ENDPROC
19270 .Lclear_page_end:
19271@@ -58,7 +61,7 @@ ENDPROC(clear_page)
19272
19273 #include <asm/cpufeature.h>
19274
19275- .section .altinstr_replacement,"ax"
19276+ .section .altinstr_replacement,"a"
19277 1: .byte 0xeb /* jmp <disp8> */
19278 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19279 2: .byte 0xeb /* jmp <disp8> */
19280diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
19281index 1e572c5..2a162cd 100644
19282--- a/arch/x86/lib/cmpxchg16b_emu.S
19283+++ b/arch/x86/lib/cmpxchg16b_emu.S
19284@@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
19285
19286 popf
19287 mov $1, %al
19288+ pax_force_retaddr
19289 ret
19290
19291 not_same:
19292 popf
19293 xor %al,%al
19294+ pax_force_retaddr
19295 ret
19296
19297 CFI_ENDPROC
19298diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
19299index 01c805b..dccb07f 100644
19300--- a/arch/x86/lib/copy_page_64.S
19301+++ b/arch/x86/lib/copy_page_64.S
19302@@ -9,6 +9,7 @@ copy_page_c:
19303 CFI_STARTPROC
19304 movl $4096/8,%ecx
19305 rep movsq
19306+ pax_force_retaddr
19307 ret
19308 CFI_ENDPROC
19309 ENDPROC(copy_page_c)
19310@@ -39,7 +40,7 @@ ENTRY(copy_page)
19311 movq 16 (%rsi), %rdx
19312 movq 24 (%rsi), %r8
19313 movq 32 (%rsi), %r9
19314- movq 40 (%rsi), %r10
19315+ movq 40 (%rsi), %r13
19316 movq 48 (%rsi), %r11
19317 movq 56 (%rsi), %r12
19318
19319@@ -50,7 +51,7 @@ ENTRY(copy_page)
19320 movq %rdx, 16 (%rdi)
19321 movq %r8, 24 (%rdi)
19322 movq %r9, 32 (%rdi)
19323- movq %r10, 40 (%rdi)
19324+ movq %r13, 40 (%rdi)
19325 movq %r11, 48 (%rdi)
19326 movq %r12, 56 (%rdi)
19327
19328@@ -69,7 +70,7 @@ ENTRY(copy_page)
19329 movq 16 (%rsi), %rdx
19330 movq 24 (%rsi), %r8
19331 movq 32 (%rsi), %r9
19332- movq 40 (%rsi), %r10
19333+ movq 40 (%rsi), %r13
19334 movq 48 (%rsi), %r11
19335 movq 56 (%rsi), %r12
19336
19337@@ -78,7 +79,7 @@ ENTRY(copy_page)
19338 movq %rdx, 16 (%rdi)
19339 movq %r8, 24 (%rdi)
19340 movq %r9, 32 (%rdi)
19341- movq %r10, 40 (%rdi)
19342+ movq %r13, 40 (%rdi)
19343 movq %r11, 48 (%rdi)
19344 movq %r12, 56 (%rdi)
19345
19346@@ -95,6 +96,7 @@ ENTRY(copy_page)
19347 CFI_RESTORE r13
19348 addq $3*8,%rsp
19349 CFI_ADJUST_CFA_OFFSET -3*8
19350+ pax_force_retaddr
19351 ret
19352 .Lcopy_page_end:
19353 CFI_ENDPROC
19354@@ -105,7 +107,7 @@ ENDPROC(copy_page)
19355
19356 #include <asm/cpufeature.h>
19357
19358- .section .altinstr_replacement,"ax"
19359+ .section .altinstr_replacement,"a"
19360 1: .byte 0xeb /* jmp <disp8> */
19361 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19362 2:
19363diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
19364index 0248402..821c786 100644
19365--- a/arch/x86/lib/copy_user_64.S
19366+++ b/arch/x86/lib/copy_user_64.S
19367@@ -16,6 +16,7 @@
19368 #include <asm/thread_info.h>
19369 #include <asm/cpufeature.h>
19370 #include <asm/alternative-asm.h>
19371+#include <asm/pgtable.h>
19372
19373 /*
19374 * By placing feature2 after feature1 in altinstructions section, we logically
19375@@ -29,7 +30,7 @@
19376 .byte 0xe9 /* 32bit jump */
19377 .long \orig-1f /* by default jump to orig */
19378 1:
19379- .section .altinstr_replacement,"ax"
19380+ .section .altinstr_replacement,"a"
19381 2: .byte 0xe9 /* near jump with 32bit immediate */
19382 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
19383 3: .byte 0xe9 /* near jump with 32bit immediate */
19384@@ -71,47 +72,20 @@
19385 #endif
19386 .endm
19387
19388-/* Standard copy_to_user with segment limit checking */
19389-ENTRY(_copy_to_user)
19390- CFI_STARTPROC
19391- GET_THREAD_INFO(%rax)
19392- movq %rdi,%rcx
19393- addq %rdx,%rcx
19394- jc bad_to_user
19395- cmpq TI_addr_limit(%rax),%rcx
19396- ja bad_to_user
19397- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19398- copy_user_generic_unrolled,copy_user_generic_string, \
19399- copy_user_enhanced_fast_string
19400- CFI_ENDPROC
19401-ENDPROC(_copy_to_user)
19402-
19403-/* Standard copy_from_user with segment limit checking */
19404-ENTRY(_copy_from_user)
19405- CFI_STARTPROC
19406- GET_THREAD_INFO(%rax)
19407- movq %rsi,%rcx
19408- addq %rdx,%rcx
19409- jc bad_from_user
19410- cmpq TI_addr_limit(%rax),%rcx
19411- ja bad_from_user
19412- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19413- copy_user_generic_unrolled,copy_user_generic_string, \
19414- copy_user_enhanced_fast_string
19415- CFI_ENDPROC
19416-ENDPROC(_copy_from_user)
19417-
19418 .section .fixup,"ax"
19419 /* must zero dest */
19420 ENTRY(bad_from_user)
19421 bad_from_user:
19422 CFI_STARTPROC
19423+ testl %edx,%edx
19424+ js bad_to_user
19425 movl %edx,%ecx
19426 xorl %eax,%eax
19427 rep
19428 stosb
19429 bad_to_user:
19430 movl %edx,%eax
19431+ pax_force_retaddr
19432 ret
19433 CFI_ENDPROC
19434 ENDPROC(bad_from_user)
19435@@ -141,19 +115,19 @@ ENTRY(copy_user_generic_unrolled)
19436 jz 17f
19437 1: movq (%rsi),%r8
19438 2: movq 1*8(%rsi),%r9
19439-3: movq 2*8(%rsi),%r10
19440+3: movq 2*8(%rsi),%rax
19441 4: movq 3*8(%rsi),%r11
19442 5: movq %r8,(%rdi)
19443 6: movq %r9,1*8(%rdi)
19444-7: movq %r10,2*8(%rdi)
19445+7: movq %rax,2*8(%rdi)
19446 8: movq %r11,3*8(%rdi)
19447 9: movq 4*8(%rsi),%r8
19448 10: movq 5*8(%rsi),%r9
19449-11: movq 6*8(%rsi),%r10
19450+11: movq 6*8(%rsi),%rax
19451 12: movq 7*8(%rsi),%r11
19452 13: movq %r8,4*8(%rdi)
19453 14: movq %r9,5*8(%rdi)
19454-15: movq %r10,6*8(%rdi)
19455+15: movq %rax,6*8(%rdi)
19456 16: movq %r11,7*8(%rdi)
19457 leaq 64(%rsi),%rsi
19458 leaq 64(%rdi),%rdi
19459@@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
19460 decl %ecx
19461 jnz 21b
19462 23: xor %eax,%eax
19463+ pax_force_retaddr
19464 ret
19465
19466 .section .fixup,"ax"
19467@@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string)
19468 3: rep
19469 movsb
19470 4: xorl %eax,%eax
19471+ pax_force_retaddr
19472 ret
19473
19474 .section .fixup,"ax"
19475@@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string)
19476 1: rep
19477 movsb
19478 2: xorl %eax,%eax
19479+ pax_force_retaddr
19480 ret
19481
19482 .section .fixup,"ax"
19483diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
19484index cb0c112..e3a6895 100644
19485--- a/arch/x86/lib/copy_user_nocache_64.S
19486+++ b/arch/x86/lib/copy_user_nocache_64.S
19487@@ -8,12 +8,14 @@
19488
19489 #include <linux/linkage.h>
19490 #include <asm/dwarf2.h>
19491+#include <asm/alternative-asm.h>
19492
19493 #define FIX_ALIGNMENT 1
19494
19495 #include <asm/current.h>
19496 #include <asm/asm-offsets.h>
19497 #include <asm/thread_info.h>
19498+#include <asm/pgtable.h>
19499
19500 .macro ALIGN_DESTINATION
19501 #ifdef FIX_ALIGNMENT
19502@@ -50,6 +52,15 @@
19503 */
19504 ENTRY(__copy_user_nocache)
19505 CFI_STARTPROC
19506+
19507+#ifdef CONFIG_PAX_MEMORY_UDEREF
19508+ mov $PAX_USER_SHADOW_BASE,%rcx
19509+ cmp %rcx,%rsi
19510+ jae 1f
19511+ add %rcx,%rsi
19512+1:
19513+#endif
19514+
19515 cmpl $8,%edx
19516 jb 20f /* less then 8 bytes, go to byte copy loop */
19517 ALIGN_DESTINATION
19518@@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache)
19519 jz 17f
19520 1: movq (%rsi),%r8
19521 2: movq 1*8(%rsi),%r9
19522-3: movq 2*8(%rsi),%r10
19523+3: movq 2*8(%rsi),%rax
19524 4: movq 3*8(%rsi),%r11
19525 5: movnti %r8,(%rdi)
19526 6: movnti %r9,1*8(%rdi)
19527-7: movnti %r10,2*8(%rdi)
19528+7: movnti %rax,2*8(%rdi)
19529 8: movnti %r11,3*8(%rdi)
19530 9: movq 4*8(%rsi),%r8
19531 10: movq 5*8(%rsi),%r9
19532-11: movq 6*8(%rsi),%r10
19533+11: movq 6*8(%rsi),%rax
19534 12: movq 7*8(%rsi),%r11
19535 13: movnti %r8,4*8(%rdi)
19536 14: movnti %r9,5*8(%rdi)
19537-15: movnti %r10,6*8(%rdi)
19538+15: movnti %rax,6*8(%rdi)
19539 16: movnti %r11,7*8(%rdi)
19540 leaq 64(%rsi),%rsi
19541 leaq 64(%rdi),%rdi
19542@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
19543 jnz 21b
19544 23: xorl %eax,%eax
19545 sfence
19546+ pax_force_retaddr
19547 ret
19548
19549 .section .fixup,"ax"
19550diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
19551index fb903b7..c92b7f7 100644
19552--- a/arch/x86/lib/csum-copy_64.S
19553+++ b/arch/x86/lib/csum-copy_64.S
19554@@ -8,6 +8,7 @@
19555 #include <linux/linkage.h>
19556 #include <asm/dwarf2.h>
19557 #include <asm/errno.h>
19558+#include <asm/alternative-asm.h>
19559
19560 /*
19561 * Checksum copy with exception handling.
19562@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
19563 CFI_RESTORE rbp
19564 addq $7*8, %rsp
19565 CFI_ADJUST_CFA_OFFSET -7*8
19566+ pax_force_retaddr 0, 1
19567 ret
19568 CFI_RESTORE_STATE
19569
19570diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
19571index 459b58a..9570bc7 100644
19572--- a/arch/x86/lib/csum-wrappers_64.c
19573+++ b/arch/x86/lib/csum-wrappers_64.c
19574@@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
19575 len -= 2;
19576 }
19577 }
19578- isum = csum_partial_copy_generic((__force const void *)src,
19579+
19580+#ifdef CONFIG_PAX_MEMORY_UDEREF
19581+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19582+ src += PAX_USER_SHADOW_BASE;
19583+#endif
19584+
19585+ isum = csum_partial_copy_generic((const void __force_kernel *)src,
19586 dst, len, isum, errp, NULL);
19587 if (unlikely(*errp))
19588 goto out_err;
19589@@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
19590 }
19591
19592 *errp = 0;
19593- return csum_partial_copy_generic(src, (void __force *)dst,
19594+
19595+#ifdef CONFIG_PAX_MEMORY_UDEREF
19596+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19597+ dst += PAX_USER_SHADOW_BASE;
19598+#endif
19599+
19600+ return csum_partial_copy_generic(src, (void __force_kernel *)dst,
19601 len, isum, NULL, errp);
19602 }
19603 EXPORT_SYMBOL(csum_partial_copy_to_user);
19604diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
19605index 51f1504..ddac4c1 100644
19606--- a/arch/x86/lib/getuser.S
19607+++ b/arch/x86/lib/getuser.S
19608@@ -33,15 +33,38 @@
19609 #include <asm/asm-offsets.h>
19610 #include <asm/thread_info.h>
19611 #include <asm/asm.h>
19612+#include <asm/segment.h>
19613+#include <asm/pgtable.h>
19614+#include <asm/alternative-asm.h>
19615+
19616+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19617+#define __copyuser_seg gs;
19618+#else
19619+#define __copyuser_seg
19620+#endif
19621
19622 .text
19623 ENTRY(__get_user_1)
19624 CFI_STARTPROC
19625+
19626+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19627 GET_THREAD_INFO(%_ASM_DX)
19628 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19629 jae bad_get_user
19630-1: movzb (%_ASM_AX),%edx
19631+
19632+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19633+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19634+ cmp %_ASM_DX,%_ASM_AX
19635+ jae 1234f
19636+ add %_ASM_DX,%_ASM_AX
19637+1234:
19638+#endif
19639+
19640+#endif
19641+
19642+1: __copyuser_seg movzb (%_ASM_AX),%edx
19643 xor %eax,%eax
19644+ pax_force_retaddr
19645 ret
19646 CFI_ENDPROC
19647 ENDPROC(__get_user_1)
19648@@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
19649 ENTRY(__get_user_2)
19650 CFI_STARTPROC
19651 add $1,%_ASM_AX
19652+
19653+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19654 jc bad_get_user
19655 GET_THREAD_INFO(%_ASM_DX)
19656 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19657 jae bad_get_user
19658-2: movzwl -1(%_ASM_AX),%edx
19659+
19660+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19661+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19662+ cmp %_ASM_DX,%_ASM_AX
19663+ jae 1234f
19664+ add %_ASM_DX,%_ASM_AX
19665+1234:
19666+#endif
19667+
19668+#endif
19669+
19670+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19671 xor %eax,%eax
19672+ pax_force_retaddr
19673 ret
19674 CFI_ENDPROC
19675 ENDPROC(__get_user_2)
19676@@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
19677 ENTRY(__get_user_4)
19678 CFI_STARTPROC
19679 add $3,%_ASM_AX
19680+
19681+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19682 jc bad_get_user
19683 GET_THREAD_INFO(%_ASM_DX)
19684 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19685 jae bad_get_user
19686-3: mov -3(%_ASM_AX),%edx
19687+
19688+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19689+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19690+ cmp %_ASM_DX,%_ASM_AX
19691+ jae 1234f
19692+ add %_ASM_DX,%_ASM_AX
19693+1234:
19694+#endif
19695+
19696+#endif
19697+
19698+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19699 xor %eax,%eax
19700+ pax_force_retaddr
19701 ret
19702 CFI_ENDPROC
19703 ENDPROC(__get_user_4)
19704@@ -80,8 +131,18 @@ ENTRY(__get_user_8)
19705 GET_THREAD_INFO(%_ASM_DX)
19706 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19707 jae bad_get_user
19708+
19709+#ifdef CONFIG_PAX_MEMORY_UDEREF
19710+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19711+ cmp %_ASM_DX,%_ASM_AX
19712+ jae 1234f
19713+ add %_ASM_DX,%_ASM_AX
19714+1234:
19715+#endif
19716+
19717 4: movq -7(%_ASM_AX),%_ASM_DX
19718 xor %eax,%eax
19719+ pax_force_retaddr
19720 ret
19721 CFI_ENDPROC
19722 ENDPROC(__get_user_8)
19723@@ -91,6 +152,7 @@ bad_get_user:
19724 CFI_STARTPROC
19725 xor %edx,%edx
19726 mov $(-EFAULT),%_ASM_AX
19727+ pax_force_retaddr
19728 ret
19729 CFI_ENDPROC
19730 END(bad_get_user)
19731diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
19732index 9f33b98..dfc7678 100644
19733--- a/arch/x86/lib/insn.c
19734+++ b/arch/x86/lib/insn.c
19735@@ -21,6 +21,11 @@
19736 #include <linux/string.h>
19737 #include <asm/inat.h>
19738 #include <asm/insn.h>
19739+#ifdef __KERNEL__
19740+#include <asm/pgtable_types.h>
19741+#else
19742+#define ktla_ktva(addr) addr
19743+#endif
19744
19745 #define get_next(t, insn) \
19746 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19747@@ -40,8 +45,8 @@
19748 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19749 {
19750 memset(insn, 0, sizeof(*insn));
19751- insn->kaddr = kaddr;
19752- insn->next_byte = kaddr;
19753+ insn->kaddr = ktla_ktva(kaddr);
19754+ insn->next_byte = ktla_ktva(kaddr);
19755 insn->x86_64 = x86_64 ? 1 : 0;
19756 insn->opnd_bytes = 4;
19757 if (x86_64)
19758diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
19759index 05a95e7..326f2fa 100644
19760--- a/arch/x86/lib/iomap_copy_64.S
19761+++ b/arch/x86/lib/iomap_copy_64.S
19762@@ -17,6 +17,7 @@
19763
19764 #include <linux/linkage.h>
19765 #include <asm/dwarf2.h>
19766+#include <asm/alternative-asm.h>
19767
19768 /*
19769 * override generic version in lib/iomap_copy.c
19770@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
19771 CFI_STARTPROC
19772 movl %edx,%ecx
19773 rep movsd
19774+ pax_force_retaddr
19775 ret
19776 CFI_ENDPROC
19777 ENDPROC(__iowrite32_copy)
19778diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
19779index efbf2a0..8893637 100644
19780--- a/arch/x86/lib/memcpy_64.S
19781+++ b/arch/x86/lib/memcpy_64.S
19782@@ -34,6 +34,7 @@
19783 rep movsq
19784 movl %edx, %ecx
19785 rep movsb
19786+ pax_force_retaddr
19787 ret
19788 .Lmemcpy_e:
19789 .previous
19790@@ -51,6 +52,7 @@
19791
19792 movl %edx, %ecx
19793 rep movsb
19794+ pax_force_retaddr
19795 ret
19796 .Lmemcpy_e_e:
19797 .previous
19798@@ -81,13 +83,13 @@ ENTRY(memcpy)
19799 */
19800 movq 0*8(%rsi), %r8
19801 movq 1*8(%rsi), %r9
19802- movq 2*8(%rsi), %r10
19803+ movq 2*8(%rsi), %rcx
19804 movq 3*8(%rsi), %r11
19805 leaq 4*8(%rsi), %rsi
19806
19807 movq %r8, 0*8(%rdi)
19808 movq %r9, 1*8(%rdi)
19809- movq %r10, 2*8(%rdi)
19810+ movq %rcx, 2*8(%rdi)
19811 movq %r11, 3*8(%rdi)
19812 leaq 4*8(%rdi), %rdi
19813 jae .Lcopy_forward_loop
19814@@ -110,12 +112,12 @@ ENTRY(memcpy)
19815 subq $0x20, %rdx
19816 movq -1*8(%rsi), %r8
19817 movq -2*8(%rsi), %r9
19818- movq -3*8(%rsi), %r10
19819+ movq -3*8(%rsi), %rcx
19820 movq -4*8(%rsi), %r11
19821 leaq -4*8(%rsi), %rsi
19822 movq %r8, -1*8(%rdi)
19823 movq %r9, -2*8(%rdi)
19824- movq %r10, -3*8(%rdi)
19825+ movq %rcx, -3*8(%rdi)
19826 movq %r11, -4*8(%rdi)
19827 leaq -4*8(%rdi), %rdi
19828 jae .Lcopy_backward_loop
19829@@ -135,12 +137,13 @@ ENTRY(memcpy)
19830 */
19831 movq 0*8(%rsi), %r8
19832 movq 1*8(%rsi), %r9
19833- movq -2*8(%rsi, %rdx), %r10
19834+ movq -2*8(%rsi, %rdx), %rcx
19835 movq -1*8(%rsi, %rdx), %r11
19836 movq %r8, 0*8(%rdi)
19837 movq %r9, 1*8(%rdi)
19838- movq %r10, -2*8(%rdi, %rdx)
19839+ movq %rcx, -2*8(%rdi, %rdx)
19840 movq %r11, -1*8(%rdi, %rdx)
19841+ pax_force_retaddr
19842 retq
19843 .p2align 4
19844 .Lless_16bytes:
19845@@ -153,6 +156,7 @@ ENTRY(memcpy)
19846 movq -1*8(%rsi, %rdx), %r9
19847 movq %r8, 0*8(%rdi)
19848 movq %r9, -1*8(%rdi, %rdx)
19849+ pax_force_retaddr
19850 retq
19851 .p2align 4
19852 .Lless_8bytes:
19853@@ -166,6 +170,7 @@ ENTRY(memcpy)
19854 movl -4(%rsi, %rdx), %r8d
19855 movl %ecx, (%rdi)
19856 movl %r8d, -4(%rdi, %rdx)
19857+ pax_force_retaddr
19858 retq
19859 .p2align 4
19860 .Lless_3bytes:
19861@@ -183,6 +188,7 @@ ENTRY(memcpy)
19862 jnz .Lloop_1
19863
19864 .Lend:
19865+ pax_force_retaddr
19866 retq
19867 CFI_ENDPROC
19868 ENDPROC(memcpy)
19869diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
19870index ee16461..c39c199 100644
19871--- a/arch/x86/lib/memmove_64.S
19872+++ b/arch/x86/lib/memmove_64.S
19873@@ -61,13 +61,13 @@ ENTRY(memmove)
19874 5:
19875 sub $0x20, %rdx
19876 movq 0*8(%rsi), %r11
19877- movq 1*8(%rsi), %r10
19878+ movq 1*8(%rsi), %rcx
19879 movq 2*8(%rsi), %r9
19880 movq 3*8(%rsi), %r8
19881 leaq 4*8(%rsi), %rsi
19882
19883 movq %r11, 0*8(%rdi)
19884- movq %r10, 1*8(%rdi)
19885+ movq %rcx, 1*8(%rdi)
19886 movq %r9, 2*8(%rdi)
19887 movq %r8, 3*8(%rdi)
19888 leaq 4*8(%rdi), %rdi
19889@@ -81,10 +81,10 @@ ENTRY(memmove)
19890 4:
19891 movq %rdx, %rcx
19892 movq -8(%rsi, %rdx), %r11
19893- lea -8(%rdi, %rdx), %r10
19894+ lea -8(%rdi, %rdx), %r9
19895 shrq $3, %rcx
19896 rep movsq
19897- movq %r11, (%r10)
19898+ movq %r11, (%r9)
19899 jmp 13f
19900 .Lmemmove_end_forward:
19901
19902@@ -95,14 +95,14 @@ ENTRY(memmove)
19903 7:
19904 movq %rdx, %rcx
19905 movq (%rsi), %r11
19906- movq %rdi, %r10
19907+ movq %rdi, %r9
19908 leaq -8(%rsi, %rdx), %rsi
19909 leaq -8(%rdi, %rdx), %rdi
19910 shrq $3, %rcx
19911 std
19912 rep movsq
19913 cld
19914- movq %r11, (%r10)
19915+ movq %r11, (%r9)
19916 jmp 13f
19917
19918 /*
19919@@ -127,13 +127,13 @@ ENTRY(memmove)
19920 8:
19921 subq $0x20, %rdx
19922 movq -1*8(%rsi), %r11
19923- movq -2*8(%rsi), %r10
19924+ movq -2*8(%rsi), %rcx
19925 movq -3*8(%rsi), %r9
19926 movq -4*8(%rsi), %r8
19927 leaq -4*8(%rsi), %rsi
19928
19929 movq %r11, -1*8(%rdi)
19930- movq %r10, -2*8(%rdi)
19931+ movq %rcx, -2*8(%rdi)
19932 movq %r9, -3*8(%rdi)
19933 movq %r8, -4*8(%rdi)
19934 leaq -4*8(%rdi), %rdi
19935@@ -151,11 +151,11 @@ ENTRY(memmove)
19936 * Move data from 16 bytes to 31 bytes.
19937 */
19938 movq 0*8(%rsi), %r11
19939- movq 1*8(%rsi), %r10
19940+ movq 1*8(%rsi), %rcx
19941 movq -2*8(%rsi, %rdx), %r9
19942 movq -1*8(%rsi, %rdx), %r8
19943 movq %r11, 0*8(%rdi)
19944- movq %r10, 1*8(%rdi)
19945+ movq %rcx, 1*8(%rdi)
19946 movq %r9, -2*8(%rdi, %rdx)
19947 movq %r8, -1*8(%rdi, %rdx)
19948 jmp 13f
19949@@ -167,9 +167,9 @@ ENTRY(memmove)
19950 * Move data from 8 bytes to 15 bytes.
19951 */
19952 movq 0*8(%rsi), %r11
19953- movq -1*8(%rsi, %rdx), %r10
19954+ movq -1*8(%rsi, %rdx), %r9
19955 movq %r11, 0*8(%rdi)
19956- movq %r10, -1*8(%rdi, %rdx)
19957+ movq %r9, -1*8(%rdi, %rdx)
19958 jmp 13f
19959 10:
19960 cmpq $4, %rdx
19961@@ -178,9 +178,9 @@ ENTRY(memmove)
19962 * Move data from 4 bytes to 7 bytes.
19963 */
19964 movl (%rsi), %r11d
19965- movl -4(%rsi, %rdx), %r10d
19966+ movl -4(%rsi, %rdx), %r9d
19967 movl %r11d, (%rdi)
19968- movl %r10d, -4(%rdi, %rdx)
19969+ movl %r9d, -4(%rdi, %rdx)
19970 jmp 13f
19971 11:
19972 cmp $2, %rdx
19973@@ -189,9 +189,9 @@ ENTRY(memmove)
19974 * Move data from 2 bytes to 3 bytes.
19975 */
19976 movw (%rsi), %r11w
19977- movw -2(%rsi, %rdx), %r10w
19978+ movw -2(%rsi, %rdx), %r9w
19979 movw %r11w, (%rdi)
19980- movw %r10w, -2(%rdi, %rdx)
19981+ movw %r9w, -2(%rdi, %rdx)
19982 jmp 13f
19983 12:
19984 cmp $1, %rdx
19985@@ -202,6 +202,7 @@ ENTRY(memmove)
19986 movb (%rsi), %r11b
19987 movb %r11b, (%rdi)
19988 13:
19989+ pax_force_retaddr
19990 retq
19991 CFI_ENDPROC
19992
19993@@ -210,6 +211,7 @@ ENTRY(memmove)
19994 /* Forward moving data. */
19995 movq %rdx, %rcx
19996 rep movsb
19997+ pax_force_retaddr
19998 retq
19999 .Lmemmove_end_forward_efs:
20000 .previous
20001diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
20002index 79bd454..dff325a 100644
20003--- a/arch/x86/lib/memset_64.S
20004+++ b/arch/x86/lib/memset_64.S
20005@@ -31,6 +31,7 @@
20006 movl %r8d,%ecx
20007 rep stosb
20008 movq %r9,%rax
20009+ pax_force_retaddr
20010 ret
20011 .Lmemset_e:
20012 .previous
20013@@ -53,6 +54,7 @@
20014 movl %edx,%ecx
20015 rep stosb
20016 movq %r9,%rax
20017+ pax_force_retaddr
20018 ret
20019 .Lmemset_e_e:
20020 .previous
20021@@ -60,13 +62,13 @@
20022 ENTRY(memset)
20023 ENTRY(__memset)
20024 CFI_STARTPROC
20025- movq %rdi,%r10
20026 movq %rdx,%r11
20027
20028 /* expand byte value */
20029 movzbl %sil,%ecx
20030 movabs $0x0101010101010101,%rax
20031 mul %rcx /* with rax, clobbers rdx */
20032+ movq %rdi,%rdx
20033
20034 /* align dst */
20035 movl %edi,%r9d
20036@@ -120,7 +122,8 @@ ENTRY(__memset)
20037 jnz .Lloop_1
20038
20039 .Lende:
20040- movq %r10,%rax
20041+ movq %rdx,%rax
20042+ pax_force_retaddr
20043 ret
20044
20045 CFI_RESTORE_STATE
20046diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
20047index c9f2d9b..e7fd2c0 100644
20048--- a/arch/x86/lib/mmx_32.c
20049+++ b/arch/x86/lib/mmx_32.c
20050@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20051 {
20052 void *p;
20053 int i;
20054+ unsigned long cr0;
20055
20056 if (unlikely(in_interrupt()))
20057 return __memcpy(to, from, len);
20058@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20059 kernel_fpu_begin();
20060
20061 __asm__ __volatile__ (
20062- "1: prefetch (%0)\n" /* This set is 28 bytes */
20063- " prefetch 64(%0)\n"
20064- " prefetch 128(%0)\n"
20065- " prefetch 192(%0)\n"
20066- " prefetch 256(%0)\n"
20067+ "1: prefetch (%1)\n" /* This set is 28 bytes */
20068+ " prefetch 64(%1)\n"
20069+ " prefetch 128(%1)\n"
20070+ " prefetch 192(%1)\n"
20071+ " prefetch 256(%1)\n"
20072 "2: \n"
20073 ".section .fixup, \"ax\"\n"
20074- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20075+ "3: \n"
20076+
20077+#ifdef CONFIG_PAX_KERNEXEC
20078+ " movl %%cr0, %0\n"
20079+ " movl %0, %%eax\n"
20080+ " andl $0xFFFEFFFF, %%eax\n"
20081+ " movl %%eax, %%cr0\n"
20082+#endif
20083+
20084+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20085+
20086+#ifdef CONFIG_PAX_KERNEXEC
20087+ " movl %0, %%cr0\n"
20088+#endif
20089+
20090 " jmp 2b\n"
20091 ".previous\n"
20092 _ASM_EXTABLE(1b, 3b)
20093- : : "r" (from));
20094+ : "=&r" (cr0) : "r" (from) : "ax");
20095
20096 for ( ; i > 5; i--) {
20097 __asm__ __volatile__ (
20098- "1: prefetch 320(%0)\n"
20099- "2: movq (%0), %%mm0\n"
20100- " movq 8(%0), %%mm1\n"
20101- " movq 16(%0), %%mm2\n"
20102- " movq 24(%0), %%mm3\n"
20103- " movq %%mm0, (%1)\n"
20104- " movq %%mm1, 8(%1)\n"
20105- " movq %%mm2, 16(%1)\n"
20106- " movq %%mm3, 24(%1)\n"
20107- " movq 32(%0), %%mm0\n"
20108- " movq 40(%0), %%mm1\n"
20109- " movq 48(%0), %%mm2\n"
20110- " movq 56(%0), %%mm3\n"
20111- " movq %%mm0, 32(%1)\n"
20112- " movq %%mm1, 40(%1)\n"
20113- " movq %%mm2, 48(%1)\n"
20114- " movq %%mm3, 56(%1)\n"
20115+ "1: prefetch 320(%1)\n"
20116+ "2: movq (%1), %%mm0\n"
20117+ " movq 8(%1), %%mm1\n"
20118+ " movq 16(%1), %%mm2\n"
20119+ " movq 24(%1), %%mm3\n"
20120+ " movq %%mm0, (%2)\n"
20121+ " movq %%mm1, 8(%2)\n"
20122+ " movq %%mm2, 16(%2)\n"
20123+ " movq %%mm3, 24(%2)\n"
20124+ " movq 32(%1), %%mm0\n"
20125+ " movq 40(%1), %%mm1\n"
20126+ " movq 48(%1), %%mm2\n"
20127+ " movq 56(%1), %%mm3\n"
20128+ " movq %%mm0, 32(%2)\n"
20129+ " movq %%mm1, 40(%2)\n"
20130+ " movq %%mm2, 48(%2)\n"
20131+ " movq %%mm3, 56(%2)\n"
20132 ".section .fixup, \"ax\"\n"
20133- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20134+ "3:\n"
20135+
20136+#ifdef CONFIG_PAX_KERNEXEC
20137+ " movl %%cr0, %0\n"
20138+ " movl %0, %%eax\n"
20139+ " andl $0xFFFEFFFF, %%eax\n"
20140+ " movl %%eax, %%cr0\n"
20141+#endif
20142+
20143+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20144+
20145+#ifdef CONFIG_PAX_KERNEXEC
20146+ " movl %0, %%cr0\n"
20147+#endif
20148+
20149 " jmp 2b\n"
20150 ".previous\n"
20151 _ASM_EXTABLE(1b, 3b)
20152- : : "r" (from), "r" (to) : "memory");
20153+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20154
20155 from += 64;
20156 to += 64;
20157@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
20158 static void fast_copy_page(void *to, void *from)
20159 {
20160 int i;
20161+ unsigned long cr0;
20162
20163 kernel_fpu_begin();
20164
20165@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
20166 * but that is for later. -AV
20167 */
20168 __asm__ __volatile__(
20169- "1: prefetch (%0)\n"
20170- " prefetch 64(%0)\n"
20171- " prefetch 128(%0)\n"
20172- " prefetch 192(%0)\n"
20173- " prefetch 256(%0)\n"
20174+ "1: prefetch (%1)\n"
20175+ " prefetch 64(%1)\n"
20176+ " prefetch 128(%1)\n"
20177+ " prefetch 192(%1)\n"
20178+ " prefetch 256(%1)\n"
20179 "2: \n"
20180 ".section .fixup, \"ax\"\n"
20181- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20182+ "3: \n"
20183+
20184+#ifdef CONFIG_PAX_KERNEXEC
20185+ " movl %%cr0, %0\n"
20186+ " movl %0, %%eax\n"
20187+ " andl $0xFFFEFFFF, %%eax\n"
20188+ " movl %%eax, %%cr0\n"
20189+#endif
20190+
20191+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20192+
20193+#ifdef CONFIG_PAX_KERNEXEC
20194+ " movl %0, %%cr0\n"
20195+#endif
20196+
20197 " jmp 2b\n"
20198 ".previous\n"
20199- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20200+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20201
20202 for (i = 0; i < (4096-320)/64; i++) {
20203 __asm__ __volatile__ (
20204- "1: prefetch 320(%0)\n"
20205- "2: movq (%0), %%mm0\n"
20206- " movntq %%mm0, (%1)\n"
20207- " movq 8(%0), %%mm1\n"
20208- " movntq %%mm1, 8(%1)\n"
20209- " movq 16(%0), %%mm2\n"
20210- " movntq %%mm2, 16(%1)\n"
20211- " movq 24(%0), %%mm3\n"
20212- " movntq %%mm3, 24(%1)\n"
20213- " movq 32(%0), %%mm4\n"
20214- " movntq %%mm4, 32(%1)\n"
20215- " movq 40(%0), %%mm5\n"
20216- " movntq %%mm5, 40(%1)\n"
20217- " movq 48(%0), %%mm6\n"
20218- " movntq %%mm6, 48(%1)\n"
20219- " movq 56(%0), %%mm7\n"
20220- " movntq %%mm7, 56(%1)\n"
20221+ "1: prefetch 320(%1)\n"
20222+ "2: movq (%1), %%mm0\n"
20223+ " movntq %%mm0, (%2)\n"
20224+ " movq 8(%1), %%mm1\n"
20225+ " movntq %%mm1, 8(%2)\n"
20226+ " movq 16(%1), %%mm2\n"
20227+ " movntq %%mm2, 16(%2)\n"
20228+ " movq 24(%1), %%mm3\n"
20229+ " movntq %%mm3, 24(%2)\n"
20230+ " movq 32(%1), %%mm4\n"
20231+ " movntq %%mm4, 32(%2)\n"
20232+ " movq 40(%1), %%mm5\n"
20233+ " movntq %%mm5, 40(%2)\n"
20234+ " movq 48(%1), %%mm6\n"
20235+ " movntq %%mm6, 48(%2)\n"
20236+ " movq 56(%1), %%mm7\n"
20237+ " movntq %%mm7, 56(%2)\n"
20238 ".section .fixup, \"ax\"\n"
20239- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20240+ "3:\n"
20241+
20242+#ifdef CONFIG_PAX_KERNEXEC
20243+ " movl %%cr0, %0\n"
20244+ " movl %0, %%eax\n"
20245+ " andl $0xFFFEFFFF, %%eax\n"
20246+ " movl %%eax, %%cr0\n"
20247+#endif
20248+
20249+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20250+
20251+#ifdef CONFIG_PAX_KERNEXEC
20252+ " movl %0, %%cr0\n"
20253+#endif
20254+
20255 " jmp 2b\n"
20256 ".previous\n"
20257- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20258+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20259
20260 from += 64;
20261 to += 64;
20262@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20263 static void fast_copy_page(void *to, void *from)
20264 {
20265 int i;
20266+ unsigned long cr0;
20267
20268 kernel_fpu_begin();
20269
20270 __asm__ __volatile__ (
20271- "1: prefetch (%0)\n"
20272- " prefetch 64(%0)\n"
20273- " prefetch 128(%0)\n"
20274- " prefetch 192(%0)\n"
20275- " prefetch 256(%0)\n"
20276+ "1: prefetch (%1)\n"
20277+ " prefetch 64(%1)\n"
20278+ " prefetch 128(%1)\n"
20279+ " prefetch 192(%1)\n"
20280+ " prefetch 256(%1)\n"
20281 "2: \n"
20282 ".section .fixup, \"ax\"\n"
20283- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20284+ "3: \n"
20285+
20286+#ifdef CONFIG_PAX_KERNEXEC
20287+ " movl %%cr0, %0\n"
20288+ " movl %0, %%eax\n"
20289+ " andl $0xFFFEFFFF, %%eax\n"
20290+ " movl %%eax, %%cr0\n"
20291+#endif
20292+
20293+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20294+
20295+#ifdef CONFIG_PAX_KERNEXEC
20296+ " movl %0, %%cr0\n"
20297+#endif
20298+
20299 " jmp 2b\n"
20300 ".previous\n"
20301- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20302+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20303
20304 for (i = 0; i < 4096/64; i++) {
20305 __asm__ __volatile__ (
20306- "1: prefetch 320(%0)\n"
20307- "2: movq (%0), %%mm0\n"
20308- " movq 8(%0), %%mm1\n"
20309- " movq 16(%0), %%mm2\n"
20310- " movq 24(%0), %%mm3\n"
20311- " movq %%mm0, (%1)\n"
20312- " movq %%mm1, 8(%1)\n"
20313- " movq %%mm2, 16(%1)\n"
20314- " movq %%mm3, 24(%1)\n"
20315- " movq 32(%0), %%mm0\n"
20316- " movq 40(%0), %%mm1\n"
20317- " movq 48(%0), %%mm2\n"
20318- " movq 56(%0), %%mm3\n"
20319- " movq %%mm0, 32(%1)\n"
20320- " movq %%mm1, 40(%1)\n"
20321- " movq %%mm2, 48(%1)\n"
20322- " movq %%mm3, 56(%1)\n"
20323+ "1: prefetch 320(%1)\n"
20324+ "2: movq (%1), %%mm0\n"
20325+ " movq 8(%1), %%mm1\n"
20326+ " movq 16(%1), %%mm2\n"
20327+ " movq 24(%1), %%mm3\n"
20328+ " movq %%mm0, (%2)\n"
20329+ " movq %%mm1, 8(%2)\n"
20330+ " movq %%mm2, 16(%2)\n"
20331+ " movq %%mm3, 24(%2)\n"
20332+ " movq 32(%1), %%mm0\n"
20333+ " movq 40(%1), %%mm1\n"
20334+ " movq 48(%1), %%mm2\n"
20335+ " movq 56(%1), %%mm3\n"
20336+ " movq %%mm0, 32(%2)\n"
20337+ " movq %%mm1, 40(%2)\n"
20338+ " movq %%mm2, 48(%2)\n"
20339+ " movq %%mm3, 56(%2)\n"
20340 ".section .fixup, \"ax\"\n"
20341- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20342+ "3:\n"
20343+
20344+#ifdef CONFIG_PAX_KERNEXEC
20345+ " movl %%cr0, %0\n"
20346+ " movl %0, %%eax\n"
20347+ " andl $0xFFFEFFFF, %%eax\n"
20348+ " movl %%eax, %%cr0\n"
20349+#endif
20350+
20351+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20352+
20353+#ifdef CONFIG_PAX_KERNEXEC
20354+ " movl %0, %%cr0\n"
20355+#endif
20356+
20357 " jmp 2b\n"
20358 ".previous\n"
20359 _ASM_EXTABLE(1b, 3b)
20360- : : "r" (from), "r" (to) : "memory");
20361+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20362
20363 from += 64;
20364 to += 64;
20365diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
20366index 69fa106..adda88b 100644
20367--- a/arch/x86/lib/msr-reg.S
20368+++ b/arch/x86/lib/msr-reg.S
20369@@ -3,6 +3,7 @@
20370 #include <asm/dwarf2.h>
20371 #include <asm/asm.h>
20372 #include <asm/msr.h>
20373+#include <asm/alternative-asm.h>
20374
20375 #ifdef CONFIG_X86_64
20376 /*
20377@@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
20378 CFI_STARTPROC
20379 pushq_cfi %rbx
20380 pushq_cfi %rbp
20381- movq %rdi, %r10 /* Save pointer */
20382+ movq %rdi, %r9 /* Save pointer */
20383 xorl %r11d, %r11d /* Return value */
20384 movl (%rdi), %eax
20385 movl 4(%rdi), %ecx
20386@@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
20387 movl 28(%rdi), %edi
20388 CFI_REMEMBER_STATE
20389 1: \op
20390-2: movl %eax, (%r10)
20391+2: movl %eax, (%r9)
20392 movl %r11d, %eax /* Return value */
20393- movl %ecx, 4(%r10)
20394- movl %edx, 8(%r10)
20395- movl %ebx, 12(%r10)
20396- movl %ebp, 20(%r10)
20397- movl %esi, 24(%r10)
20398- movl %edi, 28(%r10)
20399+ movl %ecx, 4(%r9)
20400+ movl %edx, 8(%r9)
20401+ movl %ebx, 12(%r9)
20402+ movl %ebp, 20(%r9)
20403+ movl %esi, 24(%r9)
20404+ movl %edi, 28(%r9)
20405 popq_cfi %rbp
20406 popq_cfi %rbx
20407+ pax_force_retaddr
20408 ret
20409 3:
20410 CFI_RESTORE_STATE
20411diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
20412index 36b0d15..d381858 100644
20413--- a/arch/x86/lib/putuser.S
20414+++ b/arch/x86/lib/putuser.S
20415@@ -15,7 +15,9 @@
20416 #include <asm/thread_info.h>
20417 #include <asm/errno.h>
20418 #include <asm/asm.h>
20419-
20420+#include <asm/segment.h>
20421+#include <asm/pgtable.h>
20422+#include <asm/alternative-asm.h>
20423
20424 /*
20425 * __put_user_X
20426@@ -29,52 +31,119 @@
20427 * as they get called from within inline assembly.
20428 */
20429
20430-#define ENTER CFI_STARTPROC ; \
20431- GET_THREAD_INFO(%_ASM_BX)
20432-#define EXIT ret ; \
20433+#define ENTER CFI_STARTPROC
20434+#define EXIT pax_force_retaddr; ret ; \
20435 CFI_ENDPROC
20436
20437+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20438+#define _DEST %_ASM_CX,%_ASM_BX
20439+#else
20440+#define _DEST %_ASM_CX
20441+#endif
20442+
20443+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20444+#define __copyuser_seg gs;
20445+#else
20446+#define __copyuser_seg
20447+#endif
20448+
20449 .text
20450 ENTRY(__put_user_1)
20451 ENTER
20452+
20453+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20454+ GET_THREAD_INFO(%_ASM_BX)
20455 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20456 jae bad_put_user
20457-1: movb %al,(%_ASM_CX)
20458+
20459+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20460+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20461+ cmp %_ASM_BX,%_ASM_CX
20462+ jb 1234f
20463+ xor %ebx,%ebx
20464+1234:
20465+#endif
20466+
20467+#endif
20468+
20469+1: __copyuser_seg movb %al,(_DEST)
20470 xor %eax,%eax
20471 EXIT
20472 ENDPROC(__put_user_1)
20473
20474 ENTRY(__put_user_2)
20475 ENTER
20476+
20477+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20478+ GET_THREAD_INFO(%_ASM_BX)
20479 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20480 sub $1,%_ASM_BX
20481 cmp %_ASM_BX,%_ASM_CX
20482 jae bad_put_user
20483-2: movw %ax,(%_ASM_CX)
20484+
20485+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20486+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20487+ cmp %_ASM_BX,%_ASM_CX
20488+ jb 1234f
20489+ xor %ebx,%ebx
20490+1234:
20491+#endif
20492+
20493+#endif
20494+
20495+2: __copyuser_seg movw %ax,(_DEST)
20496 xor %eax,%eax
20497 EXIT
20498 ENDPROC(__put_user_2)
20499
20500 ENTRY(__put_user_4)
20501 ENTER
20502+
20503+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20504+ GET_THREAD_INFO(%_ASM_BX)
20505 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20506 sub $3,%_ASM_BX
20507 cmp %_ASM_BX,%_ASM_CX
20508 jae bad_put_user
20509-3: movl %eax,(%_ASM_CX)
20510+
20511+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20512+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20513+ cmp %_ASM_BX,%_ASM_CX
20514+ jb 1234f
20515+ xor %ebx,%ebx
20516+1234:
20517+#endif
20518+
20519+#endif
20520+
20521+3: __copyuser_seg movl %eax,(_DEST)
20522 xor %eax,%eax
20523 EXIT
20524 ENDPROC(__put_user_4)
20525
20526 ENTRY(__put_user_8)
20527 ENTER
20528+
20529+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20530+ GET_THREAD_INFO(%_ASM_BX)
20531 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20532 sub $7,%_ASM_BX
20533 cmp %_ASM_BX,%_ASM_CX
20534 jae bad_put_user
20535-4: mov %_ASM_AX,(%_ASM_CX)
20536+
20537+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20538+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20539+ cmp %_ASM_BX,%_ASM_CX
20540+ jb 1234f
20541+ xor %ebx,%ebx
20542+1234:
20543+#endif
20544+
20545+#endif
20546+
20547+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20548 #ifdef CONFIG_X86_32
20549-5: movl %edx,4(%_ASM_CX)
20550+5: __copyuser_seg movl %edx,4(_DEST)
20551 #endif
20552 xor %eax,%eax
20553 EXIT
20554diff --git a/arch/x86/lib/rwlock.S b/arch/x86/lib/rwlock.S
20555index 1cad221..de671ee 100644
20556--- a/arch/x86/lib/rwlock.S
20557+++ b/arch/x86/lib/rwlock.S
20558@@ -16,13 +16,34 @@ ENTRY(__write_lock_failed)
20559 FRAME
20560 0: LOCK_PREFIX
20561 WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20562+
20563+#ifdef CONFIG_PAX_REFCOUNT
20564+ jno 1234f
20565+ LOCK_PREFIX
20566+ WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20567+ int $4
20568+1234:
20569+ _ASM_EXTABLE(1234b, 1234b)
20570+#endif
20571+
20572 1: rep; nop
20573 cmpl $WRITE_LOCK_CMP, (%__lock_ptr)
20574 jne 1b
20575 LOCK_PREFIX
20576 WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20577+
20578+#ifdef CONFIG_PAX_REFCOUNT
20579+ jno 1234f
20580+ LOCK_PREFIX
20581+ WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20582+ int $4
20583+1234:
20584+ _ASM_EXTABLE(1234b, 1234b)
20585+#endif
20586+
20587 jnz 0b
20588 ENDFRAME
20589+ pax_force_retaddr
20590 ret
20591 CFI_ENDPROC
20592 END(__write_lock_failed)
20593@@ -32,13 +53,34 @@ ENTRY(__read_lock_failed)
20594 FRAME
20595 0: LOCK_PREFIX
20596 READ_LOCK_SIZE(inc) (%__lock_ptr)
20597+
20598+#ifdef CONFIG_PAX_REFCOUNT
20599+ jno 1234f
20600+ LOCK_PREFIX
20601+ READ_LOCK_SIZE(dec) (%__lock_ptr)
20602+ int $4
20603+1234:
20604+ _ASM_EXTABLE(1234b, 1234b)
20605+#endif
20606+
20607 1: rep; nop
20608 READ_LOCK_SIZE(cmp) $1, (%__lock_ptr)
20609 js 1b
20610 LOCK_PREFIX
20611 READ_LOCK_SIZE(dec) (%__lock_ptr)
20612+
20613+#ifdef CONFIG_PAX_REFCOUNT
20614+ jno 1234f
20615+ LOCK_PREFIX
20616+ READ_LOCK_SIZE(inc) (%__lock_ptr)
20617+ int $4
20618+1234:
20619+ _ASM_EXTABLE(1234b, 1234b)
20620+#endif
20621+
20622 js 0b
20623 ENDFRAME
20624+ pax_force_retaddr
20625 ret
20626 CFI_ENDPROC
20627 END(__read_lock_failed)
20628diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
20629index 5dff5f0..cadebf4 100644
20630--- a/arch/x86/lib/rwsem.S
20631+++ b/arch/x86/lib/rwsem.S
20632@@ -94,6 +94,7 @@ ENTRY(call_rwsem_down_read_failed)
20633 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20634 CFI_RESTORE __ASM_REG(dx)
20635 restore_common_regs
20636+ pax_force_retaddr
20637 ret
20638 CFI_ENDPROC
20639 ENDPROC(call_rwsem_down_read_failed)
20640@@ -104,6 +105,7 @@ ENTRY(call_rwsem_down_write_failed)
20641 movq %rax,%rdi
20642 call rwsem_down_write_failed
20643 restore_common_regs
20644+ pax_force_retaddr
20645 ret
20646 CFI_ENDPROC
20647 ENDPROC(call_rwsem_down_write_failed)
20648@@ -117,7 +119,8 @@ ENTRY(call_rwsem_wake)
20649 movq %rax,%rdi
20650 call rwsem_wake
20651 restore_common_regs
20652-1: ret
20653+1: pax_force_retaddr
20654+ ret
20655 CFI_ENDPROC
20656 ENDPROC(call_rwsem_wake)
20657
20658@@ -131,6 +134,7 @@ ENTRY(call_rwsem_downgrade_wake)
20659 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20660 CFI_RESTORE __ASM_REG(dx)
20661 restore_common_regs
20662+ pax_force_retaddr
20663 ret
20664 CFI_ENDPROC
20665 ENDPROC(call_rwsem_downgrade_wake)
20666diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
20667index a63efd6..ccecad8 100644
20668--- a/arch/x86/lib/thunk_64.S
20669+++ b/arch/x86/lib/thunk_64.S
20670@@ -8,6 +8,7 @@
20671 #include <linux/linkage.h>
20672 #include <asm/dwarf2.h>
20673 #include <asm/calling.h>
20674+#include <asm/alternative-asm.h>
20675
20676 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
20677 .macro THUNK name, func, put_ret_addr_in_rdi=0
20678@@ -41,5 +42,6 @@
20679 SAVE_ARGS
20680 restore:
20681 RESTORE_ARGS
20682+ pax_force_retaddr
20683 ret
20684 CFI_ENDPROC
20685diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
20686index e218d5d..35679b4 100644
20687--- a/arch/x86/lib/usercopy_32.c
20688+++ b/arch/x86/lib/usercopy_32.c
20689@@ -43,7 +43,7 @@ do { \
20690 __asm__ __volatile__( \
20691 " testl %1,%1\n" \
20692 " jz 2f\n" \
20693- "0: lodsb\n" \
20694+ "0: "__copyuser_seg"lodsb\n" \
20695 " stosb\n" \
20696 " testb %%al,%%al\n" \
20697 " jz 1f\n" \
20698@@ -128,10 +128,12 @@ do { \
20699 int __d0; \
20700 might_fault(); \
20701 __asm__ __volatile__( \
20702+ __COPYUSER_SET_ES \
20703 "0: rep; stosl\n" \
20704 " movl %2,%0\n" \
20705 "1: rep; stosb\n" \
20706 "2:\n" \
20707+ __COPYUSER_RESTORE_ES \
20708 ".section .fixup,\"ax\"\n" \
20709 "3: lea 0(%2,%0,4),%0\n" \
20710 " jmp 2b\n" \
20711@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
20712 might_fault();
20713
20714 __asm__ __volatile__(
20715+ __COPYUSER_SET_ES
20716 " testl %0, %0\n"
20717 " jz 3f\n"
20718 " andl %0,%%ecx\n"
20719@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, long n)
20720 " subl %%ecx,%0\n"
20721 " addl %0,%%eax\n"
20722 "1:\n"
20723+ __COPYUSER_RESTORE_ES
20724 ".section .fixup,\"ax\"\n"
20725 "2: xorl %%eax,%%eax\n"
20726 " jmp 1b\n"
20727@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20728
20729 #ifdef CONFIG_X86_INTEL_USERCOPY
20730 static unsigned long
20731-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20732+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20733 {
20734 int d0, d1;
20735 __asm__ __volatile__(
20736@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20737 " .align 2,0x90\n"
20738 "3: movl 0(%4), %%eax\n"
20739 "4: movl 4(%4), %%edx\n"
20740- "5: movl %%eax, 0(%3)\n"
20741- "6: movl %%edx, 4(%3)\n"
20742+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20743+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20744 "7: movl 8(%4), %%eax\n"
20745 "8: movl 12(%4),%%edx\n"
20746- "9: movl %%eax, 8(%3)\n"
20747- "10: movl %%edx, 12(%3)\n"
20748+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20749+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20750 "11: movl 16(%4), %%eax\n"
20751 "12: movl 20(%4), %%edx\n"
20752- "13: movl %%eax, 16(%3)\n"
20753- "14: movl %%edx, 20(%3)\n"
20754+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20755+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20756 "15: movl 24(%4), %%eax\n"
20757 "16: movl 28(%4), %%edx\n"
20758- "17: movl %%eax, 24(%3)\n"
20759- "18: movl %%edx, 28(%3)\n"
20760+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20761+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20762 "19: movl 32(%4), %%eax\n"
20763 "20: movl 36(%4), %%edx\n"
20764- "21: movl %%eax, 32(%3)\n"
20765- "22: movl %%edx, 36(%3)\n"
20766+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20767+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20768 "23: movl 40(%4), %%eax\n"
20769 "24: movl 44(%4), %%edx\n"
20770- "25: movl %%eax, 40(%3)\n"
20771- "26: movl %%edx, 44(%3)\n"
20772+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20773+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20774 "27: movl 48(%4), %%eax\n"
20775 "28: movl 52(%4), %%edx\n"
20776- "29: movl %%eax, 48(%3)\n"
20777- "30: movl %%edx, 52(%3)\n"
20778+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20779+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20780 "31: movl 56(%4), %%eax\n"
20781 "32: movl 60(%4), %%edx\n"
20782- "33: movl %%eax, 56(%3)\n"
20783- "34: movl %%edx, 60(%3)\n"
20784+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20785+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20786 " addl $-64, %0\n"
20787 " addl $64, %4\n"
20788 " addl $64, %3\n"
20789@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20790 " shrl $2, %0\n"
20791 " andl $3, %%eax\n"
20792 " cld\n"
20793+ __COPYUSER_SET_ES
20794 "99: rep; movsl\n"
20795 "36: movl %%eax, %0\n"
20796 "37: rep; movsb\n"
20797 "100:\n"
20798+ __COPYUSER_RESTORE_ES
20799+ ".section .fixup,\"ax\"\n"
20800+ "101: lea 0(%%eax,%0,4),%0\n"
20801+ " jmp 100b\n"
20802+ ".previous\n"
20803+ ".section __ex_table,\"a\"\n"
20804+ " .align 4\n"
20805+ " .long 1b,100b\n"
20806+ " .long 2b,100b\n"
20807+ " .long 3b,100b\n"
20808+ " .long 4b,100b\n"
20809+ " .long 5b,100b\n"
20810+ " .long 6b,100b\n"
20811+ " .long 7b,100b\n"
20812+ " .long 8b,100b\n"
20813+ " .long 9b,100b\n"
20814+ " .long 10b,100b\n"
20815+ " .long 11b,100b\n"
20816+ " .long 12b,100b\n"
20817+ " .long 13b,100b\n"
20818+ " .long 14b,100b\n"
20819+ " .long 15b,100b\n"
20820+ " .long 16b,100b\n"
20821+ " .long 17b,100b\n"
20822+ " .long 18b,100b\n"
20823+ " .long 19b,100b\n"
20824+ " .long 20b,100b\n"
20825+ " .long 21b,100b\n"
20826+ " .long 22b,100b\n"
20827+ " .long 23b,100b\n"
20828+ " .long 24b,100b\n"
20829+ " .long 25b,100b\n"
20830+ " .long 26b,100b\n"
20831+ " .long 27b,100b\n"
20832+ " .long 28b,100b\n"
20833+ " .long 29b,100b\n"
20834+ " .long 30b,100b\n"
20835+ " .long 31b,100b\n"
20836+ " .long 32b,100b\n"
20837+ " .long 33b,100b\n"
20838+ " .long 34b,100b\n"
20839+ " .long 35b,100b\n"
20840+ " .long 36b,100b\n"
20841+ " .long 37b,100b\n"
20842+ " .long 99b,101b\n"
20843+ ".previous"
20844+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20845+ : "1"(to), "2"(from), "0"(size)
20846+ : "eax", "edx", "memory");
20847+ return size;
20848+}
20849+
20850+static unsigned long
20851+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20852+{
20853+ int d0, d1;
20854+ __asm__ __volatile__(
20855+ " .align 2,0x90\n"
20856+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20857+ " cmpl $67, %0\n"
20858+ " jbe 3f\n"
20859+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20860+ " .align 2,0x90\n"
20861+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20862+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20863+ "5: movl %%eax, 0(%3)\n"
20864+ "6: movl %%edx, 4(%3)\n"
20865+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20866+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20867+ "9: movl %%eax, 8(%3)\n"
20868+ "10: movl %%edx, 12(%3)\n"
20869+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20870+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20871+ "13: movl %%eax, 16(%3)\n"
20872+ "14: movl %%edx, 20(%3)\n"
20873+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20874+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20875+ "17: movl %%eax, 24(%3)\n"
20876+ "18: movl %%edx, 28(%3)\n"
20877+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20878+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20879+ "21: movl %%eax, 32(%3)\n"
20880+ "22: movl %%edx, 36(%3)\n"
20881+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20882+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20883+ "25: movl %%eax, 40(%3)\n"
20884+ "26: movl %%edx, 44(%3)\n"
20885+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20886+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20887+ "29: movl %%eax, 48(%3)\n"
20888+ "30: movl %%edx, 52(%3)\n"
20889+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20890+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20891+ "33: movl %%eax, 56(%3)\n"
20892+ "34: movl %%edx, 60(%3)\n"
20893+ " addl $-64, %0\n"
20894+ " addl $64, %4\n"
20895+ " addl $64, %3\n"
20896+ " cmpl $63, %0\n"
20897+ " ja 1b\n"
20898+ "35: movl %0, %%eax\n"
20899+ " shrl $2, %0\n"
20900+ " andl $3, %%eax\n"
20901+ " cld\n"
20902+ "99: rep; "__copyuser_seg" movsl\n"
20903+ "36: movl %%eax, %0\n"
20904+ "37: rep; "__copyuser_seg" movsb\n"
20905+ "100:\n"
20906 ".section .fixup,\"ax\"\n"
20907 "101: lea 0(%%eax,%0,4),%0\n"
20908 " jmp 100b\n"
20909@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20910 int d0, d1;
20911 __asm__ __volatile__(
20912 " .align 2,0x90\n"
20913- "0: movl 32(%4), %%eax\n"
20914+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20915 " cmpl $67, %0\n"
20916 " jbe 2f\n"
20917- "1: movl 64(%4), %%eax\n"
20918+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20919 " .align 2,0x90\n"
20920- "2: movl 0(%4), %%eax\n"
20921- "21: movl 4(%4), %%edx\n"
20922+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20923+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20924 " movl %%eax, 0(%3)\n"
20925 " movl %%edx, 4(%3)\n"
20926- "3: movl 8(%4), %%eax\n"
20927- "31: movl 12(%4),%%edx\n"
20928+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20929+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20930 " movl %%eax, 8(%3)\n"
20931 " movl %%edx, 12(%3)\n"
20932- "4: movl 16(%4), %%eax\n"
20933- "41: movl 20(%4), %%edx\n"
20934+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20935+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20936 " movl %%eax, 16(%3)\n"
20937 " movl %%edx, 20(%3)\n"
20938- "10: movl 24(%4), %%eax\n"
20939- "51: movl 28(%4), %%edx\n"
20940+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20941+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20942 " movl %%eax, 24(%3)\n"
20943 " movl %%edx, 28(%3)\n"
20944- "11: movl 32(%4), %%eax\n"
20945- "61: movl 36(%4), %%edx\n"
20946+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20947+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20948 " movl %%eax, 32(%3)\n"
20949 " movl %%edx, 36(%3)\n"
20950- "12: movl 40(%4), %%eax\n"
20951- "71: movl 44(%4), %%edx\n"
20952+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20953+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20954 " movl %%eax, 40(%3)\n"
20955 " movl %%edx, 44(%3)\n"
20956- "13: movl 48(%4), %%eax\n"
20957- "81: movl 52(%4), %%edx\n"
20958+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20959+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20960 " movl %%eax, 48(%3)\n"
20961 " movl %%edx, 52(%3)\n"
20962- "14: movl 56(%4), %%eax\n"
20963- "91: movl 60(%4), %%edx\n"
20964+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20965+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20966 " movl %%eax, 56(%3)\n"
20967 " movl %%edx, 60(%3)\n"
20968 " addl $-64, %0\n"
20969@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20970 " shrl $2, %0\n"
20971 " andl $3, %%eax\n"
20972 " cld\n"
20973- "6: rep; movsl\n"
20974+ "6: rep; "__copyuser_seg" movsl\n"
20975 " movl %%eax,%0\n"
20976- "7: rep; movsb\n"
20977+ "7: rep; "__copyuser_seg" movsb\n"
20978 "8:\n"
20979 ".section .fixup,\"ax\"\n"
20980 "9: lea 0(%%eax,%0,4),%0\n"
20981@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
20982
20983 __asm__ __volatile__(
20984 " .align 2,0x90\n"
20985- "0: movl 32(%4), %%eax\n"
20986+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20987 " cmpl $67, %0\n"
20988 " jbe 2f\n"
20989- "1: movl 64(%4), %%eax\n"
20990+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20991 " .align 2,0x90\n"
20992- "2: movl 0(%4), %%eax\n"
20993- "21: movl 4(%4), %%edx\n"
20994+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20995+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20996 " movnti %%eax, 0(%3)\n"
20997 " movnti %%edx, 4(%3)\n"
20998- "3: movl 8(%4), %%eax\n"
20999- "31: movl 12(%4),%%edx\n"
21000+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21001+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21002 " movnti %%eax, 8(%3)\n"
21003 " movnti %%edx, 12(%3)\n"
21004- "4: movl 16(%4), %%eax\n"
21005- "41: movl 20(%4), %%edx\n"
21006+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21007+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21008 " movnti %%eax, 16(%3)\n"
21009 " movnti %%edx, 20(%3)\n"
21010- "10: movl 24(%4), %%eax\n"
21011- "51: movl 28(%4), %%edx\n"
21012+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21013+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21014 " movnti %%eax, 24(%3)\n"
21015 " movnti %%edx, 28(%3)\n"
21016- "11: movl 32(%4), %%eax\n"
21017- "61: movl 36(%4), %%edx\n"
21018+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21019+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21020 " movnti %%eax, 32(%3)\n"
21021 " movnti %%edx, 36(%3)\n"
21022- "12: movl 40(%4), %%eax\n"
21023- "71: movl 44(%4), %%edx\n"
21024+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21025+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21026 " movnti %%eax, 40(%3)\n"
21027 " movnti %%edx, 44(%3)\n"
21028- "13: movl 48(%4), %%eax\n"
21029- "81: movl 52(%4), %%edx\n"
21030+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21031+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21032 " movnti %%eax, 48(%3)\n"
21033 " movnti %%edx, 52(%3)\n"
21034- "14: movl 56(%4), %%eax\n"
21035- "91: movl 60(%4), %%edx\n"
21036+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21037+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21038 " movnti %%eax, 56(%3)\n"
21039 " movnti %%edx, 60(%3)\n"
21040 " addl $-64, %0\n"
21041@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
21042 " shrl $2, %0\n"
21043 " andl $3, %%eax\n"
21044 " cld\n"
21045- "6: rep; movsl\n"
21046+ "6: rep; "__copyuser_seg" movsl\n"
21047 " movl %%eax,%0\n"
21048- "7: rep; movsb\n"
21049+ "7: rep; "__copyuser_seg" movsb\n"
21050 "8:\n"
21051 ".section .fixup,\"ax\"\n"
21052 "9: lea 0(%%eax,%0,4),%0\n"
21053@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_nocache(void *to,
21054
21055 __asm__ __volatile__(
21056 " .align 2,0x90\n"
21057- "0: movl 32(%4), %%eax\n"
21058+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21059 " cmpl $67, %0\n"
21060 " jbe 2f\n"
21061- "1: movl 64(%4), %%eax\n"
21062+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21063 " .align 2,0x90\n"
21064- "2: movl 0(%4), %%eax\n"
21065- "21: movl 4(%4), %%edx\n"
21066+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21067+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21068 " movnti %%eax, 0(%3)\n"
21069 " movnti %%edx, 4(%3)\n"
21070- "3: movl 8(%4), %%eax\n"
21071- "31: movl 12(%4),%%edx\n"
21072+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21073+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21074 " movnti %%eax, 8(%3)\n"
21075 " movnti %%edx, 12(%3)\n"
21076- "4: movl 16(%4), %%eax\n"
21077- "41: movl 20(%4), %%edx\n"
21078+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21079+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21080 " movnti %%eax, 16(%3)\n"
21081 " movnti %%edx, 20(%3)\n"
21082- "10: movl 24(%4), %%eax\n"
21083- "51: movl 28(%4), %%edx\n"
21084+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21085+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21086 " movnti %%eax, 24(%3)\n"
21087 " movnti %%edx, 28(%3)\n"
21088- "11: movl 32(%4), %%eax\n"
21089- "61: movl 36(%4), %%edx\n"
21090+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21091+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21092 " movnti %%eax, 32(%3)\n"
21093 " movnti %%edx, 36(%3)\n"
21094- "12: movl 40(%4), %%eax\n"
21095- "71: movl 44(%4), %%edx\n"
21096+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21097+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21098 " movnti %%eax, 40(%3)\n"
21099 " movnti %%edx, 44(%3)\n"
21100- "13: movl 48(%4), %%eax\n"
21101- "81: movl 52(%4), %%edx\n"
21102+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21103+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21104 " movnti %%eax, 48(%3)\n"
21105 " movnti %%edx, 52(%3)\n"
21106- "14: movl 56(%4), %%eax\n"
21107- "91: movl 60(%4), %%edx\n"
21108+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21109+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21110 " movnti %%eax, 56(%3)\n"
21111 " movnti %%edx, 60(%3)\n"
21112 " addl $-64, %0\n"
21113@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
21114 " shrl $2, %0\n"
21115 " andl $3, %%eax\n"
21116 " cld\n"
21117- "6: rep; movsl\n"
21118+ "6: rep; "__copyuser_seg" movsl\n"
21119 " movl %%eax,%0\n"
21120- "7: rep; movsb\n"
21121+ "7: rep; "__copyuser_seg" movsb\n"
21122 "8:\n"
21123 ".section .fixup,\"ax\"\n"
21124 "9: lea 0(%%eax,%0,4),%0\n"
21125@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
21126 */
21127 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
21128 unsigned long size);
21129-unsigned long __copy_user_intel(void __user *to, const void *from,
21130+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
21131+ unsigned long size);
21132+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
21133 unsigned long size);
21134 unsigned long __copy_user_zeroing_intel_nocache(void *to,
21135 const void __user *from, unsigned long size);
21136 #endif /* CONFIG_X86_INTEL_USERCOPY */
21137
21138 /* Generic arbitrary sized copy. */
21139-#define __copy_user(to, from, size) \
21140+#define __copy_user(to, from, size, prefix, set, restore) \
21141 do { \
21142 int __d0, __d1, __d2; \
21143 __asm__ __volatile__( \
21144+ set \
21145 " cmp $7,%0\n" \
21146 " jbe 1f\n" \
21147 " movl %1,%0\n" \
21148 " negl %0\n" \
21149 " andl $7,%0\n" \
21150 " subl %0,%3\n" \
21151- "4: rep; movsb\n" \
21152+ "4: rep; "prefix"movsb\n" \
21153 " movl %3,%0\n" \
21154 " shrl $2,%0\n" \
21155 " andl $3,%3\n" \
21156 " .align 2,0x90\n" \
21157- "0: rep; movsl\n" \
21158+ "0: rep; "prefix"movsl\n" \
21159 " movl %3,%0\n" \
21160- "1: rep; movsb\n" \
21161+ "1: rep; "prefix"movsb\n" \
21162 "2:\n" \
21163+ restore \
21164 ".section .fixup,\"ax\"\n" \
21165 "5: addl %3,%0\n" \
21166 " jmp 2b\n" \
21167@@ -682,14 +799,14 @@ do { \
21168 " negl %0\n" \
21169 " andl $7,%0\n" \
21170 " subl %0,%3\n" \
21171- "4: rep; movsb\n" \
21172+ "4: rep; "__copyuser_seg"movsb\n" \
21173 " movl %3,%0\n" \
21174 " shrl $2,%0\n" \
21175 " andl $3,%3\n" \
21176 " .align 2,0x90\n" \
21177- "0: rep; movsl\n" \
21178+ "0: rep; "__copyuser_seg"movsl\n" \
21179 " movl %3,%0\n" \
21180- "1: rep; movsb\n" \
21181+ "1: rep; "__copyuser_seg"movsb\n" \
21182 "2:\n" \
21183 ".section .fixup,\"ax\"\n" \
21184 "5: addl %3,%0\n" \
21185@@ -775,9 +892,9 @@ survive:
21186 }
21187 #endif
21188 if (movsl_is_ok(to, from, n))
21189- __copy_user(to, from, n);
21190+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
21191 else
21192- n = __copy_user_intel(to, from, n);
21193+ n = __generic_copy_to_user_intel(to, from, n);
21194 return n;
21195 }
21196 EXPORT_SYMBOL(__copy_to_user_ll);
21197@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
21198 unsigned long n)
21199 {
21200 if (movsl_is_ok(to, from, n))
21201- __copy_user(to, from, n);
21202+ __copy_user(to, from, n, __copyuser_seg, "", "");
21203 else
21204- n = __copy_user_intel((void __user *)to,
21205- (const void *)from, n);
21206+ n = __generic_copy_from_user_intel(to, from, n);
21207 return n;
21208 }
21209 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
21210@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
21211 if (n > 64 && cpu_has_xmm2)
21212 n = __copy_user_intel_nocache(to, from, n);
21213 else
21214- __copy_user(to, from, n);
21215+ __copy_user(to, from, n, __copyuser_seg, "", "");
21216 #else
21217- __copy_user(to, from, n);
21218+ __copy_user(to, from, n, __copyuser_seg, "", "");
21219 #endif
21220 return n;
21221 }
21222 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
21223
21224-/**
21225- * copy_to_user: - Copy a block of data into user space.
21226- * @to: Destination address, in user space.
21227- * @from: Source address, in kernel space.
21228- * @n: Number of bytes to copy.
21229- *
21230- * Context: User context only. This function may sleep.
21231- *
21232- * Copy data from kernel space to user space.
21233- *
21234- * Returns number of bytes that could not be copied.
21235- * On success, this will be zero.
21236- */
21237-unsigned long
21238-copy_to_user(void __user *to, const void *from, unsigned long n)
21239-{
21240- if (access_ok(VERIFY_WRITE, to, n))
21241- n = __copy_to_user(to, from, n);
21242- return n;
21243-}
21244-EXPORT_SYMBOL(copy_to_user);
21245-
21246-/**
21247- * copy_from_user: - Copy a block of data from user space.
21248- * @to: Destination address, in kernel space.
21249- * @from: Source address, in user space.
21250- * @n: Number of bytes to copy.
21251- *
21252- * Context: User context only. This function may sleep.
21253- *
21254- * Copy data from user space to kernel space.
21255- *
21256- * Returns number of bytes that could not be copied.
21257- * On success, this will be zero.
21258- *
21259- * If some data could not be copied, this function will pad the copied
21260- * data to the requested size using zero bytes.
21261- */
21262-unsigned long
21263-_copy_from_user(void *to, const void __user *from, unsigned long n)
21264-{
21265- if (access_ok(VERIFY_READ, from, n))
21266- n = __copy_from_user(to, from, n);
21267- else
21268- memset(to, 0, n);
21269- return n;
21270-}
21271-EXPORT_SYMBOL(_copy_from_user);
21272-
21273 void copy_from_user_overflow(void)
21274 {
21275 WARN(1, "Buffer overflow detected!\n");
21276 }
21277 EXPORT_SYMBOL(copy_from_user_overflow);
21278+
21279+void copy_to_user_overflow(void)
21280+{
21281+ WARN(1, "Buffer overflow detected!\n");
21282+}
21283+EXPORT_SYMBOL(copy_to_user_overflow);
21284+
21285+#ifdef CONFIG_PAX_MEMORY_UDEREF
21286+void __set_fs(mm_segment_t x)
21287+{
21288+ switch (x.seg) {
21289+ case 0:
21290+ loadsegment(gs, 0);
21291+ break;
21292+ case TASK_SIZE_MAX:
21293+ loadsegment(gs, __USER_DS);
21294+ break;
21295+ case -1UL:
21296+ loadsegment(gs, __KERNEL_DS);
21297+ break;
21298+ default:
21299+ BUG();
21300+ }
21301+ return;
21302+}
21303+EXPORT_SYMBOL(__set_fs);
21304+
21305+void set_fs(mm_segment_t x)
21306+{
21307+ current_thread_info()->addr_limit = x;
21308+ __set_fs(x);
21309+}
21310+EXPORT_SYMBOL(set_fs);
21311+#endif
21312diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
21313index b7c2849..8633ad8 100644
21314--- a/arch/x86/lib/usercopy_64.c
21315+++ b/arch/x86/lib/usercopy_64.c
21316@@ -42,6 +42,12 @@ long
21317 __strncpy_from_user(char *dst, const char __user *src, long count)
21318 {
21319 long res;
21320+
21321+#ifdef CONFIG_PAX_MEMORY_UDEREF
21322+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21323+ src += PAX_USER_SHADOW_BASE;
21324+#endif
21325+
21326 __do_strncpy_from_user(dst, src, count, res);
21327 return res;
21328 }
21329@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
21330 {
21331 long __d0;
21332 might_fault();
21333+
21334+#ifdef CONFIG_PAX_MEMORY_UDEREF
21335+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
21336+ addr += PAX_USER_SHADOW_BASE;
21337+#endif
21338+
21339 /* no memory constraint because it doesn't change any memory gcc knows
21340 about */
21341 asm volatile(
21342@@ -149,12 +161,20 @@ long strlen_user(const char __user *s)
21343 }
21344 EXPORT_SYMBOL(strlen_user);
21345
21346-unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
21347+unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
21348 {
21349- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21350- return copy_user_generic((__force void *)to, (__force void *)from, len);
21351- }
21352- return len;
21353+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21354+
21355+#ifdef CONFIG_PAX_MEMORY_UDEREF
21356+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
21357+ to += PAX_USER_SHADOW_BASE;
21358+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
21359+ from += PAX_USER_SHADOW_BASE;
21360+#endif
21361+
21362+ return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
21363+ }
21364+ return len;
21365 }
21366 EXPORT_SYMBOL(copy_in_user);
21367
21368@@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
21369 * it is not necessary to optimize tail handling.
21370 */
21371 unsigned long
21372-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
21373+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
21374 {
21375 char c;
21376 unsigned zero_len;
21377diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
21378index d0474ad..36e9257 100644
21379--- a/arch/x86/mm/extable.c
21380+++ b/arch/x86/mm/extable.c
21381@@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs)
21382 const struct exception_table_entry *fixup;
21383
21384 #ifdef CONFIG_PNPBIOS
21385- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21386+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21387 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21388 extern u32 pnp_bios_is_utter_crap;
21389 pnp_bios_is_utter_crap = 1;
21390diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
21391index 0d17c8c..4f4764f 100644
21392--- a/arch/x86/mm/fault.c
21393+++ b/arch/x86/mm/fault.c
21394@@ -13,11 +13,18 @@
21395 #include <linux/perf_event.h> /* perf_sw_event */
21396 #include <linux/hugetlb.h> /* hstate_index_to_shift */
21397 #include <linux/prefetch.h> /* prefetchw */
21398+#include <linux/unistd.h>
21399+#include <linux/compiler.h>
21400
21401 #include <asm/traps.h> /* dotraplinkage, ... */
21402 #include <asm/pgalloc.h> /* pgd_*(), ... */
21403 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21404 #include <asm/vsyscall.h>
21405+#include <asm/tlbflush.h>
21406+
21407+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21408+#include <asm/stacktrace.h>
21409+#endif
21410
21411 /*
21412 * Page fault error code bits:
21413@@ -55,7 +62,7 @@ static inline int __kprobes notify_page_fault(struct pt_regs *regs)
21414 int ret = 0;
21415
21416 /* kprobe_running() needs smp_processor_id() */
21417- if (kprobes_built_in() && !user_mode_vm(regs)) {
21418+ if (kprobes_built_in() && !user_mode(regs)) {
21419 preempt_disable();
21420 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21421 ret = 1;
21422@@ -116,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
21423 return !instr_lo || (instr_lo>>1) == 1;
21424 case 0x00:
21425 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21426- if (probe_kernel_address(instr, opcode))
21427+ if (user_mode(regs)) {
21428+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21429+ return 0;
21430+ } else if (probe_kernel_address(instr, opcode))
21431 return 0;
21432
21433 *prefetch = (instr_lo == 0xF) &&
21434@@ -150,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
21435 while (instr < max_instr) {
21436 unsigned char opcode;
21437
21438- if (probe_kernel_address(instr, opcode))
21439+ if (user_mode(regs)) {
21440+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21441+ break;
21442+ } else if (probe_kernel_address(instr, opcode))
21443 break;
21444
21445 instr++;
21446@@ -181,6 +194,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
21447 force_sig_info(si_signo, &info, tsk);
21448 }
21449
21450+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21451+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
21452+#endif
21453+
21454+#ifdef CONFIG_PAX_EMUTRAMP
21455+static int pax_handle_fetch_fault(struct pt_regs *regs);
21456+#endif
21457+
21458+#ifdef CONFIG_PAX_PAGEEXEC
21459+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21460+{
21461+ pgd_t *pgd;
21462+ pud_t *pud;
21463+ pmd_t *pmd;
21464+
21465+ pgd = pgd_offset(mm, address);
21466+ if (!pgd_present(*pgd))
21467+ return NULL;
21468+ pud = pud_offset(pgd, address);
21469+ if (!pud_present(*pud))
21470+ return NULL;
21471+ pmd = pmd_offset(pud, address);
21472+ if (!pmd_present(*pmd))
21473+ return NULL;
21474+ return pmd;
21475+}
21476+#endif
21477+
21478 DEFINE_SPINLOCK(pgd_lock);
21479 LIST_HEAD(pgd_list);
21480
21481@@ -231,10 +272,22 @@ void vmalloc_sync_all(void)
21482 for (address = VMALLOC_START & PMD_MASK;
21483 address >= TASK_SIZE && address < FIXADDR_TOP;
21484 address += PMD_SIZE) {
21485+
21486+#ifdef CONFIG_PAX_PER_CPU_PGD
21487+ unsigned long cpu;
21488+#else
21489 struct page *page;
21490+#endif
21491
21492 spin_lock(&pgd_lock);
21493+
21494+#ifdef CONFIG_PAX_PER_CPU_PGD
21495+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21496+ pgd_t *pgd = get_cpu_pgd(cpu);
21497+ pmd_t *ret;
21498+#else
21499 list_for_each_entry(page, &pgd_list, lru) {
21500+ pgd_t *pgd = page_address(page);
21501 spinlock_t *pgt_lock;
21502 pmd_t *ret;
21503
21504@@ -242,8 +295,13 @@ void vmalloc_sync_all(void)
21505 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21506
21507 spin_lock(pgt_lock);
21508- ret = vmalloc_sync_one(page_address(page), address);
21509+#endif
21510+
21511+ ret = vmalloc_sync_one(pgd, address);
21512+
21513+#ifndef CONFIG_PAX_PER_CPU_PGD
21514 spin_unlock(pgt_lock);
21515+#endif
21516
21517 if (!ret)
21518 break;
21519@@ -277,6 +335,11 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21520 * an interrupt in the middle of a task switch..
21521 */
21522 pgd_paddr = read_cr3();
21523+
21524+#ifdef CONFIG_PAX_PER_CPU_PGD
21525+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21526+#endif
21527+
21528 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21529 if (!pmd_k)
21530 return -1;
21531@@ -372,7 +435,14 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21532 * happen within a race in page table update. In the later
21533 * case just flush:
21534 */
21535+
21536+#ifdef CONFIG_PAX_PER_CPU_PGD
21537+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21538+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21539+#else
21540 pgd = pgd_offset(current->active_mm, address);
21541+#endif
21542+
21543 pgd_ref = pgd_offset_k(address);
21544 if (pgd_none(*pgd_ref))
21545 return -1;
21546@@ -534,7 +604,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
21547 static int is_errata100(struct pt_regs *regs, unsigned long address)
21548 {
21549 #ifdef CONFIG_X86_64
21550- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21551+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21552 return 1;
21553 #endif
21554 return 0;
21555@@ -561,7 +631,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
21556 }
21557
21558 static const char nx_warning[] = KERN_CRIT
21559-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21560+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21561
21562 static void
21563 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21564@@ -570,15 +640,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21565 if (!oops_may_print())
21566 return;
21567
21568- if (error_code & PF_INSTR) {
21569+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21570 unsigned int level;
21571
21572 pte_t *pte = lookup_address(address, &level);
21573
21574 if (pte && pte_present(*pte) && !pte_exec(*pte))
21575- printk(nx_warning, current_uid());
21576+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21577 }
21578
21579+#ifdef CONFIG_PAX_KERNEXEC
21580+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21581+ if (current->signal->curr_ip)
21582+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21583+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21584+ else
21585+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21586+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21587+ }
21588+#endif
21589+
21590 printk(KERN_ALERT "BUG: unable to handle kernel ");
21591 if (address < PAGE_SIZE)
21592 printk(KERN_CONT "NULL pointer dereference");
21593@@ -733,6 +814,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
21594 }
21595 #endif
21596
21597+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21598+ if (pax_is_fetch_fault(regs, error_code, address)) {
21599+
21600+#ifdef CONFIG_PAX_EMUTRAMP
21601+ switch (pax_handle_fetch_fault(regs)) {
21602+ case 2:
21603+ return;
21604+ }
21605+#endif
21606+
21607+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21608+ do_group_exit(SIGKILL);
21609+ }
21610+#endif
21611+
21612 if (unlikely(show_unhandled_signals))
21613 show_signal_msg(regs, error_code, address, tsk);
21614
21615@@ -829,7 +925,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
21616 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
21617 printk(KERN_ERR
21618 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
21619- tsk->comm, tsk->pid, address);
21620+ tsk->comm, task_pid_nr(tsk), address);
21621 code = BUS_MCEERR_AR;
21622 }
21623 #endif
21624@@ -884,6 +980,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
21625 return 1;
21626 }
21627
21628+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21629+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21630+{
21631+ pte_t *pte;
21632+ pmd_t *pmd;
21633+ spinlock_t *ptl;
21634+ unsigned char pte_mask;
21635+
21636+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21637+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21638+ return 0;
21639+
21640+ /* PaX: it's our fault, let's handle it if we can */
21641+
21642+ /* PaX: take a look at read faults before acquiring any locks */
21643+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21644+ /* instruction fetch attempt from a protected page in user mode */
21645+ up_read(&mm->mmap_sem);
21646+
21647+#ifdef CONFIG_PAX_EMUTRAMP
21648+ switch (pax_handle_fetch_fault(regs)) {
21649+ case 2:
21650+ return 1;
21651+ }
21652+#endif
21653+
21654+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21655+ do_group_exit(SIGKILL);
21656+ }
21657+
21658+ pmd = pax_get_pmd(mm, address);
21659+ if (unlikely(!pmd))
21660+ return 0;
21661+
21662+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21663+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21664+ pte_unmap_unlock(pte, ptl);
21665+ return 0;
21666+ }
21667+
21668+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21669+ /* write attempt to a protected page in user mode */
21670+ pte_unmap_unlock(pte, ptl);
21671+ return 0;
21672+ }
21673+
21674+#ifdef CONFIG_SMP
21675+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21676+#else
21677+ if (likely(address > get_limit(regs->cs)))
21678+#endif
21679+ {
21680+ set_pte(pte, pte_mkread(*pte));
21681+ __flush_tlb_one(address);
21682+ pte_unmap_unlock(pte, ptl);
21683+ up_read(&mm->mmap_sem);
21684+ return 1;
21685+ }
21686+
21687+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21688+
21689+ /*
21690+ * PaX: fill DTLB with user rights and retry
21691+ */
21692+ __asm__ __volatile__ (
21693+ "orb %2,(%1)\n"
21694+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21695+/*
21696+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21697+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21698+ * page fault when examined during a TLB load attempt. this is true not only
21699+ * for PTEs holding a non-present entry but also present entries that will
21700+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21701+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21702+ * for our target pages since their PTEs are simply not in the TLBs at all.
21703+
21704+ * the best thing in omitting it is that we gain around 15-20% speed in the
21705+ * fast path of the page fault handler and can get rid of tracing since we
21706+ * can no longer flush unintended entries.
21707+ */
21708+ "invlpg (%0)\n"
21709+#endif
21710+ __copyuser_seg"testb $0,(%0)\n"
21711+ "xorb %3,(%1)\n"
21712+ :
21713+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21714+ : "memory", "cc");
21715+ pte_unmap_unlock(pte, ptl);
21716+ up_read(&mm->mmap_sem);
21717+ return 1;
21718+}
21719+#endif
21720+
21721 /*
21722 * Handle a spurious fault caused by a stale TLB entry.
21723 *
21724@@ -956,6 +1145,9 @@ int show_unhandled_signals = 1;
21725 static inline int
21726 access_error(unsigned long error_code, struct vm_area_struct *vma)
21727 {
21728+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21729+ return 1;
21730+
21731 if (error_code & PF_WRITE) {
21732 /* write, present and write, not present: */
21733 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21734@@ -989,18 +1181,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21735 {
21736 struct vm_area_struct *vma;
21737 struct task_struct *tsk;
21738- unsigned long address;
21739 struct mm_struct *mm;
21740 int fault;
21741 int write = error_code & PF_WRITE;
21742 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
21743 (write ? FAULT_FLAG_WRITE : 0);
21744
21745- tsk = current;
21746- mm = tsk->mm;
21747-
21748 /* Get the faulting address: */
21749- address = read_cr2();
21750+ unsigned long address = read_cr2();
21751+
21752+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21753+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21754+ if (!search_exception_tables(regs->ip)) {
21755+ bad_area_nosemaphore(regs, error_code, address);
21756+ return;
21757+ }
21758+ if (address < PAX_USER_SHADOW_BASE) {
21759+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21760+ printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
21761+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21762+ } else
21763+ address -= PAX_USER_SHADOW_BASE;
21764+ }
21765+#endif
21766+
21767+ tsk = current;
21768+ mm = tsk->mm;
21769
21770 /*
21771 * Detect and handle instructions that would cause a page fault for
21772@@ -1061,7 +1267,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21773 * User-mode registers count as a user access even for any
21774 * potential system fault or CPU buglet:
21775 */
21776- if (user_mode_vm(regs)) {
21777+ if (user_mode(regs)) {
21778 local_irq_enable();
21779 error_code |= PF_USER;
21780 } else {
21781@@ -1116,6 +1322,11 @@ retry:
21782 might_sleep();
21783 }
21784
21785+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21786+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21787+ return;
21788+#endif
21789+
21790 vma = find_vma(mm, address);
21791 if (unlikely(!vma)) {
21792 bad_area(regs, error_code, address);
21793@@ -1127,18 +1338,24 @@ retry:
21794 bad_area(regs, error_code, address);
21795 return;
21796 }
21797- if (error_code & PF_USER) {
21798- /*
21799- * Accessing the stack below %sp is always a bug.
21800- * The large cushion allows instructions like enter
21801- * and pusha to work. ("enter $65535, $31" pushes
21802- * 32 pointers and then decrements %sp by 65535.)
21803- */
21804- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21805- bad_area(regs, error_code, address);
21806- return;
21807- }
21808+ /*
21809+ * Accessing the stack below %sp is always a bug.
21810+ * The large cushion allows instructions like enter
21811+ * and pusha to work. ("enter $65535, $31" pushes
21812+ * 32 pointers and then decrements %sp by 65535.)
21813+ */
21814+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21815+ bad_area(regs, error_code, address);
21816+ return;
21817 }
21818+
21819+#ifdef CONFIG_PAX_SEGMEXEC
21820+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21821+ bad_area(regs, error_code, address);
21822+ return;
21823+ }
21824+#endif
21825+
21826 if (unlikely(expand_stack(vma, address))) {
21827 bad_area(regs, error_code, address);
21828 return;
21829@@ -1193,3 +1410,240 @@ good_area:
21830
21831 up_read(&mm->mmap_sem);
21832 }
21833+
21834+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21835+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
21836+{
21837+ struct mm_struct *mm = current->mm;
21838+ unsigned long ip = regs->ip;
21839+
21840+ if (v8086_mode(regs))
21841+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21842+
21843+#ifdef CONFIG_PAX_PAGEEXEC
21844+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
21845+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
21846+ return true;
21847+ if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
21848+ return true;
21849+ return false;
21850+ }
21851+#endif
21852+
21853+#ifdef CONFIG_PAX_SEGMEXEC
21854+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
21855+ if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
21856+ return true;
21857+ return false;
21858+ }
21859+#endif
21860+
21861+ return false;
21862+}
21863+#endif
21864+
21865+#ifdef CONFIG_PAX_EMUTRAMP
21866+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21867+{
21868+ int err;
21869+
21870+ do { /* PaX: gcc trampoline emulation #1 */
21871+ unsigned char mov1, mov2;
21872+ unsigned short jmp;
21873+ unsigned int addr1, addr2;
21874+
21875+#ifdef CONFIG_X86_64
21876+ if ((regs->ip + 11) >> 32)
21877+ break;
21878+#endif
21879+
21880+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21881+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21882+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21883+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21884+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21885+
21886+ if (err)
21887+ break;
21888+
21889+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21890+ regs->cx = addr1;
21891+ regs->ax = addr2;
21892+ regs->ip = addr2;
21893+ return 2;
21894+ }
21895+ } while (0);
21896+
21897+ do { /* PaX: gcc trampoline emulation #2 */
21898+ unsigned char mov, jmp;
21899+ unsigned int addr1, addr2;
21900+
21901+#ifdef CONFIG_X86_64
21902+ if ((regs->ip + 9) >> 32)
21903+ break;
21904+#endif
21905+
21906+ err = get_user(mov, (unsigned char __user *)regs->ip);
21907+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21908+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21909+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21910+
21911+ if (err)
21912+ break;
21913+
21914+ if (mov == 0xB9 && jmp == 0xE9) {
21915+ regs->cx = addr1;
21916+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21917+ return 2;
21918+ }
21919+ } while (0);
21920+
21921+ return 1; /* PaX in action */
21922+}
21923+
21924+#ifdef CONFIG_X86_64
21925+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21926+{
21927+ int err;
21928+
21929+ do { /* PaX: gcc trampoline emulation #1 */
21930+ unsigned short mov1, mov2, jmp1;
21931+ unsigned char jmp2;
21932+ unsigned int addr1;
21933+ unsigned long addr2;
21934+
21935+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21936+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21937+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21938+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21939+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21940+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21941+
21942+ if (err)
21943+ break;
21944+
21945+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21946+ regs->r11 = addr1;
21947+ regs->r10 = addr2;
21948+ regs->ip = addr1;
21949+ return 2;
21950+ }
21951+ } while (0);
21952+
21953+ do { /* PaX: gcc trampoline emulation #2 */
21954+ unsigned short mov1, mov2, jmp1;
21955+ unsigned char jmp2;
21956+ unsigned long addr1, addr2;
21957+
21958+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21959+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21960+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21961+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21962+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21963+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21964+
21965+ if (err)
21966+ break;
21967+
21968+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21969+ regs->r11 = addr1;
21970+ regs->r10 = addr2;
21971+ regs->ip = addr1;
21972+ return 2;
21973+ }
21974+ } while (0);
21975+
21976+ return 1; /* PaX in action */
21977+}
21978+#endif
21979+
21980+/*
21981+ * PaX: decide what to do with offenders (regs->ip = fault address)
21982+ *
21983+ * returns 1 when task should be killed
21984+ * 2 when gcc trampoline was detected
21985+ */
21986+static int pax_handle_fetch_fault(struct pt_regs *regs)
21987+{
21988+ if (v8086_mode(regs))
21989+ return 1;
21990+
21991+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21992+ return 1;
21993+
21994+#ifdef CONFIG_X86_32
21995+ return pax_handle_fetch_fault_32(regs);
21996+#else
21997+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21998+ return pax_handle_fetch_fault_32(regs);
21999+ else
22000+ return pax_handle_fetch_fault_64(regs);
22001+#endif
22002+}
22003+#endif
22004+
22005+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22006+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
22007+{
22008+ long i;
22009+
22010+ printk(KERN_ERR "PAX: bytes at PC: ");
22011+ for (i = 0; i < 20; i++) {
22012+ unsigned char c;
22013+ if (get_user(c, (unsigned char __force_user *)pc+i))
22014+ printk(KERN_CONT "?? ");
22015+ else
22016+ printk(KERN_CONT "%02x ", c);
22017+ }
22018+ printk("\n");
22019+
22020+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
22021+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
22022+ unsigned long c;
22023+ if (get_user(c, (unsigned long __force_user *)sp+i)) {
22024+#ifdef CONFIG_X86_32
22025+ printk(KERN_CONT "???????? ");
22026+#else
22027+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
22028+ printk(KERN_CONT "???????? ???????? ");
22029+ else
22030+ printk(KERN_CONT "???????????????? ");
22031+#endif
22032+ } else {
22033+#ifdef CONFIG_X86_64
22034+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
22035+ printk(KERN_CONT "%08x ", (unsigned int)c);
22036+ printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
22037+ } else
22038+#endif
22039+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
22040+ }
22041+ }
22042+ printk("\n");
22043+}
22044+#endif
22045+
22046+/**
22047+ * probe_kernel_write(): safely attempt to write to a location
22048+ * @dst: address to write to
22049+ * @src: pointer to the data that shall be written
22050+ * @size: size of the data chunk
22051+ *
22052+ * Safely write to address @dst from the buffer at @src. If a kernel fault
22053+ * happens, handle that and return -EFAULT.
22054+ */
22055+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
22056+{
22057+ long ret;
22058+ mm_segment_t old_fs = get_fs();
22059+
22060+ set_fs(KERNEL_DS);
22061+ pagefault_disable();
22062+ pax_open_kernel();
22063+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
22064+ pax_close_kernel();
22065+ pagefault_enable();
22066+ set_fs(old_fs);
22067+
22068+ return ret ? -EFAULT : 0;
22069+}
22070diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
22071index dd74e46..7d26398 100644
22072--- a/arch/x86/mm/gup.c
22073+++ b/arch/x86/mm/gup.c
22074@@ -255,7 +255,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
22075 addr = start;
22076 len = (unsigned long) nr_pages << PAGE_SHIFT;
22077 end = start + len;
22078- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22079+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22080 (void __user *)start, len)))
22081 return 0;
22082
22083diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
22084index f4f29b1..5cac4fb 100644
22085--- a/arch/x86/mm/highmem_32.c
22086+++ b/arch/x86/mm/highmem_32.c
22087@@ -44,7 +44,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
22088 idx = type + KM_TYPE_NR*smp_processor_id();
22089 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22090 BUG_ON(!pte_none(*(kmap_pte-idx)));
22091+
22092+ pax_open_kernel();
22093 set_pte(kmap_pte-idx, mk_pte(page, prot));
22094+ pax_close_kernel();
22095+
22096 arch_flush_lazy_mmu_mode();
22097
22098 return (void *)vaddr;
22099diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
22100index f581a18..29efd37 100644
22101--- a/arch/x86/mm/hugetlbpage.c
22102+++ b/arch/x86/mm/hugetlbpage.c
22103@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
22104 struct hstate *h = hstate_file(file);
22105 struct mm_struct *mm = current->mm;
22106 struct vm_area_struct *vma;
22107- unsigned long start_addr;
22108+ unsigned long start_addr, pax_task_size = TASK_SIZE;
22109+
22110+#ifdef CONFIG_PAX_SEGMEXEC
22111+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22112+ pax_task_size = SEGMEXEC_TASK_SIZE;
22113+#endif
22114+
22115+ pax_task_size -= PAGE_SIZE;
22116
22117 if (len > mm->cached_hole_size) {
22118- start_addr = mm->free_area_cache;
22119+ start_addr = mm->free_area_cache;
22120 } else {
22121- start_addr = TASK_UNMAPPED_BASE;
22122- mm->cached_hole_size = 0;
22123+ start_addr = mm->mmap_base;
22124+ mm->cached_hole_size = 0;
22125 }
22126
22127 full_search:
22128@@ -280,26 +287,27 @@ full_search:
22129
22130 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
22131 /* At this point: (!vma || addr < vma->vm_end). */
22132- if (TASK_SIZE - len < addr) {
22133+ if (pax_task_size - len < addr) {
22134 /*
22135 * Start a new search - just in case we missed
22136 * some holes.
22137 */
22138- if (start_addr != TASK_UNMAPPED_BASE) {
22139- start_addr = TASK_UNMAPPED_BASE;
22140+ if (start_addr != mm->mmap_base) {
22141+ start_addr = mm->mmap_base;
22142 mm->cached_hole_size = 0;
22143 goto full_search;
22144 }
22145 return -ENOMEM;
22146 }
22147- if (!vma || addr + len <= vma->vm_start) {
22148- mm->free_area_cache = addr + len;
22149- return addr;
22150- }
22151+ if (check_heap_stack_gap(vma, addr, len))
22152+ break;
22153 if (addr + mm->cached_hole_size < vma->vm_start)
22154 mm->cached_hole_size = vma->vm_start - addr;
22155 addr = ALIGN(vma->vm_end, huge_page_size(h));
22156 }
22157+
22158+ mm->free_area_cache = addr + len;
22159+ return addr;
22160 }
22161
22162 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22163@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22164 {
22165 struct hstate *h = hstate_file(file);
22166 struct mm_struct *mm = current->mm;
22167- struct vm_area_struct *vma, *prev_vma;
22168- unsigned long base = mm->mmap_base, addr = addr0;
22169+ struct vm_area_struct *vma;
22170+ unsigned long base = mm->mmap_base, addr;
22171 unsigned long largest_hole = mm->cached_hole_size;
22172- int first_time = 1;
22173
22174 /* don't allow allocations above current base */
22175 if (mm->free_area_cache > base)
22176@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22177 largest_hole = 0;
22178 mm->free_area_cache = base;
22179 }
22180-try_again:
22181+
22182 /* make sure it can fit in the remaining address space */
22183 if (mm->free_area_cache < len)
22184 goto fail;
22185
22186 /* either no address requested or can't fit in requested address hole */
22187- addr = (mm->free_area_cache - len) & huge_page_mask(h);
22188+ addr = (mm->free_area_cache - len);
22189 do {
22190+ addr &= huge_page_mask(h);
22191+ vma = find_vma(mm, addr);
22192 /*
22193 * Lookup failure means no vma is above this address,
22194 * i.e. return with success:
22195- */
22196- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
22197- return addr;
22198-
22199- /*
22200 * new region fits between prev_vma->vm_end and
22201 * vma->vm_start, use it:
22202 */
22203- if (addr + len <= vma->vm_start &&
22204- (!prev_vma || (addr >= prev_vma->vm_end))) {
22205+ if (check_heap_stack_gap(vma, addr, len)) {
22206 /* remember the address as a hint for next time */
22207- mm->cached_hole_size = largest_hole;
22208- return (mm->free_area_cache = addr);
22209- } else {
22210- /* pull free_area_cache down to the first hole */
22211- if (mm->free_area_cache == vma->vm_end) {
22212- mm->free_area_cache = vma->vm_start;
22213- mm->cached_hole_size = largest_hole;
22214- }
22215+ mm->cached_hole_size = largest_hole;
22216+ return (mm->free_area_cache = addr);
22217+ }
22218+ /* pull free_area_cache down to the first hole */
22219+ if (mm->free_area_cache == vma->vm_end) {
22220+ mm->free_area_cache = vma->vm_start;
22221+ mm->cached_hole_size = largest_hole;
22222 }
22223
22224 /* remember the largest hole we saw so far */
22225 if (addr + largest_hole < vma->vm_start)
22226- largest_hole = vma->vm_start - addr;
22227+ largest_hole = vma->vm_start - addr;
22228
22229 /* try just below the current vma->vm_start */
22230- addr = (vma->vm_start - len) & huge_page_mask(h);
22231- } while (len <= vma->vm_start);
22232+ addr = skip_heap_stack_gap(vma, len);
22233+ } while (!IS_ERR_VALUE(addr));
22234
22235 fail:
22236 /*
22237- * if hint left us with no space for the requested
22238- * mapping then try again:
22239- */
22240- if (first_time) {
22241- mm->free_area_cache = base;
22242- largest_hole = 0;
22243- first_time = 0;
22244- goto try_again;
22245- }
22246- /*
22247 * A failed mmap() very likely causes application failure,
22248 * so fall back to the bottom-up function here. This scenario
22249 * can happen with large stack limits and large mmap()
22250 * allocations.
22251 */
22252- mm->free_area_cache = TASK_UNMAPPED_BASE;
22253+
22254+#ifdef CONFIG_PAX_SEGMEXEC
22255+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22256+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
22257+ else
22258+#endif
22259+
22260+ mm->mmap_base = TASK_UNMAPPED_BASE;
22261+
22262+#ifdef CONFIG_PAX_RANDMMAP
22263+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22264+ mm->mmap_base += mm->delta_mmap;
22265+#endif
22266+
22267+ mm->free_area_cache = mm->mmap_base;
22268 mm->cached_hole_size = ~0UL;
22269 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
22270 len, pgoff, flags);
22271@@ -386,6 +392,7 @@ fail:
22272 /*
22273 * Restore the topdown base:
22274 */
22275+ mm->mmap_base = base;
22276 mm->free_area_cache = base;
22277 mm->cached_hole_size = ~0UL;
22278
22279@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22280 struct hstate *h = hstate_file(file);
22281 struct mm_struct *mm = current->mm;
22282 struct vm_area_struct *vma;
22283+ unsigned long pax_task_size = TASK_SIZE;
22284
22285 if (len & ~huge_page_mask(h))
22286 return -EINVAL;
22287- if (len > TASK_SIZE)
22288+
22289+#ifdef CONFIG_PAX_SEGMEXEC
22290+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22291+ pax_task_size = SEGMEXEC_TASK_SIZE;
22292+#endif
22293+
22294+ pax_task_size -= PAGE_SIZE;
22295+
22296+ if (len > pax_task_size)
22297 return -ENOMEM;
22298
22299 if (flags & MAP_FIXED) {
22300@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22301 if (addr) {
22302 addr = ALIGN(addr, huge_page_size(h));
22303 vma = find_vma(mm, addr);
22304- if (TASK_SIZE - len >= addr &&
22305- (!vma || addr + len <= vma->vm_start))
22306+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
22307 return addr;
22308 }
22309 if (mm->get_unmapped_area == arch_get_unmapped_area)
22310diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
22311index 87488b9..7129f32 100644
22312--- a/arch/x86/mm/init.c
22313+++ b/arch/x86/mm/init.c
22314@@ -31,7 +31,7 @@ int direct_gbpages
22315 static void __init find_early_table_space(unsigned long end, int use_pse,
22316 int use_gbpages)
22317 {
22318- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22319+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22320 phys_addr_t base;
22321
22322 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22323@@ -312,8 +312,29 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
22324 */
22325 int devmem_is_allowed(unsigned long pagenr)
22326 {
22327+#ifdef CONFIG_GRKERNSEC_KMEM
22328+ /* allow BDA */
22329+ if (!pagenr)
22330+ return 1;
22331+ /* allow EBDA */
22332+ if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22333+ return 1;
22334+#else
22335+ if (!pagenr)
22336+ return 1;
22337+#ifdef CONFIG_VM86
22338+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22339+ return 1;
22340+#endif
22341+#endif
22342+
22343+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22344+ return 1;
22345+#ifdef CONFIG_GRKERNSEC_KMEM
22346+ /* throw out everything else below 1MB */
22347 if (pagenr <= 256)
22348- return 1;
22349+ return 0;
22350+#endif
22351 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22352 return 0;
22353 if (!page_is_ram(pagenr))
22354@@ -372,6 +393,86 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
22355
22356 void free_initmem(void)
22357 {
22358+
22359+#ifdef CONFIG_PAX_KERNEXEC
22360+#ifdef CONFIG_X86_32
22361+ /* PaX: limit KERNEL_CS to actual size */
22362+ unsigned long addr, limit;
22363+ struct desc_struct d;
22364+ int cpu;
22365+
22366+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22367+ limit = (limit - 1UL) >> PAGE_SHIFT;
22368+
22369+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22370+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22371+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22372+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22373+ }
22374+
22375+ /* PaX: make KERNEL_CS read-only */
22376+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22377+ if (!paravirt_enabled())
22378+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22379+/*
22380+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22381+ pgd = pgd_offset_k(addr);
22382+ pud = pud_offset(pgd, addr);
22383+ pmd = pmd_offset(pud, addr);
22384+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22385+ }
22386+*/
22387+#ifdef CONFIG_X86_PAE
22388+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22389+/*
22390+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22391+ pgd = pgd_offset_k(addr);
22392+ pud = pud_offset(pgd, addr);
22393+ pmd = pmd_offset(pud, addr);
22394+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22395+ }
22396+*/
22397+#endif
22398+
22399+#ifdef CONFIG_MODULES
22400+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22401+#endif
22402+
22403+#else
22404+ pgd_t *pgd;
22405+ pud_t *pud;
22406+ pmd_t *pmd;
22407+ unsigned long addr, end;
22408+
22409+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22410+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22411+ pgd = pgd_offset_k(addr);
22412+ pud = pud_offset(pgd, addr);
22413+ pmd = pmd_offset(pud, addr);
22414+ if (!pmd_present(*pmd))
22415+ continue;
22416+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22417+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22418+ else
22419+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22420+ }
22421+
22422+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22423+ end = addr + KERNEL_IMAGE_SIZE;
22424+ for (; addr < end; addr += PMD_SIZE) {
22425+ pgd = pgd_offset_k(addr);
22426+ pud = pud_offset(pgd, addr);
22427+ pmd = pmd_offset(pud, addr);
22428+ if (!pmd_present(*pmd))
22429+ continue;
22430+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22431+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22432+ }
22433+#endif
22434+
22435+ flush_tlb_all();
22436+#endif
22437+
22438 free_init_pages("unused kernel memory",
22439 (unsigned long)(&__init_begin),
22440 (unsigned long)(&__init_end));
22441diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
22442index 29f7c6d..b46b35b 100644
22443--- a/arch/x86/mm/init_32.c
22444+++ b/arch/x86/mm/init_32.c
22445@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
22446 }
22447
22448 /*
22449- * Creates a middle page table and puts a pointer to it in the
22450- * given global directory entry. This only returns the gd entry
22451- * in non-PAE compilation mode, since the middle layer is folded.
22452- */
22453-static pmd_t * __init one_md_table_init(pgd_t *pgd)
22454-{
22455- pud_t *pud;
22456- pmd_t *pmd_table;
22457-
22458-#ifdef CONFIG_X86_PAE
22459- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
22460- if (after_bootmem)
22461- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
22462- else
22463- pmd_table = (pmd_t *)alloc_low_page();
22464- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
22465- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
22466- pud = pud_offset(pgd, 0);
22467- BUG_ON(pmd_table != pmd_offset(pud, 0));
22468-
22469- return pmd_table;
22470- }
22471-#endif
22472- pud = pud_offset(pgd, 0);
22473- pmd_table = pmd_offset(pud, 0);
22474-
22475- return pmd_table;
22476-}
22477-
22478-/*
22479 * Create a page table and place a pointer to it in a middle page
22480 * directory entry:
22481 */
22482@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
22483 page_table = (pte_t *)alloc_low_page();
22484
22485 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22486+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22487+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22488+#else
22489 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22490+#endif
22491 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22492 }
22493
22494 return pte_offset_kernel(pmd, 0);
22495 }
22496
22497+static pmd_t * __init one_md_table_init(pgd_t *pgd)
22498+{
22499+ pud_t *pud;
22500+ pmd_t *pmd_table;
22501+
22502+ pud = pud_offset(pgd, 0);
22503+ pmd_table = pmd_offset(pud, 0);
22504+
22505+ return pmd_table;
22506+}
22507+
22508 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22509 {
22510 int pgd_idx = pgd_index(vaddr);
22511@@ -203,6 +188,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22512 int pgd_idx, pmd_idx;
22513 unsigned long vaddr;
22514 pgd_t *pgd;
22515+ pud_t *pud;
22516 pmd_t *pmd;
22517 pte_t *pte = NULL;
22518
22519@@ -212,8 +198,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22520 pgd = pgd_base + pgd_idx;
22521
22522 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22523- pmd = one_md_table_init(pgd);
22524- pmd = pmd + pmd_index(vaddr);
22525+ pud = pud_offset(pgd, vaddr);
22526+ pmd = pmd_offset(pud, vaddr);
22527+
22528+#ifdef CONFIG_X86_PAE
22529+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22530+#endif
22531+
22532 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22533 pmd++, pmd_idx++) {
22534 pte = page_table_kmap_check(one_page_table_init(pmd),
22535@@ -225,11 +216,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22536 }
22537 }
22538
22539-static inline int is_kernel_text(unsigned long addr)
22540+static inline int is_kernel_text(unsigned long start, unsigned long end)
22541 {
22542- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
22543- return 1;
22544- return 0;
22545+ if ((start > ktla_ktva((unsigned long)_etext) ||
22546+ end <= ktla_ktva((unsigned long)_stext)) &&
22547+ (start > ktla_ktva((unsigned long)_einittext) ||
22548+ end <= ktla_ktva((unsigned long)_sinittext)) &&
22549+
22550+#ifdef CONFIG_ACPI_SLEEP
22551+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22552+#endif
22553+
22554+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22555+ return 0;
22556+ return 1;
22557 }
22558
22559 /*
22560@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned long start,
22561 unsigned long last_map_addr = end;
22562 unsigned long start_pfn, end_pfn;
22563 pgd_t *pgd_base = swapper_pg_dir;
22564- int pgd_idx, pmd_idx, pte_ofs;
22565+ unsigned int pgd_idx, pmd_idx, pte_ofs;
22566 unsigned long pfn;
22567 pgd_t *pgd;
22568+ pud_t *pud;
22569 pmd_t *pmd;
22570 pte_t *pte;
22571 unsigned pages_2m, pages_4k;
22572@@ -281,8 +282,13 @@ repeat:
22573 pfn = start_pfn;
22574 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22575 pgd = pgd_base + pgd_idx;
22576- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22577- pmd = one_md_table_init(pgd);
22578+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22579+ pud = pud_offset(pgd, 0);
22580+ pmd = pmd_offset(pud, 0);
22581+
22582+#ifdef CONFIG_X86_PAE
22583+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22584+#endif
22585
22586 if (pfn >= end_pfn)
22587 continue;
22588@@ -294,14 +300,13 @@ repeat:
22589 #endif
22590 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22591 pmd++, pmd_idx++) {
22592- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22593+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22594
22595 /*
22596 * Map with big pages if possible, otherwise
22597 * create normal page tables:
22598 */
22599 if (use_pse) {
22600- unsigned int addr2;
22601 pgprot_t prot = PAGE_KERNEL_LARGE;
22602 /*
22603 * first pass will use the same initial
22604@@ -311,11 +316,7 @@ repeat:
22605 __pgprot(PTE_IDENT_ATTR |
22606 _PAGE_PSE);
22607
22608- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22609- PAGE_OFFSET + PAGE_SIZE-1;
22610-
22611- if (is_kernel_text(addr) ||
22612- is_kernel_text(addr2))
22613+ if (is_kernel_text(address, address + PMD_SIZE))
22614 prot = PAGE_KERNEL_LARGE_EXEC;
22615
22616 pages_2m++;
22617@@ -332,7 +333,7 @@ repeat:
22618 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22619 pte += pte_ofs;
22620 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22621- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22622+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22623 pgprot_t prot = PAGE_KERNEL;
22624 /*
22625 * first pass will use the same initial
22626@@ -340,7 +341,7 @@ repeat:
22627 */
22628 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22629
22630- if (is_kernel_text(addr))
22631+ if (is_kernel_text(address, address + PAGE_SIZE))
22632 prot = PAGE_KERNEL_EXEC;
22633
22634 pages_4k++;
22635@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
22636
22637 pud = pud_offset(pgd, va);
22638 pmd = pmd_offset(pud, va);
22639- if (!pmd_present(*pmd))
22640+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22641 break;
22642
22643 pte = pte_offset_kernel(pmd, va);
22644@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_range_init(void)
22645
22646 static void __init pagetable_init(void)
22647 {
22648- pgd_t *pgd_base = swapper_pg_dir;
22649-
22650- permanent_kmaps_init(pgd_base);
22651+ permanent_kmaps_init(swapper_pg_dir);
22652 }
22653
22654-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22655+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22656 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22657
22658 /* user-defined highmem size */
22659@@ -757,6 +756,12 @@ void __init mem_init(void)
22660
22661 pci_iommu_alloc();
22662
22663+#ifdef CONFIG_PAX_PER_CPU_PGD
22664+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22665+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22666+ KERNEL_PGD_PTRS);
22667+#endif
22668+
22669 #ifdef CONFIG_FLATMEM
22670 BUG_ON(!mem_map);
22671 #endif
22672@@ -774,7 +779,7 @@ void __init mem_init(void)
22673 set_highmem_pages_init();
22674
22675 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22676- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22677+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22678 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22679
22680 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22681@@ -815,10 +820,10 @@ void __init mem_init(void)
22682 ((unsigned long)&__init_end -
22683 (unsigned long)&__init_begin) >> 10,
22684
22685- (unsigned long)&_etext, (unsigned long)&_edata,
22686- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22687+ (unsigned long)&_sdata, (unsigned long)&_edata,
22688+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22689
22690- (unsigned long)&_text, (unsigned long)&_etext,
22691+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22692 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22693
22694 /*
22695@@ -896,6 +901,7 @@ void set_kernel_text_rw(void)
22696 if (!kernel_set_to_readonly)
22697 return;
22698
22699+ start = ktla_ktva(start);
22700 pr_debug("Set kernel text: %lx - %lx for read write\n",
22701 start, start+size);
22702
22703@@ -910,6 +916,7 @@ void set_kernel_text_ro(void)
22704 if (!kernel_set_to_readonly)
22705 return;
22706
22707+ start = ktla_ktva(start);
22708 pr_debug("Set kernel text: %lx - %lx for read only\n",
22709 start, start+size);
22710
22711@@ -938,6 +945,7 @@ void mark_rodata_ro(void)
22712 unsigned long start = PFN_ALIGN(_text);
22713 unsigned long size = PFN_ALIGN(_etext) - start;
22714
22715+ start = ktla_ktva(start);
22716 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22717 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22718 size >> 10);
22719diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
22720index bbaaa00..16dffad 100644
22721--- a/arch/x86/mm/init_64.c
22722+++ b/arch/x86/mm/init_64.c
22723@@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpages_on);
22724 * around without checking the pgd every time.
22725 */
22726
22727-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22728+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22729 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22730
22731 int force_personality32;
22732@@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22733
22734 for (address = start; address <= end; address += PGDIR_SIZE) {
22735 const pgd_t *pgd_ref = pgd_offset_k(address);
22736+
22737+#ifdef CONFIG_PAX_PER_CPU_PGD
22738+ unsigned long cpu;
22739+#else
22740 struct page *page;
22741+#endif
22742
22743 if (pgd_none(*pgd_ref))
22744 continue;
22745
22746 spin_lock(&pgd_lock);
22747+
22748+#ifdef CONFIG_PAX_PER_CPU_PGD
22749+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22750+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22751+#else
22752 list_for_each_entry(page, &pgd_list, lru) {
22753 pgd_t *pgd;
22754 spinlock_t *pgt_lock;
22755@@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22756 /* the pgt_lock only for Xen */
22757 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22758 spin_lock(pgt_lock);
22759+#endif
22760
22761 if (pgd_none(*pgd))
22762 set_pgd(pgd, *pgd_ref);
22763@@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22764 BUG_ON(pgd_page_vaddr(*pgd)
22765 != pgd_page_vaddr(*pgd_ref));
22766
22767+#ifndef CONFIG_PAX_PER_CPU_PGD
22768 spin_unlock(pgt_lock);
22769+#endif
22770+
22771 }
22772 spin_unlock(&pgd_lock);
22773 }
22774@@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
22775 pmd = fill_pmd(pud, vaddr);
22776 pte = fill_pte(pmd, vaddr);
22777
22778+ pax_open_kernel();
22779 set_pte(pte, new_pte);
22780+ pax_close_kernel();
22781
22782 /*
22783 * It's enough to flush this one mapping.
22784@@ -262,14 +278,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
22785 pgd = pgd_offset_k((unsigned long)__va(phys));
22786 if (pgd_none(*pgd)) {
22787 pud = (pud_t *) spp_getpage();
22788- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22789- _PAGE_USER));
22790+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22791 }
22792 pud = pud_offset(pgd, (unsigned long)__va(phys));
22793 if (pud_none(*pud)) {
22794 pmd = (pmd_t *) spp_getpage();
22795- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22796- _PAGE_USER));
22797+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22798 }
22799 pmd = pmd_offset(pud, phys);
22800 BUG_ON(!pmd_none(*pmd));
22801@@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsigned long *phys)
22802 if (pfn >= pgt_buf_top)
22803 panic("alloc_low_page: ran out of memory");
22804
22805- adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22806+ adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22807 clear_page(adr);
22808 *phys = pfn * PAGE_SIZE;
22809 return adr;
22810@@ -346,7 +360,7 @@ static __ref void *map_low_page(void *virt)
22811
22812 phys = __pa(virt);
22813 left = phys & (PAGE_SIZE - 1);
22814- adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22815+ adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22816 adr = (void *)(((unsigned long)adr) | left);
22817
22818 return adr;
22819@@ -693,6 +707,12 @@ void __init mem_init(void)
22820
22821 pci_iommu_alloc();
22822
22823+#ifdef CONFIG_PAX_PER_CPU_PGD
22824+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22825+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22826+ KERNEL_PGD_PTRS);
22827+#endif
22828+
22829 /* clear_bss() already clear the empty_zero_page */
22830
22831 reservedpages = 0;
22832@@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr)
22833 static struct vm_area_struct gate_vma = {
22834 .vm_start = VSYSCALL_START,
22835 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22836- .vm_page_prot = PAGE_READONLY_EXEC,
22837- .vm_flags = VM_READ | VM_EXEC
22838+ .vm_page_prot = PAGE_READONLY,
22839+ .vm_flags = VM_READ
22840 };
22841
22842 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22843@@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long addr)
22844
22845 const char *arch_vma_name(struct vm_area_struct *vma)
22846 {
22847- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22848+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22849 return "[vdso]";
22850 if (vma == &gate_vma)
22851 return "[vsyscall]";
22852diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
22853index 7b179b4..6bd1777 100644
22854--- a/arch/x86/mm/iomap_32.c
22855+++ b/arch/x86/mm/iomap_32.c
22856@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
22857 type = kmap_atomic_idx_push();
22858 idx = type + KM_TYPE_NR * smp_processor_id();
22859 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22860+
22861+ pax_open_kernel();
22862 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22863+ pax_close_kernel();
22864+
22865 arch_flush_lazy_mmu_mode();
22866
22867 return (void *)vaddr;
22868diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
22869index be1ef57..9680edc 100644
22870--- a/arch/x86/mm/ioremap.c
22871+++ b/arch/x86/mm/ioremap.c
22872@@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
22873 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22874 int is_ram = page_is_ram(pfn);
22875
22876- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22877+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22878 return NULL;
22879 WARN_ON_ONCE(is_ram);
22880 }
22881@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_setup(char *str)
22882 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22883
22884 static __initdata int after_paging_init;
22885-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22886+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22887
22888 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22889 {
22890@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22891 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22892
22893 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22894- memset(bm_pte, 0, sizeof(bm_pte));
22895- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22896+ pmd_populate_user(&init_mm, pmd, bm_pte);
22897
22898 /*
22899 * The boot-ioremap range spans multiple pmds, for which
22900diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
22901index d87dd6d..bf3fa66 100644
22902--- a/arch/x86/mm/kmemcheck/kmemcheck.c
22903+++ b/arch/x86/mm/kmemcheck/kmemcheck.c
22904@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
22905 * memory (e.g. tracked pages)? For now, we need this to avoid
22906 * invoking kmemcheck for PnP BIOS calls.
22907 */
22908- if (regs->flags & X86_VM_MASK)
22909+ if (v8086_mode(regs))
22910 return false;
22911- if (regs->cs != __KERNEL_CS)
22912+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22913 return false;
22914
22915 pte = kmemcheck_pte_lookup(address);
22916diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
22917index 1dab519..60a7e5f 100644
22918--- a/arch/x86/mm/mmap.c
22919+++ b/arch/x86/mm/mmap.c
22920@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size(void)
22921 * Leave an at least ~128 MB hole with possible stack randomization.
22922 */
22923 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22924-#define MAX_GAP (TASK_SIZE/6*5)
22925+#define MAX_GAP (pax_task_size/6*5)
22926
22927 /*
22928 * True on X86_32 or when emulating IA32 on X86_64
22929@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22930 return rnd << PAGE_SHIFT;
22931 }
22932
22933-static unsigned long mmap_base(void)
22934+static unsigned long mmap_base(struct mm_struct *mm)
22935 {
22936 unsigned long gap = rlimit(RLIMIT_STACK);
22937+ unsigned long pax_task_size = TASK_SIZE;
22938+
22939+#ifdef CONFIG_PAX_SEGMEXEC
22940+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22941+ pax_task_size = SEGMEXEC_TASK_SIZE;
22942+#endif
22943
22944 if (gap < MIN_GAP)
22945 gap = MIN_GAP;
22946 else if (gap > MAX_GAP)
22947 gap = MAX_GAP;
22948
22949- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22950+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22951 }
22952
22953 /*
22954 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22955 * does, but not when emulating X86_32
22956 */
22957-static unsigned long mmap_legacy_base(void)
22958+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22959 {
22960- if (mmap_is_ia32())
22961+ if (mmap_is_ia32()) {
22962+
22963+#ifdef CONFIG_PAX_SEGMEXEC
22964+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22965+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22966+ else
22967+#endif
22968+
22969 return TASK_UNMAPPED_BASE;
22970- else
22971+ } else
22972 return TASK_UNMAPPED_BASE + mmap_rnd();
22973 }
22974
22975@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(void)
22976 void arch_pick_mmap_layout(struct mm_struct *mm)
22977 {
22978 if (mmap_is_legacy()) {
22979- mm->mmap_base = mmap_legacy_base();
22980+ mm->mmap_base = mmap_legacy_base(mm);
22981+
22982+#ifdef CONFIG_PAX_RANDMMAP
22983+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22984+ mm->mmap_base += mm->delta_mmap;
22985+#endif
22986+
22987 mm->get_unmapped_area = arch_get_unmapped_area;
22988 mm->unmap_area = arch_unmap_area;
22989 } else {
22990- mm->mmap_base = mmap_base();
22991+ mm->mmap_base = mmap_base(mm);
22992+
22993+#ifdef CONFIG_PAX_RANDMMAP
22994+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22995+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22996+#endif
22997+
22998 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22999 mm->unmap_area = arch_unmap_area_topdown;
23000 }
23001diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
23002index 67421f3..8d6b107 100644
23003--- a/arch/x86/mm/mmio-mod.c
23004+++ b/arch/x86/mm/mmio-mod.c
23005@@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
23006 break;
23007 default:
23008 {
23009- unsigned char *ip = (unsigned char *)instptr;
23010+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
23011 my_trace->opcode = MMIO_UNKNOWN_OP;
23012 my_trace->width = 0;
23013 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
23014@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
23015 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23016 void __iomem *addr)
23017 {
23018- static atomic_t next_id;
23019+ static atomic_unchecked_t next_id;
23020 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
23021 /* These are page-unaligned. */
23022 struct mmiotrace_map map = {
23023@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23024 .private = trace
23025 },
23026 .phys = offset,
23027- .id = atomic_inc_return(&next_id)
23028+ .id = atomic_inc_return_unchecked(&next_id)
23029 };
23030 map.map_id = trace->id;
23031
23032diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
23033index b008656..773eac2 100644
23034--- a/arch/x86/mm/pageattr-test.c
23035+++ b/arch/x86/mm/pageattr-test.c
23036@@ -36,7 +36,7 @@ enum {
23037
23038 static int pte_testbit(pte_t pte)
23039 {
23040- return pte_flags(pte) & _PAGE_UNUSED1;
23041+ return pte_flags(pte) & _PAGE_CPA_TEST;
23042 }
23043
23044 struct split_state {
23045diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
23046index f9e5267..6f6e27f 100644
23047--- a/arch/x86/mm/pageattr.c
23048+++ b/arch/x86/mm/pageattr.c
23049@@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23050 */
23051 #ifdef CONFIG_PCI_BIOS
23052 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
23053- pgprot_val(forbidden) |= _PAGE_NX;
23054+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23055 #endif
23056
23057 /*
23058@@ -269,9 +269,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23059 * Does not cover __inittext since that is gone later on. On
23060 * 64bit we do not enforce !NX on the low mapping
23061 */
23062- if (within(address, (unsigned long)_text, (unsigned long)_etext))
23063- pgprot_val(forbidden) |= _PAGE_NX;
23064+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
23065+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23066
23067+#ifdef CONFIG_DEBUG_RODATA
23068 /*
23069 * The .rodata section needs to be read-only. Using the pfn
23070 * catches all aliases.
23071@@ -279,6 +280,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23072 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
23073 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
23074 pgprot_val(forbidden) |= _PAGE_RW;
23075+#endif
23076
23077 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
23078 /*
23079@@ -317,6 +319,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23080 }
23081 #endif
23082
23083+#ifdef CONFIG_PAX_KERNEXEC
23084+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
23085+ pgprot_val(forbidden) |= _PAGE_RW;
23086+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23087+ }
23088+#endif
23089+
23090 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
23091
23092 return prot;
23093@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
23094 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
23095 {
23096 /* change init_mm */
23097+ pax_open_kernel();
23098 set_pte_atomic(kpte, pte);
23099+
23100 #ifdef CONFIG_X86_32
23101 if (!SHARED_KERNEL_PMD) {
23102+
23103+#ifdef CONFIG_PAX_PER_CPU_PGD
23104+ unsigned long cpu;
23105+#else
23106 struct page *page;
23107+#endif
23108
23109+#ifdef CONFIG_PAX_PER_CPU_PGD
23110+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
23111+ pgd_t *pgd = get_cpu_pgd(cpu);
23112+#else
23113 list_for_each_entry(page, &pgd_list, lru) {
23114- pgd_t *pgd;
23115+ pgd_t *pgd = (pgd_t *)page_address(page);
23116+#endif
23117+
23118 pud_t *pud;
23119 pmd_t *pmd;
23120
23121- pgd = (pgd_t *)page_address(page) + pgd_index(address);
23122+ pgd += pgd_index(address);
23123 pud = pud_offset(pgd, address);
23124 pmd = pmd_offset(pud, address);
23125 set_pte_atomic((pte_t *)pmd, pte);
23126 }
23127 }
23128 #endif
23129+ pax_close_kernel();
23130 }
23131
23132 static int
23133diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
23134index f6ff57b..481690f 100644
23135--- a/arch/x86/mm/pat.c
23136+++ b/arch/x86/mm/pat.c
23137@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
23138
23139 if (!entry) {
23140 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
23141- current->comm, current->pid, start, end);
23142+ current->comm, task_pid_nr(current), start, end);
23143 return -EINVAL;
23144 }
23145
23146@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
23147 while (cursor < to) {
23148 if (!devmem_is_allowed(pfn)) {
23149 printk(KERN_INFO
23150- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
23151- current->comm, from, to);
23152+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
23153+ current->comm, from, to, cursor);
23154 return 0;
23155 }
23156 cursor += PAGE_SIZE;
23157@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
23158 printk(KERN_INFO
23159 "%s:%d ioremap_change_attr failed %s "
23160 "for %Lx-%Lx\n",
23161- current->comm, current->pid,
23162+ current->comm, task_pid_nr(current),
23163 cattr_name(flags),
23164 base, (unsigned long long)(base + size));
23165 return -EINVAL;
23166@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23167 if (want_flags != flags) {
23168 printk(KERN_WARNING
23169 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
23170- current->comm, current->pid,
23171+ current->comm, task_pid_nr(current),
23172 cattr_name(want_flags),
23173 (unsigned long long)paddr,
23174 (unsigned long long)(paddr + size),
23175@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23176 free_memtype(paddr, paddr + size);
23177 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
23178 " for %Lx-%Lx, got %s\n",
23179- current->comm, current->pid,
23180+ current->comm, task_pid_nr(current),
23181 cattr_name(want_flags),
23182 (unsigned long long)paddr,
23183 (unsigned long long)(paddr + size),
23184diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
23185index 9f0614d..92ae64a 100644
23186--- a/arch/x86/mm/pf_in.c
23187+++ b/arch/x86/mm/pf_in.c
23188@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
23189 int i;
23190 enum reason_type rv = OTHERS;
23191
23192- p = (unsigned char *)ins_addr;
23193+ p = (unsigned char *)ktla_ktva(ins_addr);
23194 p += skip_prefix(p, &prf);
23195 p += get_opcode(p, &opcode);
23196
23197@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
23198 struct prefix_bits prf;
23199 int i;
23200
23201- p = (unsigned char *)ins_addr;
23202+ p = (unsigned char *)ktla_ktva(ins_addr);
23203 p += skip_prefix(p, &prf);
23204 p += get_opcode(p, &opcode);
23205
23206@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
23207 struct prefix_bits prf;
23208 int i;
23209
23210- p = (unsigned char *)ins_addr;
23211+ p = (unsigned char *)ktla_ktva(ins_addr);
23212 p += skip_prefix(p, &prf);
23213 p += get_opcode(p, &opcode);
23214
23215@@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
23216 struct prefix_bits prf;
23217 int i;
23218
23219- p = (unsigned char *)ins_addr;
23220+ p = (unsigned char *)ktla_ktva(ins_addr);
23221 p += skip_prefix(p, &prf);
23222 p += get_opcode(p, &opcode);
23223 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
23224@@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
23225 struct prefix_bits prf;
23226 int i;
23227
23228- p = (unsigned char *)ins_addr;
23229+ p = (unsigned char *)ktla_ktva(ins_addr);
23230 p += skip_prefix(p, &prf);
23231 p += get_opcode(p, &opcode);
23232 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
23233diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
23234index 8573b83..6372501 100644
23235--- a/arch/x86/mm/pgtable.c
23236+++ b/arch/x86/mm/pgtable.c
23237@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *pgd)
23238 list_del(&page->lru);
23239 }
23240
23241-#define UNSHARED_PTRS_PER_PGD \
23242- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23243+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23244+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
23245
23246+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23247+{
23248+ while (count--)
23249+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
23250+}
23251+#endif
23252
23253+#ifdef CONFIG_PAX_PER_CPU_PGD
23254+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23255+{
23256+ while (count--)
23257+
23258+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23259+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
23260+#else
23261+ *dst++ = *src++;
23262+#endif
23263+
23264+}
23265+#endif
23266+
23267+#ifdef CONFIG_X86_64
23268+#define pxd_t pud_t
23269+#define pyd_t pgd_t
23270+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
23271+#define pxd_free(mm, pud) pud_free((mm), (pud))
23272+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
23273+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
23274+#define PYD_SIZE PGDIR_SIZE
23275+#else
23276+#define pxd_t pmd_t
23277+#define pyd_t pud_t
23278+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
23279+#define pxd_free(mm, pud) pmd_free((mm), (pud))
23280+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
23281+#define pyd_offset(mm ,address) pud_offset((mm), (address))
23282+#define PYD_SIZE PUD_SIZE
23283+#endif
23284+
23285+#ifdef CONFIG_PAX_PER_CPU_PGD
23286+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
23287+static inline void pgd_dtor(pgd_t *pgd) {}
23288+#else
23289 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
23290 {
23291 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
23292@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
23293 pgd_list_del(pgd);
23294 spin_unlock(&pgd_lock);
23295 }
23296+#endif
23297
23298 /*
23299 * List of all pgd's needed for non-PAE so it can invalidate entries
23300@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
23301 * -- wli
23302 */
23303
23304-#ifdef CONFIG_X86_PAE
23305+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23306 /*
23307 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
23308 * updating the top-level pagetable entries to guarantee the
23309@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
23310 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
23311 * and initialize the kernel pmds here.
23312 */
23313-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
23314+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23315
23316 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23317 {
23318@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23319 */
23320 flush_tlb_mm(mm);
23321 }
23322+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
23323+#define PREALLOCATED_PXDS USER_PGD_PTRS
23324 #else /* !CONFIG_X86_PAE */
23325
23326 /* No need to prepopulate any pagetable entries in non-PAE modes. */
23327-#define PREALLOCATED_PMDS 0
23328+#define PREALLOCATED_PXDS 0
23329
23330 #endif /* CONFIG_X86_PAE */
23331
23332-static void free_pmds(pmd_t *pmds[])
23333+static void free_pxds(pxd_t *pxds[])
23334 {
23335 int i;
23336
23337- for(i = 0; i < PREALLOCATED_PMDS; i++)
23338- if (pmds[i])
23339- free_page((unsigned long)pmds[i]);
23340+ for(i = 0; i < PREALLOCATED_PXDS; i++)
23341+ if (pxds[i])
23342+ free_page((unsigned long)pxds[i]);
23343 }
23344
23345-static int preallocate_pmds(pmd_t *pmds[])
23346+static int preallocate_pxds(pxd_t *pxds[])
23347 {
23348 int i;
23349 bool failed = false;
23350
23351- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23352- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
23353- if (pmd == NULL)
23354+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23355+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
23356+ if (pxd == NULL)
23357 failed = true;
23358- pmds[i] = pmd;
23359+ pxds[i] = pxd;
23360 }
23361
23362 if (failed) {
23363- free_pmds(pmds);
23364+ free_pxds(pxds);
23365 return -ENOMEM;
23366 }
23367
23368@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[])
23369 * preallocate which never got a corresponding vma will need to be
23370 * freed manually.
23371 */
23372-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
23373+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
23374 {
23375 int i;
23376
23377- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23378+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23379 pgd_t pgd = pgdp[i];
23380
23381 if (pgd_val(pgd) != 0) {
23382- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
23383+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
23384
23385- pgdp[i] = native_make_pgd(0);
23386+ set_pgd(pgdp + i, native_make_pgd(0));
23387
23388- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
23389- pmd_free(mm, pmd);
23390+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
23391+ pxd_free(mm, pxd);
23392 }
23393 }
23394 }
23395
23396-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23397+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23398 {
23399- pud_t *pud;
23400+ pyd_t *pyd;
23401 unsigned long addr;
23402 int i;
23403
23404- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23405+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23406 return;
23407
23408- pud = pud_offset(pgd, 0);
23409+#ifdef CONFIG_X86_64
23410+ pyd = pyd_offset(mm, 0L);
23411+#else
23412+ pyd = pyd_offset(pgd, 0L);
23413+#endif
23414
23415- for (addr = i = 0; i < PREALLOCATED_PMDS;
23416- i++, pud++, addr += PUD_SIZE) {
23417- pmd_t *pmd = pmds[i];
23418+ for (addr = i = 0; i < PREALLOCATED_PXDS;
23419+ i++, pyd++, addr += PYD_SIZE) {
23420+ pxd_t *pxd = pxds[i];
23421
23422 if (i >= KERNEL_PGD_BOUNDARY)
23423- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23424- sizeof(pmd_t) * PTRS_PER_PMD);
23425+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23426+ sizeof(pxd_t) * PTRS_PER_PMD);
23427
23428- pud_populate(mm, pud, pmd);
23429+ pyd_populate(mm, pyd, pxd);
23430 }
23431 }
23432
23433 pgd_t *pgd_alloc(struct mm_struct *mm)
23434 {
23435 pgd_t *pgd;
23436- pmd_t *pmds[PREALLOCATED_PMDS];
23437+ pxd_t *pxds[PREALLOCATED_PXDS];
23438
23439 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23440
23441@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23442
23443 mm->pgd = pgd;
23444
23445- if (preallocate_pmds(pmds) != 0)
23446+ if (preallocate_pxds(pxds) != 0)
23447 goto out_free_pgd;
23448
23449 if (paravirt_pgd_alloc(mm) != 0)
23450- goto out_free_pmds;
23451+ goto out_free_pxds;
23452
23453 /*
23454 * Make sure that pre-populating the pmds is atomic with
23455@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23456 spin_lock(&pgd_lock);
23457
23458 pgd_ctor(mm, pgd);
23459- pgd_prepopulate_pmd(mm, pgd, pmds);
23460+ pgd_prepopulate_pxd(mm, pgd, pxds);
23461
23462 spin_unlock(&pgd_lock);
23463
23464 return pgd;
23465
23466-out_free_pmds:
23467- free_pmds(pmds);
23468+out_free_pxds:
23469+ free_pxds(pxds);
23470 out_free_pgd:
23471 free_page((unsigned long)pgd);
23472 out:
23473@@ -295,7 +344,7 @@ out:
23474
23475 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23476 {
23477- pgd_mop_up_pmds(mm, pgd);
23478+ pgd_mop_up_pxds(mm, pgd);
23479 pgd_dtor(pgd);
23480 paravirt_pgd_free(mm, pgd);
23481 free_page((unsigned long)pgd);
23482diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
23483index cac7184..09a39fa 100644
23484--- a/arch/x86/mm/pgtable_32.c
23485+++ b/arch/x86/mm/pgtable_32.c
23486@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
23487 return;
23488 }
23489 pte = pte_offset_kernel(pmd, vaddr);
23490+
23491+ pax_open_kernel();
23492 if (pte_val(pteval))
23493 set_pte_at(&init_mm, vaddr, pte, pteval);
23494 else
23495 pte_clear(&init_mm, vaddr, pte);
23496+ pax_close_kernel();
23497
23498 /*
23499 * It's enough to flush this one mapping.
23500diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
23501index 410531d..0f16030 100644
23502--- a/arch/x86/mm/setup_nx.c
23503+++ b/arch/x86/mm/setup_nx.c
23504@@ -5,8 +5,10 @@
23505 #include <asm/pgtable.h>
23506 #include <asm/proto.h>
23507
23508+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23509 static int disable_nx __cpuinitdata;
23510
23511+#ifndef CONFIG_PAX_PAGEEXEC
23512 /*
23513 * noexec = on|off
23514 *
23515@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
23516 return 0;
23517 }
23518 early_param("noexec", noexec_setup);
23519+#endif
23520+
23521+#endif
23522
23523 void __cpuinit x86_configure_nx(void)
23524 {
23525+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23526 if (cpu_has_nx && !disable_nx)
23527 __supported_pte_mask |= _PAGE_NX;
23528 else
23529+#endif
23530 __supported_pte_mask &= ~_PAGE_NX;
23531 }
23532
23533diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
23534index d6c0418..06a0ad5 100644
23535--- a/arch/x86/mm/tlb.c
23536+++ b/arch/x86/mm/tlb.c
23537@@ -65,7 +65,11 @@ void leave_mm(int cpu)
23538 BUG();
23539 cpumask_clear_cpu(cpu,
23540 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23541+
23542+#ifndef CONFIG_PAX_PER_CPU_PGD
23543 load_cr3(swapper_pg_dir);
23544+#endif
23545+
23546 }
23547 EXPORT_SYMBOL_GPL(leave_mm);
23548
23549diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
23550index 6687022..ceabcfa 100644
23551--- a/arch/x86/net/bpf_jit.S
23552+++ b/arch/x86/net/bpf_jit.S
23553@@ -9,6 +9,7 @@
23554 */
23555 #include <linux/linkage.h>
23556 #include <asm/dwarf2.h>
23557+#include <asm/alternative-asm.h>
23558
23559 /*
23560 * Calling convention :
23561@@ -35,6 +36,7 @@ sk_load_word:
23562 jle bpf_slow_path_word
23563 mov (SKBDATA,%rsi),%eax
23564 bswap %eax /* ntohl() */
23565+ pax_force_retaddr
23566 ret
23567
23568
23569@@ -53,6 +55,7 @@ sk_load_half:
23570 jle bpf_slow_path_half
23571 movzwl (SKBDATA,%rsi),%eax
23572 rol $8,%ax # ntohs()
23573+ pax_force_retaddr
23574 ret
23575
23576 sk_load_byte_ind:
23577@@ -66,6 +69,7 @@ sk_load_byte:
23578 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
23579 jle bpf_slow_path_byte
23580 movzbl (SKBDATA,%rsi),%eax
23581+ pax_force_retaddr
23582 ret
23583
23584 /**
23585@@ -82,6 +86,7 @@ ENTRY(sk_load_byte_msh)
23586 movzbl (SKBDATA,%rsi),%ebx
23587 and $15,%bl
23588 shl $2,%bl
23589+ pax_force_retaddr
23590 ret
23591 CFI_ENDPROC
23592 ENDPROC(sk_load_byte_msh)
23593@@ -91,6 +96,7 @@ bpf_error:
23594 xor %eax,%eax
23595 mov -8(%rbp),%rbx
23596 leaveq
23597+ pax_force_retaddr
23598 ret
23599
23600 /* rsi contains offset and can be scratched */
23601@@ -113,6 +119,7 @@ bpf_slow_path_word:
23602 js bpf_error
23603 mov -12(%rbp),%eax
23604 bswap %eax
23605+ pax_force_retaddr
23606 ret
23607
23608 bpf_slow_path_half:
23609@@ -121,12 +128,14 @@ bpf_slow_path_half:
23610 mov -12(%rbp),%ax
23611 rol $8,%ax
23612 movzwl %ax,%eax
23613+ pax_force_retaddr
23614 ret
23615
23616 bpf_slow_path_byte:
23617 bpf_slow_path_common(1)
23618 js bpf_error
23619 movzbl -12(%rbp),%eax
23620+ pax_force_retaddr
23621 ret
23622
23623 bpf_slow_path_byte_msh:
23624@@ -137,4 +146,5 @@ bpf_slow_path_byte_msh:
23625 and $15,%al
23626 shl $2,%al
23627 xchg %eax,%ebx
23628+ pax_force_retaddr
23629 ret
23630diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
23631index bfab3fa..05aac3a 100644
23632--- a/arch/x86/net/bpf_jit_comp.c
23633+++ b/arch/x86/net/bpf_jit_comp.c
23634@@ -117,6 +117,10 @@ static inline void bpf_flush_icache(void *start, void *end)
23635 set_fs(old_fs);
23636 }
23637
23638+struct bpf_jit_work {
23639+ struct work_struct work;
23640+ void *image;
23641+};
23642
23643 void bpf_jit_compile(struct sk_filter *fp)
23644 {
23645@@ -141,6 +145,10 @@ void bpf_jit_compile(struct sk_filter *fp)
23646 if (addrs == NULL)
23647 return;
23648
23649+ fp->work = kmalloc(sizeof(*fp->work), GFP_KERNEL);
23650+ if (!fp->work)
23651+ goto out;
23652+
23653 /* Before first pass, make a rough estimation of addrs[]
23654 * each bpf instruction is translated to less than 64 bytes
23655 */
23656@@ -585,11 +593,12 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23657 if (image) {
23658 if (unlikely(proglen + ilen > oldproglen)) {
23659 pr_err("bpb_jit_compile fatal error\n");
23660- kfree(addrs);
23661- module_free(NULL, image);
23662- return;
23663+ module_free_exec(NULL, image);
23664+ goto out;
23665 }
23666+ pax_open_kernel();
23667 memcpy(image + proglen, temp, ilen);
23668+ pax_close_kernel();
23669 }
23670 proglen += ilen;
23671 addrs[i] = proglen;
23672@@ -609,7 +618,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23673 break;
23674 }
23675 if (proglen == oldproglen) {
23676- image = module_alloc(max_t(unsigned int,
23677+ image = module_alloc_exec(max_t(unsigned int,
23678 proglen,
23679 sizeof(struct work_struct)));
23680 if (!image)
23681@@ -631,24 +640,27 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23682 fp->bpf_func = (void *)image;
23683 }
23684 out:
23685+ kfree(fp->work);
23686 kfree(addrs);
23687 return;
23688 }
23689
23690 static void jit_free_defer(struct work_struct *arg)
23691 {
23692- module_free(NULL, arg);
23693+ module_free_exec(NULL, ((struct bpf_jit_work*)arg)->image);
23694+ kfree(arg);
23695 }
23696
23697 /* run from softirq, we must use a work_struct to call
23698- * module_free() from process context
23699+ * module_free_exec() from process context
23700 */
23701 void bpf_jit_free(struct sk_filter *fp)
23702 {
23703 if (fp->bpf_func != sk_run_filter) {
23704- struct work_struct *work = (struct work_struct *)fp->bpf_func;
23705+ struct work_struct *work = &fp->work->work;
23706
23707 INIT_WORK(work, jit_free_defer);
23708+ fp->work->image = fp->bpf_func;
23709 schedule_work(work);
23710 }
23711 }
23712diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
23713index bff89df..377758a 100644
23714--- a/arch/x86/oprofile/backtrace.c
23715+++ b/arch/x86/oprofile/backtrace.c
23716@@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
23717 struct stack_frame_ia32 *fp;
23718 unsigned long bytes;
23719
23720- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23721+ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23722 if (bytes != sizeof(bufhead))
23723 return NULL;
23724
23725- fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
23726+ fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
23727
23728 oprofile_add_trace(bufhead[0].return_address);
23729
23730@@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
23731 struct stack_frame bufhead[2];
23732 unsigned long bytes;
23733
23734- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23735+ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23736 if (bytes != sizeof(bufhead))
23737 return NULL;
23738
23739@@ -111,7 +111,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
23740 {
23741 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23742
23743- if (!user_mode_vm(regs)) {
23744+ if (!user_mode(regs)) {
23745 unsigned long stack = kernel_stack_pointer(regs);
23746 if (depth)
23747 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23748diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
23749index cb29191..036766d 100644
23750--- a/arch/x86/pci/mrst.c
23751+++ b/arch/x86/pci/mrst.c
23752@@ -234,7 +234,9 @@ int __init pci_mrst_init(void)
23753 printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n");
23754 pci_mmcfg_late_init();
23755 pcibios_enable_irq = mrst_pci_irq_enable;
23756- pci_root_ops = pci_mrst_ops;
23757+ pax_open_kernel();
23758+ memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
23759+ pax_close_kernel();
23760 /* Continue with standard init */
23761 return 1;
23762 }
23763diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
23764index f685535..2b76a81 100644
23765--- a/arch/x86/pci/pcbios.c
23766+++ b/arch/x86/pci/pcbios.c
23767@@ -79,50 +79,93 @@ union bios32 {
23768 static struct {
23769 unsigned long address;
23770 unsigned short segment;
23771-} bios32_indirect = { 0, __KERNEL_CS };
23772+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23773
23774 /*
23775 * Returns the entry point for the given service, NULL on error
23776 */
23777
23778-static unsigned long bios32_service(unsigned long service)
23779+static unsigned long __devinit bios32_service(unsigned long service)
23780 {
23781 unsigned char return_code; /* %al */
23782 unsigned long address; /* %ebx */
23783 unsigned long length; /* %ecx */
23784 unsigned long entry; /* %edx */
23785 unsigned long flags;
23786+ struct desc_struct d, *gdt;
23787
23788 local_irq_save(flags);
23789- __asm__("lcall *(%%edi); cld"
23790+
23791+ gdt = get_cpu_gdt_table(smp_processor_id());
23792+
23793+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23794+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23795+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23796+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23797+
23798+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23799 : "=a" (return_code),
23800 "=b" (address),
23801 "=c" (length),
23802 "=d" (entry)
23803 : "0" (service),
23804 "1" (0),
23805- "D" (&bios32_indirect));
23806+ "D" (&bios32_indirect),
23807+ "r"(__PCIBIOS_DS)
23808+ : "memory");
23809+
23810+ pax_open_kernel();
23811+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23812+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23813+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23814+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23815+ pax_close_kernel();
23816+
23817 local_irq_restore(flags);
23818
23819 switch (return_code) {
23820- case 0:
23821- return address + entry;
23822- case 0x80: /* Not present */
23823- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23824- return 0;
23825- default: /* Shouldn't happen */
23826- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23827- service, return_code);
23828+ case 0: {
23829+ int cpu;
23830+ unsigned char flags;
23831+
23832+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23833+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23834+ printk(KERN_WARNING "bios32_service: not valid\n");
23835 return 0;
23836+ }
23837+ address = address + PAGE_OFFSET;
23838+ length += 16UL; /* some BIOSs underreport this... */
23839+ flags = 4;
23840+ if (length >= 64*1024*1024) {
23841+ length >>= PAGE_SHIFT;
23842+ flags |= 8;
23843+ }
23844+
23845+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23846+ gdt = get_cpu_gdt_table(cpu);
23847+ pack_descriptor(&d, address, length, 0x9b, flags);
23848+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23849+ pack_descriptor(&d, address, length, 0x93, flags);
23850+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23851+ }
23852+ return entry;
23853+ }
23854+ case 0x80: /* Not present */
23855+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23856+ return 0;
23857+ default: /* Shouldn't happen */
23858+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23859+ service, return_code);
23860+ return 0;
23861 }
23862 }
23863
23864 static struct {
23865 unsigned long address;
23866 unsigned short segment;
23867-} pci_indirect = { 0, __KERNEL_CS };
23868+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23869
23870-static int pci_bios_present;
23871+static int pci_bios_present __read_only;
23872
23873 static int __devinit check_pcibios(void)
23874 {
23875@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23876 unsigned long flags, pcibios_entry;
23877
23878 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23879- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23880+ pci_indirect.address = pcibios_entry;
23881
23882 local_irq_save(flags);
23883- __asm__(
23884- "lcall *(%%edi); cld\n\t"
23885+ __asm__("movw %w6, %%ds\n\t"
23886+ "lcall *%%ss:(%%edi); cld\n\t"
23887+ "push %%ss\n\t"
23888+ "pop %%ds\n\t"
23889 "jc 1f\n\t"
23890 "xor %%ah, %%ah\n"
23891 "1:"
23892@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23893 "=b" (ebx),
23894 "=c" (ecx)
23895 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23896- "D" (&pci_indirect)
23897+ "D" (&pci_indirect),
23898+ "r" (__PCIBIOS_DS)
23899 : "memory");
23900 local_irq_restore(flags);
23901
23902@@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23903
23904 switch (len) {
23905 case 1:
23906- __asm__("lcall *(%%esi); cld\n\t"
23907+ __asm__("movw %w6, %%ds\n\t"
23908+ "lcall *%%ss:(%%esi); cld\n\t"
23909+ "push %%ss\n\t"
23910+ "pop %%ds\n\t"
23911 "jc 1f\n\t"
23912 "xor %%ah, %%ah\n"
23913 "1:"
23914@@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23915 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23916 "b" (bx),
23917 "D" ((long)reg),
23918- "S" (&pci_indirect));
23919+ "S" (&pci_indirect),
23920+ "r" (__PCIBIOS_DS));
23921 /*
23922 * Zero-extend the result beyond 8 bits, do not trust the
23923 * BIOS having done it:
23924@@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23925 *value &= 0xff;
23926 break;
23927 case 2:
23928- __asm__("lcall *(%%esi); cld\n\t"
23929+ __asm__("movw %w6, %%ds\n\t"
23930+ "lcall *%%ss:(%%esi); cld\n\t"
23931+ "push %%ss\n\t"
23932+ "pop %%ds\n\t"
23933 "jc 1f\n\t"
23934 "xor %%ah, %%ah\n"
23935 "1:"
23936@@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23937 : "1" (PCIBIOS_READ_CONFIG_WORD),
23938 "b" (bx),
23939 "D" ((long)reg),
23940- "S" (&pci_indirect));
23941+ "S" (&pci_indirect),
23942+ "r" (__PCIBIOS_DS));
23943 /*
23944 * Zero-extend the result beyond 16 bits, do not trust the
23945 * BIOS having done it:
23946@@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23947 *value &= 0xffff;
23948 break;
23949 case 4:
23950- __asm__("lcall *(%%esi); cld\n\t"
23951+ __asm__("movw %w6, %%ds\n\t"
23952+ "lcall *%%ss:(%%esi); cld\n\t"
23953+ "push %%ss\n\t"
23954+ "pop %%ds\n\t"
23955 "jc 1f\n\t"
23956 "xor %%ah, %%ah\n"
23957 "1:"
23958@@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23959 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23960 "b" (bx),
23961 "D" ((long)reg),
23962- "S" (&pci_indirect));
23963+ "S" (&pci_indirect),
23964+ "r" (__PCIBIOS_DS));
23965 break;
23966 }
23967
23968@@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23969
23970 switch (len) {
23971 case 1:
23972- __asm__("lcall *(%%esi); cld\n\t"
23973+ __asm__("movw %w6, %%ds\n\t"
23974+ "lcall *%%ss:(%%esi); cld\n\t"
23975+ "push %%ss\n\t"
23976+ "pop %%ds\n\t"
23977 "jc 1f\n\t"
23978 "xor %%ah, %%ah\n"
23979 "1:"
23980@@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23981 "c" (value),
23982 "b" (bx),
23983 "D" ((long)reg),
23984- "S" (&pci_indirect));
23985+ "S" (&pci_indirect),
23986+ "r" (__PCIBIOS_DS));
23987 break;
23988 case 2:
23989- __asm__("lcall *(%%esi); cld\n\t"
23990+ __asm__("movw %w6, %%ds\n\t"
23991+ "lcall *%%ss:(%%esi); cld\n\t"
23992+ "push %%ss\n\t"
23993+ "pop %%ds\n\t"
23994 "jc 1f\n\t"
23995 "xor %%ah, %%ah\n"
23996 "1:"
23997@@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23998 "c" (value),
23999 "b" (bx),
24000 "D" ((long)reg),
24001- "S" (&pci_indirect));
24002+ "S" (&pci_indirect),
24003+ "r" (__PCIBIOS_DS));
24004 break;
24005 case 4:
24006- __asm__("lcall *(%%esi); cld\n\t"
24007+ __asm__("movw %w6, %%ds\n\t"
24008+ "lcall *%%ss:(%%esi); cld\n\t"
24009+ "push %%ss\n\t"
24010+ "pop %%ds\n\t"
24011 "jc 1f\n\t"
24012 "xor %%ah, %%ah\n"
24013 "1:"
24014@@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24015 "c" (value),
24016 "b" (bx),
24017 "D" ((long)reg),
24018- "S" (&pci_indirect));
24019+ "S" (&pci_indirect),
24020+ "r" (__PCIBIOS_DS));
24021 break;
24022 }
24023
24024@@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24025
24026 DBG("PCI: Fetching IRQ routing table... ");
24027 __asm__("push %%es\n\t"
24028+ "movw %w8, %%ds\n\t"
24029 "push %%ds\n\t"
24030 "pop %%es\n\t"
24031- "lcall *(%%esi); cld\n\t"
24032+ "lcall *%%ss:(%%esi); cld\n\t"
24033 "pop %%es\n\t"
24034+ "push %%ss\n\t"
24035+ "pop %%ds\n"
24036 "jc 1f\n\t"
24037 "xor %%ah, %%ah\n"
24038 "1:"
24039@@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24040 "1" (0),
24041 "D" ((long) &opt),
24042 "S" (&pci_indirect),
24043- "m" (opt)
24044+ "m" (opt),
24045+ "r" (__PCIBIOS_DS)
24046 : "memory");
24047 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
24048 if (ret & 0xff00)
24049@@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24050 {
24051 int ret;
24052
24053- __asm__("lcall *(%%esi); cld\n\t"
24054+ __asm__("movw %w5, %%ds\n\t"
24055+ "lcall *%%ss:(%%esi); cld\n\t"
24056+ "push %%ss\n\t"
24057+ "pop %%ds\n"
24058 "jc 1f\n\t"
24059 "xor %%ah, %%ah\n"
24060 "1:"
24061@@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24062 : "0" (PCIBIOS_SET_PCI_HW_INT),
24063 "b" ((dev->bus->number << 8) | dev->devfn),
24064 "c" ((irq << 8) | (pin + 10)),
24065- "S" (&pci_indirect));
24066+ "S" (&pci_indirect),
24067+ "r" (__PCIBIOS_DS));
24068 return !(ret & 0xff00);
24069 }
24070 EXPORT_SYMBOL(pcibios_set_irq_routing);
24071diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
24072index 5cab48e..b025f9b 100644
24073--- a/arch/x86/platform/efi/efi_32.c
24074+++ b/arch/x86/platform/efi/efi_32.c
24075@@ -38,70 +38,56 @@
24076 */
24077
24078 static unsigned long efi_rt_eflags;
24079-static pgd_t efi_bak_pg_dir_pointer[2];
24080+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
24081
24082-void efi_call_phys_prelog(void)
24083+void __init efi_call_phys_prelog(void)
24084 {
24085- unsigned long cr4;
24086- unsigned long temp;
24087 struct desc_ptr gdt_descr;
24088
24089+#ifdef CONFIG_PAX_KERNEXEC
24090+ struct desc_struct d;
24091+#endif
24092+
24093 local_irq_save(efi_rt_eflags);
24094
24095- /*
24096- * If I don't have PAE, I should just duplicate two entries in page
24097- * directory. If I have PAE, I just need to duplicate one entry in
24098- * page directory.
24099- */
24100- cr4 = read_cr4_safe();
24101-
24102- if (cr4 & X86_CR4_PAE) {
24103- efi_bak_pg_dir_pointer[0].pgd =
24104- swapper_pg_dir[pgd_index(0)].pgd;
24105- swapper_pg_dir[0].pgd =
24106- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24107- } else {
24108- efi_bak_pg_dir_pointer[0].pgd =
24109- swapper_pg_dir[pgd_index(0)].pgd;
24110- efi_bak_pg_dir_pointer[1].pgd =
24111- swapper_pg_dir[pgd_index(0x400000)].pgd;
24112- swapper_pg_dir[pgd_index(0)].pgd =
24113- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24114- temp = PAGE_OFFSET + 0x400000;
24115- swapper_pg_dir[pgd_index(0x400000)].pgd =
24116- swapper_pg_dir[pgd_index(temp)].pgd;
24117- }
24118+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
24119+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
24120+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
24121
24122 /*
24123 * After the lock is released, the original page table is restored.
24124 */
24125 __flush_tlb_all();
24126
24127+#ifdef CONFIG_PAX_KERNEXEC
24128+ pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
24129+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24130+ pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
24131+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24132+#endif
24133+
24134 gdt_descr.address = __pa(get_cpu_gdt_table(0));
24135 gdt_descr.size = GDT_SIZE - 1;
24136 load_gdt(&gdt_descr);
24137 }
24138
24139-void efi_call_phys_epilog(void)
24140+void __init efi_call_phys_epilog(void)
24141 {
24142- unsigned long cr4;
24143 struct desc_ptr gdt_descr;
24144
24145+#ifdef CONFIG_PAX_KERNEXEC
24146+ struct desc_struct d;
24147+
24148+ memset(&d, 0, sizeof d);
24149+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24150+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24151+#endif
24152+
24153 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
24154 gdt_descr.size = GDT_SIZE - 1;
24155 load_gdt(&gdt_descr);
24156
24157- cr4 = read_cr4_safe();
24158-
24159- if (cr4 & X86_CR4_PAE) {
24160- swapper_pg_dir[pgd_index(0)].pgd =
24161- efi_bak_pg_dir_pointer[0].pgd;
24162- } else {
24163- swapper_pg_dir[pgd_index(0)].pgd =
24164- efi_bak_pg_dir_pointer[0].pgd;
24165- swapper_pg_dir[pgd_index(0x400000)].pgd =
24166- efi_bak_pg_dir_pointer[1].pgd;
24167- }
24168+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
24169
24170 /*
24171 * After the lock is released, the original page table is restored.
24172diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
24173index fbe66e6..c5c0dd2 100644
24174--- a/arch/x86/platform/efi/efi_stub_32.S
24175+++ b/arch/x86/platform/efi/efi_stub_32.S
24176@@ -6,7 +6,9 @@
24177 */
24178
24179 #include <linux/linkage.h>
24180+#include <linux/init.h>
24181 #include <asm/page_types.h>
24182+#include <asm/segment.h>
24183
24184 /*
24185 * efi_call_phys(void *, ...) is a function with variable parameters.
24186@@ -20,7 +22,7 @@
24187 * service functions will comply with gcc calling convention, too.
24188 */
24189
24190-.text
24191+__INIT
24192 ENTRY(efi_call_phys)
24193 /*
24194 * 0. The function can only be called in Linux kernel. So CS has been
24195@@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
24196 * The mapping of lower virtual memory has been created in prelog and
24197 * epilog.
24198 */
24199- movl $1f, %edx
24200- subl $__PAGE_OFFSET, %edx
24201- jmp *%edx
24202+ movl $(__KERNEXEC_EFI_DS), %edx
24203+ mov %edx, %ds
24204+ mov %edx, %es
24205+ mov %edx, %ss
24206+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
24207 1:
24208
24209 /*
24210@@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
24211 * parameter 2, ..., param n. To make things easy, we save the return
24212 * address of efi_call_phys in a global variable.
24213 */
24214- popl %edx
24215- movl %edx, saved_return_addr
24216- /* get the function pointer into ECX*/
24217- popl %ecx
24218- movl %ecx, efi_rt_function_ptr
24219- movl $2f, %edx
24220- subl $__PAGE_OFFSET, %edx
24221- pushl %edx
24222+ popl (saved_return_addr)
24223+ popl (efi_rt_function_ptr)
24224
24225 /*
24226 * 3. Clear PG bit in %CR0.
24227@@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
24228 /*
24229 * 5. Call the physical function.
24230 */
24231- jmp *%ecx
24232+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
24233
24234-2:
24235 /*
24236 * 6. After EFI runtime service returns, control will return to
24237 * following instruction. We'd better readjust stack pointer first.
24238@@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
24239 movl %cr0, %edx
24240 orl $0x80000000, %edx
24241 movl %edx, %cr0
24242- jmp 1f
24243-1:
24244+
24245 /*
24246 * 8. Now restore the virtual mode from flat mode by
24247 * adding EIP with PAGE_OFFSET.
24248 */
24249- movl $1f, %edx
24250- jmp *%edx
24251+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
24252 1:
24253+ movl $(__KERNEL_DS), %edx
24254+ mov %edx, %ds
24255+ mov %edx, %es
24256+ mov %edx, %ss
24257
24258 /*
24259 * 9. Balance the stack. And because EAX contain the return value,
24260 * we'd better not clobber it.
24261 */
24262- leal efi_rt_function_ptr, %edx
24263- movl (%edx), %ecx
24264- pushl %ecx
24265+ pushl (efi_rt_function_ptr)
24266
24267 /*
24268- * 10. Push the saved return address onto the stack and return.
24269+ * 10. Return to the saved return address.
24270 */
24271- leal saved_return_addr, %edx
24272- movl (%edx), %ecx
24273- pushl %ecx
24274- ret
24275+ jmpl *(saved_return_addr)
24276 ENDPROC(efi_call_phys)
24277 .previous
24278
24279-.data
24280+__INITDATA
24281 saved_return_addr:
24282 .long 0
24283 efi_rt_function_ptr:
24284diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
24285index 4c07cca..2c8427d 100644
24286--- a/arch/x86/platform/efi/efi_stub_64.S
24287+++ b/arch/x86/platform/efi/efi_stub_64.S
24288@@ -7,6 +7,7 @@
24289 */
24290
24291 #include <linux/linkage.h>
24292+#include <asm/alternative-asm.h>
24293
24294 #define SAVE_XMM \
24295 mov %rsp, %rax; \
24296@@ -40,6 +41,7 @@ ENTRY(efi_call0)
24297 call *%rdi
24298 addq $32, %rsp
24299 RESTORE_XMM
24300+ pax_force_retaddr 0, 1
24301 ret
24302 ENDPROC(efi_call0)
24303
24304@@ -50,6 +52,7 @@ ENTRY(efi_call1)
24305 call *%rdi
24306 addq $32, %rsp
24307 RESTORE_XMM
24308+ pax_force_retaddr 0, 1
24309 ret
24310 ENDPROC(efi_call1)
24311
24312@@ -60,6 +63,7 @@ ENTRY(efi_call2)
24313 call *%rdi
24314 addq $32, %rsp
24315 RESTORE_XMM
24316+ pax_force_retaddr 0, 1
24317 ret
24318 ENDPROC(efi_call2)
24319
24320@@ -71,6 +75,7 @@ ENTRY(efi_call3)
24321 call *%rdi
24322 addq $32, %rsp
24323 RESTORE_XMM
24324+ pax_force_retaddr 0, 1
24325 ret
24326 ENDPROC(efi_call3)
24327
24328@@ -83,6 +88,7 @@ ENTRY(efi_call4)
24329 call *%rdi
24330 addq $32, %rsp
24331 RESTORE_XMM
24332+ pax_force_retaddr 0, 1
24333 ret
24334 ENDPROC(efi_call4)
24335
24336@@ -96,6 +102,7 @@ ENTRY(efi_call5)
24337 call *%rdi
24338 addq $48, %rsp
24339 RESTORE_XMM
24340+ pax_force_retaddr 0, 1
24341 ret
24342 ENDPROC(efi_call5)
24343
24344@@ -112,5 +119,6 @@ ENTRY(efi_call6)
24345 call *%rdi
24346 addq $48, %rsp
24347 RESTORE_XMM
24348+ pax_force_retaddr 0, 1
24349 ret
24350 ENDPROC(efi_call6)
24351diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
24352index fe73276..70fe25a 100644
24353--- a/arch/x86/platform/mrst/mrst.c
24354+++ b/arch/x86/platform/mrst/mrst.c
24355@@ -239,14 +239,16 @@ static int mrst_i8042_detect(void)
24356 }
24357
24358 /* Reboot and power off are handled by the SCU on a MID device */
24359-static void mrst_power_off(void)
24360+static __noreturn void mrst_power_off(void)
24361 {
24362 intel_scu_ipc_simple_command(0xf1, 1);
24363+ BUG();
24364 }
24365
24366-static void mrst_reboot(void)
24367+static __noreturn void mrst_reboot(void)
24368 {
24369 intel_scu_ipc_simple_command(0xf1, 0);
24370+ BUG();
24371 }
24372
24373 /*
24374diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
24375index 5b55219..b326540 100644
24376--- a/arch/x86/platform/uv/tlb_uv.c
24377+++ b/arch/x86/platform/uv/tlb_uv.c
24378@@ -377,6 +377,8 @@ static void reset_with_ipi(struct pnmask *distribution, struct bau_control *bcp)
24379 struct bau_control *smaster = bcp->socket_master;
24380 struct reset_args reset_args;
24381
24382+ pax_track_stack();
24383+
24384 reset_args.sender = sender;
24385 cpus_clear(*mask);
24386 /* find a single cpu for each uvhub in this distribution mask */
24387diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
24388index 87bb35e..eff2da8 100644
24389--- a/arch/x86/power/cpu.c
24390+++ b/arch/x86/power/cpu.c
24391@@ -130,7 +130,7 @@ static void do_fpu_end(void)
24392 static void fix_processor_context(void)
24393 {
24394 int cpu = smp_processor_id();
24395- struct tss_struct *t = &per_cpu(init_tss, cpu);
24396+ struct tss_struct *t = init_tss + cpu;
24397
24398 set_tss_desc(cpu, t); /*
24399 * This just modifies memory; should not be
24400@@ -140,7 +140,9 @@ static void fix_processor_context(void)
24401 */
24402
24403 #ifdef CONFIG_X86_64
24404+ pax_open_kernel();
24405 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24406+ pax_close_kernel();
24407
24408 syscall_init(); /* This sets MSR_*STAR and related */
24409 #endif
24410diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
24411index 5d17950..2253fc9 100644
24412--- a/arch/x86/vdso/Makefile
24413+++ b/arch/x86/vdso/Makefile
24414@@ -137,7 +137,7 @@ quiet_cmd_vdso = VDSO $@
24415 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
24416 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
24417
24418-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24419+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24420 GCOV_PROFILE := n
24421
24422 #
24423diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
24424index 468d591..8e80a0a 100644
24425--- a/arch/x86/vdso/vdso32-setup.c
24426+++ b/arch/x86/vdso/vdso32-setup.c
24427@@ -25,6 +25,7 @@
24428 #include <asm/tlbflush.h>
24429 #include <asm/vdso.h>
24430 #include <asm/proto.h>
24431+#include <asm/mman.h>
24432
24433 enum {
24434 VDSO_DISABLED = 0,
24435@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
24436 void enable_sep_cpu(void)
24437 {
24438 int cpu = get_cpu();
24439- struct tss_struct *tss = &per_cpu(init_tss, cpu);
24440+ struct tss_struct *tss = init_tss + cpu;
24441
24442 if (!boot_cpu_has(X86_FEATURE_SEP)) {
24443 put_cpu();
24444@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
24445 gate_vma.vm_start = FIXADDR_USER_START;
24446 gate_vma.vm_end = FIXADDR_USER_END;
24447 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
24448- gate_vma.vm_page_prot = __P101;
24449+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
24450 /*
24451 * Make sure the vDSO gets into every core dump.
24452 * Dumping its contents makes post-mortem fully interpretable later
24453@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24454 if (compat)
24455 addr = VDSO_HIGH_BASE;
24456 else {
24457- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
24458+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
24459 if (IS_ERR_VALUE(addr)) {
24460 ret = addr;
24461 goto up_fail;
24462 }
24463 }
24464
24465- current->mm->context.vdso = (void *)addr;
24466+ current->mm->context.vdso = addr;
24467
24468 if (compat_uses_vma || !compat) {
24469 /*
24470@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24471 }
24472
24473 current_thread_info()->sysenter_return =
24474- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24475+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24476
24477 up_fail:
24478 if (ret)
24479- current->mm->context.vdso = NULL;
24480+ current->mm->context.vdso = 0;
24481
24482 up_write(&mm->mmap_sem);
24483
24484@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
24485
24486 const char *arch_vma_name(struct vm_area_struct *vma)
24487 {
24488- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24489+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24490 return "[vdso]";
24491+
24492+#ifdef CONFIG_PAX_SEGMEXEC
24493+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24494+ return "[vdso]";
24495+#endif
24496+
24497 return NULL;
24498 }
24499
24500@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
24501 * Check to see if the corresponding task was created in compat vdso
24502 * mode.
24503 */
24504- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24505+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24506 return &gate_vma;
24507 return NULL;
24508 }
24509diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
24510index 316fbca..4638633 100644
24511--- a/arch/x86/vdso/vma.c
24512+++ b/arch/x86/vdso/vma.c
24513@@ -16,8 +16,6 @@
24514 #include <asm/vdso.h>
24515 #include <asm/page.h>
24516
24517-unsigned int __read_mostly vdso_enabled = 1;
24518-
24519 extern char vdso_start[], vdso_end[];
24520 extern unsigned short vdso_sync_cpuid;
24521
24522@@ -97,13 +95,15 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
24523 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24524 {
24525 struct mm_struct *mm = current->mm;
24526- unsigned long addr;
24527+ unsigned long addr = 0;
24528 int ret;
24529
24530- if (!vdso_enabled)
24531- return 0;
24532-
24533 down_write(&mm->mmap_sem);
24534+
24535+#ifdef CONFIG_PAX_RANDMMAP
24536+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
24537+#endif
24538+
24539 addr = vdso_addr(mm->start_stack, vdso_size);
24540 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
24541 if (IS_ERR_VALUE(addr)) {
24542@@ -111,26 +111,18 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24543 goto up_fail;
24544 }
24545
24546- current->mm->context.vdso = (void *)addr;
24547+ mm->context.vdso = addr;
24548
24549 ret = install_special_mapping(mm, addr, vdso_size,
24550 VM_READ|VM_EXEC|
24551 VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
24552 VM_ALWAYSDUMP,
24553 vdso_pages);
24554- if (ret) {
24555- current->mm->context.vdso = NULL;
24556- goto up_fail;
24557- }
24558+
24559+ if (ret)
24560+ mm->context.vdso = 0;
24561
24562 up_fail:
24563 up_write(&mm->mmap_sem);
24564 return ret;
24565 }
24566-
24567-static __init int vdso_setup(char *s)
24568-{
24569- vdso_enabled = simple_strtoul(s, NULL, 0);
24570- return 0;
24571-}
24572-__setup("vdso=", vdso_setup);
24573diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
24574index 46c8069..6330d3c 100644
24575--- a/arch/x86/xen/enlighten.c
24576+++ b/arch/x86/xen/enlighten.c
24577@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24578
24579 struct shared_info xen_dummy_shared_info;
24580
24581-void *xen_initial_gdt;
24582-
24583 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
24584 __read_mostly int xen_have_vector_callback;
24585 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
24586@@ -1028,7 +1026,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
24587 #endif
24588 };
24589
24590-static void xen_reboot(int reason)
24591+static __noreturn void xen_reboot(int reason)
24592 {
24593 struct sched_shutdown r = { .reason = reason };
24594
24595@@ -1036,17 +1034,17 @@ static void xen_reboot(int reason)
24596 BUG();
24597 }
24598
24599-static void xen_restart(char *msg)
24600+static __noreturn void xen_restart(char *msg)
24601 {
24602 xen_reboot(SHUTDOWN_reboot);
24603 }
24604
24605-static void xen_emergency_restart(void)
24606+static __noreturn void xen_emergency_restart(void)
24607 {
24608 xen_reboot(SHUTDOWN_reboot);
24609 }
24610
24611-static void xen_machine_halt(void)
24612+static __noreturn void xen_machine_halt(void)
24613 {
24614 xen_reboot(SHUTDOWN_poweroff);
24615 }
24616@@ -1152,7 +1150,17 @@ asmlinkage void __init xen_start_kernel(void)
24617 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24618
24619 /* Work out if we support NX */
24620- x86_configure_nx();
24621+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24622+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24623+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24624+ unsigned l, h;
24625+
24626+ __supported_pte_mask |= _PAGE_NX;
24627+ rdmsr(MSR_EFER, l, h);
24628+ l |= EFER_NX;
24629+ wrmsr(MSR_EFER, l, h);
24630+ }
24631+#endif
24632
24633 xen_setup_features();
24634
24635@@ -1183,13 +1191,6 @@ asmlinkage void __init xen_start_kernel(void)
24636
24637 machine_ops = xen_machine_ops;
24638
24639- /*
24640- * The only reliable way to retain the initial address of the
24641- * percpu gdt_page is to remember it here, so we can go and
24642- * mark it RW later, when the initial percpu area is freed.
24643- */
24644- xen_initial_gdt = &per_cpu(gdt_page, 0);
24645-
24646 xen_smp_init();
24647
24648 #ifdef CONFIG_ACPI_NUMA
24649diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
24650index 3dd53f9..5aa5df3 100644
24651--- a/arch/x86/xen/mmu.c
24652+++ b/arch/x86/xen/mmu.c
24653@@ -1768,6 +1768,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24654 convert_pfn_mfn(init_level4_pgt);
24655 convert_pfn_mfn(level3_ident_pgt);
24656 convert_pfn_mfn(level3_kernel_pgt);
24657+ convert_pfn_mfn(level3_vmalloc_start_pgt);
24658+ convert_pfn_mfn(level3_vmalloc_end_pgt);
24659+ convert_pfn_mfn(level3_vmemmap_pgt);
24660
24661 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24662 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24663@@ -1786,7 +1789,11 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24664 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24665 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24666 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24667+ set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
24668+ set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
24669+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24670 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24671+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24672 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24673 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24674
24675@@ -2000,6 +2007,7 @@ static void __init xen_post_allocator_init(void)
24676 pv_mmu_ops.set_pud = xen_set_pud;
24677 #if PAGETABLE_LEVELS == 4
24678 pv_mmu_ops.set_pgd = xen_set_pgd;
24679+ pv_mmu_ops.set_pgd_batched = xen_set_pgd;
24680 #endif
24681
24682 /* This will work as long as patching hasn't happened yet
24683@@ -2081,6 +2089,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
24684 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
24685 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
24686 .set_pgd = xen_set_pgd_hyper,
24687+ .set_pgd_batched = xen_set_pgd_hyper,
24688
24689 .alloc_pud = xen_alloc_pmd_init,
24690 .release_pud = xen_release_pmd_init,
24691diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
24692index 041d4fe..7666b7e 100644
24693--- a/arch/x86/xen/smp.c
24694+++ b/arch/x86/xen/smp.c
24695@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
24696 {
24697 BUG_ON(smp_processor_id() != 0);
24698 native_smp_prepare_boot_cpu();
24699-
24700- /* We've switched to the "real" per-cpu gdt, so make sure the
24701- old memory can be recycled */
24702- make_lowmem_page_readwrite(xen_initial_gdt);
24703-
24704 xen_filter_cpu_maps();
24705 xen_setup_vcpu_info_placement();
24706 }
24707@@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
24708 gdt = get_cpu_gdt_table(cpu);
24709
24710 ctxt->flags = VGCF_IN_KERNEL;
24711- ctxt->user_regs.ds = __USER_DS;
24712- ctxt->user_regs.es = __USER_DS;
24713+ ctxt->user_regs.ds = __KERNEL_DS;
24714+ ctxt->user_regs.es = __KERNEL_DS;
24715 ctxt->user_regs.ss = __KERNEL_DS;
24716 #ifdef CONFIG_X86_32
24717 ctxt->user_regs.fs = __KERNEL_PERCPU;
24718- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24719+ savesegment(gs, ctxt->user_regs.gs);
24720 #else
24721 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24722 #endif
24723@@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
24724 int rc;
24725
24726 per_cpu(current_task, cpu) = idle;
24727+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24728 #ifdef CONFIG_X86_32
24729 irq_ctx_init(cpu);
24730 #else
24731 clear_tsk_thread_flag(idle, TIF_FORK);
24732- per_cpu(kernel_stack, cpu) =
24733- (unsigned long)task_stack_page(idle) -
24734- KERNEL_STACK_OFFSET + THREAD_SIZE;
24735+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24736 #endif
24737 xen_setup_runstate_info(cpu);
24738 xen_setup_timer(cpu);
24739diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
24740index b040b0e..8cc4fe0 100644
24741--- a/arch/x86/xen/xen-asm_32.S
24742+++ b/arch/x86/xen/xen-asm_32.S
24743@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24744 ESP_OFFSET=4 # bytes pushed onto stack
24745
24746 /*
24747- * Store vcpu_info pointer for easy access. Do it this way to
24748- * avoid having to reload %fs
24749+ * Store vcpu_info pointer for easy access.
24750 */
24751 #ifdef CONFIG_SMP
24752- GET_THREAD_INFO(%eax)
24753- movl TI_cpu(%eax), %eax
24754- movl __per_cpu_offset(,%eax,4), %eax
24755- mov xen_vcpu(%eax), %eax
24756+ push %fs
24757+ mov $(__KERNEL_PERCPU), %eax
24758+ mov %eax, %fs
24759+ mov PER_CPU_VAR(xen_vcpu), %eax
24760+ pop %fs
24761 #else
24762 movl xen_vcpu, %eax
24763 #endif
24764diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
24765index aaa7291..3f77960 100644
24766--- a/arch/x86/xen/xen-head.S
24767+++ b/arch/x86/xen/xen-head.S
24768@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24769 #ifdef CONFIG_X86_32
24770 mov %esi,xen_start_info
24771 mov $init_thread_union+THREAD_SIZE,%esp
24772+#ifdef CONFIG_SMP
24773+ movl $cpu_gdt_table,%edi
24774+ movl $__per_cpu_load,%eax
24775+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24776+ rorl $16,%eax
24777+ movb %al,__KERNEL_PERCPU + 4(%edi)
24778+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24779+ movl $__per_cpu_end - 1,%eax
24780+ subl $__per_cpu_start,%eax
24781+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24782+#endif
24783 #else
24784 mov %rsi,xen_start_info
24785 mov $init_thread_union+THREAD_SIZE,%rsp
24786diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
24787index b095739..8c17bcd 100644
24788--- a/arch/x86/xen/xen-ops.h
24789+++ b/arch/x86/xen/xen-ops.h
24790@@ -10,8 +10,6 @@
24791 extern const char xen_hypervisor_callback[];
24792 extern const char xen_failsafe_callback[];
24793
24794-extern void *xen_initial_gdt;
24795-
24796 struct trap_info;
24797 void xen_copy_trap_info(struct trap_info *traps);
24798
24799diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
24800index 58916af..9cb880b 100644
24801--- a/block/blk-iopoll.c
24802+++ b/block/blk-iopoll.c
24803@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
24804 }
24805 EXPORT_SYMBOL(blk_iopoll_complete);
24806
24807-static void blk_iopoll_softirq(struct softirq_action *h)
24808+static void blk_iopoll_softirq(void)
24809 {
24810 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24811 int rearm = 0, budget = blk_iopoll_budget;
24812diff --git a/block/blk-map.c b/block/blk-map.c
24813index 164cd00..6d96fc1 100644
24814--- a/block/blk-map.c
24815+++ b/block/blk-map.c
24816@@ -302,7 +302,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
24817 if (!len || !kbuf)
24818 return -EINVAL;
24819
24820- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24821+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24822 if (do_copy)
24823 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24824 else
24825diff --git a/block/blk-softirq.c b/block/blk-softirq.c
24826index 1366a89..e17f54b 100644
24827--- a/block/blk-softirq.c
24828+++ b/block/blk-softirq.c
24829@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
24830 * Softirq action handler - move entries to local list and loop over them
24831 * while passing them to the queue registered handler.
24832 */
24833-static void blk_done_softirq(struct softirq_action *h)
24834+static void blk_done_softirq(void)
24835 {
24836 struct list_head *cpu_list, local_list;
24837
24838diff --git a/block/bsg.c b/block/bsg.c
24839index 702f131..37808bf 100644
24840--- a/block/bsg.c
24841+++ b/block/bsg.c
24842@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
24843 struct sg_io_v4 *hdr, struct bsg_device *bd,
24844 fmode_t has_write_perm)
24845 {
24846+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24847+ unsigned char *cmdptr;
24848+
24849 if (hdr->request_len > BLK_MAX_CDB) {
24850 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24851 if (!rq->cmd)
24852 return -ENOMEM;
24853- }
24854+ cmdptr = rq->cmd;
24855+ } else
24856+ cmdptr = tmpcmd;
24857
24858- if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
24859+ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
24860 hdr->request_len))
24861 return -EFAULT;
24862
24863+ if (cmdptr != rq->cmd)
24864+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24865+
24866 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24867 if (blk_verify_command(rq->cmd, has_write_perm))
24868 return -EPERM;
24869diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
24870index 7b72502..646105c 100644
24871--- a/block/compat_ioctl.c
24872+++ b/block/compat_ioctl.c
24873@@ -340,7 +340,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
24874 err |= __get_user(f->spec1, &uf->spec1);
24875 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
24876 err |= __get_user(name, &uf->name);
24877- f->name = compat_ptr(name);
24878+ f->name = (void __force_kernel *)compat_ptr(name);
24879 if (err) {
24880 err = -EFAULT;
24881 goto out;
24882diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
24883index 4f4230b..0feae9a 100644
24884--- a/block/scsi_ioctl.c
24885+++ b/block/scsi_ioctl.c
24886@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24887 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24888 struct sg_io_hdr *hdr, fmode_t mode)
24889 {
24890- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24891+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24892+ unsigned char *cmdptr;
24893+
24894+ if (rq->cmd != rq->__cmd)
24895+ cmdptr = rq->cmd;
24896+ else
24897+ cmdptr = tmpcmd;
24898+
24899+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24900 return -EFAULT;
24901+
24902+ if (cmdptr != rq->cmd)
24903+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24904+
24905 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24906 return -EPERM;
24907
24908@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24909 int err;
24910 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24911 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24912+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24913+ unsigned char *cmdptr;
24914
24915 if (!sic)
24916 return -EINVAL;
24917@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24918 */
24919 err = -EFAULT;
24920 rq->cmd_len = cmdlen;
24921- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24922+
24923+ if (rq->cmd != rq->__cmd)
24924+ cmdptr = rq->cmd;
24925+ else
24926+ cmdptr = tmpcmd;
24927+
24928+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24929 goto error;
24930
24931+ if (rq->cmd != cmdptr)
24932+ memcpy(rq->cmd, cmdptr, cmdlen);
24933+
24934 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24935 goto error;
24936
24937diff --git a/crypto/cryptd.c b/crypto/cryptd.c
24938index 671d4d6..5f24030 100644
24939--- a/crypto/cryptd.c
24940+++ b/crypto/cryptd.c
24941@@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
24942
24943 struct cryptd_blkcipher_request_ctx {
24944 crypto_completion_t complete;
24945-};
24946+} __no_const;
24947
24948 struct cryptd_hash_ctx {
24949 struct crypto_shash *child;
24950@@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
24951
24952 struct cryptd_aead_request_ctx {
24953 crypto_completion_t complete;
24954-};
24955+} __no_const;
24956
24957 static void cryptd_queue_worker(struct work_struct *work);
24958
24959diff --git a/crypto/serpent.c b/crypto/serpent.c
24960index b651a55..a9ddd79b 100644
24961--- a/crypto/serpent.c
24962+++ b/crypto/serpent.c
24963@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_tfm *tfm, const u8 *key,
24964 u32 r0,r1,r2,r3,r4;
24965 int i;
24966
24967+ pax_track_stack();
24968+
24969 /* Copy key, add padding */
24970
24971 for (i = 0; i < keylen; ++i)
24972diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
24973index 5d41894..22021e4 100644
24974--- a/drivers/acpi/apei/cper.c
24975+++ b/drivers/acpi/apei/cper.c
24976@@ -38,12 +38,12 @@
24977 */
24978 u64 cper_next_record_id(void)
24979 {
24980- static atomic64_t seq;
24981+ static atomic64_unchecked_t seq;
24982
24983- if (!atomic64_read(&seq))
24984- atomic64_set(&seq, ((u64)get_seconds()) << 32);
24985+ if (!atomic64_read_unchecked(&seq))
24986+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24987
24988- return atomic64_inc_return(&seq);
24989+ return atomic64_inc_return_unchecked(&seq);
24990 }
24991 EXPORT_SYMBOL_GPL(cper_next_record_id);
24992
24993diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
24994index 22f918b..9fafb84 100644
24995--- a/drivers/acpi/ec_sys.c
24996+++ b/drivers/acpi/ec_sys.c
24997@@ -11,6 +11,7 @@
24998 #include <linux/kernel.h>
24999 #include <linux/acpi.h>
25000 #include <linux/debugfs.h>
25001+#include <asm/uaccess.h>
25002 #include "internal.h"
25003
25004 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
25005@@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25006 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
25007 */
25008 unsigned int size = EC_SPACE_SIZE;
25009- u8 *data = (u8 *) buf;
25010+ u8 data;
25011 loff_t init_off = *off;
25012 int err = 0;
25013
25014@@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25015 size = count;
25016
25017 while (size) {
25018- err = ec_read(*off, &data[*off - init_off]);
25019+ err = ec_read(*off, &data);
25020 if (err)
25021 return err;
25022+ if (put_user(data, &buf[*off - init_off]))
25023+ return -EFAULT;
25024 *off += 1;
25025 size--;
25026 }
25027@@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25028
25029 unsigned int size = count;
25030 loff_t init_off = *off;
25031- u8 *data = (u8 *) buf;
25032 int err = 0;
25033
25034 if (*off >= EC_SPACE_SIZE)
25035@@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25036 }
25037
25038 while (size) {
25039- u8 byte_write = data[*off - init_off];
25040+ u8 byte_write;
25041+ if (get_user(byte_write, &buf[*off - init_off]))
25042+ return -EFAULT;
25043 err = ec_write(*off, byte_write);
25044 if (err)
25045 return err;
25046diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
25047index f5f9869..da87aeb 100644
25048--- a/drivers/acpi/proc.c
25049+++ b/drivers/acpi/proc.c
25050@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct file *file,
25051 size_t count, loff_t * ppos)
25052 {
25053 struct list_head *node, *next;
25054- char strbuf[5];
25055- char str[5] = "";
25056- unsigned int len = count;
25057+ char strbuf[5] = {0};
25058
25059- if (len > 4)
25060- len = 4;
25061- if (len < 0)
25062+ if (count > 4)
25063+ count = 4;
25064+ if (copy_from_user(strbuf, buffer, count))
25065 return -EFAULT;
25066-
25067- if (copy_from_user(strbuf, buffer, len))
25068- return -EFAULT;
25069- strbuf[len] = '\0';
25070- sscanf(strbuf, "%s", str);
25071+ strbuf[count] = '\0';
25072
25073 mutex_lock(&acpi_device_lock);
25074 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
25075@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct file *file,
25076 if (!dev->wakeup.flags.valid)
25077 continue;
25078
25079- if (!strncmp(dev->pnp.bus_id, str, 4)) {
25080+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
25081 if (device_can_wakeup(&dev->dev)) {
25082 bool enable = !device_may_wakeup(&dev->dev);
25083 device_set_wakeup_enable(&dev->dev, enable);
25084diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
25085index a4e0f1b..9793b28 100644
25086--- a/drivers/acpi/processor_driver.c
25087+++ b/drivers/acpi/processor_driver.c
25088@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
25089 return 0;
25090 #endif
25091
25092- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
25093+ BUG_ON(pr->id >= nr_cpu_ids);
25094
25095 /*
25096 * Buggy BIOS check
25097diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
25098index 4a3a5ae..cbee192 100644
25099--- a/drivers/ata/libata-core.c
25100+++ b/drivers/ata/libata-core.c
25101@@ -4733,7 +4733,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
25102 struct ata_port *ap;
25103 unsigned int tag;
25104
25105- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25106+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25107 ap = qc->ap;
25108
25109 qc->flags = 0;
25110@@ -4749,7 +4749,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
25111 struct ata_port *ap;
25112 struct ata_link *link;
25113
25114- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25115+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25116 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25117 ap = qc->ap;
25118 link = qc->dev->link;
25119@@ -5754,6 +5754,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25120 return;
25121
25122 spin_lock(&lock);
25123+ pax_open_kernel();
25124
25125 for (cur = ops->inherits; cur; cur = cur->inherits) {
25126 void **inherit = (void **)cur;
25127@@ -5767,8 +5768,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25128 if (IS_ERR(*pp))
25129 *pp = NULL;
25130
25131- ops->inherits = NULL;
25132+ *(struct ata_port_operations **)&ops->inherits = NULL;
25133
25134+ pax_close_kernel();
25135 spin_unlock(&lock);
25136 }
25137
25138diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
25139index ed16fbe..fc92cb8 100644
25140--- a/drivers/ata/libata-eh.c
25141+++ b/drivers/ata/libata-eh.c
25142@@ -2515,6 +2515,8 @@ void ata_eh_report(struct ata_port *ap)
25143 {
25144 struct ata_link *link;
25145
25146+ pax_track_stack();
25147+
25148 ata_for_each_link(link, ap, HOST_FIRST)
25149 ata_eh_link_report(link);
25150 }
25151diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
25152index 719bb73..79ce858 100644
25153--- a/drivers/ata/pata_arasan_cf.c
25154+++ b/drivers/ata/pata_arasan_cf.c
25155@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
25156 /* Handle platform specific quirks */
25157 if (pdata->quirk) {
25158 if (pdata->quirk & CF_BROKEN_PIO) {
25159- ap->ops->set_piomode = NULL;
25160+ pax_open_kernel();
25161+ *(void **)&ap->ops->set_piomode = NULL;
25162+ pax_close_kernel();
25163 ap->pio_mask = 0;
25164 }
25165 if (pdata->quirk & CF_BROKEN_MWDMA)
25166diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
25167index f9b983a..887b9d8 100644
25168--- a/drivers/atm/adummy.c
25169+++ b/drivers/atm/adummy.c
25170@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
25171 vcc->pop(vcc, skb);
25172 else
25173 dev_kfree_skb_any(skb);
25174- atomic_inc(&vcc->stats->tx);
25175+ atomic_inc_unchecked(&vcc->stats->tx);
25176
25177 return 0;
25178 }
25179diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
25180index f8f41e0..1f987dd 100644
25181--- a/drivers/atm/ambassador.c
25182+++ b/drivers/atm/ambassador.c
25183@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
25184 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
25185
25186 // VC layer stats
25187- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25188+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25189
25190 // free the descriptor
25191 kfree (tx_descr);
25192@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25193 dump_skb ("<<<", vc, skb);
25194
25195 // VC layer stats
25196- atomic_inc(&atm_vcc->stats->rx);
25197+ atomic_inc_unchecked(&atm_vcc->stats->rx);
25198 __net_timestamp(skb);
25199 // end of our responsibility
25200 atm_vcc->push (atm_vcc, skb);
25201@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25202 } else {
25203 PRINTK (KERN_INFO, "dropped over-size frame");
25204 // should we count this?
25205- atomic_inc(&atm_vcc->stats->rx_drop);
25206+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25207 }
25208
25209 } else {
25210@@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
25211 }
25212
25213 if (check_area (skb->data, skb->len)) {
25214- atomic_inc(&atm_vcc->stats->tx_err);
25215+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
25216 return -ENOMEM; // ?
25217 }
25218
25219diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
25220index b22d71c..d6e1049 100644
25221--- a/drivers/atm/atmtcp.c
25222+++ b/drivers/atm/atmtcp.c
25223@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25224 if (vcc->pop) vcc->pop(vcc,skb);
25225 else dev_kfree_skb(skb);
25226 if (dev_data) return 0;
25227- atomic_inc(&vcc->stats->tx_err);
25228+ atomic_inc_unchecked(&vcc->stats->tx_err);
25229 return -ENOLINK;
25230 }
25231 size = skb->len+sizeof(struct atmtcp_hdr);
25232@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25233 if (!new_skb) {
25234 if (vcc->pop) vcc->pop(vcc,skb);
25235 else dev_kfree_skb(skb);
25236- atomic_inc(&vcc->stats->tx_err);
25237+ atomic_inc_unchecked(&vcc->stats->tx_err);
25238 return -ENOBUFS;
25239 }
25240 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
25241@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25242 if (vcc->pop) vcc->pop(vcc,skb);
25243 else dev_kfree_skb(skb);
25244 out_vcc->push(out_vcc,new_skb);
25245- atomic_inc(&vcc->stats->tx);
25246- atomic_inc(&out_vcc->stats->rx);
25247+ atomic_inc_unchecked(&vcc->stats->tx);
25248+ atomic_inc_unchecked(&out_vcc->stats->rx);
25249 return 0;
25250 }
25251
25252@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25253 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
25254 read_unlock(&vcc_sklist_lock);
25255 if (!out_vcc) {
25256- atomic_inc(&vcc->stats->tx_err);
25257+ atomic_inc_unchecked(&vcc->stats->tx_err);
25258 goto done;
25259 }
25260 skb_pull(skb,sizeof(struct atmtcp_hdr));
25261@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25262 __net_timestamp(new_skb);
25263 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
25264 out_vcc->push(out_vcc,new_skb);
25265- atomic_inc(&vcc->stats->tx);
25266- atomic_inc(&out_vcc->stats->rx);
25267+ atomic_inc_unchecked(&vcc->stats->tx);
25268+ atomic_inc_unchecked(&out_vcc->stats->rx);
25269 done:
25270 if (vcc->pop) vcc->pop(vcc,skb);
25271 else dev_kfree_skb(skb);
25272diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
25273index 9307141..d8521bf 100644
25274--- a/drivers/atm/eni.c
25275+++ b/drivers/atm/eni.c
25276@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
25277 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
25278 vcc->dev->number);
25279 length = 0;
25280- atomic_inc(&vcc->stats->rx_err);
25281+ atomic_inc_unchecked(&vcc->stats->rx_err);
25282 }
25283 else {
25284 length = ATM_CELL_SIZE-1; /* no HEC */
25285@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25286 size);
25287 }
25288 eff = length = 0;
25289- atomic_inc(&vcc->stats->rx_err);
25290+ atomic_inc_unchecked(&vcc->stats->rx_err);
25291 }
25292 else {
25293 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
25294@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25295 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
25296 vcc->dev->number,vcc->vci,length,size << 2,descr);
25297 length = eff = 0;
25298- atomic_inc(&vcc->stats->rx_err);
25299+ atomic_inc_unchecked(&vcc->stats->rx_err);
25300 }
25301 }
25302 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
25303@@ -771,7 +771,7 @@ rx_dequeued++;
25304 vcc->push(vcc,skb);
25305 pushed++;
25306 }
25307- atomic_inc(&vcc->stats->rx);
25308+ atomic_inc_unchecked(&vcc->stats->rx);
25309 }
25310 wake_up(&eni_dev->rx_wait);
25311 }
25312@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *dev)
25313 PCI_DMA_TODEVICE);
25314 if (vcc->pop) vcc->pop(vcc,skb);
25315 else dev_kfree_skb_irq(skb);
25316- atomic_inc(&vcc->stats->tx);
25317+ atomic_inc_unchecked(&vcc->stats->tx);
25318 wake_up(&eni_dev->tx_wait);
25319 dma_complete++;
25320 }
25321@@ -1568,7 +1568,7 @@ tx_complete++;
25322 /*--------------------------------- entries ---------------------------------*/
25323
25324
25325-static const char *media_name[] __devinitdata = {
25326+static const char *media_name[] __devinitconst = {
25327 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
25328 "UTP", "05?", "06?", "07?", /* 4- 7 */
25329 "TAXI","09?", "10?", "11?", /* 8-11 */
25330diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
25331index 5072f8a..fa52520 100644
25332--- a/drivers/atm/firestream.c
25333+++ b/drivers/atm/firestream.c
25334@@ -750,7 +750,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
25335 }
25336 }
25337
25338- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25339+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25340
25341 fs_dprintk (FS_DEBUG_TXMEM, "i");
25342 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
25343@@ -817,7 +817,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25344 #endif
25345 skb_put (skb, qe->p1 & 0xffff);
25346 ATM_SKB(skb)->vcc = atm_vcc;
25347- atomic_inc(&atm_vcc->stats->rx);
25348+ atomic_inc_unchecked(&atm_vcc->stats->rx);
25349 __net_timestamp(skb);
25350 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
25351 atm_vcc->push (atm_vcc, skb);
25352@@ -838,12 +838,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25353 kfree (pe);
25354 }
25355 if (atm_vcc)
25356- atomic_inc(&atm_vcc->stats->rx_drop);
25357+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25358 break;
25359 case 0x1f: /* Reassembly abort: no buffers. */
25360 /* Silently increment error counter. */
25361 if (atm_vcc)
25362- atomic_inc(&atm_vcc->stats->rx_drop);
25363+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25364 break;
25365 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
25366 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
25367diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
25368index 361f5ae..7fc552d 100644
25369--- a/drivers/atm/fore200e.c
25370+++ b/drivers/atm/fore200e.c
25371@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
25372 #endif
25373 /* check error condition */
25374 if (*entry->status & STATUS_ERROR)
25375- atomic_inc(&vcc->stats->tx_err);
25376+ atomic_inc_unchecked(&vcc->stats->tx_err);
25377 else
25378- atomic_inc(&vcc->stats->tx);
25379+ atomic_inc_unchecked(&vcc->stats->tx);
25380 }
25381 }
25382
25383@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25384 if (skb == NULL) {
25385 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
25386
25387- atomic_inc(&vcc->stats->rx_drop);
25388+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25389 return -ENOMEM;
25390 }
25391
25392@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25393
25394 dev_kfree_skb_any(skb);
25395
25396- atomic_inc(&vcc->stats->rx_drop);
25397+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25398 return -ENOMEM;
25399 }
25400
25401 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25402
25403 vcc->push(vcc, skb);
25404- atomic_inc(&vcc->stats->rx);
25405+ atomic_inc_unchecked(&vcc->stats->rx);
25406
25407 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25408
25409@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
25410 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
25411 fore200e->atm_dev->number,
25412 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
25413- atomic_inc(&vcc->stats->rx_err);
25414+ atomic_inc_unchecked(&vcc->stats->rx_err);
25415 }
25416 }
25417
25418@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
25419 goto retry_here;
25420 }
25421
25422- atomic_inc(&vcc->stats->tx_err);
25423+ atomic_inc_unchecked(&vcc->stats->tx_err);
25424
25425 fore200e->tx_sat++;
25426 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
25427diff --git a/drivers/atm/he.c b/drivers/atm/he.c
25428index 9a51df4..f3bb5f8 100644
25429--- a/drivers/atm/he.c
25430+++ b/drivers/atm/he.c
25431@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25432
25433 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
25434 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
25435- atomic_inc(&vcc->stats->rx_drop);
25436+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25437 goto return_host_buffers;
25438 }
25439
25440@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25441 RBRQ_LEN_ERR(he_dev->rbrq_head)
25442 ? "LEN_ERR" : "",
25443 vcc->vpi, vcc->vci);
25444- atomic_inc(&vcc->stats->rx_err);
25445+ atomic_inc_unchecked(&vcc->stats->rx_err);
25446 goto return_host_buffers;
25447 }
25448
25449@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25450 vcc->push(vcc, skb);
25451 spin_lock(&he_dev->global_lock);
25452
25453- atomic_inc(&vcc->stats->rx);
25454+ atomic_inc_unchecked(&vcc->stats->rx);
25455
25456 return_host_buffers:
25457 ++pdus_assembled;
25458@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
25459 tpd->vcc->pop(tpd->vcc, tpd->skb);
25460 else
25461 dev_kfree_skb_any(tpd->skb);
25462- atomic_inc(&tpd->vcc->stats->tx_err);
25463+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
25464 }
25465 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
25466 return;
25467@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25468 vcc->pop(vcc, skb);
25469 else
25470 dev_kfree_skb_any(skb);
25471- atomic_inc(&vcc->stats->tx_err);
25472+ atomic_inc_unchecked(&vcc->stats->tx_err);
25473 return -EINVAL;
25474 }
25475
25476@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25477 vcc->pop(vcc, skb);
25478 else
25479 dev_kfree_skb_any(skb);
25480- atomic_inc(&vcc->stats->tx_err);
25481+ atomic_inc_unchecked(&vcc->stats->tx_err);
25482 return -EINVAL;
25483 }
25484 #endif
25485@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25486 vcc->pop(vcc, skb);
25487 else
25488 dev_kfree_skb_any(skb);
25489- atomic_inc(&vcc->stats->tx_err);
25490+ atomic_inc_unchecked(&vcc->stats->tx_err);
25491 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25492 return -ENOMEM;
25493 }
25494@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25495 vcc->pop(vcc, skb);
25496 else
25497 dev_kfree_skb_any(skb);
25498- atomic_inc(&vcc->stats->tx_err);
25499+ atomic_inc_unchecked(&vcc->stats->tx_err);
25500 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25501 return -ENOMEM;
25502 }
25503@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25504 __enqueue_tpd(he_dev, tpd, cid);
25505 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25506
25507- atomic_inc(&vcc->stats->tx);
25508+ atomic_inc_unchecked(&vcc->stats->tx);
25509
25510 return 0;
25511 }
25512diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
25513index b812103..e391a49 100644
25514--- a/drivers/atm/horizon.c
25515+++ b/drivers/atm/horizon.c
25516@@ -1035,7 +1035,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
25517 {
25518 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
25519 // VC layer stats
25520- atomic_inc(&vcc->stats->rx);
25521+ atomic_inc_unchecked(&vcc->stats->rx);
25522 __net_timestamp(skb);
25523 // end of our responsibility
25524 vcc->push (vcc, skb);
25525@@ -1187,7 +1187,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
25526 dev->tx_iovec = NULL;
25527
25528 // VC layer stats
25529- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25530+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25531
25532 // free the skb
25533 hrz_kfree_skb (skb);
25534diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
25535index db06f34..dcebb61 100644
25536--- a/drivers/atm/idt77252.c
25537+++ b/drivers/atm/idt77252.c
25538@@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
25539 else
25540 dev_kfree_skb(skb);
25541
25542- atomic_inc(&vcc->stats->tx);
25543+ atomic_inc_unchecked(&vcc->stats->tx);
25544 }
25545
25546 atomic_dec(&scq->used);
25547@@ -1075,13 +1075,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25548 if ((sb = dev_alloc_skb(64)) == NULL) {
25549 printk("%s: Can't allocate buffers for aal0.\n",
25550 card->name);
25551- atomic_add(i, &vcc->stats->rx_drop);
25552+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
25553 break;
25554 }
25555 if (!atm_charge(vcc, sb->truesize)) {
25556 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
25557 card->name);
25558- atomic_add(i - 1, &vcc->stats->rx_drop);
25559+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
25560 dev_kfree_skb(sb);
25561 break;
25562 }
25563@@ -1098,7 +1098,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25564 ATM_SKB(sb)->vcc = vcc;
25565 __net_timestamp(sb);
25566 vcc->push(vcc, sb);
25567- atomic_inc(&vcc->stats->rx);
25568+ atomic_inc_unchecked(&vcc->stats->rx);
25569
25570 cell += ATM_CELL_PAYLOAD;
25571 }
25572@@ -1135,13 +1135,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25573 "(CDC: %08x)\n",
25574 card->name, len, rpp->len, readl(SAR_REG_CDC));
25575 recycle_rx_pool_skb(card, rpp);
25576- atomic_inc(&vcc->stats->rx_err);
25577+ atomic_inc_unchecked(&vcc->stats->rx_err);
25578 return;
25579 }
25580 if (stat & SAR_RSQE_CRC) {
25581 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
25582 recycle_rx_pool_skb(card, rpp);
25583- atomic_inc(&vcc->stats->rx_err);
25584+ atomic_inc_unchecked(&vcc->stats->rx_err);
25585 return;
25586 }
25587 if (skb_queue_len(&rpp->queue) > 1) {
25588@@ -1152,7 +1152,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25589 RXPRINTK("%s: Can't alloc RX skb.\n",
25590 card->name);
25591 recycle_rx_pool_skb(card, rpp);
25592- atomic_inc(&vcc->stats->rx_err);
25593+ atomic_inc_unchecked(&vcc->stats->rx_err);
25594 return;
25595 }
25596 if (!atm_charge(vcc, skb->truesize)) {
25597@@ -1171,7 +1171,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25598 __net_timestamp(skb);
25599
25600 vcc->push(vcc, skb);
25601- atomic_inc(&vcc->stats->rx);
25602+ atomic_inc_unchecked(&vcc->stats->rx);
25603
25604 return;
25605 }
25606@@ -1193,7 +1193,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25607 __net_timestamp(skb);
25608
25609 vcc->push(vcc, skb);
25610- atomic_inc(&vcc->stats->rx);
25611+ atomic_inc_unchecked(&vcc->stats->rx);
25612
25613 if (skb->truesize > SAR_FB_SIZE_3)
25614 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
25615@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
25616 if (vcc->qos.aal != ATM_AAL0) {
25617 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
25618 card->name, vpi, vci);
25619- atomic_inc(&vcc->stats->rx_drop);
25620+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25621 goto drop;
25622 }
25623
25624 if ((sb = dev_alloc_skb(64)) == NULL) {
25625 printk("%s: Can't allocate buffers for AAL0.\n",
25626 card->name);
25627- atomic_inc(&vcc->stats->rx_err);
25628+ atomic_inc_unchecked(&vcc->stats->rx_err);
25629 goto drop;
25630 }
25631
25632@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
25633 ATM_SKB(sb)->vcc = vcc;
25634 __net_timestamp(sb);
25635 vcc->push(vcc, sb);
25636- atomic_inc(&vcc->stats->rx);
25637+ atomic_inc_unchecked(&vcc->stats->rx);
25638
25639 drop:
25640 skb_pull(queue, 64);
25641@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25642
25643 if (vc == NULL) {
25644 printk("%s: NULL connection in send().\n", card->name);
25645- atomic_inc(&vcc->stats->tx_err);
25646+ atomic_inc_unchecked(&vcc->stats->tx_err);
25647 dev_kfree_skb(skb);
25648 return -EINVAL;
25649 }
25650 if (!test_bit(VCF_TX, &vc->flags)) {
25651 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
25652- atomic_inc(&vcc->stats->tx_err);
25653+ atomic_inc_unchecked(&vcc->stats->tx_err);
25654 dev_kfree_skb(skb);
25655 return -EINVAL;
25656 }
25657@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25658 break;
25659 default:
25660 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
25661- atomic_inc(&vcc->stats->tx_err);
25662+ atomic_inc_unchecked(&vcc->stats->tx_err);
25663 dev_kfree_skb(skb);
25664 return -EINVAL;
25665 }
25666
25667 if (skb_shinfo(skb)->nr_frags != 0) {
25668 printk("%s: No scatter-gather yet.\n", card->name);
25669- atomic_inc(&vcc->stats->tx_err);
25670+ atomic_inc_unchecked(&vcc->stats->tx_err);
25671 dev_kfree_skb(skb);
25672 return -EINVAL;
25673 }
25674@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25675
25676 err = queue_skb(card, vc, skb, oam);
25677 if (err) {
25678- atomic_inc(&vcc->stats->tx_err);
25679+ atomic_inc_unchecked(&vcc->stats->tx_err);
25680 dev_kfree_skb(skb);
25681 return err;
25682 }
25683@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
25684 skb = dev_alloc_skb(64);
25685 if (!skb) {
25686 printk("%s: Out of memory in send_oam().\n", card->name);
25687- atomic_inc(&vcc->stats->tx_err);
25688+ atomic_inc_unchecked(&vcc->stats->tx_err);
25689 return -ENOMEM;
25690 }
25691 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
25692diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
25693index cb90f7a..bd33566 100644
25694--- a/drivers/atm/iphase.c
25695+++ b/drivers/atm/iphase.c
25696@@ -1121,7 +1121,7 @@ static int rx_pkt(struct atm_dev *dev)
25697 status = (u_short) (buf_desc_ptr->desc_mode);
25698 if (status & (RX_CER | RX_PTE | RX_OFL))
25699 {
25700- atomic_inc(&vcc->stats->rx_err);
25701+ atomic_inc_unchecked(&vcc->stats->rx_err);
25702 IF_ERR(printk("IA: bad packet, dropping it");)
25703 if (status & RX_CER) {
25704 IF_ERR(printk(" cause: packet CRC error\n");)
25705@@ -1144,7 +1144,7 @@ static int rx_pkt(struct atm_dev *dev)
25706 len = dma_addr - buf_addr;
25707 if (len > iadev->rx_buf_sz) {
25708 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
25709- atomic_inc(&vcc->stats->rx_err);
25710+ atomic_inc_unchecked(&vcc->stats->rx_err);
25711 goto out_free_desc;
25712 }
25713
25714@@ -1294,7 +1294,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25715 ia_vcc = INPH_IA_VCC(vcc);
25716 if (ia_vcc == NULL)
25717 {
25718- atomic_inc(&vcc->stats->rx_err);
25719+ atomic_inc_unchecked(&vcc->stats->rx_err);
25720 dev_kfree_skb_any(skb);
25721 atm_return(vcc, atm_guess_pdu2truesize(len));
25722 goto INCR_DLE;
25723@@ -1306,7 +1306,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25724 if ((length > iadev->rx_buf_sz) || (length >
25725 (skb->len - sizeof(struct cpcs_trailer))))
25726 {
25727- atomic_inc(&vcc->stats->rx_err);
25728+ atomic_inc_unchecked(&vcc->stats->rx_err);
25729 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
25730 length, skb->len);)
25731 dev_kfree_skb_any(skb);
25732@@ -1322,7 +1322,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25733
25734 IF_RX(printk("rx_dle_intr: skb push");)
25735 vcc->push(vcc,skb);
25736- atomic_inc(&vcc->stats->rx);
25737+ atomic_inc_unchecked(&vcc->stats->rx);
25738 iadev->rx_pkt_cnt++;
25739 }
25740 INCR_DLE:
25741@@ -2802,15 +2802,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
25742 {
25743 struct k_sonet_stats *stats;
25744 stats = &PRIV(_ia_dev[board])->sonet_stats;
25745- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
25746- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
25747- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
25748- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
25749- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
25750- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
25751- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
25752- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
25753- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
25754+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
25755+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
25756+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
25757+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
25758+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
25759+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
25760+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
25761+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
25762+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
25763 }
25764 ia_cmds.status = 0;
25765 break;
25766@@ -2915,7 +2915,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25767 if ((desc == 0) || (desc > iadev->num_tx_desc))
25768 {
25769 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
25770- atomic_inc(&vcc->stats->tx);
25771+ atomic_inc_unchecked(&vcc->stats->tx);
25772 if (vcc->pop)
25773 vcc->pop(vcc, skb);
25774 else
25775@@ -3020,14 +3020,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25776 ATM_DESC(skb) = vcc->vci;
25777 skb_queue_tail(&iadev->tx_dma_q, skb);
25778
25779- atomic_inc(&vcc->stats->tx);
25780+ atomic_inc_unchecked(&vcc->stats->tx);
25781 iadev->tx_pkt_cnt++;
25782 /* Increment transaction counter */
25783 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
25784
25785 #if 0
25786 /* add flow control logic */
25787- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
25788+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
25789 if (iavcc->vc_desc_cnt > 10) {
25790 vcc->tx_quota = vcc->tx_quota * 3 / 4;
25791 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
25792diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
25793index e828c54..ae83976 100644
25794--- a/drivers/atm/lanai.c
25795+++ b/drivers/atm/lanai.c
25796@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
25797 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
25798 lanai_endtx(lanai, lvcc);
25799 lanai_free_skb(lvcc->tx.atmvcc, skb);
25800- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
25801+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
25802 }
25803
25804 /* Try to fill the buffer - don't call unless there is backlog */
25805@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
25806 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
25807 __net_timestamp(skb);
25808 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
25809- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
25810+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
25811 out:
25812 lvcc->rx.buf.ptr = end;
25813 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
25814@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25815 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
25816 "vcc %d\n", lanai->number, (unsigned int) s, vci);
25817 lanai->stats.service_rxnotaal5++;
25818- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25819+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25820 return 0;
25821 }
25822 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
25823@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25824 int bytes;
25825 read_unlock(&vcc_sklist_lock);
25826 DPRINTK("got trashed rx pdu on vci %d\n", vci);
25827- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25828+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25829 lvcc->stats.x.aal5.service_trash++;
25830 bytes = (SERVICE_GET_END(s) * 16) -
25831 (((unsigned long) lvcc->rx.buf.ptr) -
25832@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25833 }
25834 if (s & SERVICE_STREAM) {
25835 read_unlock(&vcc_sklist_lock);
25836- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25837+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25838 lvcc->stats.x.aal5.service_stream++;
25839 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
25840 "PDU on VCI %d!\n", lanai->number, vci);
25841@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25842 return 0;
25843 }
25844 DPRINTK("got rx crc error on vci %d\n", vci);
25845- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25846+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25847 lvcc->stats.x.aal5.service_rxcrc++;
25848 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
25849 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
25850diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
25851index 1c70c45..300718d 100644
25852--- a/drivers/atm/nicstar.c
25853+++ b/drivers/atm/nicstar.c
25854@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25855 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
25856 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
25857 card->index);
25858- atomic_inc(&vcc->stats->tx_err);
25859+ atomic_inc_unchecked(&vcc->stats->tx_err);
25860 dev_kfree_skb_any(skb);
25861 return -EINVAL;
25862 }
25863@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25864 if (!vc->tx) {
25865 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
25866 card->index);
25867- atomic_inc(&vcc->stats->tx_err);
25868+ atomic_inc_unchecked(&vcc->stats->tx_err);
25869 dev_kfree_skb_any(skb);
25870 return -EINVAL;
25871 }
25872@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25873 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
25874 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
25875 card->index);
25876- atomic_inc(&vcc->stats->tx_err);
25877+ atomic_inc_unchecked(&vcc->stats->tx_err);
25878 dev_kfree_skb_any(skb);
25879 return -EINVAL;
25880 }
25881
25882 if (skb_shinfo(skb)->nr_frags != 0) {
25883 printk("nicstar%d: No scatter-gather yet.\n", card->index);
25884- atomic_inc(&vcc->stats->tx_err);
25885+ atomic_inc_unchecked(&vcc->stats->tx_err);
25886 dev_kfree_skb_any(skb);
25887 return -EINVAL;
25888 }
25889@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25890 }
25891
25892 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
25893- atomic_inc(&vcc->stats->tx_err);
25894+ atomic_inc_unchecked(&vcc->stats->tx_err);
25895 dev_kfree_skb_any(skb);
25896 return -EIO;
25897 }
25898- atomic_inc(&vcc->stats->tx);
25899+ atomic_inc_unchecked(&vcc->stats->tx);
25900
25901 return 0;
25902 }
25903@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25904 printk
25905 ("nicstar%d: Can't allocate buffers for aal0.\n",
25906 card->index);
25907- atomic_add(i, &vcc->stats->rx_drop);
25908+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
25909 break;
25910 }
25911 if (!atm_charge(vcc, sb->truesize)) {
25912 RXPRINTK
25913 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
25914 card->index);
25915- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
25916+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
25917 dev_kfree_skb_any(sb);
25918 break;
25919 }
25920@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25921 ATM_SKB(sb)->vcc = vcc;
25922 __net_timestamp(sb);
25923 vcc->push(vcc, sb);
25924- atomic_inc(&vcc->stats->rx);
25925+ atomic_inc_unchecked(&vcc->stats->rx);
25926 cell += ATM_CELL_PAYLOAD;
25927 }
25928
25929@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25930 if (iovb == NULL) {
25931 printk("nicstar%d: Out of iovec buffers.\n",
25932 card->index);
25933- atomic_inc(&vcc->stats->rx_drop);
25934+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25935 recycle_rx_buf(card, skb);
25936 return;
25937 }
25938@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25939 small or large buffer itself. */
25940 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
25941 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
25942- atomic_inc(&vcc->stats->rx_err);
25943+ atomic_inc_unchecked(&vcc->stats->rx_err);
25944 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25945 NS_MAX_IOVECS);
25946 NS_PRV_IOVCNT(iovb) = 0;
25947@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25948 ("nicstar%d: Expected a small buffer, and this is not one.\n",
25949 card->index);
25950 which_list(card, skb);
25951- atomic_inc(&vcc->stats->rx_err);
25952+ atomic_inc_unchecked(&vcc->stats->rx_err);
25953 recycle_rx_buf(card, skb);
25954 vc->rx_iov = NULL;
25955 recycle_iov_buf(card, iovb);
25956@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25957 ("nicstar%d: Expected a large buffer, and this is not one.\n",
25958 card->index);
25959 which_list(card, skb);
25960- atomic_inc(&vcc->stats->rx_err);
25961+ atomic_inc_unchecked(&vcc->stats->rx_err);
25962 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25963 NS_PRV_IOVCNT(iovb));
25964 vc->rx_iov = NULL;
25965@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25966 printk(" - PDU size mismatch.\n");
25967 else
25968 printk(".\n");
25969- atomic_inc(&vcc->stats->rx_err);
25970+ atomic_inc_unchecked(&vcc->stats->rx_err);
25971 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25972 NS_PRV_IOVCNT(iovb));
25973 vc->rx_iov = NULL;
25974@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25975 /* skb points to a small buffer */
25976 if (!atm_charge(vcc, skb->truesize)) {
25977 push_rxbufs(card, skb);
25978- atomic_inc(&vcc->stats->rx_drop);
25979+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25980 } else {
25981 skb_put(skb, len);
25982 dequeue_sm_buf(card, skb);
25983@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25984 ATM_SKB(skb)->vcc = vcc;
25985 __net_timestamp(skb);
25986 vcc->push(vcc, skb);
25987- atomic_inc(&vcc->stats->rx);
25988+ atomic_inc_unchecked(&vcc->stats->rx);
25989 }
25990 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
25991 struct sk_buff *sb;
25992@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25993 if (len <= NS_SMBUFSIZE) {
25994 if (!atm_charge(vcc, sb->truesize)) {
25995 push_rxbufs(card, sb);
25996- atomic_inc(&vcc->stats->rx_drop);
25997+ atomic_inc_unchecked(&vcc->stats->rx_drop);
25998 } else {
25999 skb_put(sb, len);
26000 dequeue_sm_buf(card, sb);
26001@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26002 ATM_SKB(sb)->vcc = vcc;
26003 __net_timestamp(sb);
26004 vcc->push(vcc, sb);
26005- atomic_inc(&vcc->stats->rx);
26006+ atomic_inc_unchecked(&vcc->stats->rx);
26007 }
26008
26009 push_rxbufs(card, skb);
26010@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26011
26012 if (!atm_charge(vcc, skb->truesize)) {
26013 push_rxbufs(card, skb);
26014- atomic_inc(&vcc->stats->rx_drop);
26015+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26016 } else {
26017 dequeue_lg_buf(card, skb);
26018 #ifdef NS_USE_DESTRUCTORS
26019@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26020 ATM_SKB(skb)->vcc = vcc;
26021 __net_timestamp(skb);
26022 vcc->push(vcc, skb);
26023- atomic_inc(&vcc->stats->rx);
26024+ atomic_inc_unchecked(&vcc->stats->rx);
26025 }
26026
26027 push_rxbufs(card, sb);
26028@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26029 printk
26030 ("nicstar%d: Out of huge buffers.\n",
26031 card->index);
26032- atomic_inc(&vcc->stats->rx_drop);
26033+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26034 recycle_iovec_rx_bufs(card,
26035 (struct iovec *)
26036 iovb->data,
26037@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26038 card->hbpool.count++;
26039 } else
26040 dev_kfree_skb_any(hb);
26041- atomic_inc(&vcc->stats->rx_drop);
26042+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26043 } else {
26044 /* Copy the small buffer to the huge buffer */
26045 sb = (struct sk_buff *)iov->iov_base;
26046@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26047 #endif /* NS_USE_DESTRUCTORS */
26048 __net_timestamp(hb);
26049 vcc->push(vcc, hb);
26050- atomic_inc(&vcc->stats->rx);
26051+ atomic_inc_unchecked(&vcc->stats->rx);
26052 }
26053 }
26054
26055diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
26056index 5d1d076..4f31f42 100644
26057--- a/drivers/atm/solos-pci.c
26058+++ b/drivers/atm/solos-pci.c
26059@@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
26060 }
26061 atm_charge(vcc, skb->truesize);
26062 vcc->push(vcc, skb);
26063- atomic_inc(&vcc->stats->rx);
26064+ atomic_inc_unchecked(&vcc->stats->rx);
26065 break;
26066
26067 case PKT_STATUS:
26068@@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff *buf)
26069 char msg[500];
26070 char item[10];
26071
26072+ pax_track_stack();
26073+
26074 len = buf->len;
26075 for (i = 0; i < len; i++){
26076 if(i % 8 == 0)
26077@@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_card *card)
26078 vcc = SKB_CB(oldskb)->vcc;
26079
26080 if (vcc) {
26081- atomic_inc(&vcc->stats->tx);
26082+ atomic_inc_unchecked(&vcc->stats->tx);
26083 solos_pop(vcc, oldskb);
26084 } else
26085 dev_kfree_skb_irq(oldskb);
26086diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
26087index 90f1ccc..04c4a1e 100644
26088--- a/drivers/atm/suni.c
26089+++ b/drivers/atm/suni.c
26090@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
26091
26092
26093 #define ADD_LIMITED(s,v) \
26094- atomic_add((v),&stats->s); \
26095- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
26096+ atomic_add_unchecked((v),&stats->s); \
26097+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
26098
26099
26100 static void suni_hz(unsigned long from_timer)
26101diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
26102index 5120a96..e2572bd 100644
26103--- a/drivers/atm/uPD98402.c
26104+++ b/drivers/atm/uPD98402.c
26105@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
26106 struct sonet_stats tmp;
26107 int error = 0;
26108
26109- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26110+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26111 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
26112 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
26113 if (zero && !error) {
26114@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
26115
26116
26117 #define ADD_LIMITED(s,v) \
26118- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
26119- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
26120- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26121+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
26122+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
26123+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26124
26125
26126 static void stat_event(struct atm_dev *dev)
26127@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
26128 if (reason & uPD98402_INT_PFM) stat_event(dev);
26129 if (reason & uPD98402_INT_PCO) {
26130 (void) GET(PCOCR); /* clear interrupt cause */
26131- atomic_add(GET(HECCT),
26132+ atomic_add_unchecked(GET(HECCT),
26133 &PRIV(dev)->sonet_stats.uncorr_hcs);
26134 }
26135 if ((reason & uPD98402_INT_RFO) &&
26136@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
26137 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
26138 uPD98402_INT_LOS),PIMR); /* enable them */
26139 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
26140- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26141- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
26142- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
26143+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26144+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
26145+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
26146 return 0;
26147 }
26148
26149diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
26150index d889f56..17eb71e 100644
26151--- a/drivers/atm/zatm.c
26152+++ b/drivers/atm/zatm.c
26153@@ -460,7 +460,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26154 }
26155 if (!size) {
26156 dev_kfree_skb_irq(skb);
26157- if (vcc) atomic_inc(&vcc->stats->rx_err);
26158+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
26159 continue;
26160 }
26161 if (!atm_charge(vcc,skb->truesize)) {
26162@@ -470,7 +470,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26163 skb->len = size;
26164 ATM_SKB(skb)->vcc = vcc;
26165 vcc->push(vcc,skb);
26166- atomic_inc(&vcc->stats->rx);
26167+ atomic_inc_unchecked(&vcc->stats->rx);
26168 }
26169 zout(pos & 0xffff,MTA(mbx));
26170 #if 0 /* probably a stupid idea */
26171@@ -734,7 +734,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
26172 skb_queue_head(&zatm_vcc->backlog,skb);
26173 break;
26174 }
26175- atomic_inc(&vcc->stats->tx);
26176+ atomic_inc_unchecked(&vcc->stats->tx);
26177 wake_up(&zatm_vcc->tx_wait);
26178 }
26179
26180diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
26181index a4760e0..51283cf 100644
26182--- a/drivers/base/devtmpfs.c
26183+++ b/drivers/base/devtmpfs.c
26184@@ -368,7 +368,7 @@ int devtmpfs_mount(const char *mntdir)
26185 if (!thread)
26186 return 0;
26187
26188- err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
26189+ err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
26190 if (err)
26191 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
26192 else
26193diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
26194index 84f7c7d..37cfd87 100644
26195--- a/drivers/base/power/wakeup.c
26196+++ b/drivers/base/power/wakeup.c
26197@@ -29,14 +29,14 @@ bool events_check_enabled;
26198 * They need to be modified together atomically, so it's better to use one
26199 * atomic variable to hold them both.
26200 */
26201-static atomic_t combined_event_count = ATOMIC_INIT(0);
26202+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
26203
26204 #define IN_PROGRESS_BITS (sizeof(int) * 4)
26205 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
26206
26207 static void split_counters(unsigned int *cnt, unsigned int *inpr)
26208 {
26209- unsigned int comb = atomic_read(&combined_event_count);
26210+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
26211
26212 *cnt = (comb >> IN_PROGRESS_BITS);
26213 *inpr = comb & MAX_IN_PROGRESS;
26214@@ -350,7 +350,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
26215 ws->last_time = ktime_get();
26216
26217 /* Increment the counter of events in progress. */
26218- atomic_inc(&combined_event_count);
26219+ atomic_inc_unchecked(&combined_event_count);
26220 }
26221
26222 /**
26223@@ -440,7 +440,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
26224 * Increment the counter of registered wakeup events and decrement the
26225 * couter of wakeup events in progress simultaneously.
26226 */
26227- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
26228+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
26229 }
26230
26231 /**
26232diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
26233index e086fbb..398e1fe 100644
26234--- a/drivers/block/DAC960.c
26235+++ b/drivers/block/DAC960.c
26236@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfiguration(DAC960_Controller_T
26237 unsigned long flags;
26238 int Channel, TargetID;
26239
26240+ pax_track_stack();
26241+
26242 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
26243 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
26244 sizeof(DAC960_SCSI_Inquiry_T) +
26245diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
26246index c2f9b3e..5911988 100644
26247--- a/drivers/block/cciss.c
26248+++ b/drivers/block/cciss.c
26249@@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
26250 int err;
26251 u32 cp;
26252
26253+ memset(&arg64, 0, sizeof(arg64));
26254+
26255 err = 0;
26256 err |=
26257 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
26258@@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h)
26259 while (!list_empty(&h->reqQ)) {
26260 c = list_entry(h->reqQ.next, CommandList_struct, list);
26261 /* can't do anything if fifo is full */
26262- if ((h->access.fifo_full(h))) {
26263+ if ((h->access->fifo_full(h))) {
26264 dev_warn(&h->pdev->dev, "fifo full\n");
26265 break;
26266 }
26267@@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h)
26268 h->Qdepth--;
26269
26270 /* Tell the controller execute command */
26271- h->access.submit_command(h, c);
26272+ h->access->submit_command(h, c);
26273
26274 /* Put job onto the completed Q */
26275 addQ(&h->cmpQ, c);
26276@@ -3422,17 +3424,17 @@ startio:
26277
26278 static inline unsigned long get_next_completion(ctlr_info_t *h)
26279 {
26280- return h->access.command_completed(h);
26281+ return h->access->command_completed(h);
26282 }
26283
26284 static inline int interrupt_pending(ctlr_info_t *h)
26285 {
26286- return h->access.intr_pending(h);
26287+ return h->access->intr_pending(h);
26288 }
26289
26290 static inline long interrupt_not_for_us(ctlr_info_t *h)
26291 {
26292- return ((h->access.intr_pending(h) == 0) ||
26293+ return ((h->access->intr_pending(h) == 0) ||
26294 (h->interrupts_enabled == 0));
26295 }
26296
26297@@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info_t *h)
26298 u32 a;
26299
26300 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
26301- return h->access.command_completed(h);
26302+ return h->access->command_completed(h);
26303
26304 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
26305 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
26306@@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
26307 trans_support & CFGTBL_Trans_use_short_tags);
26308
26309 /* Change the access methods to the performant access methods */
26310- h->access = SA5_performant_access;
26311+ h->access = &SA5_performant_access;
26312 h->transMethod = CFGTBL_Trans_Performant;
26313
26314 return;
26315@@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *h)
26316 if (prod_index < 0)
26317 return -ENODEV;
26318 h->product_name = products[prod_index].product_name;
26319- h->access = *(products[prod_index].access);
26320+ h->access = products[prod_index].access;
26321
26322 if (cciss_board_disabled(h)) {
26323 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
26324@@ -5009,7 +5011,7 @@ reinit_after_soft_reset:
26325 }
26326
26327 /* make sure the board interrupts are off */
26328- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26329+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26330 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
26331 if (rc)
26332 goto clean2;
26333@@ -5061,7 +5063,7 @@ reinit_after_soft_reset:
26334 * fake ones to scoop up any residual completions.
26335 */
26336 spin_lock_irqsave(&h->lock, flags);
26337- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26338+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26339 spin_unlock_irqrestore(&h->lock, flags);
26340 free_irq(h->intr[PERF_MODE_INT], h);
26341 rc = cciss_request_irq(h, cciss_msix_discard_completions,
26342@@ -5081,9 +5083,9 @@ reinit_after_soft_reset:
26343 dev_info(&h->pdev->dev, "Board READY.\n");
26344 dev_info(&h->pdev->dev,
26345 "Waiting for stale completions to drain.\n");
26346- h->access.set_intr_mask(h, CCISS_INTR_ON);
26347+ h->access->set_intr_mask(h, CCISS_INTR_ON);
26348 msleep(10000);
26349- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26350+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26351
26352 rc = controller_reset_failed(h->cfgtable);
26353 if (rc)
26354@@ -5106,7 +5108,7 @@ reinit_after_soft_reset:
26355 cciss_scsi_setup(h);
26356
26357 /* Turn the interrupts on so we can service requests */
26358- h->access.set_intr_mask(h, CCISS_INTR_ON);
26359+ h->access->set_intr_mask(h, CCISS_INTR_ON);
26360
26361 /* Get the firmware version */
26362 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
26363@@ -5178,7 +5180,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
26364 kfree(flush_buf);
26365 if (return_code != IO_OK)
26366 dev_warn(&h->pdev->dev, "Error flushing cache\n");
26367- h->access.set_intr_mask(h, CCISS_INTR_OFF);
26368+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
26369 free_irq(h->intr[PERF_MODE_INT], h);
26370 }
26371
26372diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
26373index c049548..a09cb6e 100644
26374--- a/drivers/block/cciss.h
26375+++ b/drivers/block/cciss.h
26376@@ -100,7 +100,7 @@ struct ctlr_info
26377 /* information about each logical volume */
26378 drive_info_struct *drv[CISS_MAX_LUN];
26379
26380- struct access_method access;
26381+ struct access_method *access;
26382
26383 /* queue and queue Info */
26384 struct list_head reqQ;
26385diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
26386index b2fceb5..87fec83 100644
26387--- a/drivers/block/cpqarray.c
26388+++ b/drivers/block/cpqarray.c
26389@@ -404,7 +404,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26390 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
26391 goto Enomem4;
26392 }
26393- hba[i]->access.set_intr_mask(hba[i], 0);
26394+ hba[i]->access->set_intr_mask(hba[i], 0);
26395 if (request_irq(hba[i]->intr, do_ida_intr,
26396 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
26397 {
26398@@ -459,7 +459,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26399 add_timer(&hba[i]->timer);
26400
26401 /* Enable IRQ now that spinlock and rate limit timer are set up */
26402- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26403+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26404
26405 for(j=0; j<NWD; j++) {
26406 struct gendisk *disk = ida_gendisk[i][j];
26407@@ -694,7 +694,7 @@ DBGINFO(
26408 for(i=0; i<NR_PRODUCTS; i++) {
26409 if (board_id == products[i].board_id) {
26410 c->product_name = products[i].product_name;
26411- c->access = *(products[i].access);
26412+ c->access = products[i].access;
26413 break;
26414 }
26415 }
26416@@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detect(void)
26417 hba[ctlr]->intr = intr;
26418 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
26419 hba[ctlr]->product_name = products[j].product_name;
26420- hba[ctlr]->access = *(products[j].access);
26421+ hba[ctlr]->access = products[j].access;
26422 hba[ctlr]->ctlr = ctlr;
26423 hba[ctlr]->board_id = board_id;
26424 hba[ctlr]->pci_dev = NULL; /* not PCI */
26425@@ -911,6 +911,8 @@ static void do_ida_request(struct request_queue *q)
26426 struct scatterlist tmp_sg[SG_MAX];
26427 int i, dir, seg;
26428
26429+ pax_track_stack();
26430+
26431 queue_next:
26432 creq = blk_peek_request(q);
26433 if (!creq)
26434@@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h)
26435
26436 while((c = h->reqQ) != NULL) {
26437 /* Can't do anything if we're busy */
26438- if (h->access.fifo_full(h) == 0)
26439+ if (h->access->fifo_full(h) == 0)
26440 return;
26441
26442 /* Get the first entry from the request Q */
26443@@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h)
26444 h->Qdepth--;
26445
26446 /* Tell the controller to do our bidding */
26447- h->access.submit_command(h, c);
26448+ h->access->submit_command(h, c);
26449
26450 /* Get onto the completion Q */
26451 addQ(&h->cmpQ, c);
26452@@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26453 unsigned long flags;
26454 __u32 a,a1;
26455
26456- istat = h->access.intr_pending(h);
26457+ istat = h->access->intr_pending(h);
26458 /* Is this interrupt for us? */
26459 if (istat == 0)
26460 return IRQ_NONE;
26461@@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26462 */
26463 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
26464 if (istat & FIFO_NOT_EMPTY) {
26465- while((a = h->access.command_completed(h))) {
26466+ while((a = h->access->command_completed(h))) {
26467 a1 = a; a &= ~3;
26468 if ((c = h->cmpQ) == NULL)
26469 {
26470@@ -1449,11 +1451,11 @@ static int sendcmd(
26471 /*
26472 * Disable interrupt
26473 */
26474- info_p->access.set_intr_mask(info_p, 0);
26475+ info_p->access->set_intr_mask(info_p, 0);
26476 /* Make sure there is room in the command FIFO */
26477 /* Actually it should be completely empty at this time. */
26478 for (i = 200000; i > 0; i--) {
26479- temp = info_p->access.fifo_full(info_p);
26480+ temp = info_p->access->fifo_full(info_p);
26481 if (temp != 0) {
26482 break;
26483 }
26484@@ -1466,7 +1468,7 @@ DBG(
26485 /*
26486 * Send the cmd
26487 */
26488- info_p->access.submit_command(info_p, c);
26489+ info_p->access->submit_command(info_p, c);
26490 complete = pollcomplete(ctlr);
26491
26492 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
26493@@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t *host)
26494 * we check the new geometry. Then turn interrupts back on when
26495 * we're done.
26496 */
26497- host->access.set_intr_mask(host, 0);
26498+ host->access->set_intr_mask(host, 0);
26499 getgeometry(ctlr);
26500- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
26501+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
26502
26503 for(i=0; i<NWD; i++) {
26504 struct gendisk *disk = ida_gendisk[ctlr][i];
26505@@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr)
26506 /* Wait (up to 2 seconds) for a command to complete */
26507
26508 for (i = 200000; i > 0; i--) {
26509- done = hba[ctlr]->access.command_completed(hba[ctlr]);
26510+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
26511 if (done == 0) {
26512 udelay(10); /* a short fixed delay */
26513 } else
26514diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
26515index be73e9d..7fbf140 100644
26516--- a/drivers/block/cpqarray.h
26517+++ b/drivers/block/cpqarray.h
26518@@ -99,7 +99,7 @@ struct ctlr_info {
26519 drv_info_t drv[NWD];
26520 struct proc_dir_entry *proc;
26521
26522- struct access_method access;
26523+ struct access_method *access;
26524
26525 cmdlist_t *reqQ;
26526 cmdlist_t *cmpQ;
26527diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
26528index ef2ceed..c9cb18e 100644
26529--- a/drivers/block/drbd/drbd_int.h
26530+++ b/drivers/block/drbd/drbd_int.h
26531@@ -737,7 +737,7 @@ struct drbd_request;
26532 struct drbd_epoch {
26533 struct list_head list;
26534 unsigned int barrier_nr;
26535- atomic_t epoch_size; /* increased on every request added. */
26536+ atomic_unchecked_t epoch_size; /* increased on every request added. */
26537 atomic_t active; /* increased on every req. added, and dec on every finished. */
26538 unsigned long flags;
26539 };
26540@@ -1109,7 +1109,7 @@ struct drbd_conf {
26541 void *int_dig_in;
26542 void *int_dig_vv;
26543 wait_queue_head_t seq_wait;
26544- atomic_t packet_seq;
26545+ atomic_unchecked_t packet_seq;
26546 unsigned int peer_seq;
26547 spinlock_t peer_seq_lock;
26548 unsigned int minor;
26549@@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
26550
26551 static inline void drbd_tcp_cork(struct socket *sock)
26552 {
26553- int __user val = 1;
26554+ int val = 1;
26555 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26556- (char __user *)&val, sizeof(val));
26557+ (char __force_user *)&val, sizeof(val));
26558 }
26559
26560 static inline void drbd_tcp_uncork(struct socket *sock)
26561 {
26562- int __user val = 0;
26563+ int val = 0;
26564 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26565- (char __user *)&val, sizeof(val));
26566+ (char __force_user *)&val, sizeof(val));
26567 }
26568
26569 static inline void drbd_tcp_nodelay(struct socket *sock)
26570 {
26571- int __user val = 1;
26572+ int val = 1;
26573 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
26574- (char __user *)&val, sizeof(val));
26575+ (char __force_user *)&val, sizeof(val));
26576 }
26577
26578 static inline void drbd_tcp_quickack(struct socket *sock)
26579 {
26580- int __user val = 2;
26581+ int val = 2;
26582 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
26583- (char __user *)&val, sizeof(val));
26584+ (char __force_user *)&val, sizeof(val));
26585 }
26586
26587 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
26588diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
26589index 0358e55..bc33689 100644
26590--- a/drivers/block/drbd/drbd_main.c
26591+++ b/drivers/block/drbd/drbd_main.c
26592@@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd,
26593 p.sector = sector;
26594 p.block_id = block_id;
26595 p.blksize = blksize;
26596- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
26597+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
26598
26599 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
26600 return false;
26601@@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
26602 p.sector = cpu_to_be64(req->sector);
26603 p.block_id = (unsigned long)req;
26604 p.seq_num = cpu_to_be32(req->seq_num =
26605- atomic_add_return(1, &mdev->packet_seq));
26606+ atomic_add_return_unchecked(1, &mdev->packet_seq));
26607
26608 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
26609
26610@@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev)
26611 atomic_set(&mdev->unacked_cnt, 0);
26612 atomic_set(&mdev->local_cnt, 0);
26613 atomic_set(&mdev->net_cnt, 0);
26614- atomic_set(&mdev->packet_seq, 0);
26615+ atomic_set_unchecked(&mdev->packet_seq, 0);
26616 atomic_set(&mdev->pp_in_use, 0);
26617 atomic_set(&mdev->pp_in_use_by_net, 0);
26618 atomic_set(&mdev->rs_sect_in, 0);
26619@@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev)
26620 mdev->receiver.t_state);
26621
26622 /* no need to lock it, I'm the only thread alive */
26623- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
26624- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
26625+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
26626+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
26627 mdev->al_writ_cnt =
26628 mdev->bm_writ_cnt =
26629 mdev->read_cnt =
26630diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
26631index 0feab26..5d9b3dd 100644
26632--- a/drivers/block/drbd/drbd_nl.c
26633+++ b/drivers/block/drbd/drbd_nl.c
26634@@ -2359,7 +2359,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms
26635 module_put(THIS_MODULE);
26636 }
26637
26638-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26639+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26640
26641 static unsigned short *
26642 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
26643@@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state)
26644 cn_reply->id.idx = CN_IDX_DRBD;
26645 cn_reply->id.val = CN_VAL_DRBD;
26646
26647- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26648+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26649 cn_reply->ack = 0; /* not used here. */
26650 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26651 (int)((char *)tl - (char *)reply->tag_list);
26652@@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name)
26653 cn_reply->id.idx = CN_IDX_DRBD;
26654 cn_reply->id.val = CN_VAL_DRBD;
26655
26656- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26657+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26658 cn_reply->ack = 0; /* not used here. */
26659 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26660 (int)((char *)tl - (char *)reply->tag_list);
26661@@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev,
26662 cn_reply->id.idx = CN_IDX_DRBD;
26663 cn_reply->id.val = CN_VAL_DRBD;
26664
26665- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
26666+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
26667 cn_reply->ack = 0; // not used here.
26668 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26669 (int)((char*)tl - (char*)reply->tag_list);
26670@@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev)
26671 cn_reply->id.idx = CN_IDX_DRBD;
26672 cn_reply->id.val = CN_VAL_DRBD;
26673
26674- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26675+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26676 cn_reply->ack = 0; /* not used here. */
26677 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26678 (int)((char *)tl - (char *)reply->tag_list);
26679diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
26680index 43beaca..4a5b1dd 100644
26681--- a/drivers/block/drbd/drbd_receiver.c
26682+++ b/drivers/block/drbd/drbd_receiver.c
26683@@ -894,7 +894,7 @@ retry:
26684 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
26685 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
26686
26687- atomic_set(&mdev->packet_seq, 0);
26688+ atomic_set_unchecked(&mdev->packet_seq, 0);
26689 mdev->peer_seq = 0;
26690
26691 drbd_thread_start(&mdev->asender);
26692@@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26693 do {
26694 next_epoch = NULL;
26695
26696- epoch_size = atomic_read(&epoch->epoch_size);
26697+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
26698
26699 switch (ev & ~EV_CLEANUP) {
26700 case EV_PUT:
26701@@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26702 rv = FE_DESTROYED;
26703 } else {
26704 epoch->flags = 0;
26705- atomic_set(&epoch->epoch_size, 0);
26706+ atomic_set_unchecked(&epoch->epoch_size, 0);
26707 /* atomic_set(&epoch->active, 0); is already zero */
26708 if (rv == FE_STILL_LIVE)
26709 rv = FE_RECYCLED;
26710@@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26711 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
26712 drbd_flush(mdev);
26713
26714- if (atomic_read(&mdev->current_epoch->epoch_size)) {
26715+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26716 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
26717 if (epoch)
26718 break;
26719 }
26720
26721 epoch = mdev->current_epoch;
26722- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
26723+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
26724
26725 D_ASSERT(atomic_read(&epoch->active) == 0);
26726 D_ASSERT(epoch->flags == 0);
26727@@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26728 }
26729
26730 epoch->flags = 0;
26731- atomic_set(&epoch->epoch_size, 0);
26732+ atomic_set_unchecked(&epoch->epoch_size, 0);
26733 atomic_set(&epoch->active, 0);
26734
26735 spin_lock(&mdev->epoch_lock);
26736- if (atomic_read(&mdev->current_epoch->epoch_size)) {
26737+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26738 list_add(&epoch->list, &mdev->current_epoch->list);
26739 mdev->current_epoch = epoch;
26740 mdev->epochs++;
26741@@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26742 spin_unlock(&mdev->peer_seq_lock);
26743
26744 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
26745- atomic_inc(&mdev->current_epoch->epoch_size);
26746+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
26747 return drbd_drain_block(mdev, data_size);
26748 }
26749
26750@@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26751
26752 spin_lock(&mdev->epoch_lock);
26753 e->epoch = mdev->current_epoch;
26754- atomic_inc(&e->epoch->epoch_size);
26755+ atomic_inc_unchecked(&e->epoch->epoch_size);
26756 atomic_inc(&e->epoch->active);
26757 spin_unlock(&mdev->epoch_lock);
26758
26759@@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
26760 D_ASSERT(list_empty(&mdev->done_ee));
26761
26762 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
26763- atomic_set(&mdev->current_epoch->epoch_size, 0);
26764+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
26765 D_ASSERT(list_empty(&mdev->current_epoch->list));
26766 }
26767
26768diff --git a/drivers/block/loop.c b/drivers/block/loop.c
26769index 4720c7a..2c49af1 100644
26770--- a/drivers/block/loop.c
26771+++ b/drivers/block/loop.c
26772@@ -283,7 +283,7 @@ static int __do_lo_send_write(struct file *file,
26773 mm_segment_t old_fs = get_fs();
26774
26775 set_fs(get_ds());
26776- bw = file->f_op->write(file, buf, len, &pos);
26777+ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
26778 set_fs(old_fs);
26779 if (likely(bw == len))
26780 return 0;
26781diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
26782index f533f33..6177bcb 100644
26783--- a/drivers/block/nbd.c
26784+++ b/drivers/block/nbd.c
26785@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
26786 struct kvec iov;
26787 sigset_t blocked, oldset;
26788
26789+ pax_track_stack();
26790+
26791 if (unlikely(!sock)) {
26792 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
26793 lo->disk->disk_name, (send ? "send" : "recv"));
26794@@ -572,6 +574,8 @@ static void do_nbd_request(struct request_queue *q)
26795 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
26796 unsigned int cmd, unsigned long arg)
26797 {
26798+ pax_track_stack();
26799+
26800 switch (cmd) {
26801 case NBD_DISCONNECT: {
26802 struct request sreq;
26803diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
26804index 423fd56..06d3be0 100644
26805--- a/drivers/char/Kconfig
26806+++ b/drivers/char/Kconfig
26807@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
26808
26809 config DEVKMEM
26810 bool "/dev/kmem virtual device support"
26811- default y
26812+ default n
26813+ depends on !GRKERNSEC_KMEM
26814 help
26815 Say Y here if you want to support the /dev/kmem device. The
26816 /dev/kmem device is rarely used, but can be used for certain
26817@@ -596,6 +597,7 @@ config DEVPORT
26818 bool
26819 depends on !M68K
26820 depends on ISA || PCI
26821+ depends on !GRKERNSEC_KMEM
26822 default y
26823
26824 source "drivers/s390/char/Kconfig"
26825diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
26826index 2e04433..22afc64 100644
26827--- a/drivers/char/agp/frontend.c
26828+++ b/drivers/char/agp/frontend.c
26829@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
26830 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
26831 return -EFAULT;
26832
26833- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
26834+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
26835 return -EFAULT;
26836
26837 client = agp_find_client_by_pid(reserve.pid);
26838diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
26839index 095ab90..afad0a4 100644
26840--- a/drivers/char/briq_panel.c
26841+++ b/drivers/char/briq_panel.c
26842@@ -9,6 +9,7 @@
26843 #include <linux/types.h>
26844 #include <linux/errno.h>
26845 #include <linux/tty.h>
26846+#include <linux/mutex.h>
26847 #include <linux/timer.h>
26848 #include <linux/kernel.h>
26849 #include <linux/wait.h>
26850@@ -34,6 +35,7 @@ static int vfd_is_open;
26851 static unsigned char vfd[40];
26852 static int vfd_cursor;
26853 static unsigned char ledpb, led;
26854+static DEFINE_MUTEX(vfd_mutex);
26855
26856 static void update_vfd(void)
26857 {
26858@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
26859 if (!vfd_is_open)
26860 return -EBUSY;
26861
26862+ mutex_lock(&vfd_mutex);
26863 for (;;) {
26864 char c;
26865 if (!indx)
26866 break;
26867- if (get_user(c, buf))
26868+ if (get_user(c, buf)) {
26869+ mutex_unlock(&vfd_mutex);
26870 return -EFAULT;
26871+ }
26872 if (esc) {
26873 set_led(c);
26874 esc = 0;
26875@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
26876 buf++;
26877 }
26878 update_vfd();
26879+ mutex_unlock(&vfd_mutex);
26880
26881 return len;
26882 }
26883diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
26884index f773a9d..65cd683 100644
26885--- a/drivers/char/genrtc.c
26886+++ b/drivers/char/genrtc.c
26887@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *file,
26888 switch (cmd) {
26889
26890 case RTC_PLL_GET:
26891+ memset(&pll, 0, sizeof(pll));
26892 if (get_rtc_pll(&pll))
26893 return -EINVAL;
26894 else
26895diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
26896index 0833896..cccce52 100644
26897--- a/drivers/char/hpet.c
26898+++ b/drivers/char/hpet.c
26899@@ -572,7 +572,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
26900 }
26901
26902 static int
26903-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
26904+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
26905 struct hpet_info *info)
26906 {
26907 struct hpet_timer __iomem *timer;
26908diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
26909index 58c0e63..25aed94 100644
26910--- a/drivers/char/ipmi/ipmi_msghandler.c
26911+++ b/drivers/char/ipmi/ipmi_msghandler.c
26912@@ -415,7 +415,7 @@ struct ipmi_smi {
26913 struct proc_dir_entry *proc_dir;
26914 char proc_dir_name[10];
26915
26916- atomic_t stats[IPMI_NUM_STATS];
26917+ atomic_unchecked_t stats[IPMI_NUM_STATS];
26918
26919 /*
26920 * run_to_completion duplicate of smb_info, smi_info
26921@@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
26922
26923
26924 #define ipmi_inc_stat(intf, stat) \
26925- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
26926+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
26927 #define ipmi_get_stat(intf, stat) \
26928- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
26929+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
26930
26931 static int is_lan_addr(struct ipmi_addr *addr)
26932 {
26933@@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
26934 INIT_LIST_HEAD(&intf->cmd_rcvrs);
26935 init_waitqueue_head(&intf->waitq);
26936 for (i = 0; i < IPMI_NUM_STATS; i++)
26937- atomic_set(&intf->stats[i], 0);
26938+ atomic_set_unchecked(&intf->stats[i], 0);
26939
26940 intf->proc_dir = NULL;
26941
26942@@ -4220,6 +4220,8 @@ static void send_panic_events(char *str)
26943 struct ipmi_smi_msg smi_msg;
26944 struct ipmi_recv_msg recv_msg;
26945
26946+ pax_track_stack();
26947+
26948 si = (struct ipmi_system_interface_addr *) &addr;
26949 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
26950 si->channel = IPMI_BMC_CHANNEL;
26951diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
26952index 9397ab4..d01bee1 100644
26953--- a/drivers/char/ipmi/ipmi_si_intf.c
26954+++ b/drivers/char/ipmi/ipmi_si_intf.c
26955@@ -277,7 +277,7 @@ struct smi_info {
26956 unsigned char slave_addr;
26957
26958 /* Counters and things for the proc filesystem. */
26959- atomic_t stats[SI_NUM_STATS];
26960+ atomic_unchecked_t stats[SI_NUM_STATS];
26961
26962 struct task_struct *thread;
26963
26964@@ -286,9 +286,9 @@ struct smi_info {
26965 };
26966
26967 #define smi_inc_stat(smi, stat) \
26968- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
26969+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
26970 #define smi_get_stat(smi, stat) \
26971- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
26972+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
26973
26974 #define SI_MAX_PARMS 4
26975
26976@@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info *new_smi)
26977 atomic_set(&new_smi->req_events, 0);
26978 new_smi->run_to_completion = 0;
26979 for (i = 0; i < SI_NUM_STATS; i++)
26980- atomic_set(&new_smi->stats[i], 0);
26981+ atomic_set_unchecked(&new_smi->stats[i], 0);
26982
26983 new_smi->interrupt_disabled = 1;
26984 atomic_set(&new_smi->stop_operation, 0);
26985diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
26986index 1aeaaba..e018570 100644
26987--- a/drivers/char/mbcs.c
26988+++ b/drivers/char/mbcs.c
26989@@ -800,7 +800,7 @@ static int mbcs_remove(struct cx_dev *dev)
26990 return 0;
26991 }
26992
26993-static const struct cx_device_id __devinitdata mbcs_id_table[] = {
26994+static const struct cx_device_id __devinitconst mbcs_id_table[] = {
26995 {
26996 .part_num = MBCS_PART_NUM,
26997 .mfg_num = MBCS_MFG_NUM,
26998diff --git a/drivers/char/mem.c b/drivers/char/mem.c
26999index 8fc04b4..cebdeec 100644
27000--- a/drivers/char/mem.c
27001+++ b/drivers/char/mem.c
27002@@ -18,6 +18,7 @@
27003 #include <linux/raw.h>
27004 #include <linux/tty.h>
27005 #include <linux/capability.h>
27006+#include <linux/security.h>
27007 #include <linux/ptrace.h>
27008 #include <linux/device.h>
27009 #include <linux/highmem.h>
27010@@ -34,6 +35,10 @@
27011 # include <linux/efi.h>
27012 #endif
27013
27014+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27015+extern const struct file_operations grsec_fops;
27016+#endif
27017+
27018 static inline unsigned long size_inside_page(unsigned long start,
27019 unsigned long size)
27020 {
27021@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27022
27023 while (cursor < to) {
27024 if (!devmem_is_allowed(pfn)) {
27025+#ifdef CONFIG_GRKERNSEC_KMEM
27026+ gr_handle_mem_readwrite(from, to);
27027+#else
27028 printk(KERN_INFO
27029 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
27030 current->comm, from, to);
27031+#endif
27032 return 0;
27033 }
27034 cursor += PAGE_SIZE;
27035@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27036 }
27037 return 1;
27038 }
27039+#elif defined(CONFIG_GRKERNSEC_KMEM)
27040+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27041+{
27042+ return 0;
27043+}
27044 #else
27045 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27046 {
27047@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27048
27049 while (count > 0) {
27050 unsigned long remaining;
27051+ char *temp;
27052
27053 sz = size_inside_page(p, count);
27054
27055@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27056 if (!ptr)
27057 return -EFAULT;
27058
27059- remaining = copy_to_user(buf, ptr, sz);
27060+#ifdef CONFIG_PAX_USERCOPY
27061+ temp = kmalloc(sz, GFP_KERNEL);
27062+ if (!temp) {
27063+ unxlate_dev_mem_ptr(p, ptr);
27064+ return -ENOMEM;
27065+ }
27066+ memcpy(temp, ptr, sz);
27067+#else
27068+ temp = ptr;
27069+#endif
27070+
27071+ remaining = copy_to_user(buf, temp, sz);
27072+
27073+#ifdef CONFIG_PAX_USERCOPY
27074+ kfree(temp);
27075+#endif
27076+
27077 unxlate_dev_mem_ptr(p, ptr);
27078 if (remaining)
27079 return -EFAULT;
27080@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27081 size_t count, loff_t *ppos)
27082 {
27083 unsigned long p = *ppos;
27084- ssize_t low_count, read, sz;
27085+ ssize_t low_count, read, sz, err = 0;
27086 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
27087- int err = 0;
27088
27089 read = 0;
27090 if (p < (unsigned long) high_memory) {
27091@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27092 }
27093 #endif
27094 while (low_count > 0) {
27095+ char *temp;
27096+
27097 sz = size_inside_page(p, low_count);
27098
27099 /*
27100@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27101 */
27102 kbuf = xlate_dev_kmem_ptr((char *)p);
27103
27104- if (copy_to_user(buf, kbuf, sz))
27105+#ifdef CONFIG_PAX_USERCOPY
27106+ temp = kmalloc(sz, GFP_KERNEL);
27107+ if (!temp)
27108+ return -ENOMEM;
27109+ memcpy(temp, kbuf, sz);
27110+#else
27111+ temp = kbuf;
27112+#endif
27113+
27114+ err = copy_to_user(buf, temp, sz);
27115+
27116+#ifdef CONFIG_PAX_USERCOPY
27117+ kfree(temp);
27118+#endif
27119+
27120+ if (err)
27121 return -EFAULT;
27122 buf += sz;
27123 p += sz;
27124@@ -866,6 +913,9 @@ static const struct memdev {
27125 #ifdef CONFIG_CRASH_DUMP
27126 [12] = { "oldmem", 0, &oldmem_fops, NULL },
27127 #endif
27128+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27129+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
27130+#endif
27131 };
27132
27133 static int memory_open(struct inode *inode, struct file *filp)
27134diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
27135index da3cfee..a5a6606 100644
27136--- a/drivers/char/nvram.c
27137+++ b/drivers/char/nvram.c
27138@@ -248,7 +248,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
27139
27140 spin_unlock_irq(&rtc_lock);
27141
27142- if (copy_to_user(buf, contents, tmp - contents))
27143+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
27144 return -EFAULT;
27145
27146 *ppos = i;
27147diff --git a/drivers/char/random.c b/drivers/char/random.c
27148index c35a785..6d82202 100644
27149--- a/drivers/char/random.c
27150+++ b/drivers/char/random.c
27151@@ -261,8 +261,13 @@
27152 /*
27153 * Configuration information
27154 */
27155+#ifdef CONFIG_GRKERNSEC_RANDNET
27156+#define INPUT_POOL_WORDS 512
27157+#define OUTPUT_POOL_WORDS 128
27158+#else
27159 #define INPUT_POOL_WORDS 128
27160 #define OUTPUT_POOL_WORDS 32
27161+#endif
27162 #define SEC_XFER_SIZE 512
27163 #define EXTRACT_SIZE 10
27164
27165@@ -300,10 +305,17 @@ static struct poolinfo {
27166 int poolwords;
27167 int tap1, tap2, tap3, tap4, tap5;
27168 } poolinfo_table[] = {
27169+#ifdef CONFIG_GRKERNSEC_RANDNET
27170+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
27171+ { 512, 411, 308, 208, 104, 1 },
27172+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
27173+ { 128, 103, 76, 51, 25, 1 },
27174+#else
27175 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
27176 { 128, 103, 76, 51, 25, 1 },
27177 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
27178 { 32, 26, 20, 14, 7, 1 },
27179+#endif
27180 #if 0
27181 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
27182 { 2048, 1638, 1231, 819, 411, 1 },
27183@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
27184
27185 extract_buf(r, tmp);
27186 i = min_t(int, nbytes, EXTRACT_SIZE);
27187- if (copy_to_user(buf, tmp, i)) {
27188+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
27189 ret = -EFAULT;
27190 break;
27191 }
27192@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
27193 #include <linux/sysctl.h>
27194
27195 static int min_read_thresh = 8, min_write_thresh;
27196-static int max_read_thresh = INPUT_POOL_WORDS * 32;
27197+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
27198 static int max_write_thresh = INPUT_POOL_WORDS * 32;
27199 static char sysctl_bootid[16];
27200
27201diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
27202index 1ee8ce7..b778bef 100644
27203--- a/drivers/char/sonypi.c
27204+++ b/drivers/char/sonypi.c
27205@@ -55,6 +55,7 @@
27206 #include <asm/uaccess.h>
27207 #include <asm/io.h>
27208 #include <asm/system.h>
27209+#include <asm/local.h>
27210
27211 #include <linux/sonypi.h>
27212
27213@@ -491,7 +492,7 @@ static struct sonypi_device {
27214 spinlock_t fifo_lock;
27215 wait_queue_head_t fifo_proc_list;
27216 struct fasync_struct *fifo_async;
27217- int open_count;
27218+ local_t open_count;
27219 int model;
27220 struct input_dev *input_jog_dev;
27221 struct input_dev *input_key_dev;
27222@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
27223 static int sonypi_misc_release(struct inode *inode, struct file *file)
27224 {
27225 mutex_lock(&sonypi_device.lock);
27226- sonypi_device.open_count--;
27227+ local_dec(&sonypi_device.open_count);
27228 mutex_unlock(&sonypi_device.lock);
27229 return 0;
27230 }
27231@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
27232 {
27233 mutex_lock(&sonypi_device.lock);
27234 /* Flush input queue on first open */
27235- if (!sonypi_device.open_count)
27236+ if (!local_read(&sonypi_device.open_count))
27237 kfifo_reset(&sonypi_device.fifo);
27238- sonypi_device.open_count++;
27239+ local_inc(&sonypi_device.open_count);
27240 mutex_unlock(&sonypi_device.lock);
27241
27242 return 0;
27243diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
27244index 9ca5c02..7ce352c 100644
27245--- a/drivers/char/tpm/tpm.c
27246+++ b/drivers/char/tpm/tpm.c
27247@@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
27248 chip->vendor.req_complete_val)
27249 goto out_recv;
27250
27251- if ((status == chip->vendor.req_canceled)) {
27252+ if (status == chip->vendor.req_canceled) {
27253 dev_err(chip->dev, "Operation Canceled\n");
27254 rc = -ECANCELED;
27255 goto out;
27256@@ -862,6 +862,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
27257
27258 struct tpm_chip *chip = dev_get_drvdata(dev);
27259
27260+ pax_track_stack();
27261+
27262 tpm_cmd.header.in = tpm_readpubek_header;
27263 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
27264 "attempting to read the PUBEK");
27265diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
27266index 0636520..169c1d0 100644
27267--- a/drivers/char/tpm/tpm_bios.c
27268+++ b/drivers/char/tpm/tpm_bios.c
27269@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
27270 event = addr;
27271
27272 if ((event->event_type == 0 && event->event_size == 0) ||
27273- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
27274+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
27275 return NULL;
27276
27277 return addr;
27278@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
27279 return NULL;
27280
27281 if ((event->event_type == 0 && event->event_size == 0) ||
27282- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
27283+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
27284 return NULL;
27285
27286 (*pos)++;
27287@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
27288 int i;
27289
27290 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
27291- seq_putc(m, data[i]);
27292+ if (!seq_putc(m, data[i]))
27293+ return -EFAULT;
27294
27295 return 0;
27296 }
27297@@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log *log)
27298 log->bios_event_log_end = log->bios_event_log + len;
27299
27300 virt = acpi_os_map_memory(start, len);
27301+ if (!virt) {
27302+ kfree(log->bios_event_log);
27303+ log->bios_event_log = NULL;
27304+ return -EFAULT;
27305+ }
27306
27307- memcpy(log->bios_event_log, virt, len);
27308+ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
27309
27310 acpi_os_unmap_memory(virt, len);
27311 return 0;
27312diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
27313index fb68b12..0f6c6ca 100644
27314--- a/drivers/char/virtio_console.c
27315+++ b/drivers/char/virtio_console.c
27316@@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
27317 if (to_user) {
27318 ssize_t ret;
27319
27320- ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
27321+ ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
27322 if (ret)
27323 return -EFAULT;
27324 } else {
27325@@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
27326 if (!port_has_data(port) && !port->host_connected)
27327 return 0;
27328
27329- return fill_readbuf(port, ubuf, count, true);
27330+ return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
27331 }
27332
27333 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
27334diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
27335index a84250a..68c725e 100644
27336--- a/drivers/crypto/hifn_795x.c
27337+++ b/drivers/crypto/hifn_795x.c
27338@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
27339 0xCA, 0x34, 0x2B, 0x2E};
27340 struct scatterlist sg;
27341
27342+ pax_track_stack();
27343+
27344 memset(src, 0, sizeof(src));
27345 memset(ctx.key, 0, sizeof(ctx.key));
27346
27347diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
27348index db33d30..7823369 100644
27349--- a/drivers/crypto/padlock-aes.c
27350+++ b/drivers/crypto/padlock-aes.c
27351@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
27352 struct crypto_aes_ctx gen_aes;
27353 int cpu;
27354
27355+ pax_track_stack();
27356+
27357 if (key_len % 8) {
27358 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
27359 return -EINVAL;
27360diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
27361index 9a8bebc..b1e4989 100644
27362--- a/drivers/edac/amd64_edac.c
27363+++ b/drivers/edac/amd64_edac.c
27364@@ -2670,7 +2670,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
27365 * PCI core identifies what devices are on a system during boot, and then
27366 * inquiry this table to see if this driver is for a given device found.
27367 */
27368-static const struct pci_device_id amd64_pci_table[] __devinitdata = {
27369+static const struct pci_device_id amd64_pci_table[] __devinitconst = {
27370 {
27371 .vendor = PCI_VENDOR_ID_AMD,
27372 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
27373diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
27374index e47e73b..348e0bd 100644
27375--- a/drivers/edac/amd76x_edac.c
27376+++ b/drivers/edac/amd76x_edac.c
27377@@ -321,7 +321,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
27378 edac_mc_free(mci);
27379 }
27380
27381-static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
27382+static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
27383 {
27384 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27385 AMD762},
27386diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
27387index 1af531a..3a8ff27 100644
27388--- a/drivers/edac/e752x_edac.c
27389+++ b/drivers/edac/e752x_edac.c
27390@@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
27391 edac_mc_free(mci);
27392 }
27393
27394-static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
27395+static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
27396 {
27397 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27398 E7520},
27399diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
27400index 6ffb6d2..383d8d7 100644
27401--- a/drivers/edac/e7xxx_edac.c
27402+++ b/drivers/edac/e7xxx_edac.c
27403@@ -525,7 +525,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
27404 edac_mc_free(mci);
27405 }
27406
27407-static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
27408+static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
27409 {
27410 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27411 E7205},
27412diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
27413index 495198a..ac08c85 100644
27414--- a/drivers/edac/edac_pci_sysfs.c
27415+++ b/drivers/edac/edac_pci_sysfs.c
27416@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
27417 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
27418 static int edac_pci_poll_msec = 1000; /* one second workq period */
27419
27420-static atomic_t pci_parity_count = ATOMIC_INIT(0);
27421-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
27422+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
27423+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
27424
27425 static struct kobject *edac_pci_top_main_kobj;
27426 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
27427@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27428 edac_printk(KERN_CRIT, EDAC_PCI,
27429 "Signaled System Error on %s\n",
27430 pci_name(dev));
27431- atomic_inc(&pci_nonparity_count);
27432+ atomic_inc_unchecked(&pci_nonparity_count);
27433 }
27434
27435 if (status & (PCI_STATUS_PARITY)) {
27436@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27437 "Master Data Parity Error on %s\n",
27438 pci_name(dev));
27439
27440- atomic_inc(&pci_parity_count);
27441+ atomic_inc_unchecked(&pci_parity_count);
27442 }
27443
27444 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27445@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27446 "Detected Parity Error on %s\n",
27447 pci_name(dev));
27448
27449- atomic_inc(&pci_parity_count);
27450+ atomic_inc_unchecked(&pci_parity_count);
27451 }
27452 }
27453
27454@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27455 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
27456 "Signaled System Error on %s\n",
27457 pci_name(dev));
27458- atomic_inc(&pci_nonparity_count);
27459+ atomic_inc_unchecked(&pci_nonparity_count);
27460 }
27461
27462 if (status & (PCI_STATUS_PARITY)) {
27463@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27464 "Master Data Parity Error on "
27465 "%s\n", pci_name(dev));
27466
27467- atomic_inc(&pci_parity_count);
27468+ atomic_inc_unchecked(&pci_parity_count);
27469 }
27470
27471 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27472@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27473 "Detected Parity Error on %s\n",
27474 pci_name(dev));
27475
27476- atomic_inc(&pci_parity_count);
27477+ atomic_inc_unchecked(&pci_parity_count);
27478 }
27479 }
27480 }
27481@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
27482 if (!check_pci_errors)
27483 return;
27484
27485- before_count = atomic_read(&pci_parity_count);
27486+ before_count = atomic_read_unchecked(&pci_parity_count);
27487
27488 /* scan all PCI devices looking for a Parity Error on devices and
27489 * bridges.
27490@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
27491 /* Only if operator has selected panic on PCI Error */
27492 if (edac_pci_get_panic_on_pe()) {
27493 /* If the count is different 'after' from 'before' */
27494- if (before_count != atomic_read(&pci_parity_count))
27495+ if (before_count != atomic_read_unchecked(&pci_parity_count))
27496 panic("EDAC: PCI Parity Error");
27497 }
27498 }
27499diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
27500index c0510b3..6e2a954 100644
27501--- a/drivers/edac/i3000_edac.c
27502+++ b/drivers/edac/i3000_edac.c
27503@@ -470,7 +470,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
27504 edac_mc_free(mci);
27505 }
27506
27507-static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
27508+static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
27509 {
27510 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27511 I3000},
27512diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
27513index aa08497..7e6822a 100644
27514--- a/drivers/edac/i3200_edac.c
27515+++ b/drivers/edac/i3200_edac.c
27516@@ -456,7 +456,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
27517 edac_mc_free(mci);
27518 }
27519
27520-static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
27521+static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
27522 {
27523 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27524 I3200},
27525diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
27526index 4dc3ac2..67d05a6 100644
27527--- a/drivers/edac/i5000_edac.c
27528+++ b/drivers/edac/i5000_edac.c
27529@@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
27530 *
27531 * The "E500P" device is the first device supported.
27532 */
27533-static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
27534+static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
27535 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
27536 .driver_data = I5000P},
27537
27538diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
27539index bcbdeec..9886d16 100644
27540--- a/drivers/edac/i5100_edac.c
27541+++ b/drivers/edac/i5100_edac.c
27542@@ -1051,7 +1051,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
27543 edac_mc_free(mci);
27544 }
27545
27546-static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
27547+static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
27548 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
27549 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
27550 { 0, }
27551diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
27552index 74d6ec34..baff517 100644
27553--- a/drivers/edac/i5400_edac.c
27554+++ b/drivers/edac/i5400_edac.c
27555@@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
27556 *
27557 * The "E500P" device is the first device supported.
27558 */
27559-static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
27560+static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
27561 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
27562 {0,} /* 0 terminated list. */
27563 };
27564diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
27565index a76fe83..15479e6 100644
27566--- a/drivers/edac/i7300_edac.c
27567+++ b/drivers/edac/i7300_edac.c
27568@@ -1191,7 +1191,7 @@ static void __devexit i7300_remove_one(struct pci_dev *pdev)
27569 *
27570 * Has only 8086:360c PCI ID
27571 */
27572-static const struct pci_device_id i7300_pci_tbl[] __devinitdata = {
27573+static const struct pci_device_id i7300_pci_tbl[] __devinitconst = {
27574 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
27575 {0,} /* 0 terminated list. */
27576 };
27577diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
27578index f6cf448..3f612e9 100644
27579--- a/drivers/edac/i7core_edac.c
27580+++ b/drivers/edac/i7core_edac.c
27581@@ -359,7 +359,7 @@ static const struct pci_id_table pci_dev_table[] = {
27582 /*
27583 * pci_device_id table for which devices we are looking for
27584 */
27585-static const struct pci_device_id i7core_pci_tbl[] __devinitdata = {
27586+static const struct pci_device_id i7core_pci_tbl[] __devinitconst = {
27587 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
27588 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
27589 {0,} /* 0 terminated list. */
27590diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
27591index 4329d39..f3022ef 100644
27592--- a/drivers/edac/i82443bxgx_edac.c
27593+++ b/drivers/edac/i82443bxgx_edac.c
27594@@ -380,7 +380,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
27595
27596 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
27597
27598-static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
27599+static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
27600 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
27601 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
27602 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
27603diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
27604index 931a057..fd28340 100644
27605--- a/drivers/edac/i82860_edac.c
27606+++ b/drivers/edac/i82860_edac.c
27607@@ -270,7 +270,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
27608 edac_mc_free(mci);
27609 }
27610
27611-static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
27612+static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
27613 {
27614 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27615 I82860},
27616diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
27617index 33864c6..01edc61 100644
27618--- a/drivers/edac/i82875p_edac.c
27619+++ b/drivers/edac/i82875p_edac.c
27620@@ -511,7 +511,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
27621 edac_mc_free(mci);
27622 }
27623
27624-static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
27625+static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
27626 {
27627 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27628 I82875P},
27629diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
27630index a5da732..983363b 100644
27631--- a/drivers/edac/i82975x_edac.c
27632+++ b/drivers/edac/i82975x_edac.c
27633@@ -604,7 +604,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
27634 edac_mc_free(mci);
27635 }
27636
27637-static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
27638+static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
27639 {
27640 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27641 I82975X
27642diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
27643index 795a320..3bbc3d3 100644
27644--- a/drivers/edac/mce_amd.h
27645+++ b/drivers/edac/mce_amd.h
27646@@ -83,7 +83,7 @@ struct amd_decoder_ops {
27647 bool (*dc_mce)(u16, u8);
27648 bool (*ic_mce)(u16, u8);
27649 bool (*nb_mce)(u16, u8);
27650-};
27651+} __no_const;
27652
27653 void amd_report_gart_errors(bool);
27654 void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
27655diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
27656index b153674..ad2ba9b 100644
27657--- a/drivers/edac/r82600_edac.c
27658+++ b/drivers/edac/r82600_edac.c
27659@@ -373,7 +373,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
27660 edac_mc_free(mci);
27661 }
27662
27663-static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
27664+static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
27665 {
27666 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
27667 },
27668diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
27669index b6f47de..c5acf3a 100644
27670--- a/drivers/edac/x38_edac.c
27671+++ b/drivers/edac/x38_edac.c
27672@@ -440,7 +440,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
27673 edac_mc_free(mci);
27674 }
27675
27676-static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
27677+static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
27678 {
27679 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27680 X38},
27681diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
27682index 85661b0..c784559a 100644
27683--- a/drivers/firewire/core-card.c
27684+++ b/drivers/firewire/core-card.c
27685@@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref)
27686
27687 void fw_core_remove_card(struct fw_card *card)
27688 {
27689- struct fw_card_driver dummy_driver = dummy_driver_template;
27690+ fw_card_driver_no_const dummy_driver = dummy_driver_template;
27691
27692 card->driver->update_phy_reg(card, 4,
27693 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
27694diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
27695index 4799393..37bd3ab 100644
27696--- a/drivers/firewire/core-cdev.c
27697+++ b/drivers/firewire/core-cdev.c
27698@@ -1331,8 +1331,7 @@ static int init_iso_resource(struct client *client,
27699 int ret;
27700
27701 if ((request->channels == 0 && request->bandwidth == 0) ||
27702- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
27703- request->bandwidth < 0)
27704+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
27705 return -EINVAL;
27706
27707 r = kmalloc(sizeof(*r), GFP_KERNEL);
27708diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
27709index 334b82a..ea5261d 100644
27710--- a/drivers/firewire/core-transaction.c
27711+++ b/drivers/firewire/core-transaction.c
27712@@ -37,6 +37,7 @@
27713 #include <linux/timer.h>
27714 #include <linux/types.h>
27715 #include <linux/workqueue.h>
27716+#include <linux/sched.h>
27717
27718 #include <asm/byteorder.h>
27719
27720@@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
27721 struct transaction_callback_data d;
27722 struct fw_transaction t;
27723
27724+ pax_track_stack();
27725+
27726 init_timer_on_stack(&t.split_timeout_timer);
27727 init_completion(&d.done);
27728 d.payload = payload;
27729diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
27730index b45be57..5fad18b 100644
27731--- a/drivers/firewire/core.h
27732+++ b/drivers/firewire/core.h
27733@@ -101,6 +101,7 @@ struct fw_card_driver {
27734
27735 int (*stop_iso)(struct fw_iso_context *ctx);
27736 };
27737+typedef struct fw_card_driver __no_const fw_card_driver_no_const;
27738
27739 void fw_card_initialize(struct fw_card *card,
27740 const struct fw_card_driver *driver, struct device *device);
27741diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
27742index bcb1126..2cc2121 100644
27743--- a/drivers/firmware/dmi_scan.c
27744+++ b/drivers/firmware/dmi_scan.c
27745@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
27746 }
27747 }
27748 else {
27749- /*
27750- * no iounmap() for that ioremap(); it would be a no-op, but
27751- * it's so early in setup that sucker gets confused into doing
27752- * what it shouldn't if we actually call it.
27753- */
27754 p = dmi_ioremap(0xF0000, 0x10000);
27755 if (p == NULL)
27756 goto error;
27757@@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
27758 if (buf == NULL)
27759 return -1;
27760
27761- dmi_table(buf, dmi_len, dmi_num, decode, private_data);
27762+ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
27763
27764 iounmap(buf);
27765 return 0;
27766diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
27767index 98723cb..10ca85b 100644
27768--- a/drivers/gpio/gpio-vr41xx.c
27769+++ b/drivers/gpio/gpio-vr41xx.c
27770@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
27771 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
27772 maskl, pendl, maskh, pendh);
27773
27774- atomic_inc(&irq_err_count);
27775+ atomic_inc_unchecked(&irq_err_count);
27776
27777 return -EINVAL;
27778 }
27779diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
27780index 2410c40..2d03563 100644
27781--- a/drivers/gpu/drm/drm_crtc.c
27782+++ b/drivers/gpu/drm/drm_crtc.c
27783@@ -1374,7 +1374,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27784 */
27785 if ((out_resp->count_modes >= mode_count) && mode_count) {
27786 copied = 0;
27787- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
27788+ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
27789 list_for_each_entry(mode, &connector->modes, head) {
27790 drm_crtc_convert_to_umode(&u_mode, mode);
27791 if (copy_to_user(mode_ptr + copied,
27792@@ -1389,8 +1389,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27793
27794 if ((out_resp->count_props >= props_count) && props_count) {
27795 copied = 0;
27796- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
27797- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
27798+ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
27799+ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
27800 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
27801 if (connector->property_ids[i] != 0) {
27802 if (put_user(connector->property_ids[i],
27803@@ -1412,7 +1412,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27804
27805 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
27806 copied = 0;
27807- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
27808+ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
27809 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
27810 if (connector->encoder_ids[i] != 0) {
27811 if (put_user(connector->encoder_ids[i],
27812@@ -1571,7 +1571,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
27813 }
27814
27815 for (i = 0; i < crtc_req->count_connectors; i++) {
27816- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
27817+ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
27818 if (get_user(out_id, &set_connectors_ptr[i])) {
27819 ret = -EFAULT;
27820 goto out;
27821@@ -1852,7 +1852,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
27822 fb = obj_to_fb(obj);
27823
27824 num_clips = r->num_clips;
27825- clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
27826+ clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
27827
27828 if (!num_clips != !clips_ptr) {
27829 ret = -EINVAL;
27830@@ -2276,7 +2276,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27831 out_resp->flags = property->flags;
27832
27833 if ((out_resp->count_values >= value_count) && value_count) {
27834- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
27835+ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
27836 for (i = 0; i < value_count; i++) {
27837 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
27838 ret = -EFAULT;
27839@@ -2289,7 +2289,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27840 if (property->flags & DRM_MODE_PROP_ENUM) {
27841 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
27842 copied = 0;
27843- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
27844+ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
27845 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
27846
27847 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
27848@@ -2312,7 +2312,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27849 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
27850 copied = 0;
27851 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
27852- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
27853+ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
27854
27855 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
27856 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
27857@@ -2373,7 +2373,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
27858 struct drm_mode_get_blob *out_resp = data;
27859 struct drm_property_blob *blob;
27860 int ret = 0;
27861- void *blob_ptr;
27862+ void __user *blob_ptr;
27863
27864 if (!drm_core_check_feature(dev, DRIVER_MODESET))
27865 return -EINVAL;
27866@@ -2387,7 +2387,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
27867 blob = obj_to_blob(obj);
27868
27869 if (out_resp->length == blob->length) {
27870- blob_ptr = (void *)(unsigned long)out_resp->data;
27871+ blob_ptr = (void __user *)(unsigned long)out_resp->data;
27872 if (copy_to_user(blob_ptr, blob->data, blob->length)){
27873 ret = -EFAULT;
27874 goto done;
27875diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
27876index f88a9b2..8f4078f 100644
27877--- a/drivers/gpu/drm/drm_crtc_helper.c
27878+++ b/drivers/gpu/drm/drm_crtc_helper.c
27879@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
27880 struct drm_crtc *tmp;
27881 int crtc_mask = 1;
27882
27883- WARN(!crtc, "checking null crtc?\n");
27884+ BUG_ON(!crtc);
27885
27886 dev = crtc->dev;
27887
27888@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
27889 struct drm_encoder *encoder;
27890 bool ret = true;
27891
27892+ pax_track_stack();
27893+
27894 crtc->enabled = drm_helper_crtc_in_use(crtc);
27895 if (!crtc->enabled)
27896 return true;
27897diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
27898index 93a112d..c8b065d 100644
27899--- a/drivers/gpu/drm/drm_drv.c
27900+++ b/drivers/gpu/drm/drm_drv.c
27901@@ -307,7 +307,7 @@ module_exit(drm_core_exit);
27902 /**
27903 * Copy and IOCTL return string to user space
27904 */
27905-static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
27906+static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
27907 {
27908 int len;
27909
27910@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
27911
27912 dev = file_priv->minor->dev;
27913 atomic_inc(&dev->ioctl_count);
27914- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
27915+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
27916 ++file_priv->ioctl_count;
27917
27918 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
27919diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
27920index 2ec7d48..be14bb1 100644
27921--- a/drivers/gpu/drm/drm_fops.c
27922+++ b/drivers/gpu/drm/drm_fops.c
27923@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device * dev)
27924 }
27925
27926 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
27927- atomic_set(&dev->counts[i], 0);
27928+ atomic_set_unchecked(&dev->counts[i], 0);
27929
27930 dev->sigdata.lock = NULL;
27931
27932@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct file *filp)
27933
27934 retcode = drm_open_helper(inode, filp, dev);
27935 if (!retcode) {
27936- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
27937- if (!dev->open_count++)
27938+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
27939+ if (local_inc_return(&dev->open_count) == 1)
27940 retcode = drm_setup(dev);
27941 }
27942 if (!retcode) {
27943@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, struct file *filp)
27944
27945 mutex_lock(&drm_global_mutex);
27946
27947- DRM_DEBUG("open_count = %d\n", dev->open_count);
27948+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
27949
27950 if (dev->driver->preclose)
27951 dev->driver->preclose(dev, file_priv);
27952@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, struct file *filp)
27953 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
27954 task_pid_nr(current),
27955 (long)old_encode_dev(file_priv->minor->device),
27956- dev->open_count);
27957+ local_read(&dev->open_count));
27958
27959 /* if the master has gone away we can't do anything with the lock */
27960 if (file_priv->minor->master)
27961@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, struct file *filp)
27962 * End inline drm_release
27963 */
27964
27965- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
27966- if (!--dev->open_count) {
27967+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
27968+ if (local_dec_and_test(&dev->open_count)) {
27969 if (atomic_read(&dev->ioctl_count)) {
27970 DRM_ERROR("Device busy: %d\n",
27971 atomic_read(&dev->ioctl_count));
27972diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
27973index c87dc96..326055d 100644
27974--- a/drivers/gpu/drm/drm_global.c
27975+++ b/drivers/gpu/drm/drm_global.c
27976@@ -36,7 +36,7 @@
27977 struct drm_global_item {
27978 struct mutex mutex;
27979 void *object;
27980- int refcount;
27981+ atomic_t refcount;
27982 };
27983
27984 static struct drm_global_item glob[DRM_GLOBAL_NUM];
27985@@ -49,7 +49,7 @@ void drm_global_init(void)
27986 struct drm_global_item *item = &glob[i];
27987 mutex_init(&item->mutex);
27988 item->object = NULL;
27989- item->refcount = 0;
27990+ atomic_set(&item->refcount, 0);
27991 }
27992 }
27993
27994@@ -59,7 +59,7 @@ void drm_global_release(void)
27995 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
27996 struct drm_global_item *item = &glob[i];
27997 BUG_ON(item->object != NULL);
27998- BUG_ON(item->refcount != 0);
27999+ BUG_ON(atomic_read(&item->refcount) != 0);
28000 }
28001 }
28002
28003@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28004 void *object;
28005
28006 mutex_lock(&item->mutex);
28007- if (item->refcount == 0) {
28008+ if (atomic_read(&item->refcount) == 0) {
28009 item->object = kzalloc(ref->size, GFP_KERNEL);
28010 if (unlikely(item->object == NULL)) {
28011 ret = -ENOMEM;
28012@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28013 goto out_err;
28014
28015 }
28016- ++item->refcount;
28017+ atomic_inc(&item->refcount);
28018 ref->object = item->object;
28019 object = item->object;
28020 mutex_unlock(&item->mutex);
28021@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
28022 struct drm_global_item *item = &glob[ref->global_type];
28023
28024 mutex_lock(&item->mutex);
28025- BUG_ON(item->refcount == 0);
28026+ BUG_ON(atomic_read(&item->refcount) == 0);
28027 BUG_ON(ref->object != item->object);
28028- if (--item->refcount == 0) {
28029+ if (atomic_dec_and_test(&item->refcount)) {
28030 ref->release(ref);
28031 item->object = NULL;
28032 }
28033diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
28034index ab1162d..42587b2 100644
28035--- a/drivers/gpu/drm/drm_info.c
28036+++ b/drivers/gpu/drm/drm_info.c
28037@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
28038 struct drm_local_map *map;
28039 struct drm_map_list *r_list;
28040
28041- /* Hardcoded from _DRM_FRAME_BUFFER,
28042- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28043- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28044- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28045+ static const char * const types[] = {
28046+ [_DRM_FRAME_BUFFER] = "FB",
28047+ [_DRM_REGISTERS] = "REG",
28048+ [_DRM_SHM] = "SHM",
28049+ [_DRM_AGP] = "AGP",
28050+ [_DRM_SCATTER_GATHER] = "SG",
28051+ [_DRM_CONSISTENT] = "PCI",
28052+ [_DRM_GEM] = "GEM" };
28053 const char *type;
28054 int i;
28055
28056@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
28057 map = r_list->map;
28058 if (!map)
28059 continue;
28060- if (map->type < 0 || map->type > 5)
28061+ if (map->type >= ARRAY_SIZE(types))
28062 type = "??";
28063 else
28064 type = types[map->type];
28065@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, void *data)
28066 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28067 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28068 vma->vm_flags & VM_IO ? 'i' : '-',
28069+#ifdef CONFIG_GRKERNSEC_HIDESYM
28070+ 0);
28071+#else
28072 vma->vm_pgoff);
28073+#endif
28074
28075 #if defined(__i386__)
28076 pgprot = pgprot_val(vma->vm_page_prot);
28077diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
28078index 4a058c7..b42cd92 100644
28079--- a/drivers/gpu/drm/drm_ioc32.c
28080+++ b/drivers/gpu/drm/drm_ioc32.c
28081@@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
28082 request = compat_alloc_user_space(nbytes);
28083 if (!access_ok(VERIFY_WRITE, request, nbytes))
28084 return -EFAULT;
28085- list = (struct drm_buf_desc *) (request + 1);
28086+ list = (struct drm_buf_desc __user *) (request + 1);
28087
28088 if (__put_user(count, &request->count)
28089 || __put_user(list, &request->list))
28090@@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
28091 request = compat_alloc_user_space(nbytes);
28092 if (!access_ok(VERIFY_WRITE, request, nbytes))
28093 return -EFAULT;
28094- list = (struct drm_buf_pub *) (request + 1);
28095+ list = (struct drm_buf_pub __user *) (request + 1);
28096
28097 if (__put_user(count, &request->count)
28098 || __put_user(list, &request->list))
28099diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
28100index 904d7e9..ab88581 100644
28101--- a/drivers/gpu/drm/drm_ioctl.c
28102+++ b/drivers/gpu/drm/drm_ioctl.c
28103@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev, void *data,
28104 stats->data[i].value =
28105 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28106 else
28107- stats->data[i].value = atomic_read(&dev->counts[i]);
28108+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28109 stats->data[i].type = dev->types[i];
28110 }
28111
28112diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
28113index 632ae24..244cf4a 100644
28114--- a/drivers/gpu/drm/drm_lock.c
28115+++ b/drivers/gpu/drm/drm_lock.c
28116@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28117 if (drm_lock_take(&master->lock, lock->context)) {
28118 master->lock.file_priv = file_priv;
28119 master->lock.lock_time = jiffies;
28120- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28121+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28122 break; /* Got lock */
28123 }
28124
28125@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28126 return -EINVAL;
28127 }
28128
28129- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28130+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28131
28132 if (drm_lock_free(&master->lock, lock->context)) {
28133 /* FIXME: Should really bail out here. */
28134diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
28135index 8f371e8..9f85d52 100644
28136--- a/drivers/gpu/drm/i810/i810_dma.c
28137+++ b/drivers/gpu/drm/i810/i810_dma.c
28138@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
28139 dma->buflist[vertex->idx],
28140 vertex->discard, vertex->used);
28141
28142- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28143- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28144+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28145+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28146 sarea_priv->last_enqueue = dev_priv->counter - 1;
28147 sarea_priv->last_dispatch = (int)hw_status[5];
28148
28149@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
28150 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28151 mc->last_render);
28152
28153- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28154- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28155+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28156+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28157 sarea_priv->last_enqueue = dev_priv->counter - 1;
28158 sarea_priv->last_dispatch = (int)hw_status[5];
28159
28160diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
28161index c9339f4..f5e1b9d 100644
28162--- a/drivers/gpu/drm/i810/i810_drv.h
28163+++ b/drivers/gpu/drm/i810/i810_drv.h
28164@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28165 int page_flipping;
28166
28167 wait_queue_head_t irq_queue;
28168- atomic_t irq_received;
28169- atomic_t irq_emitted;
28170+ atomic_unchecked_t irq_received;
28171+ atomic_unchecked_t irq_emitted;
28172
28173 int front_offset;
28174 } drm_i810_private_t;
28175diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
28176index 3c395a5..02889c2 100644
28177--- a/drivers/gpu/drm/i915/i915_debugfs.c
28178+++ b/drivers/gpu/drm/i915/i915_debugfs.c
28179@@ -497,7 +497,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
28180 I915_READ(GTIMR));
28181 }
28182 seq_printf(m, "Interrupts received: %d\n",
28183- atomic_read(&dev_priv->irq_received));
28184+ atomic_read_unchecked(&dev_priv->irq_received));
28185 for (i = 0; i < I915_NUM_RINGS; i++) {
28186 if (IS_GEN6(dev) || IS_GEN7(dev)) {
28187 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
28188@@ -1185,7 +1185,7 @@ static int i915_opregion(struct seq_file *m, void *unused)
28189 return ret;
28190
28191 if (opregion->header)
28192- seq_write(m, opregion->header, OPREGION_SIZE);
28193+ seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE);
28194
28195 mutex_unlock(&dev->struct_mutex);
28196
28197diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
28198index 8a3942c..1b73bf1 100644
28199--- a/drivers/gpu/drm/i915/i915_dma.c
28200+++ b/drivers/gpu/drm/i915/i915_dma.c
28201@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
28202 bool can_switch;
28203
28204 spin_lock(&dev->count_lock);
28205- can_switch = (dev->open_count == 0);
28206+ can_switch = (local_read(&dev->open_count) == 0);
28207 spin_unlock(&dev->count_lock);
28208 return can_switch;
28209 }
28210diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
28211index 7916bd9..7c17a0f 100644
28212--- a/drivers/gpu/drm/i915/i915_drv.h
28213+++ b/drivers/gpu/drm/i915/i915_drv.h
28214@@ -222,7 +222,7 @@ struct drm_i915_display_funcs {
28215 /* render clock increase/decrease */
28216 /* display clock increase/decrease */
28217 /* pll clock increase/decrease */
28218-};
28219+} __no_const;
28220
28221 struct intel_device_info {
28222 u8 gen;
28223@@ -305,7 +305,7 @@ typedef struct drm_i915_private {
28224 int current_page;
28225 int page_flipping;
28226
28227- atomic_t irq_received;
28228+ atomic_unchecked_t irq_received;
28229
28230 /* protects the irq masks */
28231 spinlock_t irq_lock;
28232@@ -882,7 +882,7 @@ struct drm_i915_gem_object {
28233 * will be page flipped away on the next vblank. When it
28234 * reaches 0, dev_priv->pending_flip_queue will be woken up.
28235 */
28236- atomic_t pending_flip;
28237+ atomic_unchecked_t pending_flip;
28238 };
28239
28240 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
28241@@ -1262,7 +1262,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
28242 extern void intel_teardown_gmbus(struct drm_device *dev);
28243 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
28244 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
28245-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28246+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28247 {
28248 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
28249 }
28250diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28251index 4934cf8..1da9c84 100644
28252--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28253+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28254@@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
28255 i915_gem_clflush_object(obj);
28256
28257 if (obj->base.pending_write_domain)
28258- cd->flips |= atomic_read(&obj->pending_flip);
28259+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
28260
28261 /* The actual obj->write_domain will be updated with
28262 * pending_write_domain after we emit the accumulated flush for all
28263@@ -864,9 +864,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
28264
28265 static int
28266 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
28267- int count)
28268+ unsigned int count)
28269 {
28270- int i;
28271+ unsigned int i;
28272
28273 for (i = 0; i < count; i++) {
28274 char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
28275diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
28276index 73248d0..f7bac29 100644
28277--- a/drivers/gpu/drm/i915/i915_irq.c
28278+++ b/drivers/gpu/drm/i915/i915_irq.c
28279@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
28280 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
28281 struct drm_i915_master_private *master_priv;
28282
28283- atomic_inc(&dev_priv->irq_received);
28284+ atomic_inc_unchecked(&dev_priv->irq_received);
28285
28286 /* disable master interrupt before clearing iir */
28287 de_ier = I915_READ(DEIER);
28288@@ -565,7 +565,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
28289 struct drm_i915_master_private *master_priv;
28290 u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
28291
28292- atomic_inc(&dev_priv->irq_received);
28293+ atomic_inc_unchecked(&dev_priv->irq_received);
28294
28295 if (IS_GEN6(dev))
28296 bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
28297@@ -1229,7 +1229,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
28298 int ret = IRQ_NONE, pipe;
28299 bool blc_event = false;
28300
28301- atomic_inc(&dev_priv->irq_received);
28302+ atomic_inc_unchecked(&dev_priv->irq_received);
28303
28304 iir = I915_READ(IIR);
28305
28306@@ -1741,7 +1741,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
28307 {
28308 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28309
28310- atomic_set(&dev_priv->irq_received, 0);
28311+ atomic_set_unchecked(&dev_priv->irq_received, 0);
28312
28313 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28314 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28315@@ -1905,7 +1905,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
28316 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28317 int pipe;
28318
28319- atomic_set(&dev_priv->irq_received, 0);
28320+ atomic_set_unchecked(&dev_priv->irq_received, 0);
28321
28322 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28323 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28324diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
28325index 07e7cf3..c75f312 100644
28326--- a/drivers/gpu/drm/i915/intel_display.c
28327+++ b/drivers/gpu/drm/i915/intel_display.c
28328@@ -2205,7 +2205,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
28329
28330 wait_event(dev_priv->pending_flip_queue,
28331 atomic_read(&dev_priv->mm.wedged) ||
28332- atomic_read(&obj->pending_flip) == 0);
28333+ atomic_read_unchecked(&obj->pending_flip) == 0);
28334
28335 /* Big Hammer, we also need to ensure that any pending
28336 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
28337@@ -2826,7 +2826,7 @@ static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
28338 obj = to_intel_framebuffer(crtc->fb)->obj;
28339 dev_priv = crtc->dev->dev_private;
28340 wait_event(dev_priv->pending_flip_queue,
28341- atomic_read(&obj->pending_flip) == 0);
28342+ atomic_read_unchecked(&obj->pending_flip) == 0);
28343 }
28344
28345 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
28346@@ -6676,7 +6676,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
28347
28348 atomic_clear_mask(1 << intel_crtc->plane,
28349 &obj->pending_flip.counter);
28350- if (atomic_read(&obj->pending_flip) == 0)
28351+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
28352 wake_up(&dev_priv->pending_flip_queue);
28353
28354 schedule_work(&work->work);
28355@@ -6965,7 +6965,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28356 /* Block clients from rendering to the new back buffer until
28357 * the flip occurs and the object is no longer visible.
28358 */
28359- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28360+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28361
28362 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
28363 if (ret)
28364@@ -6979,7 +6979,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28365 return 0;
28366
28367 cleanup_pending:
28368- atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28369+ atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28370 cleanup_objs:
28371 drm_gem_object_unreference(&work->old_fb_obj->base);
28372 drm_gem_object_unreference(&obj->base);
28373diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
28374index 54558a0..2d97005 100644
28375--- a/drivers/gpu/drm/mga/mga_drv.h
28376+++ b/drivers/gpu/drm/mga/mga_drv.h
28377@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
28378 u32 clear_cmd;
28379 u32 maccess;
28380
28381- atomic_t vbl_received; /**< Number of vblanks received. */
28382+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
28383 wait_queue_head_t fence_queue;
28384- atomic_t last_fence_retired;
28385+ atomic_unchecked_t last_fence_retired;
28386 u32 next_fence_to_post;
28387
28388 unsigned int fb_cpp;
28389diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
28390index 2581202..f230a8d9 100644
28391--- a/drivers/gpu/drm/mga/mga_irq.c
28392+++ b/drivers/gpu/drm/mga/mga_irq.c
28393@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
28394 if (crtc != 0)
28395 return 0;
28396
28397- return atomic_read(&dev_priv->vbl_received);
28398+ return atomic_read_unchecked(&dev_priv->vbl_received);
28399 }
28400
28401
28402@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28403 /* VBLANK interrupt */
28404 if (status & MGA_VLINEPEN) {
28405 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
28406- atomic_inc(&dev_priv->vbl_received);
28407+ atomic_inc_unchecked(&dev_priv->vbl_received);
28408 drm_handle_vblank(dev, 0);
28409 handled = 1;
28410 }
28411@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28412 if ((prim_start & ~0x03) != (prim_end & ~0x03))
28413 MGA_WRITE(MGA_PRIMEND, prim_end);
28414
28415- atomic_inc(&dev_priv->last_fence_retired);
28416+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
28417 DRM_WAKEUP(&dev_priv->fence_queue);
28418 handled = 1;
28419 }
28420@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
28421 * using fences.
28422 */
28423 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
28424- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
28425+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
28426 - *sequence) <= (1 << 23)));
28427
28428 *sequence = cur_fence;
28429diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
28430index b311fab..dc11d6a 100644
28431--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
28432+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
28433@@ -201,7 +201,7 @@ struct methods {
28434 const char desc[8];
28435 void (*loadbios)(struct drm_device *, uint8_t *);
28436 const bool rw;
28437-};
28438+} __do_const;
28439
28440 static struct methods shadow_methods[] = {
28441 { "PRAMIN", load_vbios_pramin, true },
28442@@ -5489,7 +5489,7 @@ parse_bit_displayport_tbl_entry(struct drm_device *dev, struct nvbios *bios,
28443 struct bit_table {
28444 const char id;
28445 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
28446-};
28447+} __no_const;
28448
28449 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
28450
28451diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
28452index d7d51de..7c6a7f1 100644
28453--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
28454+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
28455@@ -238,7 +238,7 @@ struct nouveau_channel {
28456 struct list_head pending;
28457 uint32_t sequence;
28458 uint32_t sequence_ack;
28459- atomic_t last_sequence_irq;
28460+ atomic_unchecked_t last_sequence_irq;
28461 struct nouveau_vma vma;
28462 } fence;
28463
28464@@ -319,7 +319,7 @@ struct nouveau_exec_engine {
28465 u32 handle, u16 class);
28466 void (*set_tile_region)(struct drm_device *dev, int i);
28467 void (*tlb_flush)(struct drm_device *, int engine);
28468-};
28469+} __no_const;
28470
28471 struct nouveau_instmem_engine {
28472 void *priv;
28473@@ -341,13 +341,13 @@ struct nouveau_instmem_engine {
28474 struct nouveau_mc_engine {
28475 int (*init)(struct drm_device *dev);
28476 void (*takedown)(struct drm_device *dev);
28477-};
28478+} __no_const;
28479
28480 struct nouveau_timer_engine {
28481 int (*init)(struct drm_device *dev);
28482 void (*takedown)(struct drm_device *dev);
28483 uint64_t (*read)(struct drm_device *dev);
28484-};
28485+} __no_const;
28486
28487 struct nouveau_fb_engine {
28488 int num_tiles;
28489@@ -513,7 +513,7 @@ struct nouveau_vram_engine {
28490 void (*put)(struct drm_device *, struct nouveau_mem **);
28491
28492 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
28493-};
28494+} __no_const;
28495
28496 struct nouveau_engine {
28497 struct nouveau_instmem_engine instmem;
28498@@ -660,7 +660,7 @@ struct drm_nouveau_private {
28499 struct drm_global_reference mem_global_ref;
28500 struct ttm_bo_global_ref bo_global_ref;
28501 struct ttm_bo_device bdev;
28502- atomic_t validate_sequence;
28503+ atomic_unchecked_t validate_sequence;
28504 } ttm;
28505
28506 struct {
28507diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
28508index ae22dfa..4f09960 100644
28509--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
28510+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
28511@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_channel *chan)
28512 if (USE_REFCNT(dev))
28513 sequence = nvchan_rd32(chan, 0x48);
28514 else
28515- sequence = atomic_read(&chan->fence.last_sequence_irq);
28516+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
28517
28518 if (chan->fence.sequence_ack == sequence)
28519 goto out;
28520@@ -539,7 +539,7 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
28521 return ret;
28522 }
28523
28524- atomic_set(&chan->fence.last_sequence_irq, 0);
28525+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
28526 return 0;
28527 }
28528
28529diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
28530index 5f0bc57..eb9fac8 100644
28531--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
28532+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
28533@@ -314,7 +314,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
28534 int trycnt = 0;
28535 int ret, i;
28536
28537- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
28538+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
28539 retry:
28540 if (++trycnt > 100000) {
28541 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
28542diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
28543index 10656e4..59bf2a4 100644
28544--- a/drivers/gpu/drm/nouveau/nouveau_state.c
28545+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
28546@@ -496,7 +496,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev)
28547 bool can_switch;
28548
28549 spin_lock(&dev->count_lock);
28550- can_switch = (dev->open_count == 0);
28551+ can_switch = (local_read(&dev->open_count) == 0);
28552 spin_unlock(&dev->count_lock);
28553 return can_switch;
28554 }
28555diff --git a/drivers/gpu/drm/nouveau/nv04_graph.c b/drivers/gpu/drm/nouveau/nv04_graph.c
28556index dbdea8e..cd6eeeb 100644
28557--- a/drivers/gpu/drm/nouveau/nv04_graph.c
28558+++ b/drivers/gpu/drm/nouveau/nv04_graph.c
28559@@ -554,7 +554,7 @@ static int
28560 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
28561 u32 class, u32 mthd, u32 data)
28562 {
28563- atomic_set(&chan->fence.last_sequence_irq, data);
28564+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
28565 return 0;
28566 }
28567
28568diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
28569index 570e190..084a31a 100644
28570--- a/drivers/gpu/drm/r128/r128_cce.c
28571+++ b/drivers/gpu/drm/r128/r128_cce.c
28572@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
28573
28574 /* GH: Simple idle check.
28575 */
28576- atomic_set(&dev_priv->idle_count, 0);
28577+ atomic_set_unchecked(&dev_priv->idle_count, 0);
28578
28579 /* We don't support anything other than bus-mastering ring mode,
28580 * but the ring can be in either AGP or PCI space for the ring
28581diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
28582index 930c71b..499aded 100644
28583--- a/drivers/gpu/drm/r128/r128_drv.h
28584+++ b/drivers/gpu/drm/r128/r128_drv.h
28585@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
28586 int is_pci;
28587 unsigned long cce_buffers_offset;
28588
28589- atomic_t idle_count;
28590+ atomic_unchecked_t idle_count;
28591
28592 int page_flipping;
28593 int current_page;
28594 u32 crtc_offset;
28595 u32 crtc_offset_cntl;
28596
28597- atomic_t vbl_received;
28598+ atomic_unchecked_t vbl_received;
28599
28600 u32 color_fmt;
28601 unsigned int front_offset;
28602diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
28603index 429d5a0..7e899ed 100644
28604--- a/drivers/gpu/drm/r128/r128_irq.c
28605+++ b/drivers/gpu/drm/r128/r128_irq.c
28606@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
28607 if (crtc != 0)
28608 return 0;
28609
28610- return atomic_read(&dev_priv->vbl_received);
28611+ return atomic_read_unchecked(&dev_priv->vbl_received);
28612 }
28613
28614 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28615@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28616 /* VBLANK interrupt */
28617 if (status & R128_CRTC_VBLANK_INT) {
28618 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
28619- atomic_inc(&dev_priv->vbl_received);
28620+ atomic_inc_unchecked(&dev_priv->vbl_received);
28621 drm_handle_vblank(dev, 0);
28622 return IRQ_HANDLED;
28623 }
28624diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
28625index a9e33ce..09edd4b 100644
28626--- a/drivers/gpu/drm/r128/r128_state.c
28627+++ b/drivers/gpu/drm/r128/r128_state.c
28628@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
28629
28630 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
28631 {
28632- if (atomic_read(&dev_priv->idle_count) == 0)
28633+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
28634 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
28635 else
28636- atomic_set(&dev_priv->idle_count, 0);
28637+ atomic_set_unchecked(&dev_priv->idle_count, 0);
28638 }
28639
28640 #endif
28641diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
28642index 14cc88a..cc7b3a5 100644
28643--- a/drivers/gpu/drm/radeon/atom.c
28644+++ b/drivers/gpu/drm/radeon/atom.c
28645@@ -1254,6 +1254,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
28646 char name[512];
28647 int i;
28648
28649+ pax_track_stack();
28650+
28651 if (!ctx)
28652 return NULL;
28653
28654diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
28655index 5a82b6b..9e69c73 100644
28656--- a/drivers/gpu/drm/radeon/mkregtable.c
28657+++ b/drivers/gpu/drm/radeon/mkregtable.c
28658@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
28659 regex_t mask_rex;
28660 regmatch_t match[4];
28661 char buf[1024];
28662- size_t end;
28663+ long end;
28664 int len;
28665 int done = 0;
28666 int r;
28667 unsigned o;
28668 struct offset *offset;
28669 char last_reg_s[10];
28670- int last_reg;
28671+ unsigned long last_reg;
28672
28673 if (regcomp
28674 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
28675diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
28676index 184628c..30e1725 100644
28677--- a/drivers/gpu/drm/radeon/radeon.h
28678+++ b/drivers/gpu/drm/radeon/radeon.h
28679@@ -192,7 +192,7 @@ extern int sumo_get_temp(struct radeon_device *rdev);
28680 */
28681 struct radeon_fence_driver {
28682 uint32_t scratch_reg;
28683- atomic_t seq;
28684+ atomic_unchecked_t seq;
28685 uint32_t last_seq;
28686 unsigned long last_jiffies;
28687 unsigned long last_timeout;
28688@@ -962,7 +962,7 @@ struct radeon_asic {
28689 void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
28690 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
28691 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
28692-};
28693+} __no_const;
28694
28695 /*
28696 * Asic structures
28697diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
28698index 285acc4..f4d909f 100644
28699--- a/drivers/gpu/drm/radeon/radeon_atombios.c
28700+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
28701@@ -569,6 +569,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
28702 struct radeon_gpio_rec gpio;
28703 struct radeon_hpd hpd;
28704
28705+ pax_track_stack();
28706+
28707 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
28708 return false;
28709
28710diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
28711index b51e157..8f14fb9 100644
28712--- a/drivers/gpu/drm/radeon/radeon_device.c
28713+++ b/drivers/gpu/drm/radeon/radeon_device.c
28714@@ -684,7 +684,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
28715 bool can_switch;
28716
28717 spin_lock(&dev->count_lock);
28718- can_switch = (dev->open_count == 0);
28719+ can_switch = (local_read(&dev->open_count) == 0);
28720 spin_unlock(&dev->count_lock);
28721 return can_switch;
28722 }
28723diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
28724index 07ac481..41cb437 100644
28725--- a/drivers/gpu/drm/radeon/radeon_display.c
28726+++ b/drivers/gpu/drm/radeon/radeon_display.c
28727@@ -926,6 +926,8 @@ void radeon_compute_pll_legacy(struct radeon_pll *pll,
28728 uint32_t post_div;
28729 u32 pll_out_min, pll_out_max;
28730
28731+ pax_track_stack();
28732+
28733 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
28734 freq = freq * 1000;
28735
28736diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
28737index a1b59ca..86f2d44 100644
28738--- a/drivers/gpu/drm/radeon/radeon_drv.h
28739+++ b/drivers/gpu/drm/radeon/radeon_drv.h
28740@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
28741
28742 /* SW interrupt */
28743 wait_queue_head_t swi_queue;
28744- atomic_t swi_emitted;
28745+ atomic_unchecked_t swi_emitted;
28746 int vblank_crtc;
28747 uint32_t irq_enable_reg;
28748 uint32_t r500_disp_irq_reg;
28749diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
28750index 7fd4e3e..9748ab5 100644
28751--- a/drivers/gpu/drm/radeon/radeon_fence.c
28752+++ b/drivers/gpu/drm/radeon/radeon_fence.c
28753@@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
28754 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
28755 return 0;
28756 }
28757- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
28758+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
28759 if (!rdev->cp.ready)
28760 /* FIXME: cp is not running assume everythings is done right
28761 * away
28762@@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
28763 return r;
28764 }
28765 radeon_fence_write(rdev, 0);
28766- atomic_set(&rdev->fence_drv.seq, 0);
28767+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
28768 INIT_LIST_HEAD(&rdev->fence_drv.created);
28769 INIT_LIST_HEAD(&rdev->fence_drv.emited);
28770 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
28771diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
28772index 48b7cea..342236f 100644
28773--- a/drivers/gpu/drm/radeon/radeon_ioc32.c
28774+++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
28775@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
28776 request = compat_alloc_user_space(sizeof(*request));
28777 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
28778 || __put_user(req32.param, &request->param)
28779- || __put_user((void __user *)(unsigned long)req32.value,
28780+ || __put_user((unsigned long)req32.value,
28781 &request->value))
28782 return -EFAULT;
28783
28784diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
28785index 465746b..cb2b055 100644
28786--- a/drivers/gpu/drm/radeon/radeon_irq.c
28787+++ b/drivers/gpu/drm/radeon/radeon_irq.c
28788@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
28789 unsigned int ret;
28790 RING_LOCALS;
28791
28792- atomic_inc(&dev_priv->swi_emitted);
28793- ret = atomic_read(&dev_priv->swi_emitted);
28794+ atomic_inc_unchecked(&dev_priv->swi_emitted);
28795+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
28796
28797 BEGIN_RING(4);
28798 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
28799@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
28800 drm_radeon_private_t *dev_priv =
28801 (drm_radeon_private_t *) dev->dev_private;
28802
28803- atomic_set(&dev_priv->swi_emitted, 0);
28804+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
28805 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
28806
28807 dev->max_vblank_count = 0x001fffff;
28808diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
28809index 92e7ea7..147ffad 100644
28810--- a/drivers/gpu/drm/radeon/radeon_state.c
28811+++ b/drivers/gpu/drm/radeon/radeon_state.c
28812@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
28813 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
28814 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
28815
28816- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
28817+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
28818 sarea_priv->nbox * sizeof(depth_boxes[0])))
28819 return -EFAULT;
28820
28821@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
28822 {
28823 drm_radeon_private_t *dev_priv = dev->dev_private;
28824 drm_radeon_getparam_t *param = data;
28825- int value;
28826+ int value = 0;
28827
28828 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
28829
28830diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
28831index 0b5468b..9c4b308 100644
28832--- a/drivers/gpu/drm/radeon/radeon_ttm.c
28833+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
28834@@ -672,8 +672,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
28835 }
28836 if (unlikely(ttm_vm_ops == NULL)) {
28837 ttm_vm_ops = vma->vm_ops;
28838- radeon_ttm_vm_ops = *ttm_vm_ops;
28839- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
28840+ pax_open_kernel();
28841+ memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
28842+ *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
28843+ pax_close_kernel();
28844 }
28845 vma->vm_ops = &radeon_ttm_vm_ops;
28846 return 0;
28847diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
28848index a9049ed..501f284 100644
28849--- a/drivers/gpu/drm/radeon/rs690.c
28850+++ b/drivers/gpu/drm/radeon/rs690.c
28851@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
28852 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
28853 rdev->pm.sideport_bandwidth.full)
28854 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
28855- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
28856+ read_delay_latency.full = dfixed_const(800 * 1000);
28857 read_delay_latency.full = dfixed_div(read_delay_latency,
28858 rdev->pm.igp_sideport_mclk);
28859+ a.full = dfixed_const(370);
28860+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
28861 } else {
28862 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
28863 rdev->pm.k8_bandwidth.full)
28864diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
28865index 727e93d..1565650 100644
28866--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
28867+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
28868@@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages(void)
28869 static int ttm_pool_mm_shrink(struct shrinker *shrink,
28870 struct shrink_control *sc)
28871 {
28872- static atomic_t start_pool = ATOMIC_INIT(0);
28873+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
28874 unsigned i;
28875- unsigned pool_offset = atomic_add_return(1, &start_pool);
28876+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
28877 struct ttm_page_pool *pool;
28878 int shrink_pages = sc->nr_to_scan;
28879
28880diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
28881index 9cf87d9..2000b7d 100644
28882--- a/drivers/gpu/drm/via/via_drv.h
28883+++ b/drivers/gpu/drm/via/via_drv.h
28884@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
28885 typedef uint32_t maskarray_t[5];
28886
28887 typedef struct drm_via_irq {
28888- atomic_t irq_received;
28889+ atomic_unchecked_t irq_received;
28890 uint32_t pending_mask;
28891 uint32_t enable_mask;
28892 wait_queue_head_t irq_queue;
28893@@ -75,7 +75,7 @@ typedef struct drm_via_private {
28894 struct timeval last_vblank;
28895 int last_vblank_valid;
28896 unsigned usec_per_vblank;
28897- atomic_t vbl_received;
28898+ atomic_unchecked_t vbl_received;
28899 drm_via_state_t hc_state;
28900 char pci_buf[VIA_PCI_BUF_SIZE];
28901 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
28902diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
28903index d391f48..10c8ca3 100644
28904--- a/drivers/gpu/drm/via/via_irq.c
28905+++ b/drivers/gpu/drm/via/via_irq.c
28906@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
28907 if (crtc != 0)
28908 return 0;
28909
28910- return atomic_read(&dev_priv->vbl_received);
28911+ return atomic_read_unchecked(&dev_priv->vbl_received);
28912 }
28913
28914 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28915@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28916
28917 status = VIA_READ(VIA_REG_INTERRUPT);
28918 if (status & VIA_IRQ_VBLANK_PENDING) {
28919- atomic_inc(&dev_priv->vbl_received);
28920- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
28921+ atomic_inc_unchecked(&dev_priv->vbl_received);
28922+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
28923 do_gettimeofday(&cur_vblank);
28924 if (dev_priv->last_vblank_valid) {
28925 dev_priv->usec_per_vblank =
28926@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28927 dev_priv->last_vblank = cur_vblank;
28928 dev_priv->last_vblank_valid = 1;
28929 }
28930- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
28931+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
28932 DRM_DEBUG("US per vblank is: %u\n",
28933 dev_priv->usec_per_vblank);
28934 }
28935@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28936
28937 for (i = 0; i < dev_priv->num_irqs; ++i) {
28938 if (status & cur_irq->pending_mask) {
28939- atomic_inc(&cur_irq->irq_received);
28940+ atomic_inc_unchecked(&cur_irq->irq_received);
28941 DRM_WAKEUP(&cur_irq->irq_queue);
28942 handled = 1;
28943 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
28944@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
28945 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
28946 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
28947 masks[irq][4]));
28948- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
28949+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
28950 } else {
28951 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
28952 (((cur_irq_sequence =
28953- atomic_read(&cur_irq->irq_received)) -
28954+ atomic_read_unchecked(&cur_irq->irq_received)) -
28955 *sequence) <= (1 << 23)));
28956 }
28957 *sequence = cur_irq_sequence;
28958@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
28959 }
28960
28961 for (i = 0; i < dev_priv->num_irqs; ++i) {
28962- atomic_set(&cur_irq->irq_received, 0);
28963+ atomic_set_unchecked(&cur_irq->irq_received, 0);
28964 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
28965 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
28966 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
28967@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
28968 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
28969 case VIA_IRQ_RELATIVE:
28970 irqwait->request.sequence +=
28971- atomic_read(&cur_irq->irq_received);
28972+ atomic_read_unchecked(&cur_irq->irq_received);
28973 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
28974 case VIA_IRQ_ABSOLUTE:
28975 break;
28976diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28977index 10fc01f..b4e9822 100644
28978--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28979+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28980@@ -240,7 +240,7 @@ struct vmw_private {
28981 * Fencing and IRQs.
28982 */
28983
28984- atomic_t fence_seq;
28985+ atomic_unchecked_t fence_seq;
28986 wait_queue_head_t fence_queue;
28987 wait_queue_head_t fifo_queue;
28988 atomic_t fence_queue_waiters;
28989diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28990index 41b95ed..69ea504 100644
28991--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28992+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28993@@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
28994 struct drm_vmw_fence_rep fence_rep;
28995 struct drm_vmw_fence_rep __user *user_fence_rep;
28996 int ret;
28997- void *user_cmd;
28998+ void __user *user_cmd;
28999 void *cmd;
29000 uint32_t sequence;
29001 struct vmw_sw_context *sw_context = &dev_priv->ctx;
29002diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29003index 61eacc1..ee38ce8 100644
29004--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29005+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29006@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
29007 while (!vmw_lag_lt(queue, us)) {
29008 spin_lock(&queue->lock);
29009 if (list_empty(&queue->head))
29010- sequence = atomic_read(&dev_priv->fence_seq);
29011+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29012 else {
29013 fence = list_first_entry(&queue->head,
29014 struct vmw_fence, head);
29015diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29016index 635c0ff..2641bbb 100644
29017--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29018+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29019@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
29020 (unsigned int) min,
29021 (unsigned int) fifo->capabilities);
29022
29023- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29024+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29025 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29026 vmw_fence_queue_init(&fifo->fence_queue);
29027 return vmw_fifo_send_fence(dev_priv, &dummy);
29028@@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
29029 if (reserveable)
29030 iowrite32(bytes, fifo_mem +
29031 SVGA_FIFO_RESERVED);
29032- return fifo_mem + (next_cmd >> 2);
29033+ return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
29034 } else {
29035 need_bounce = true;
29036 }
29037@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29038
29039 fm = vmw_fifo_reserve(dev_priv, bytes);
29040 if (unlikely(fm == NULL)) {
29041- *sequence = atomic_read(&dev_priv->fence_seq);
29042+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29043 ret = -ENOMEM;
29044 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29045 false, 3*HZ);
29046@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29047 }
29048
29049 do {
29050- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29051+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29052 } while (*sequence == 0);
29053
29054 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
29055diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29056index e92298a..f68f2d6 100644
29057--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29058+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29059@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_private *dev_priv,
29060 * emitted. Then the fence is stale and signaled.
29061 */
29062
29063- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29064+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29065 > VMW_FENCE_WRAP);
29066
29067 return ret;
29068@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
29069
29070 if (fifo_idle)
29071 down_read(&fifo_state->rwsem);
29072- signal_seq = atomic_read(&dev_priv->fence_seq);
29073+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29074 ret = 0;
29075
29076 for (;;) {
29077diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29078index dfe32e6..dd18a00 100644
29079--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29080+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29081@@ -843,7 +843,6 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
29082 struct vmw_framebuffer *vfb = NULL;
29083 struct vmw_surface *surface = NULL;
29084 struct vmw_dma_buffer *bo = NULL;
29085- u64 required_size;
29086 int ret;
29087
29088 /**
29089@@ -852,8 +851,9 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
29090 * requested framebuffer.
29091 */
29092
29093- required_size = mode_cmd->pitch * mode_cmd->height;
29094- if (unlikely(required_size > (u64) dev_priv->vram_size)) {
29095+ if (!vmw_kms_validate_mode_vram(dev_priv,
29096+ mode_cmd->pitch,
29097+ mode_cmd->height)) {
29098 DRM_ERROR("VRAM size is too small for requested mode.\n");
29099 return NULL;
29100 }
29101diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
29102index c72f1c0..18376f1 100644
29103--- a/drivers/gpu/vga/vgaarb.c
29104+++ b/drivers/gpu/vga/vgaarb.c
29105@@ -993,14 +993,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
29106 uc = &priv->cards[i];
29107 }
29108
29109- if (!uc)
29110- return -EINVAL;
29111+ if (!uc) {
29112+ ret_val = -EINVAL;
29113+ goto done;
29114+ }
29115
29116- if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
29117- return -EINVAL;
29118+ if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
29119+ ret_val = -EINVAL;
29120+ goto done;
29121+ }
29122
29123- if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
29124- return -EINVAL;
29125+ if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
29126+ ret_val = -EINVAL;
29127+ goto done;
29128+ }
29129
29130 vga_put(pdev, io_state);
29131
29132diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
29133index f26ae31..721fe1b 100644
29134--- a/drivers/hid/hid-core.c
29135+++ b/drivers/hid/hid-core.c
29136@@ -1951,7 +1951,7 @@ static bool hid_ignore(struct hid_device *hdev)
29137
29138 int hid_add_device(struct hid_device *hdev)
29139 {
29140- static atomic_t id = ATOMIC_INIT(0);
29141+ static atomic_unchecked_t id = ATOMIC_INIT(0);
29142 int ret;
29143
29144 if (WARN_ON(hdev->status & HID_STAT_ADDED))
29145@@ -1966,7 +1966,7 @@ int hid_add_device(struct hid_device *hdev)
29146 /* XXX hack, any other cleaner solution after the driver core
29147 * is converted to allow more than 20 bytes as the device name? */
29148 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29149- hdev->vendor, hdev->product, atomic_inc_return(&id));
29150+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29151
29152 hid_debug_register(hdev, dev_name(&hdev->dev));
29153 ret = device_add(&hdev->dev);
29154diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
29155index 7c1188b..5a64357 100644
29156--- a/drivers/hid/usbhid/hiddev.c
29157+++ b/drivers/hid/usbhid/hiddev.c
29158@@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
29159 break;
29160
29161 case HIDIOCAPPLICATION:
29162- if (arg < 0 || arg >= hid->maxapplication)
29163+ if (arg >= hid->maxapplication)
29164 break;
29165
29166 for (i = 0; i < hid->maxcollection; i++)
29167diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
29168index 66f6729..2d6de0a 100644
29169--- a/drivers/hwmon/acpi_power_meter.c
29170+++ b/drivers/hwmon/acpi_power_meter.c
29171@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
29172 return res;
29173
29174 temp /= 1000;
29175- if (temp < 0)
29176- return -EINVAL;
29177
29178 mutex_lock(&resource->lock);
29179 resource->trip[attr->index - 7] = temp;
29180diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
29181index fe4104c..346febb 100644
29182--- a/drivers/hwmon/sht15.c
29183+++ b/drivers/hwmon/sht15.c
29184@@ -166,7 +166,7 @@ struct sht15_data {
29185 int supply_uV;
29186 bool supply_uV_valid;
29187 struct work_struct update_supply_work;
29188- atomic_t interrupt_handled;
29189+ atomic_unchecked_t interrupt_handled;
29190 };
29191
29192 /**
29193@@ -509,13 +509,13 @@ static int sht15_measurement(struct sht15_data *data,
29194 return ret;
29195
29196 gpio_direction_input(data->pdata->gpio_data);
29197- atomic_set(&data->interrupt_handled, 0);
29198+ atomic_set_unchecked(&data->interrupt_handled, 0);
29199
29200 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29201 if (gpio_get_value(data->pdata->gpio_data) == 0) {
29202 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
29203 /* Only relevant if the interrupt hasn't occurred. */
29204- if (!atomic_read(&data->interrupt_handled))
29205+ if (!atomic_read_unchecked(&data->interrupt_handled))
29206 schedule_work(&data->read_work);
29207 }
29208 ret = wait_event_timeout(data->wait_queue,
29209@@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
29210
29211 /* First disable the interrupt */
29212 disable_irq_nosync(irq);
29213- atomic_inc(&data->interrupt_handled);
29214+ atomic_inc_unchecked(&data->interrupt_handled);
29215 /* Then schedule a reading work struct */
29216 if (data->state != SHT15_READING_NOTHING)
29217 schedule_work(&data->read_work);
29218@@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
29219 * If not, then start the interrupt again - care here as could
29220 * have gone low in meantime so verify it hasn't!
29221 */
29222- atomic_set(&data->interrupt_handled, 0);
29223+ atomic_set_unchecked(&data->interrupt_handled, 0);
29224 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29225 /* If still not occurred or another handler has been scheduled */
29226 if (gpio_get_value(data->pdata->gpio_data)
29227- || atomic_read(&data->interrupt_handled))
29228+ || atomic_read_unchecked(&data->interrupt_handled))
29229 return;
29230 }
29231
29232diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
29233index 378fcb5..5e91fa8 100644
29234--- a/drivers/i2c/busses/i2c-amd756-s4882.c
29235+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
29236@@ -43,7 +43,7 @@
29237 extern struct i2c_adapter amd756_smbus;
29238
29239 static struct i2c_adapter *s4882_adapter;
29240-static struct i2c_algorithm *s4882_algo;
29241+static i2c_algorithm_no_const *s4882_algo;
29242
29243 /* Wrapper access functions for multiplexed SMBus */
29244 static DEFINE_MUTEX(amd756_lock);
29245diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
29246index 29015eb..af2d8e9 100644
29247--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
29248+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
29249@@ -41,7 +41,7 @@
29250 extern struct i2c_adapter *nforce2_smbus;
29251
29252 static struct i2c_adapter *s4985_adapter;
29253-static struct i2c_algorithm *s4985_algo;
29254+static i2c_algorithm_no_const *s4985_algo;
29255
29256 /* Wrapper access functions for multiplexed SMBus */
29257 static DEFINE_MUTEX(nforce2_lock);
29258diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
29259index d7a4833..7fae376 100644
29260--- a/drivers/i2c/i2c-mux.c
29261+++ b/drivers/i2c/i2c-mux.c
29262@@ -28,7 +28,7 @@
29263 /* multiplexer per channel data */
29264 struct i2c_mux_priv {
29265 struct i2c_adapter adap;
29266- struct i2c_algorithm algo;
29267+ i2c_algorithm_no_const algo;
29268
29269 struct i2c_adapter *parent;
29270 void *mux_dev; /* the mux chip/device */
29271diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
29272index 57d00ca..0145194 100644
29273--- a/drivers/ide/aec62xx.c
29274+++ b/drivers/ide/aec62xx.c
29275@@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_port_ops = {
29276 .cable_detect = atp86x_cable_detect,
29277 };
29278
29279-static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
29280+static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
29281 { /* 0: AEC6210 */
29282 .name = DRV_NAME,
29283 .init_chipset = init_chipset_aec62xx,
29284diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
29285index 2c8016a..911a27c 100644
29286--- a/drivers/ide/alim15x3.c
29287+++ b/drivers/ide/alim15x3.c
29288@@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_ops = {
29289 .dma_sff_read_status = ide_dma_sff_read_status,
29290 };
29291
29292-static const struct ide_port_info ali15x3_chipset __devinitdata = {
29293+static const struct ide_port_info ali15x3_chipset __devinitconst = {
29294 .name = DRV_NAME,
29295 .init_chipset = init_chipset_ali15x3,
29296 .init_hwif = init_hwif_ali15x3,
29297diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
29298index 3747b25..56fc995 100644
29299--- a/drivers/ide/amd74xx.c
29300+++ b/drivers/ide/amd74xx.c
29301@@ -223,7 +223,7 @@ static const struct ide_port_ops amd_port_ops = {
29302 .udma_mask = udma, \
29303 }
29304
29305-static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
29306+static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
29307 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
29308 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
29309 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
29310diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
29311index 15f0ead..cb43480 100644
29312--- a/drivers/ide/atiixp.c
29313+++ b/drivers/ide/atiixp.c
29314@@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_port_ops = {
29315 .cable_detect = atiixp_cable_detect,
29316 };
29317
29318-static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
29319+static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
29320 { /* 0: IXP200/300/400/700 */
29321 .name = DRV_NAME,
29322 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
29323diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
29324index 5f80312..d1fc438 100644
29325--- a/drivers/ide/cmd64x.c
29326+++ b/drivers/ide/cmd64x.c
29327@@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
29328 .dma_sff_read_status = ide_dma_sff_read_status,
29329 };
29330
29331-static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
29332+static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
29333 { /* 0: CMD643 */
29334 .name = DRV_NAME,
29335 .init_chipset = init_chipset_cmd64x,
29336diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
29337index 2c1e5f7..1444762 100644
29338--- a/drivers/ide/cs5520.c
29339+++ b/drivers/ide/cs5520.c
29340@@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_port_ops = {
29341 .set_dma_mode = cs5520_set_dma_mode,
29342 };
29343
29344-static const struct ide_port_info cyrix_chipset __devinitdata = {
29345+static const struct ide_port_info cyrix_chipset __devinitconst = {
29346 .name = DRV_NAME,
29347 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
29348 .port_ops = &cs5520_port_ops,
29349diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
29350index 4dc4eb9..49b40ad 100644
29351--- a/drivers/ide/cs5530.c
29352+++ b/drivers/ide/cs5530.c
29353@@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_port_ops = {
29354 .udma_filter = cs5530_udma_filter,
29355 };
29356
29357-static const struct ide_port_info cs5530_chipset __devinitdata = {
29358+static const struct ide_port_info cs5530_chipset __devinitconst = {
29359 .name = DRV_NAME,
29360 .init_chipset = init_chipset_cs5530,
29361 .init_hwif = init_hwif_cs5530,
29362diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
29363index 5059faf..18d4c85 100644
29364--- a/drivers/ide/cs5535.c
29365+++ b/drivers/ide/cs5535.c
29366@@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
29367 .cable_detect = cs5535_cable_detect,
29368 };
29369
29370-static const struct ide_port_info cs5535_chipset __devinitdata = {
29371+static const struct ide_port_info cs5535_chipset __devinitconst = {
29372 .name = DRV_NAME,
29373 .port_ops = &cs5535_port_ops,
29374 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
29375diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
29376index 67cbcfa..37ea151 100644
29377--- a/drivers/ide/cy82c693.c
29378+++ b/drivers/ide/cy82c693.c
29379@@ -163,7 +163,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
29380 .set_dma_mode = cy82c693_set_dma_mode,
29381 };
29382
29383-static const struct ide_port_info cy82c693_chipset __devinitdata = {
29384+static const struct ide_port_info cy82c693_chipset __devinitconst = {
29385 .name = DRV_NAME,
29386 .init_iops = init_iops_cy82c693,
29387 .port_ops = &cy82c693_port_ops,
29388diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
29389index 58c51cd..4aec3b8 100644
29390--- a/drivers/ide/hpt366.c
29391+++ b/drivers/ide/hpt366.c
29392@@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings = {
29393 }
29394 };
29395
29396-static const struct hpt_info hpt36x __devinitdata = {
29397+static const struct hpt_info hpt36x __devinitconst = {
29398 .chip_name = "HPT36x",
29399 .chip_type = HPT36x,
29400 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
29401@@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __devinitdata = {
29402 .timings = &hpt36x_timings
29403 };
29404
29405-static const struct hpt_info hpt370 __devinitdata = {
29406+static const struct hpt_info hpt370 __devinitconst = {
29407 .chip_name = "HPT370",
29408 .chip_type = HPT370,
29409 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29410@@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __devinitdata = {
29411 .timings = &hpt37x_timings
29412 };
29413
29414-static const struct hpt_info hpt370a __devinitdata = {
29415+static const struct hpt_info hpt370a __devinitconst = {
29416 .chip_name = "HPT370A",
29417 .chip_type = HPT370A,
29418 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29419@@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __devinitdata = {
29420 .timings = &hpt37x_timings
29421 };
29422
29423-static const struct hpt_info hpt374 __devinitdata = {
29424+static const struct hpt_info hpt374 __devinitconst = {
29425 .chip_name = "HPT374",
29426 .chip_type = HPT374,
29427 .udma_mask = ATA_UDMA5,
29428@@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __devinitdata = {
29429 .timings = &hpt37x_timings
29430 };
29431
29432-static const struct hpt_info hpt372 __devinitdata = {
29433+static const struct hpt_info hpt372 __devinitconst = {
29434 .chip_name = "HPT372",
29435 .chip_type = HPT372,
29436 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29437@@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __devinitdata = {
29438 .timings = &hpt37x_timings
29439 };
29440
29441-static const struct hpt_info hpt372a __devinitdata = {
29442+static const struct hpt_info hpt372a __devinitconst = {
29443 .chip_name = "HPT372A",
29444 .chip_type = HPT372A,
29445 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29446@@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __devinitdata = {
29447 .timings = &hpt37x_timings
29448 };
29449
29450-static const struct hpt_info hpt302 __devinitdata = {
29451+static const struct hpt_info hpt302 __devinitconst = {
29452 .chip_name = "HPT302",
29453 .chip_type = HPT302,
29454 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29455@@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __devinitdata = {
29456 .timings = &hpt37x_timings
29457 };
29458
29459-static const struct hpt_info hpt371 __devinitdata = {
29460+static const struct hpt_info hpt371 __devinitconst = {
29461 .chip_name = "HPT371",
29462 .chip_type = HPT371,
29463 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29464@@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __devinitdata = {
29465 .timings = &hpt37x_timings
29466 };
29467
29468-static const struct hpt_info hpt372n __devinitdata = {
29469+static const struct hpt_info hpt372n __devinitconst = {
29470 .chip_name = "HPT372N",
29471 .chip_type = HPT372N,
29472 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29473@@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __devinitdata = {
29474 .timings = &hpt37x_timings
29475 };
29476
29477-static const struct hpt_info hpt302n __devinitdata = {
29478+static const struct hpt_info hpt302n __devinitconst = {
29479 .chip_name = "HPT302N",
29480 .chip_type = HPT302N,
29481 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29482@@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __devinitdata = {
29483 .timings = &hpt37x_timings
29484 };
29485
29486-static const struct hpt_info hpt371n __devinitdata = {
29487+static const struct hpt_info hpt371n __devinitconst = {
29488 .chip_name = "HPT371N",
29489 .chip_type = HPT371N,
29490 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29491@@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
29492 .dma_sff_read_status = ide_dma_sff_read_status,
29493 };
29494
29495-static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
29496+static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
29497 { /* 0: HPT36x */
29498 .name = DRV_NAME,
29499 .init_chipset = init_chipset_hpt366,
29500diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
29501index 04b0956..f5b47dc 100644
29502--- a/drivers/ide/ide-cd.c
29503+++ b/drivers/ide/ide-cd.c
29504@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
29505 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
29506 if ((unsigned long)buf & alignment
29507 || blk_rq_bytes(rq) & q->dma_pad_mask
29508- || object_is_on_stack(buf))
29509+ || object_starts_on_stack(buf))
29510 drive->dma = 0;
29511 }
29512 }
29513diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
29514index 61fdf54..2834ea6 100644
29515--- a/drivers/ide/ide-floppy.c
29516+++ b/drivers/ide/ide-floppy.c
29517@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
29518 u8 pc_buf[256], header_len, desc_cnt;
29519 int i, rc = 1, blocks, length;
29520
29521+ pax_track_stack();
29522+
29523 ide_debug_log(IDE_DBG_FUNC, "enter");
29524
29525 drive->bios_cyl = 0;
29526diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
29527index a743e68..1cfd674 100644
29528--- a/drivers/ide/ide-pci-generic.c
29529+++ b/drivers/ide/ide-pci-generic.c
29530@@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
29531 .udma_mask = ATA_UDMA6, \
29532 }
29533
29534-static const struct ide_port_info generic_chipsets[] __devinitdata = {
29535+static const struct ide_port_info generic_chipsets[] __devinitconst = {
29536 /* 0: Unknown */
29537 DECLARE_GENERIC_PCI_DEV(0),
29538
29539diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
29540index 560e66d..d5dd180 100644
29541--- a/drivers/ide/it8172.c
29542+++ b/drivers/ide/it8172.c
29543@@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
29544 .set_dma_mode = it8172_set_dma_mode,
29545 };
29546
29547-static const struct ide_port_info it8172_port_info __devinitdata = {
29548+static const struct ide_port_info it8172_port_info __devinitconst = {
29549 .name = DRV_NAME,
29550 .port_ops = &it8172_port_ops,
29551 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
29552diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
29553index 46816ba..1847aeb 100644
29554--- a/drivers/ide/it8213.c
29555+++ b/drivers/ide/it8213.c
29556@@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
29557 .cable_detect = it8213_cable_detect,
29558 };
29559
29560-static const struct ide_port_info it8213_chipset __devinitdata = {
29561+static const struct ide_port_info it8213_chipset __devinitconst = {
29562 .name = DRV_NAME,
29563 .enablebits = { {0x41, 0x80, 0x80} },
29564 .port_ops = &it8213_port_ops,
29565diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
29566index 2e3169f..c5611db 100644
29567--- a/drivers/ide/it821x.c
29568+++ b/drivers/ide/it821x.c
29569@@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_port_ops = {
29570 .cable_detect = it821x_cable_detect,
29571 };
29572
29573-static const struct ide_port_info it821x_chipset __devinitdata = {
29574+static const struct ide_port_info it821x_chipset __devinitconst = {
29575 .name = DRV_NAME,
29576 .init_chipset = init_chipset_it821x,
29577 .init_hwif = init_hwif_it821x,
29578diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
29579index 74c2c4a..efddd7d 100644
29580--- a/drivers/ide/jmicron.c
29581+++ b/drivers/ide/jmicron.c
29582@@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
29583 .cable_detect = jmicron_cable_detect,
29584 };
29585
29586-static const struct ide_port_info jmicron_chipset __devinitdata = {
29587+static const struct ide_port_info jmicron_chipset __devinitconst = {
29588 .name = DRV_NAME,
29589 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
29590 .port_ops = &jmicron_port_ops,
29591diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
29592index 95327a2..73f78d8 100644
29593--- a/drivers/ide/ns87415.c
29594+++ b/drivers/ide/ns87415.c
29595@@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
29596 .dma_sff_read_status = superio_dma_sff_read_status,
29597 };
29598
29599-static const struct ide_port_info ns87415_chipset __devinitdata = {
29600+static const struct ide_port_info ns87415_chipset __devinitconst = {
29601 .name = DRV_NAME,
29602 .init_hwif = init_hwif_ns87415,
29603 .tp_ops = &ns87415_tp_ops,
29604diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
29605index 1a53a4c..39edc66 100644
29606--- a/drivers/ide/opti621.c
29607+++ b/drivers/ide/opti621.c
29608@@ -131,7 +131,7 @@ static const struct ide_port_ops opti621_port_ops = {
29609 .set_pio_mode = opti621_set_pio_mode,
29610 };
29611
29612-static const struct ide_port_info opti621_chipset __devinitdata = {
29613+static const struct ide_port_info opti621_chipset __devinitconst = {
29614 .name = DRV_NAME,
29615 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
29616 .port_ops = &opti621_port_ops,
29617diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
29618index 9546fe2..2e5ceb6 100644
29619--- a/drivers/ide/pdc202xx_new.c
29620+++ b/drivers/ide/pdc202xx_new.c
29621@@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
29622 .udma_mask = udma, \
29623 }
29624
29625-static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
29626+static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
29627 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
29628 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
29629 };
29630diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
29631index 3a35ec6..5634510 100644
29632--- a/drivers/ide/pdc202xx_old.c
29633+++ b/drivers/ide/pdc202xx_old.c
29634@@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
29635 .max_sectors = sectors, \
29636 }
29637
29638-static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
29639+static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
29640 { /* 0: PDC20246 */
29641 .name = DRV_NAME,
29642 .init_chipset = init_chipset_pdc202xx,
29643diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
29644index b59d04c..368c2a7 100644
29645--- a/drivers/ide/piix.c
29646+++ b/drivers/ide/piix.c
29647@@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
29648 .udma_mask = udma, \
29649 }
29650
29651-static const struct ide_port_info piix_pci_info[] __devinitdata = {
29652+static const struct ide_port_info piix_pci_info[] __devinitconst = {
29653 /* 0: MPIIX */
29654 { /*
29655 * MPIIX actually has only a single IDE channel mapped to
29656diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
29657index a6414a8..c04173e 100644
29658--- a/drivers/ide/rz1000.c
29659+++ b/drivers/ide/rz1000.c
29660@@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
29661 }
29662 }
29663
29664-static const struct ide_port_info rz1000_chipset __devinitdata = {
29665+static const struct ide_port_info rz1000_chipset __devinitconst = {
29666 .name = DRV_NAME,
29667 .host_flags = IDE_HFLAG_NO_DMA,
29668 };
29669diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
29670index 356b9b5..d4758eb 100644
29671--- a/drivers/ide/sc1200.c
29672+++ b/drivers/ide/sc1200.c
29673@@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
29674 .dma_sff_read_status = ide_dma_sff_read_status,
29675 };
29676
29677-static const struct ide_port_info sc1200_chipset __devinitdata = {
29678+static const struct ide_port_info sc1200_chipset __devinitconst = {
29679 .name = DRV_NAME,
29680 .port_ops = &sc1200_port_ops,
29681 .dma_ops = &sc1200_dma_ops,
29682diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
29683index b7f5b0c..9701038 100644
29684--- a/drivers/ide/scc_pata.c
29685+++ b/drivers/ide/scc_pata.c
29686@@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
29687 .dma_sff_read_status = scc_dma_sff_read_status,
29688 };
29689
29690-static const struct ide_port_info scc_chipset __devinitdata = {
29691+static const struct ide_port_info scc_chipset __devinitconst = {
29692 .name = "sccIDE",
29693 .init_iops = init_iops_scc,
29694 .init_dma = scc_init_dma,
29695diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
29696index 35fb8da..24d72ef 100644
29697--- a/drivers/ide/serverworks.c
29698+++ b/drivers/ide/serverworks.c
29699@@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_port_ops = {
29700 .cable_detect = svwks_cable_detect,
29701 };
29702
29703-static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
29704+static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
29705 { /* 0: OSB4 */
29706 .name = DRV_NAME,
29707 .init_chipset = init_chipset_svwks,
29708diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
29709index ab3db61..afed580 100644
29710--- a/drivers/ide/setup-pci.c
29711+++ b/drivers/ide/setup-pci.c
29712@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
29713 int ret, i, n_ports = dev2 ? 4 : 2;
29714 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
29715
29716+ pax_track_stack();
29717+
29718 for (i = 0; i < n_ports / 2; i++) {
29719 ret = ide_setup_pci_controller(pdev[i], d, !i);
29720 if (ret < 0)
29721diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
29722index ddeda44..46f7e30 100644
29723--- a/drivers/ide/siimage.c
29724+++ b/drivers/ide/siimage.c
29725@@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
29726 .udma_mask = ATA_UDMA6, \
29727 }
29728
29729-static const struct ide_port_info siimage_chipsets[] __devinitdata = {
29730+static const struct ide_port_info siimage_chipsets[] __devinitconst = {
29731 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
29732 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
29733 };
29734diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
29735index 4a00225..09e61b4 100644
29736--- a/drivers/ide/sis5513.c
29737+++ b/drivers/ide/sis5513.c
29738@@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
29739 .cable_detect = sis_cable_detect,
29740 };
29741
29742-static const struct ide_port_info sis5513_chipset __devinitdata = {
29743+static const struct ide_port_info sis5513_chipset __devinitconst = {
29744 .name = DRV_NAME,
29745 .init_chipset = init_chipset_sis5513,
29746 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
29747diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
29748index f21dc2a..d051cd2 100644
29749--- a/drivers/ide/sl82c105.c
29750+++ b/drivers/ide/sl82c105.c
29751@@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
29752 .dma_sff_read_status = ide_dma_sff_read_status,
29753 };
29754
29755-static const struct ide_port_info sl82c105_chipset __devinitdata = {
29756+static const struct ide_port_info sl82c105_chipset __devinitconst = {
29757 .name = DRV_NAME,
29758 .init_chipset = init_chipset_sl82c105,
29759 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
29760diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
29761index 864ffe0..863a5e9 100644
29762--- a/drivers/ide/slc90e66.c
29763+++ b/drivers/ide/slc90e66.c
29764@@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
29765 .cable_detect = slc90e66_cable_detect,
29766 };
29767
29768-static const struct ide_port_info slc90e66_chipset __devinitdata = {
29769+static const struct ide_port_info slc90e66_chipset __devinitconst = {
29770 .name = DRV_NAME,
29771 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
29772 .port_ops = &slc90e66_port_ops,
29773diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
29774index e444d24..ba577de 100644
29775--- a/drivers/ide/tc86c001.c
29776+++ b/drivers/ide/tc86c001.c
29777@@ -191,7 +191,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
29778 .dma_sff_read_status = ide_dma_sff_read_status,
29779 };
29780
29781-static const struct ide_port_info tc86c001_chipset __devinitdata = {
29782+static const struct ide_port_info tc86c001_chipset __devinitconst = {
29783 .name = DRV_NAME,
29784 .init_hwif = init_hwif_tc86c001,
29785 .port_ops = &tc86c001_port_ops,
29786diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
29787index e53a1b7..d11aff7 100644
29788--- a/drivers/ide/triflex.c
29789+++ b/drivers/ide/triflex.c
29790@@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
29791 .set_dma_mode = triflex_set_mode,
29792 };
29793
29794-static const struct ide_port_info triflex_device __devinitdata = {
29795+static const struct ide_port_info triflex_device __devinitconst = {
29796 .name = DRV_NAME,
29797 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
29798 .port_ops = &triflex_port_ops,
29799diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
29800index 4b42ca0..e494a98 100644
29801--- a/drivers/ide/trm290.c
29802+++ b/drivers/ide/trm290.c
29803@@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
29804 .dma_check = trm290_dma_check,
29805 };
29806
29807-static const struct ide_port_info trm290_chipset __devinitdata = {
29808+static const struct ide_port_info trm290_chipset __devinitconst = {
29809 .name = DRV_NAME,
29810 .init_hwif = init_hwif_trm290,
29811 .tp_ops = &trm290_tp_ops,
29812diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
29813index f46f49c..eb77678 100644
29814--- a/drivers/ide/via82cxxx.c
29815+++ b/drivers/ide/via82cxxx.c
29816@@ -403,7 +403,7 @@ static const struct ide_port_ops via_port_ops = {
29817 .cable_detect = via82cxxx_cable_detect,
29818 };
29819
29820-static const struct ide_port_info via82cxxx_chipset __devinitdata = {
29821+static const struct ide_port_info via82cxxx_chipset __devinitconst = {
29822 .name = DRV_NAME,
29823 .init_chipset = init_chipset_via82cxxx,
29824 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
29825diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
29826index fc0f2bd..ac2f8a5 100644
29827--- a/drivers/infiniband/core/cm.c
29828+++ b/drivers/infiniband/core/cm.c
29829@@ -113,7 +113,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
29830
29831 struct cm_counter_group {
29832 struct kobject obj;
29833- atomic_long_t counter[CM_ATTR_COUNT];
29834+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
29835 };
29836
29837 struct cm_counter_attribute {
29838@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm_work *work,
29839 struct ib_mad_send_buf *msg = NULL;
29840 int ret;
29841
29842- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29843+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29844 counter[CM_REQ_COUNTER]);
29845
29846 /* Quick state check to discard duplicate REQs. */
29847@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
29848 if (!cm_id_priv)
29849 return;
29850
29851- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29852+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29853 counter[CM_REP_COUNTER]);
29854 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
29855 if (ret)
29856@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work *work)
29857 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
29858 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
29859 spin_unlock_irq(&cm_id_priv->lock);
29860- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29861+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29862 counter[CM_RTU_COUNTER]);
29863 goto out;
29864 }
29865@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_work *work)
29866 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
29867 dreq_msg->local_comm_id);
29868 if (!cm_id_priv) {
29869- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29870+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29871 counter[CM_DREQ_COUNTER]);
29872 cm_issue_drep(work->port, work->mad_recv_wc);
29873 return -EINVAL;
29874@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_work *work)
29875 case IB_CM_MRA_REP_RCVD:
29876 break;
29877 case IB_CM_TIMEWAIT:
29878- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29879+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29880 counter[CM_DREQ_COUNTER]);
29881 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
29882 goto unlock;
29883@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_work *work)
29884 cm_free_msg(msg);
29885 goto deref;
29886 case IB_CM_DREQ_RCVD:
29887- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29888+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29889 counter[CM_DREQ_COUNTER]);
29890 goto unlock;
29891 default:
29892@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work *work)
29893 ib_modify_mad(cm_id_priv->av.port->mad_agent,
29894 cm_id_priv->msg, timeout)) {
29895 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
29896- atomic_long_inc(&work->port->
29897+ atomic_long_inc_unchecked(&work->port->
29898 counter_group[CM_RECV_DUPLICATES].
29899 counter[CM_MRA_COUNTER]);
29900 goto out;
29901@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work *work)
29902 break;
29903 case IB_CM_MRA_REQ_RCVD:
29904 case IB_CM_MRA_REP_RCVD:
29905- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29906+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29907 counter[CM_MRA_COUNTER]);
29908 /* fall through */
29909 default:
29910@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work *work)
29911 case IB_CM_LAP_IDLE:
29912 break;
29913 case IB_CM_MRA_LAP_SENT:
29914- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29915+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29916 counter[CM_LAP_COUNTER]);
29917 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
29918 goto unlock;
29919@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work *work)
29920 cm_free_msg(msg);
29921 goto deref;
29922 case IB_CM_LAP_RCVD:
29923- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29924+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29925 counter[CM_LAP_COUNTER]);
29926 goto unlock;
29927 default:
29928@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
29929 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
29930 if (cur_cm_id_priv) {
29931 spin_unlock_irq(&cm.lock);
29932- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29933+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29934 counter[CM_SIDR_REQ_COUNTER]);
29935 goto out; /* Duplicate message. */
29936 }
29937@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
29938 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
29939 msg->retries = 1;
29940
29941- atomic_long_add(1 + msg->retries,
29942+ atomic_long_add_unchecked(1 + msg->retries,
29943 &port->counter_group[CM_XMIT].counter[attr_index]);
29944 if (msg->retries)
29945- atomic_long_add(msg->retries,
29946+ atomic_long_add_unchecked(msg->retries,
29947 &port->counter_group[CM_XMIT_RETRIES].
29948 counter[attr_index]);
29949
29950@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
29951 }
29952
29953 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
29954- atomic_long_inc(&port->counter_group[CM_RECV].
29955+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
29956 counter[attr_id - CM_ATTR_ID_OFFSET]);
29957
29958 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
29959@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
29960 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
29961
29962 return sprintf(buf, "%ld\n",
29963- atomic_long_read(&group->counter[cm_attr->index]));
29964+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
29965 }
29966
29967 static const struct sysfs_ops cm_counter_ops = {
29968diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
29969index ca4c5dc..572d1ae 100644
29970--- a/drivers/infiniband/core/cma.c
29971+++ b/drivers/infiniband/core/cma.c
29972@@ -2492,6 +2492,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
29973
29974 req.private_data_len = sizeof(struct cma_hdr) +
29975 conn_param->private_data_len;
29976+ if (req.private_data_len < conn_param->private_data_len)
29977+ return -EINVAL;
29978+
29979 req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
29980 if (!req.private_data)
29981 return -ENOMEM;
29982@@ -2541,6 +2544,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
29983 memset(&req, 0, sizeof req);
29984 offset = cma_user_data_offset(id_priv->id.ps);
29985 req.private_data_len = offset + conn_param->private_data_len;
29986+ if (req.private_data_len < conn_param->private_data_len)
29987+ return -EINVAL;
29988+
29989 private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
29990 if (!private_data)
29991 return -ENOMEM;
29992diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
29993index 4507043..14ad522 100644
29994--- a/drivers/infiniband/core/fmr_pool.c
29995+++ b/drivers/infiniband/core/fmr_pool.c
29996@@ -97,8 +97,8 @@ struct ib_fmr_pool {
29997
29998 struct task_struct *thread;
29999
30000- atomic_t req_ser;
30001- atomic_t flush_ser;
30002+ atomic_unchecked_t req_ser;
30003+ atomic_unchecked_t flush_ser;
30004
30005 wait_queue_head_t force_wait;
30006 };
30007@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
30008 struct ib_fmr_pool *pool = pool_ptr;
30009
30010 do {
30011- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30012+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30013 ib_fmr_batch_release(pool);
30014
30015- atomic_inc(&pool->flush_ser);
30016+ atomic_inc_unchecked(&pool->flush_ser);
30017 wake_up_interruptible(&pool->force_wait);
30018
30019 if (pool->flush_function)
30020@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
30021 }
30022
30023 set_current_state(TASK_INTERRUPTIBLE);
30024- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30025+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30026 !kthread_should_stop())
30027 schedule();
30028 __set_current_state(TASK_RUNNING);
30029@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
30030 pool->dirty_watermark = params->dirty_watermark;
30031 pool->dirty_len = 0;
30032 spin_lock_init(&pool->pool_lock);
30033- atomic_set(&pool->req_ser, 0);
30034- atomic_set(&pool->flush_ser, 0);
30035+ atomic_set_unchecked(&pool->req_ser, 0);
30036+ atomic_set_unchecked(&pool->flush_ser, 0);
30037 init_waitqueue_head(&pool->force_wait);
30038
30039 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30040@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
30041 }
30042 spin_unlock_irq(&pool->pool_lock);
30043
30044- serial = atomic_inc_return(&pool->req_ser);
30045+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30046 wake_up_process(pool->thread);
30047
30048 if (wait_event_interruptible(pool->force_wait,
30049- atomic_read(&pool->flush_ser) - serial >= 0))
30050+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30051 return -EINTR;
30052
30053 return 0;
30054@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
30055 } else {
30056 list_add_tail(&fmr->list, &pool->dirty_list);
30057 if (++pool->dirty_len >= pool->dirty_watermark) {
30058- atomic_inc(&pool->req_ser);
30059+ atomic_inc_unchecked(&pool->req_ser);
30060 wake_up_process(pool->thread);
30061 }
30062 }
30063diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
30064index 40c8353..946b0e4 100644
30065--- a/drivers/infiniband/hw/cxgb4/mem.c
30066+++ b/drivers/infiniband/hw/cxgb4/mem.c
30067@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30068 int err;
30069 struct fw_ri_tpte tpt;
30070 u32 stag_idx;
30071- static atomic_t key;
30072+ static atomic_unchecked_t key;
30073
30074 if (c4iw_fatal_error(rdev))
30075 return -EIO;
30076@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30077 &rdev->resource.tpt_fifo_lock);
30078 if (!stag_idx)
30079 return -ENOMEM;
30080- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30081+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30082 }
30083 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30084 __func__, stag_state, type, pdid, stag_idx);
30085diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
30086index 31ae1b1..2f5b038 100644
30087--- a/drivers/infiniband/hw/ipath/ipath_fs.c
30088+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
30089@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
30090 struct infinipath_counters counters;
30091 struct ipath_devdata *dd;
30092
30093+ pax_track_stack();
30094+
30095 dd = file->f_path.dentry->d_inode->i_private;
30096 dd->ipath_f_read_counters(dd, &counters);
30097
30098diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
30099index 79b3dbc..96e5fcc 100644
30100--- a/drivers/infiniband/hw/ipath/ipath_rc.c
30101+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
30102@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30103 struct ib_atomic_eth *ateth;
30104 struct ipath_ack_entry *e;
30105 u64 vaddr;
30106- atomic64_t *maddr;
30107+ atomic64_unchecked_t *maddr;
30108 u64 sdata;
30109 u32 rkey;
30110 u8 next;
30111@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30112 IB_ACCESS_REMOTE_ATOMIC)))
30113 goto nack_acc_unlck;
30114 /* Perform atomic OP and save result. */
30115- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30116+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30117 sdata = be64_to_cpu(ateth->swap_data);
30118 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30119 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30120- (u64) atomic64_add_return(sdata, maddr) - sdata :
30121+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30122 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30123 be64_to_cpu(ateth->compare_data),
30124 sdata);
30125diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
30126index 1f95bba..9530f87 100644
30127--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
30128+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
30129@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
30130 unsigned long flags;
30131 struct ib_wc wc;
30132 u64 sdata;
30133- atomic64_t *maddr;
30134+ atomic64_unchecked_t *maddr;
30135 enum ib_wc_status send_status;
30136
30137 /*
30138@@ -382,11 +382,11 @@ again:
30139 IB_ACCESS_REMOTE_ATOMIC)))
30140 goto acc_err;
30141 /* Perform atomic OP and save result. */
30142- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30143+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30144 sdata = wqe->wr.wr.atomic.compare_add;
30145 *(u64 *) sqp->s_sge.sge.vaddr =
30146 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30147- (u64) atomic64_add_return(sdata, maddr) - sdata :
30148+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30149 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30150 sdata, wqe->wr.wr.atomic.swap);
30151 goto send_comp;
30152diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
30153index 2d668c6..3312bb7 100644
30154--- a/drivers/infiniband/hw/nes/nes.c
30155+++ b/drivers/infiniband/hw/nes/nes.c
30156@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
30157 LIST_HEAD(nes_adapter_list);
30158 static LIST_HEAD(nes_dev_list);
30159
30160-atomic_t qps_destroyed;
30161+atomic_unchecked_t qps_destroyed;
30162
30163 static unsigned int ee_flsh_adapter;
30164 static unsigned int sysfs_nonidx_addr;
30165@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
30166 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30167 struct nes_adapter *nesadapter = nesdev->nesadapter;
30168
30169- atomic_inc(&qps_destroyed);
30170+ atomic_inc_unchecked(&qps_destroyed);
30171
30172 /* Free the control structures */
30173
30174diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
30175index 6fe7987..68637b5 100644
30176--- a/drivers/infiniband/hw/nes/nes.h
30177+++ b/drivers/infiniband/hw/nes/nes.h
30178@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30179 extern unsigned int wqm_quanta;
30180 extern struct list_head nes_adapter_list;
30181
30182-extern atomic_t cm_connects;
30183-extern atomic_t cm_accepts;
30184-extern atomic_t cm_disconnects;
30185-extern atomic_t cm_closes;
30186-extern atomic_t cm_connecteds;
30187-extern atomic_t cm_connect_reqs;
30188-extern atomic_t cm_rejects;
30189-extern atomic_t mod_qp_timouts;
30190-extern atomic_t qps_created;
30191-extern atomic_t qps_destroyed;
30192-extern atomic_t sw_qps_destroyed;
30193+extern atomic_unchecked_t cm_connects;
30194+extern atomic_unchecked_t cm_accepts;
30195+extern atomic_unchecked_t cm_disconnects;
30196+extern atomic_unchecked_t cm_closes;
30197+extern atomic_unchecked_t cm_connecteds;
30198+extern atomic_unchecked_t cm_connect_reqs;
30199+extern atomic_unchecked_t cm_rejects;
30200+extern atomic_unchecked_t mod_qp_timouts;
30201+extern atomic_unchecked_t qps_created;
30202+extern atomic_unchecked_t qps_destroyed;
30203+extern atomic_unchecked_t sw_qps_destroyed;
30204 extern u32 mh_detected;
30205 extern u32 mh_pauses_sent;
30206 extern u32 cm_packets_sent;
30207@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30208 extern u32 cm_packets_received;
30209 extern u32 cm_packets_dropped;
30210 extern u32 cm_packets_retrans;
30211-extern atomic_t cm_listens_created;
30212-extern atomic_t cm_listens_destroyed;
30213+extern atomic_unchecked_t cm_listens_created;
30214+extern atomic_unchecked_t cm_listens_destroyed;
30215 extern u32 cm_backlog_drops;
30216-extern atomic_t cm_loopbacks;
30217-extern atomic_t cm_nodes_created;
30218-extern atomic_t cm_nodes_destroyed;
30219-extern atomic_t cm_accel_dropped_pkts;
30220-extern atomic_t cm_resets_recvd;
30221+extern atomic_unchecked_t cm_loopbacks;
30222+extern atomic_unchecked_t cm_nodes_created;
30223+extern atomic_unchecked_t cm_nodes_destroyed;
30224+extern atomic_unchecked_t cm_accel_dropped_pkts;
30225+extern atomic_unchecked_t cm_resets_recvd;
30226
30227 extern u32 int_mod_timer_init;
30228 extern u32 int_mod_cq_depth_256;
30229diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
30230index a237547..28a9819 100644
30231--- a/drivers/infiniband/hw/nes/nes_cm.c
30232+++ b/drivers/infiniband/hw/nes/nes_cm.c
30233@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30234 u32 cm_packets_retrans;
30235 u32 cm_packets_created;
30236 u32 cm_packets_received;
30237-atomic_t cm_listens_created;
30238-atomic_t cm_listens_destroyed;
30239+atomic_unchecked_t cm_listens_created;
30240+atomic_unchecked_t cm_listens_destroyed;
30241 u32 cm_backlog_drops;
30242-atomic_t cm_loopbacks;
30243-atomic_t cm_nodes_created;
30244-atomic_t cm_nodes_destroyed;
30245-atomic_t cm_accel_dropped_pkts;
30246-atomic_t cm_resets_recvd;
30247+atomic_unchecked_t cm_loopbacks;
30248+atomic_unchecked_t cm_nodes_created;
30249+atomic_unchecked_t cm_nodes_destroyed;
30250+atomic_unchecked_t cm_accel_dropped_pkts;
30251+atomic_unchecked_t cm_resets_recvd;
30252
30253 static inline int mini_cm_accelerated(struct nes_cm_core *,
30254 struct nes_cm_node *);
30255@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30256
30257 static struct nes_cm_core *g_cm_core;
30258
30259-atomic_t cm_connects;
30260-atomic_t cm_accepts;
30261-atomic_t cm_disconnects;
30262-atomic_t cm_closes;
30263-atomic_t cm_connecteds;
30264-atomic_t cm_connect_reqs;
30265-atomic_t cm_rejects;
30266+atomic_unchecked_t cm_connects;
30267+atomic_unchecked_t cm_accepts;
30268+atomic_unchecked_t cm_disconnects;
30269+atomic_unchecked_t cm_closes;
30270+atomic_unchecked_t cm_connecteds;
30271+atomic_unchecked_t cm_connect_reqs;
30272+atomic_unchecked_t cm_rejects;
30273
30274
30275 /**
30276@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
30277 kfree(listener);
30278 listener = NULL;
30279 ret = 0;
30280- atomic_inc(&cm_listens_destroyed);
30281+ atomic_inc_unchecked(&cm_listens_destroyed);
30282 } else {
30283 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30284 }
30285@@ -1242,7 +1242,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
30286 cm_node->rem_mac);
30287
30288 add_hte_node(cm_core, cm_node);
30289- atomic_inc(&cm_nodes_created);
30290+ atomic_inc_unchecked(&cm_nodes_created);
30291
30292 return cm_node;
30293 }
30294@@ -1300,7 +1300,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
30295 }
30296
30297 atomic_dec(&cm_core->node_cnt);
30298- atomic_inc(&cm_nodes_destroyed);
30299+ atomic_inc_unchecked(&cm_nodes_destroyed);
30300 nesqp = cm_node->nesqp;
30301 if (nesqp) {
30302 nesqp->cm_node = NULL;
30303@@ -1367,7 +1367,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
30304
30305 static void drop_packet(struct sk_buff *skb)
30306 {
30307- atomic_inc(&cm_accel_dropped_pkts);
30308+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30309 dev_kfree_skb_any(skb);
30310 }
30311
30312@@ -1430,7 +1430,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
30313 {
30314
30315 int reset = 0; /* whether to send reset in case of err.. */
30316- atomic_inc(&cm_resets_recvd);
30317+ atomic_inc_unchecked(&cm_resets_recvd);
30318 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30319 " refcnt=%d\n", cm_node, cm_node->state,
30320 atomic_read(&cm_node->ref_count));
30321@@ -2059,7 +2059,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
30322 rem_ref_cm_node(cm_node->cm_core, cm_node);
30323 return NULL;
30324 }
30325- atomic_inc(&cm_loopbacks);
30326+ atomic_inc_unchecked(&cm_loopbacks);
30327 loopbackremotenode->loopbackpartner = cm_node;
30328 loopbackremotenode->tcp_cntxt.rcv_wscale =
30329 NES_CM_DEFAULT_RCV_WND_SCALE;
30330@@ -2334,7 +2334,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
30331 add_ref_cm_node(cm_node);
30332 } else if (cm_node->state == NES_CM_STATE_TSA) {
30333 rem_ref_cm_node(cm_core, cm_node);
30334- atomic_inc(&cm_accel_dropped_pkts);
30335+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30336 dev_kfree_skb_any(skb);
30337 break;
30338 }
30339@@ -2640,7 +2640,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30340
30341 if ((cm_id) && (cm_id->event_handler)) {
30342 if (issue_disconn) {
30343- atomic_inc(&cm_disconnects);
30344+ atomic_inc_unchecked(&cm_disconnects);
30345 cm_event.event = IW_CM_EVENT_DISCONNECT;
30346 cm_event.status = disconn_status;
30347 cm_event.local_addr = cm_id->local_addr;
30348@@ -2662,7 +2662,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30349 }
30350
30351 if (issue_close) {
30352- atomic_inc(&cm_closes);
30353+ atomic_inc_unchecked(&cm_closes);
30354 nes_disconnect(nesqp, 1);
30355
30356 cm_id->provider_data = nesqp;
30357@@ -2793,7 +2793,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30358
30359 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30360 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30361- atomic_inc(&cm_accepts);
30362+ atomic_inc_unchecked(&cm_accepts);
30363
30364 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30365 netdev_refcnt_read(nesvnic->netdev));
30366@@ -3003,7 +3003,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
30367
30368 struct nes_cm_core *cm_core;
30369
30370- atomic_inc(&cm_rejects);
30371+ atomic_inc_unchecked(&cm_rejects);
30372 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30373 loopback = cm_node->loopbackpartner;
30374 cm_core = cm_node->cm_core;
30375@@ -3069,7 +3069,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30376 ntohl(cm_id->local_addr.sin_addr.s_addr),
30377 ntohs(cm_id->local_addr.sin_port));
30378
30379- atomic_inc(&cm_connects);
30380+ atomic_inc_unchecked(&cm_connects);
30381 nesqp->active_conn = 1;
30382
30383 /* cache the cm_id in the qp */
30384@@ -3175,7 +3175,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
30385 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30386 return err;
30387 }
30388- atomic_inc(&cm_listens_created);
30389+ atomic_inc_unchecked(&cm_listens_created);
30390 }
30391
30392 cm_id->add_ref(cm_id);
30393@@ -3280,7 +3280,7 @@ static void cm_event_connected(struct nes_cm_event *event)
30394 if (nesqp->destroyed) {
30395 return;
30396 }
30397- atomic_inc(&cm_connecteds);
30398+ atomic_inc_unchecked(&cm_connecteds);
30399 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30400 " local port 0x%04X. jiffies = %lu.\n",
30401 nesqp->hwqp.qp_id,
30402@@ -3495,7 +3495,7 @@ static void cm_event_reset(struct nes_cm_event *event)
30403
30404 cm_id->add_ref(cm_id);
30405 ret = cm_id->event_handler(cm_id, &cm_event);
30406- atomic_inc(&cm_closes);
30407+ atomic_inc_unchecked(&cm_closes);
30408 cm_event.event = IW_CM_EVENT_CLOSE;
30409 cm_event.status = 0;
30410 cm_event.provider_data = cm_id->provider_data;
30411@@ -3531,7 +3531,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
30412 return;
30413 cm_id = cm_node->cm_id;
30414
30415- atomic_inc(&cm_connect_reqs);
30416+ atomic_inc_unchecked(&cm_connect_reqs);
30417 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30418 cm_node, cm_id, jiffies);
30419
30420@@ -3569,7 +3569,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
30421 return;
30422 cm_id = cm_node->cm_id;
30423
30424- atomic_inc(&cm_connect_reqs);
30425+ atomic_inc_unchecked(&cm_connect_reqs);
30426 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30427 cm_node, cm_id, jiffies);
30428
30429diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
30430index 9d7ffeb..a95dd7d 100644
30431--- a/drivers/infiniband/hw/nes/nes_nic.c
30432+++ b/drivers/infiniband/hw/nes/nes_nic.c
30433@@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
30434 target_stat_values[++index] = mh_detected;
30435 target_stat_values[++index] = mh_pauses_sent;
30436 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30437- target_stat_values[++index] = atomic_read(&cm_connects);
30438- target_stat_values[++index] = atomic_read(&cm_accepts);
30439- target_stat_values[++index] = atomic_read(&cm_disconnects);
30440- target_stat_values[++index] = atomic_read(&cm_connecteds);
30441- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30442- target_stat_values[++index] = atomic_read(&cm_rejects);
30443- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30444- target_stat_values[++index] = atomic_read(&qps_created);
30445- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30446- target_stat_values[++index] = atomic_read(&qps_destroyed);
30447- target_stat_values[++index] = atomic_read(&cm_closes);
30448+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30449+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30450+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30451+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30452+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30453+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30454+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30455+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30456+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30457+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30458+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30459 target_stat_values[++index] = cm_packets_sent;
30460 target_stat_values[++index] = cm_packets_bounced;
30461 target_stat_values[++index] = cm_packets_created;
30462 target_stat_values[++index] = cm_packets_received;
30463 target_stat_values[++index] = cm_packets_dropped;
30464 target_stat_values[++index] = cm_packets_retrans;
30465- target_stat_values[++index] = atomic_read(&cm_listens_created);
30466- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30467+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30468+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30469 target_stat_values[++index] = cm_backlog_drops;
30470- target_stat_values[++index] = atomic_read(&cm_loopbacks);
30471- target_stat_values[++index] = atomic_read(&cm_nodes_created);
30472- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30473- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30474- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30475+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30476+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30477+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30478+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30479+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30480 target_stat_values[++index] = nesadapter->free_4kpbl;
30481 target_stat_values[++index] = nesadapter->free_256pbl;
30482 target_stat_values[++index] = int_mod_timer_init;
30483diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
30484index 9f2f7d4..6d2fee2 100644
30485--- a/drivers/infiniband/hw/nes/nes_verbs.c
30486+++ b/drivers/infiniband/hw/nes/nes_verbs.c
30487@@ -46,9 +46,9 @@
30488
30489 #include <rdma/ib_umem.h>
30490
30491-atomic_t mod_qp_timouts;
30492-atomic_t qps_created;
30493-atomic_t sw_qps_destroyed;
30494+atomic_unchecked_t mod_qp_timouts;
30495+atomic_unchecked_t qps_created;
30496+atomic_unchecked_t sw_qps_destroyed;
30497
30498 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30499
30500@@ -1131,7 +1131,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
30501 if (init_attr->create_flags)
30502 return ERR_PTR(-EINVAL);
30503
30504- atomic_inc(&qps_created);
30505+ atomic_inc_unchecked(&qps_created);
30506 switch (init_attr->qp_type) {
30507 case IB_QPT_RC:
30508 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30509@@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
30510 struct iw_cm_event cm_event;
30511 int ret;
30512
30513- atomic_inc(&sw_qps_destroyed);
30514+ atomic_inc_unchecked(&sw_qps_destroyed);
30515 nesqp->destroyed = 1;
30516
30517 /* Blow away the connection if it exists. */
30518diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
30519index c9624ea..e025b66 100644
30520--- a/drivers/infiniband/hw/qib/qib.h
30521+++ b/drivers/infiniband/hw/qib/qib.h
30522@@ -51,6 +51,7 @@
30523 #include <linux/completion.h>
30524 #include <linux/kref.h>
30525 #include <linux/sched.h>
30526+#include <linux/slab.h>
30527
30528 #include "qib_common.h"
30529 #include "qib_verbs.h"
30530diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
30531index c351aa4..e6967c2 100644
30532--- a/drivers/input/gameport/gameport.c
30533+++ b/drivers/input/gameport/gameport.c
30534@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
30535 */
30536 static void gameport_init_port(struct gameport *gameport)
30537 {
30538- static atomic_t gameport_no = ATOMIC_INIT(0);
30539+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
30540
30541 __module_get(THIS_MODULE);
30542
30543 mutex_init(&gameport->drv_mutex);
30544 device_initialize(&gameport->dev);
30545 dev_set_name(&gameport->dev, "gameport%lu",
30546- (unsigned long)atomic_inc_return(&gameport_no) - 1);
30547+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
30548 gameport->dev.bus = &gameport_bus;
30549 gameport->dev.release = gameport_release_port;
30550 if (gameport->parent)
30551diff --git a/drivers/input/input.c b/drivers/input/input.c
30552index da38d97..2aa0b79 100644
30553--- a/drivers/input/input.c
30554+++ b/drivers/input/input.c
30555@@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struct input_dev *dev)
30556 */
30557 int input_register_device(struct input_dev *dev)
30558 {
30559- static atomic_t input_no = ATOMIC_INIT(0);
30560+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
30561 struct input_handler *handler;
30562 const char *path;
30563 int error;
30564@@ -1851,7 +1851,7 @@ int input_register_device(struct input_dev *dev)
30565 dev->setkeycode = input_default_setkeycode;
30566
30567 dev_set_name(&dev->dev, "input%ld",
30568- (unsigned long) atomic_inc_return(&input_no) - 1);
30569+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
30570
30571 error = device_add(&dev->dev);
30572 if (error)
30573diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
30574index b8d8611..15f8d2c 100644
30575--- a/drivers/input/joystick/sidewinder.c
30576+++ b/drivers/input/joystick/sidewinder.c
30577@@ -30,6 +30,7 @@
30578 #include <linux/kernel.h>
30579 #include <linux/module.h>
30580 #include <linux/slab.h>
30581+#include <linux/sched.h>
30582 #include <linux/init.h>
30583 #include <linux/input.h>
30584 #include <linux/gameport.h>
30585@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
30586 unsigned char buf[SW_LENGTH];
30587 int i;
30588
30589+ pax_track_stack();
30590+
30591 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
30592
30593 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
30594diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
30595index d728875..844c89b 100644
30596--- a/drivers/input/joystick/xpad.c
30597+++ b/drivers/input/joystick/xpad.c
30598@@ -710,7 +710,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
30599
30600 static int xpad_led_probe(struct usb_xpad *xpad)
30601 {
30602- static atomic_t led_seq = ATOMIC_INIT(0);
30603+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
30604 long led_no;
30605 struct xpad_led *led;
30606 struct led_classdev *led_cdev;
30607@@ -723,7 +723,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
30608 if (!led)
30609 return -ENOMEM;
30610
30611- led_no = (long)atomic_inc_return(&led_seq) - 1;
30612+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
30613
30614 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
30615 led->xpad = xpad;
30616diff --git a/drivers/input/misc/cma3000_d0x.c b/drivers/input/misc/cma3000_d0x.c
30617index 1633b63..09f8f20 100644
30618--- a/drivers/input/misc/cma3000_d0x.c
30619+++ b/drivers/input/misc/cma3000_d0x.c
30620@@ -114,8 +114,8 @@ static void decode_mg(struct cma3000_accl_data *data, int *datax,
30621 static irqreturn_t cma3000_thread_irq(int irq, void *dev_id)
30622 {
30623 struct cma3000_accl_data *data = dev_id;
30624- int datax, datay, dataz;
30625- u8 ctrl, mode, range, intr_status;
30626+ int datax, datay, dataz, intr_status;
30627+ u8 ctrl, mode, range;
30628
30629 intr_status = CMA3000_READ(data, CMA3000_INTSTATUS, "interrupt status");
30630 if (intr_status < 0)
30631diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
30632index 0110b5a..d3ad144 100644
30633--- a/drivers/input/mousedev.c
30634+++ b/drivers/input/mousedev.c
30635@@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
30636
30637 spin_unlock_irq(&client->packet_lock);
30638
30639- if (copy_to_user(buffer, data, count))
30640+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
30641 return -EFAULT;
30642
30643 return count;
30644diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
30645index ba70058..571d25d 100644
30646--- a/drivers/input/serio/serio.c
30647+++ b/drivers/input/serio/serio.c
30648@@ -497,7 +497,7 @@ static void serio_release_port(struct device *dev)
30649 */
30650 static void serio_init_port(struct serio *serio)
30651 {
30652- static atomic_t serio_no = ATOMIC_INIT(0);
30653+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
30654
30655 __module_get(THIS_MODULE);
30656
30657@@ -508,7 +508,7 @@ static void serio_init_port(struct serio *serio)
30658 mutex_init(&serio->drv_mutex);
30659 device_initialize(&serio->dev);
30660 dev_set_name(&serio->dev, "serio%ld",
30661- (long)atomic_inc_return(&serio_no) - 1);
30662+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
30663 serio->dev.bus = &serio_bus;
30664 serio->dev.release = serio_release_port;
30665 serio->dev.groups = serio_device_attr_groups;
30666diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
30667index e44933d..9ba484a 100644
30668--- a/drivers/isdn/capi/capi.c
30669+++ b/drivers/isdn/capi/capi.c
30670@@ -83,8 +83,8 @@ struct capiminor {
30671
30672 struct capi20_appl *ap;
30673 u32 ncci;
30674- atomic_t datahandle;
30675- atomic_t msgid;
30676+ atomic_unchecked_t datahandle;
30677+ atomic_unchecked_t msgid;
30678
30679 struct tty_port port;
30680 int ttyinstop;
30681@@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
30682 capimsg_setu16(s, 2, mp->ap->applid);
30683 capimsg_setu8 (s, 4, CAPI_DATA_B3);
30684 capimsg_setu8 (s, 5, CAPI_RESP);
30685- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
30686+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
30687 capimsg_setu32(s, 8, mp->ncci);
30688 capimsg_setu16(s, 12, datahandle);
30689 }
30690@@ -518,14 +518,14 @@ static void handle_minor_send(struct capiminor *mp)
30691 mp->outbytes -= len;
30692 spin_unlock_bh(&mp->outlock);
30693
30694- datahandle = atomic_inc_return(&mp->datahandle);
30695+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
30696 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
30697 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30698 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30699 capimsg_setu16(skb->data, 2, mp->ap->applid);
30700 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
30701 capimsg_setu8 (skb->data, 5, CAPI_REQ);
30702- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
30703+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
30704 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
30705 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
30706 capimsg_setu16(skb->data, 16, len); /* Data length */
30707diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
30708index db621db..825ea1a 100644
30709--- a/drivers/isdn/gigaset/common.c
30710+++ b/drivers/isdn/gigaset/common.c
30711@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
30712 cs->commands_pending = 0;
30713 cs->cur_at_seq = 0;
30714 cs->gotfwver = -1;
30715- cs->open_count = 0;
30716+ local_set(&cs->open_count, 0);
30717 cs->dev = NULL;
30718 cs->tty = NULL;
30719 cs->tty_dev = NULL;
30720diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
30721index 212efaf..f187c6b 100644
30722--- a/drivers/isdn/gigaset/gigaset.h
30723+++ b/drivers/isdn/gigaset/gigaset.h
30724@@ -35,6 +35,7 @@
30725 #include <linux/tty_driver.h>
30726 #include <linux/list.h>
30727 #include <linux/atomic.h>
30728+#include <asm/local.h>
30729
30730 #define GIG_VERSION {0, 5, 0, 0}
30731 #define GIG_COMPAT {0, 4, 0, 0}
30732@@ -433,7 +434,7 @@ struct cardstate {
30733 spinlock_t cmdlock;
30734 unsigned curlen, cmdbytes;
30735
30736- unsigned open_count;
30737+ local_t open_count;
30738 struct tty_struct *tty;
30739 struct tasklet_struct if_wake_tasklet;
30740 unsigned control_state;
30741diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
30742index e35058b..5898a8b 100644
30743--- a/drivers/isdn/gigaset/interface.c
30744+++ b/drivers/isdn/gigaset/interface.c
30745@@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
30746 }
30747 tty->driver_data = cs;
30748
30749- ++cs->open_count;
30750-
30751- if (cs->open_count == 1) {
30752+ if (local_inc_return(&cs->open_count) == 1) {
30753 spin_lock_irqsave(&cs->lock, flags);
30754 cs->tty = tty;
30755 spin_unlock_irqrestore(&cs->lock, flags);
30756@@ -192,10 +190,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
30757
30758 if (!cs->connected)
30759 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30760- else if (!cs->open_count)
30761+ else if (!local_read(&cs->open_count))
30762 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30763 else {
30764- if (!--cs->open_count) {
30765+ if (!local_dec_return(&cs->open_count)) {
30766 spin_lock_irqsave(&cs->lock, flags);
30767 cs->tty = NULL;
30768 spin_unlock_irqrestore(&cs->lock, flags);
30769@@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *tty,
30770 if (!cs->connected) {
30771 gig_dbg(DEBUG_IF, "not connected");
30772 retval = -ENODEV;
30773- } else if (!cs->open_count)
30774+ } else if (!local_read(&cs->open_count))
30775 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30776 else {
30777 retval = 0;
30778@@ -360,7 +358,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
30779 retval = -ENODEV;
30780 goto done;
30781 }
30782- if (!cs->open_count) {
30783+ if (!local_read(&cs->open_count)) {
30784 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30785 retval = -ENODEV;
30786 goto done;
30787@@ -413,7 +411,7 @@ static int if_write_room(struct tty_struct *tty)
30788 if (!cs->connected) {
30789 gig_dbg(DEBUG_IF, "not connected");
30790 retval = -ENODEV;
30791- } else if (!cs->open_count)
30792+ } else if (!local_read(&cs->open_count))
30793 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30794 else if (cs->mstate != MS_LOCKED) {
30795 dev_warn(cs->dev, "can't write to unlocked device\n");
30796@@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
30797
30798 if (!cs->connected)
30799 gig_dbg(DEBUG_IF, "not connected");
30800- else if (!cs->open_count)
30801+ else if (!local_read(&cs->open_count))
30802 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30803 else if (cs->mstate != MS_LOCKED)
30804 dev_warn(cs->dev, "can't write to unlocked device\n");
30805@@ -471,7 +469,7 @@ static void if_throttle(struct tty_struct *tty)
30806
30807 if (!cs->connected)
30808 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30809- else if (!cs->open_count)
30810+ else if (!local_read(&cs->open_count))
30811 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30812 else
30813 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
30814@@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_struct *tty)
30815
30816 if (!cs->connected)
30817 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30818- else if (!cs->open_count)
30819+ else if (!local_read(&cs->open_count))
30820 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30821 else
30822 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
30823@@ -526,7 +524,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
30824 goto out;
30825 }
30826
30827- if (!cs->open_count) {
30828+ if (!local_read(&cs->open_count)) {
30829 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30830 goto out;
30831 }
30832diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
30833index 2a57da59..e7a12ed 100644
30834--- a/drivers/isdn/hardware/avm/b1.c
30835+++ b/drivers/isdn/hardware/avm/b1.c
30836@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
30837 }
30838 if (left) {
30839 if (t4file->user) {
30840- if (copy_from_user(buf, dp, left))
30841+ if (left > sizeof buf || copy_from_user(buf, dp, left))
30842 return -EFAULT;
30843 } else {
30844 memcpy(buf, dp, left);
30845@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
30846 }
30847 if (left) {
30848 if (config->user) {
30849- if (copy_from_user(buf, dp, left))
30850+ if (left > sizeof buf || copy_from_user(buf, dp, left))
30851 return -EFAULT;
30852 } else {
30853 memcpy(buf, dp, left);
30854diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
30855index f130724..c373c68 100644
30856--- a/drivers/isdn/hardware/eicon/capidtmf.c
30857+++ b/drivers/isdn/hardware/eicon/capidtmf.c
30858@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
30859 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
30860 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
30861
30862+ pax_track_stack();
30863
30864 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
30865 {
30866diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
30867index 4d425c6..a9be6c4 100644
30868--- a/drivers/isdn/hardware/eicon/capifunc.c
30869+++ b/drivers/isdn/hardware/eicon/capifunc.c
30870@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
30871 IDI_SYNC_REQ req;
30872 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30873
30874+ pax_track_stack();
30875+
30876 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30877
30878 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30879diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
30880index 3029234..ef0d9e2 100644
30881--- a/drivers/isdn/hardware/eicon/diddfunc.c
30882+++ b/drivers/isdn/hardware/eicon/diddfunc.c
30883@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30884 IDI_SYNC_REQ req;
30885 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30886
30887+ pax_track_stack();
30888+
30889 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30890
30891 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30892diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
30893index 0bbee78..a0d0a01 100644
30894--- a/drivers/isdn/hardware/eicon/divasfunc.c
30895+++ b/drivers/isdn/hardware/eicon/divasfunc.c
30896@@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30897 IDI_SYNC_REQ req;
30898 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30899
30900+ pax_track_stack();
30901+
30902 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30903
30904 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30905diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
30906index 85784a7..a19ca98 100644
30907--- a/drivers/isdn/hardware/eicon/divasync.h
30908+++ b/drivers/isdn/hardware/eicon/divasync.h
30909@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
30910 } diva_didd_add_adapter_t;
30911 typedef struct _diva_didd_remove_adapter {
30912 IDI_CALL p_request;
30913-} diva_didd_remove_adapter_t;
30914+} __no_const diva_didd_remove_adapter_t;
30915 typedef struct _diva_didd_read_adapter_array {
30916 void * buffer;
30917 dword length;
30918diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
30919index db87d51..7d09acf 100644
30920--- a/drivers/isdn/hardware/eicon/idifunc.c
30921+++ b/drivers/isdn/hardware/eicon/idifunc.c
30922@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30923 IDI_SYNC_REQ req;
30924 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30925
30926+ pax_track_stack();
30927+
30928 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30929
30930 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30931diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
30932index a339598..b6a8bfc 100644
30933--- a/drivers/isdn/hardware/eicon/message.c
30934+++ b/drivers/isdn/hardware/eicon/message.c
30935@@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci)
30936 dword d;
30937 word w;
30938
30939+ pax_track_stack();
30940+
30941 a = plci->adapter;
30942 Id = ((word)plci->Id<<8)|a->Id;
30943 PUT_WORD(&SS_Ind[4],0x0000);
30944@@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
30945 word j, n, w;
30946 dword d;
30947
30948+ pax_track_stack();
30949+
30950
30951 for(i=0;i<8;i++) bp_parms[i].length = 0;
30952 for(i=0;i<2;i++) global_config[i].length = 0;
30953@@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
30954 const byte llc3[] = {4,3,2,2,6,6,0};
30955 const byte header[] = {0,2,3,3,0,0,0};
30956
30957+ pax_track_stack();
30958+
30959 for(i=0;i<8;i++) bp_parms[i].length = 0;
30960 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
30961 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
30962@@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
30963 word appl_number_group_type[MAX_APPL];
30964 PLCI *auxplci;
30965
30966+ pax_track_stack();
30967+
30968 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
30969
30970 if(!a->group_optimization_enabled)
30971diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
30972index a564b75..f3cf8b5 100644
30973--- a/drivers/isdn/hardware/eicon/mntfunc.c
30974+++ b/drivers/isdn/hardware/eicon/mntfunc.c
30975@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30976 IDI_SYNC_REQ req;
30977 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30978
30979+ pax_track_stack();
30980+
30981 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30982
30983 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30984diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
30985index a3bd163..8956575 100644
30986--- a/drivers/isdn/hardware/eicon/xdi_adapter.h
30987+++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
30988@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
30989 typedef struct _diva_os_idi_adapter_interface {
30990 diva_init_card_proc_t cleanup_adapter_proc;
30991 diva_cmd_card_proc_t cmd_proc;
30992-} diva_os_idi_adapter_interface_t;
30993+} __no_const diva_os_idi_adapter_interface_t;
30994
30995 typedef struct _diva_os_xdi_adapter {
30996 struct list_head link;
30997diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
30998index 6ed82ad..b05ac05 100644
30999--- a/drivers/isdn/i4l/isdn_common.c
31000+++ b/drivers/isdn/i4l/isdn_common.c
31001@@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
31002 } iocpar;
31003 void __user *argp = (void __user *)arg;
31004
31005+ pax_track_stack();
31006+
31007 #define name iocpar.name
31008 #define bname iocpar.bname
31009 #define iocts iocpar.iocts
31010diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
31011index 1f355bb..43f1fea 100644
31012--- a/drivers/isdn/icn/icn.c
31013+++ b/drivers/isdn/icn/icn.c
31014@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
31015 if (count > len)
31016 count = len;
31017 if (user) {
31018- if (copy_from_user(msg, buf, count))
31019+ if (count > sizeof msg || copy_from_user(msg, buf, count))
31020 return -EFAULT;
31021 } else
31022 memcpy(msg, buf, count);
31023diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
31024index 2535933..09a8e86 100644
31025--- a/drivers/lguest/core.c
31026+++ b/drivers/lguest/core.c
31027@@ -92,9 +92,17 @@ static __init int map_switcher(void)
31028 * it's worked so far. The end address needs +1 because __get_vm_area
31029 * allocates an extra guard page, so we need space for that.
31030 */
31031+
31032+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31033+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31034+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31035+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31036+#else
31037 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31038 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31039 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31040+#endif
31041+
31042 if (!switcher_vma) {
31043 err = -ENOMEM;
31044 printk("lguest: could not map switcher pages high\n");
31045@@ -119,7 +127,7 @@ static __init int map_switcher(void)
31046 * Now the Switcher is mapped at the right address, we can't fail!
31047 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
31048 */
31049- memcpy(switcher_vma->addr, start_switcher_text,
31050+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31051 end_switcher_text - start_switcher_text);
31052
31053 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31054diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
31055index 65af42f..530c87a 100644
31056--- a/drivers/lguest/x86/core.c
31057+++ b/drivers/lguest/x86/core.c
31058@@ -59,7 +59,7 @@ static struct {
31059 /* Offset from where switcher.S was compiled to where we've copied it */
31060 static unsigned long switcher_offset(void)
31061 {
31062- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31063+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31064 }
31065
31066 /* This cpu's struct lguest_pages. */
31067@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
31068 * These copies are pretty cheap, so we do them unconditionally: */
31069 /* Save the current Host top-level page directory.
31070 */
31071+
31072+#ifdef CONFIG_PAX_PER_CPU_PGD
31073+ pages->state.host_cr3 = read_cr3();
31074+#else
31075 pages->state.host_cr3 = __pa(current->mm->pgd);
31076+#endif
31077+
31078 /*
31079 * Set up the Guest's page tables to see this CPU's pages (and no
31080 * other CPU's pages).
31081@@ -472,7 +478,7 @@ void __init lguest_arch_host_init(void)
31082 * compiled-in switcher code and the high-mapped copy we just made.
31083 */
31084 for (i = 0; i < IDT_ENTRIES; i++)
31085- default_idt_entries[i] += switcher_offset();
31086+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31087
31088 /*
31089 * Set up the Switcher's per-cpu areas.
31090@@ -555,7 +561,7 @@ void __init lguest_arch_host_init(void)
31091 * it will be undisturbed when we switch. To change %cs and jump we
31092 * need this structure to feed to Intel's "lcall" instruction.
31093 */
31094- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31095+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31096 lguest_entry.segment = LGUEST_CS;
31097
31098 /*
31099diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
31100index 40634b0..4f5855e 100644
31101--- a/drivers/lguest/x86/switcher_32.S
31102+++ b/drivers/lguest/x86/switcher_32.S
31103@@ -87,6 +87,7 @@
31104 #include <asm/page.h>
31105 #include <asm/segment.h>
31106 #include <asm/lguest.h>
31107+#include <asm/processor-flags.h>
31108
31109 // We mark the start of the code to copy
31110 // It's placed in .text tho it's never run here
31111@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31112 // Changes type when we load it: damn Intel!
31113 // For after we switch over our page tables
31114 // That entry will be read-only: we'd crash.
31115+
31116+#ifdef CONFIG_PAX_KERNEXEC
31117+ mov %cr0, %edx
31118+ xor $X86_CR0_WP, %edx
31119+ mov %edx, %cr0
31120+#endif
31121+
31122 movl $(GDT_ENTRY_TSS*8), %edx
31123 ltr %dx
31124
31125@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31126 // Let's clear it again for our return.
31127 // The GDT descriptor of the Host
31128 // Points to the table after two "size" bytes
31129- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31130+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31131 // Clear "used" from type field (byte 5, bit 2)
31132- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31133+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31134+
31135+#ifdef CONFIG_PAX_KERNEXEC
31136+ mov %cr0, %eax
31137+ xor $X86_CR0_WP, %eax
31138+ mov %eax, %cr0
31139+#endif
31140
31141 // Once our page table's switched, the Guest is live!
31142 // The Host fades as we run this final step.
31143@@ -295,13 +309,12 @@ deliver_to_host:
31144 // I consulted gcc, and it gave
31145 // These instructions, which I gladly credit:
31146 leal (%edx,%ebx,8), %eax
31147- movzwl (%eax),%edx
31148- movl 4(%eax), %eax
31149- xorw %ax, %ax
31150- orl %eax, %edx
31151+ movl 4(%eax), %edx
31152+ movw (%eax), %dx
31153 // Now the address of the handler's in %edx
31154 // We call it now: its "iret" drops us home.
31155- jmp *%edx
31156+ ljmp $__KERNEL_CS, $1f
31157+1: jmp *%edx
31158
31159 // Every interrupt can come to us here
31160 // But we must truly tell each apart.
31161diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
31162index 4daf9e5..b8d1d0f 100644
31163--- a/drivers/macintosh/macio_asic.c
31164+++ b/drivers/macintosh/macio_asic.c
31165@@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
31166 * MacIO is matched against any Apple ID, it's probe() function
31167 * will then decide wether it applies or not
31168 */
31169-static const struct pci_device_id __devinitdata pci_ids [] = { {
31170+static const struct pci_device_id __devinitconst pci_ids [] = { {
31171 .vendor = PCI_VENDOR_ID_APPLE,
31172 .device = PCI_ANY_ID,
31173 .subvendor = PCI_ANY_ID,
31174diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
31175index 2e9a3ca..c2fb229 100644
31176--- a/drivers/md/dm-ioctl.c
31177+++ b/drivers/md/dm-ioctl.c
31178@@ -1578,7 +1578,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
31179 cmd == DM_LIST_VERSIONS_CMD)
31180 return 0;
31181
31182- if ((cmd == DM_DEV_CREATE_CMD)) {
31183+ if (cmd == DM_DEV_CREATE_CMD) {
31184 if (!*param->name) {
31185 DMWARN("name not supplied when creating device");
31186 return -EINVAL;
31187diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
31188index 9bfd057..01180bc 100644
31189--- a/drivers/md/dm-raid1.c
31190+++ b/drivers/md/dm-raid1.c
31191@@ -40,7 +40,7 @@ enum dm_raid1_error {
31192
31193 struct mirror {
31194 struct mirror_set *ms;
31195- atomic_t error_count;
31196+ atomic_unchecked_t error_count;
31197 unsigned long error_type;
31198 struct dm_dev *dev;
31199 sector_t offset;
31200@@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
31201 struct mirror *m;
31202
31203 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31204- if (!atomic_read(&m->error_count))
31205+ if (!atomic_read_unchecked(&m->error_count))
31206 return m;
31207
31208 return NULL;
31209@@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
31210 * simple way to tell if a device has encountered
31211 * errors.
31212 */
31213- atomic_inc(&m->error_count);
31214+ atomic_inc_unchecked(&m->error_count);
31215
31216 if (test_and_set_bit(error_type, &m->error_type))
31217 return;
31218@@ -408,7 +408,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
31219 struct mirror *m = get_default_mirror(ms);
31220
31221 do {
31222- if (likely(!atomic_read(&m->error_count)))
31223+ if (likely(!atomic_read_unchecked(&m->error_count)))
31224 return m;
31225
31226 if (m-- == ms->mirror)
31227@@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
31228 {
31229 struct mirror *default_mirror = get_default_mirror(m->ms);
31230
31231- return !atomic_read(&default_mirror->error_count);
31232+ return !atomic_read_unchecked(&default_mirror->error_count);
31233 }
31234
31235 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31236@@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
31237 */
31238 if (likely(region_in_sync(ms, region, 1)))
31239 m = choose_mirror(ms, bio->bi_sector);
31240- else if (m && atomic_read(&m->error_count))
31241+ else if (m && atomic_read_unchecked(&m->error_count))
31242 m = NULL;
31243
31244 if (likely(m))
31245@@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
31246 }
31247
31248 ms->mirror[mirror].ms = ms;
31249- atomic_set(&(ms->mirror[mirror].error_count), 0);
31250+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31251 ms->mirror[mirror].error_type = 0;
31252 ms->mirror[mirror].offset = offset;
31253
31254@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_target *ti)
31255 */
31256 static char device_status_char(struct mirror *m)
31257 {
31258- if (!atomic_read(&(m->error_count)))
31259+ if (!atomic_read_unchecked(&(m->error_count)))
31260 return 'A';
31261
31262 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
31263diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
31264index 3d80cf0..b77cc47 100644
31265--- a/drivers/md/dm-stripe.c
31266+++ b/drivers/md/dm-stripe.c
31267@@ -20,7 +20,7 @@ struct stripe {
31268 struct dm_dev *dev;
31269 sector_t physical_start;
31270
31271- atomic_t error_count;
31272+ atomic_unchecked_t error_count;
31273 };
31274
31275 struct stripe_c {
31276@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
31277 kfree(sc);
31278 return r;
31279 }
31280- atomic_set(&(sc->stripe[i].error_count), 0);
31281+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31282 }
31283
31284 ti->private = sc;
31285@@ -314,7 +314,7 @@ static int stripe_status(struct dm_target *ti,
31286 DMEMIT("%d ", sc->stripes);
31287 for (i = 0; i < sc->stripes; i++) {
31288 DMEMIT("%s ", sc->stripe[i].dev->name);
31289- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31290+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31291 'D' : 'A';
31292 }
31293 buffer[i] = '\0';
31294@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
31295 */
31296 for (i = 0; i < sc->stripes; i++)
31297 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31298- atomic_inc(&(sc->stripe[i].error_count));
31299- if (atomic_read(&(sc->stripe[i].error_count)) <
31300+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31301+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31302 DM_IO_ERROR_THRESHOLD)
31303 schedule_work(&sc->trigger_event);
31304 }
31305diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
31306index bc04518..7a83b81 100644
31307--- a/drivers/md/dm-table.c
31308+++ b/drivers/md/dm-table.c
31309@@ -389,7 +389,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
31310 if (!dev_size)
31311 return 0;
31312
31313- if ((start >= dev_size) || (start + len > dev_size)) {
31314+ if ((start >= dev_size) || (len > dev_size - start)) {
31315 DMWARN("%s: %s too small for target: "
31316 "start=%llu, len=%llu, dev_size=%llu",
31317 dm_device_name(ti->table->md), bdevname(bdev, b),
31318diff --git a/drivers/md/dm.c b/drivers/md/dm.c
31319index 52b39f3..83a8b6b 100644
31320--- a/drivers/md/dm.c
31321+++ b/drivers/md/dm.c
31322@@ -165,9 +165,9 @@ struct mapped_device {
31323 /*
31324 * Event handling.
31325 */
31326- atomic_t event_nr;
31327+ atomic_unchecked_t event_nr;
31328 wait_queue_head_t eventq;
31329- atomic_t uevent_seq;
31330+ atomic_unchecked_t uevent_seq;
31331 struct list_head uevent_list;
31332 spinlock_t uevent_lock; /* Protect access to uevent_list */
31333
31334@@ -1843,8 +1843,8 @@ static struct mapped_device *alloc_dev(int minor)
31335 rwlock_init(&md->map_lock);
31336 atomic_set(&md->holders, 1);
31337 atomic_set(&md->open_count, 0);
31338- atomic_set(&md->event_nr, 0);
31339- atomic_set(&md->uevent_seq, 0);
31340+ atomic_set_unchecked(&md->event_nr, 0);
31341+ atomic_set_unchecked(&md->uevent_seq, 0);
31342 INIT_LIST_HEAD(&md->uevent_list);
31343 spin_lock_init(&md->uevent_lock);
31344
31345@@ -1978,7 +1978,7 @@ static void event_callback(void *context)
31346
31347 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31348
31349- atomic_inc(&md->event_nr);
31350+ atomic_inc_unchecked(&md->event_nr);
31351 wake_up(&md->eventq);
31352 }
31353
31354@@ -2614,18 +2614,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
31355
31356 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31357 {
31358- return atomic_add_return(1, &md->uevent_seq);
31359+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31360 }
31361
31362 uint32_t dm_get_event_nr(struct mapped_device *md)
31363 {
31364- return atomic_read(&md->event_nr);
31365+ return atomic_read_unchecked(&md->event_nr);
31366 }
31367
31368 int dm_wait_event(struct mapped_device *md, int event_nr)
31369 {
31370 return wait_event_interruptible(md->eventq,
31371- (event_nr != atomic_read(&md->event_nr)));
31372+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31373 }
31374
31375 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31376diff --git a/drivers/md/md.c b/drivers/md/md.c
31377index 5c95ccb..217fa57 100644
31378--- a/drivers/md/md.c
31379+++ b/drivers/md/md.c
31380@@ -280,10 +280,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
31381 * start build, activate spare
31382 */
31383 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31384-static atomic_t md_event_count;
31385+static atomic_unchecked_t md_event_count;
31386 void md_new_event(mddev_t *mddev)
31387 {
31388- atomic_inc(&md_event_count);
31389+ atomic_inc_unchecked(&md_event_count);
31390 wake_up(&md_event_waiters);
31391 }
31392 EXPORT_SYMBOL_GPL(md_new_event);
31393@@ -293,7 +293,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31394 */
31395 static void md_new_event_inintr(mddev_t *mddev)
31396 {
31397- atomic_inc(&md_event_count);
31398+ atomic_inc_unchecked(&md_event_count);
31399 wake_up(&md_event_waiters);
31400 }
31401
31402@@ -1531,7 +1531,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
31403
31404 rdev->preferred_minor = 0xffff;
31405 rdev->data_offset = le64_to_cpu(sb->data_offset);
31406- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31407+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31408
31409 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31410 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
31411@@ -1748,7 +1748,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
31412 else
31413 sb->resync_offset = cpu_to_le64(0);
31414
31415- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31416+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31417
31418 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31419 sb->size = cpu_to_le64(mddev->dev_sectors);
31420@@ -2643,7 +2643,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
31421 static ssize_t
31422 errors_show(mdk_rdev_t *rdev, char *page)
31423 {
31424- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31425+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31426 }
31427
31428 static ssize_t
31429@@ -2652,7 +2652,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
31430 char *e;
31431 unsigned long n = simple_strtoul(buf, &e, 10);
31432 if (*buf && (*e == 0 || *e == '\n')) {
31433- atomic_set(&rdev->corrected_errors, n);
31434+ atomic_set_unchecked(&rdev->corrected_errors, n);
31435 return len;
31436 }
31437 return -EINVAL;
31438@@ -3042,8 +3042,8 @@ int md_rdev_init(mdk_rdev_t *rdev)
31439 rdev->sb_loaded = 0;
31440 rdev->bb_page = NULL;
31441 atomic_set(&rdev->nr_pending, 0);
31442- atomic_set(&rdev->read_errors, 0);
31443- atomic_set(&rdev->corrected_errors, 0);
31444+ atomic_set_unchecked(&rdev->read_errors, 0);
31445+ atomic_set_unchecked(&rdev->corrected_errors, 0);
31446
31447 INIT_LIST_HEAD(&rdev->same_set);
31448 init_waitqueue_head(&rdev->blocked_wait);
31449@@ -6667,7 +6667,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31450
31451 spin_unlock(&pers_lock);
31452 seq_printf(seq, "\n");
31453- seq->poll_event = atomic_read(&md_event_count);
31454+ seq->poll_event = atomic_read_unchecked(&md_event_count);
31455 return 0;
31456 }
31457 if (v == (void*)2) {
31458@@ -6756,7 +6756,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31459 chunk_kb ? "KB" : "B");
31460 if (bitmap->file) {
31461 seq_printf(seq, ", file: ");
31462- seq_path(seq, &bitmap->file->f_path, " \t\n");
31463+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31464 }
31465
31466 seq_printf(seq, "\n");
31467@@ -6787,7 +6787,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
31468 return error;
31469
31470 seq = file->private_data;
31471- seq->poll_event = atomic_read(&md_event_count);
31472+ seq->poll_event = atomic_read_unchecked(&md_event_count);
31473 return error;
31474 }
31475
31476@@ -6801,7 +6801,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
31477 /* always allow read */
31478 mask = POLLIN | POLLRDNORM;
31479
31480- if (seq->poll_event != atomic_read(&md_event_count))
31481+ if (seq->poll_event != atomic_read_unchecked(&md_event_count))
31482 mask |= POLLERR | POLLPRI;
31483 return mask;
31484 }
31485@@ -6845,7 +6845,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
31486 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
31487 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
31488 (int)part_stat_read(&disk->part0, sectors[1]) -
31489- atomic_read(&disk->sync_io);
31490+ atomic_read_unchecked(&disk->sync_io);
31491 /* sync IO will cause sync_io to increase before the disk_stats
31492 * as sync_io is counted when a request starts, and
31493 * disk_stats is counted when it completes.
31494diff --git a/drivers/md/md.h b/drivers/md/md.h
31495index 0a309dc..7e01d7f 100644
31496--- a/drivers/md/md.h
31497+++ b/drivers/md/md.h
31498@@ -124,13 +124,13 @@ struct mdk_rdev_s
31499 * only maintained for arrays that
31500 * support hot removal
31501 */
31502- atomic_t read_errors; /* number of consecutive read errors that
31503+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
31504 * we have tried to ignore.
31505 */
31506 struct timespec last_read_error; /* monotonic time since our
31507 * last read error
31508 */
31509- atomic_t corrected_errors; /* number of corrected read errors,
31510+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
31511 * for reporting to userspace and storing
31512 * in superblock.
31513 */
31514@@ -415,7 +415,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
31515
31516 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
31517 {
31518- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31519+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31520 }
31521
31522 struct mdk_personality
31523diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
31524index d9587df..83a0dc3 100644
31525--- a/drivers/md/raid1.c
31526+++ b/drivers/md/raid1.c
31527@@ -1541,7 +1541,7 @@ static int fix_sync_read_error(r1bio_t *r1_bio)
31528 if (r1_sync_page_io(rdev, sect, s,
31529 bio->bi_io_vec[idx].bv_page,
31530 READ) != 0)
31531- atomic_add(s, &rdev->corrected_errors);
31532+ atomic_add_unchecked(s, &rdev->corrected_errors);
31533 }
31534 sectors -= s;
31535 sect += s;
31536@@ -1754,7 +1754,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
31537 test_bit(In_sync, &rdev->flags)) {
31538 if (r1_sync_page_io(rdev, sect, s,
31539 conf->tmppage, READ)) {
31540- atomic_add(s, &rdev->corrected_errors);
31541+ atomic_add_unchecked(s, &rdev->corrected_errors);
31542 printk(KERN_INFO
31543 "md/raid1:%s: read error corrected "
31544 "(%d sectors at %llu on %s)\n",
31545diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
31546index 1d44228..98db57d 100644
31547--- a/drivers/md/raid10.c
31548+++ b/drivers/md/raid10.c
31549@@ -1423,7 +1423,7 @@ static void end_sync_read(struct bio *bio, int error)
31550 /* The write handler will notice the lack of
31551 * R10BIO_Uptodate and record any errors etc
31552 */
31553- atomic_add(r10_bio->sectors,
31554+ atomic_add_unchecked(r10_bio->sectors,
31555 &conf->mirrors[d].rdev->corrected_errors);
31556
31557 /* for reconstruct, we always reschedule after a read.
31558@@ -1723,7 +1723,7 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31559 {
31560 struct timespec cur_time_mon;
31561 unsigned long hours_since_last;
31562- unsigned int read_errors = atomic_read(&rdev->read_errors);
31563+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
31564
31565 ktime_get_ts(&cur_time_mon);
31566
31567@@ -1745,9 +1745,9 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31568 * overflowing the shift of read_errors by hours_since_last.
31569 */
31570 if (hours_since_last >= 8 * sizeof(read_errors))
31571- atomic_set(&rdev->read_errors, 0);
31572+ atomic_set_unchecked(&rdev->read_errors, 0);
31573 else
31574- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
31575+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
31576 }
31577
31578 static int r10_sync_page_io(mdk_rdev_t *rdev, sector_t sector,
31579@@ -1797,8 +1797,8 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31580 return;
31581
31582 check_decay_read_errors(mddev, rdev);
31583- atomic_inc(&rdev->read_errors);
31584- if (atomic_read(&rdev->read_errors) > max_read_errors) {
31585+ atomic_inc_unchecked(&rdev->read_errors);
31586+ if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
31587 char b[BDEVNAME_SIZE];
31588 bdevname(rdev->bdev, b);
31589
31590@@ -1806,7 +1806,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31591 "md/raid10:%s: %s: Raid device exceeded "
31592 "read_error threshold [cur %d:max %d]\n",
31593 mdname(mddev), b,
31594- atomic_read(&rdev->read_errors), max_read_errors);
31595+ atomic_read_unchecked(&rdev->read_errors), max_read_errors);
31596 printk(KERN_NOTICE
31597 "md/raid10:%s: %s: Failing raid device\n",
31598 mdname(mddev), b);
31599@@ -1951,7 +1951,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31600 (unsigned long long)(
31601 sect + rdev->data_offset),
31602 bdevname(rdev->bdev, b));
31603- atomic_add(s, &rdev->corrected_errors);
31604+ atomic_add_unchecked(s, &rdev->corrected_errors);
31605 }
31606
31607 rdev_dec_pending(rdev, mddev);
31608diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
31609index b6200c3..02e8702 100644
31610--- a/drivers/md/raid5.c
31611+++ b/drivers/md/raid5.c
31612@@ -1616,19 +1616,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
31613 (unsigned long long)(sh->sector
31614 + rdev->data_offset),
31615 bdevname(rdev->bdev, b));
31616- atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
31617+ atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
31618 clear_bit(R5_ReadError, &sh->dev[i].flags);
31619 clear_bit(R5_ReWrite, &sh->dev[i].flags);
31620 }
31621- if (atomic_read(&conf->disks[i].rdev->read_errors))
31622- atomic_set(&conf->disks[i].rdev->read_errors, 0);
31623+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
31624+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
31625 } else {
31626 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
31627 int retry = 0;
31628 rdev = conf->disks[i].rdev;
31629
31630 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
31631- atomic_inc(&rdev->read_errors);
31632+ atomic_inc_unchecked(&rdev->read_errors);
31633 if (conf->mddev->degraded >= conf->max_degraded)
31634 printk_ratelimited(
31635 KERN_WARNING
31636@@ -1648,7 +1648,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
31637 (unsigned long long)(sh->sector
31638 + rdev->data_offset),
31639 bdn);
31640- else if (atomic_read(&rdev->read_errors)
31641+ else if (atomic_read_unchecked(&rdev->read_errors)
31642 > conf->max_nr_stripes)
31643 printk(KERN_WARNING
31644 "md/raid:%s: Too many read errors, failing device %s.\n",
31645@@ -1978,6 +1978,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
31646 sector_t r_sector;
31647 struct stripe_head sh2;
31648
31649+ pax_track_stack();
31650
31651 chunk_offset = sector_div(new_sector, sectors_per_chunk);
31652 stripe = new_sector;
31653diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
31654index 1d1d8d2..6c6837a 100644
31655--- a/drivers/media/common/saa7146_hlp.c
31656+++ b/drivers/media/common/saa7146_hlp.c
31657@@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
31658
31659 int x[32], y[32], w[32], h[32];
31660
31661+ pax_track_stack();
31662+
31663 /* clear out memory */
31664 memset(&line_list[0], 0x00, sizeof(u32)*32);
31665 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
31666diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c
31667index 573d540..16f78f3 100644
31668--- a/drivers/media/dvb/ddbridge/ddbridge-core.c
31669+++ b/drivers/media/dvb/ddbridge/ddbridge-core.c
31670@@ -1675,7 +1675,7 @@ static struct ddb_info ddb_v6 = {
31671 .subvendor = _subvend, .subdevice = _subdev, \
31672 .driver_data = (unsigned long)&_driverdata }
31673
31674-static const struct pci_device_id ddb_id_tbl[] __devinitdata = {
31675+static const struct pci_device_id ddb_id_tbl[] __devinitconst = {
31676 DDB_ID(DDVID, 0x0002, DDVID, 0x0001, ddb_octopus),
31677 DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus),
31678 DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le),
31679diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31680index 7ea517b..252fe54 100644
31681--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31682+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31683@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
31684 u8 buf[HOST_LINK_BUF_SIZE];
31685 int i;
31686
31687+ pax_track_stack();
31688+
31689 dprintk("%s\n", __func__);
31690
31691 /* check if we have space for a link buf in the rx_buffer */
31692@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
31693 unsigned long timeout;
31694 int written;
31695
31696+ pax_track_stack();
31697+
31698 dprintk("%s\n", __func__);
31699
31700 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
31701diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
31702index a7d876f..8c21b61 100644
31703--- a/drivers/media/dvb/dvb-core/dvb_demux.h
31704+++ b/drivers/media/dvb/dvb-core/dvb_demux.h
31705@@ -73,7 +73,7 @@ struct dvb_demux_feed {
31706 union {
31707 dmx_ts_cb ts;
31708 dmx_section_cb sec;
31709- } cb;
31710+ } __no_const cb;
31711
31712 struct dvb_demux *demux;
31713 void *priv;
31714diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
31715index f732877..d38c35a 100644
31716--- a/drivers/media/dvb/dvb-core/dvbdev.c
31717+++ b/drivers/media/dvb/dvb-core/dvbdev.c
31718@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
31719 const struct dvb_device *template, void *priv, int type)
31720 {
31721 struct dvb_device *dvbdev;
31722- struct file_operations *dvbdevfops;
31723+ file_operations_no_const *dvbdevfops;
31724 struct device *clsdev;
31725 int minor;
31726 int id;
31727diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
31728index acb5fb2..2413f1d 100644
31729--- a/drivers/media/dvb/dvb-usb/cxusb.c
31730+++ b/drivers/media/dvb/dvb-usb/cxusb.c
31731@@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
31732 struct dib0700_adapter_state {
31733 int (*set_param_save) (struct dvb_frontend *,
31734 struct dvb_frontend_parameters *);
31735-};
31736+} __no_const;
31737
31738 static int dib7070_set_param_override(struct dvb_frontend *fe,
31739 struct dvb_frontend_parameters *fep)
31740diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
31741index a224e94..503b76a 100644
31742--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
31743+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
31744@@ -478,6 +478,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
31745 if (!buf)
31746 return -ENOMEM;
31747
31748+ pax_track_stack();
31749+
31750 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
31751 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
31752 hx.addr, hx.len, hx.chk);
31753diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
31754index 058b231..183d2b3 100644
31755--- a/drivers/media/dvb/dvb-usb/dw2102.c
31756+++ b/drivers/media/dvb/dvb-usb/dw2102.c
31757@@ -95,7 +95,7 @@ struct su3000_state {
31758
31759 struct s6x0_state {
31760 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
31761-};
31762+} __no_const;
31763
31764 /* debug */
31765 static int dvb_usb_dw2102_debug;
31766diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c
31767index 37b1469..28a6f6f 100644
31768--- a/drivers/media/dvb/dvb-usb/lmedm04.c
31769+++ b/drivers/media/dvb/dvb-usb/lmedm04.c
31770@@ -742,6 +742,7 @@ static int lme2510_download_firmware(struct usb_device *dev,
31771 usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
31772 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000);
31773
31774+ pax_track_stack();
31775
31776 data[0] = 0x8a;
31777 len_in = 1;
31778@@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_device *dev)
31779 int ret = 0, len_in;
31780 u8 data[512] = {0};
31781
31782+ pax_track_stack();
31783+
31784 data[0] = 0x0a;
31785 len_in = 1;
31786 info("FRM Firmware Cold Reset");
31787diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
31788index ba91735..4261d84 100644
31789--- a/drivers/media/dvb/frontends/dib3000.h
31790+++ b/drivers/media/dvb/frontends/dib3000.h
31791@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
31792 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
31793 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
31794 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
31795-};
31796+} __no_const;
31797
31798 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
31799 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
31800diff --git a/drivers/media/dvb/frontends/mb86a16.c b/drivers/media/dvb/frontends/mb86a16.c
31801index c283112..7f367a7 100644
31802--- a/drivers/media/dvb/frontends/mb86a16.c
31803+++ b/drivers/media/dvb/frontends/mb86a16.c
31804@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16_state *state)
31805 int ret = -1;
31806 int sync;
31807
31808+ pax_track_stack();
31809+
31810 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
31811
31812 fcp = 3000;
31813diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
31814index c709ce6..b3fe620 100644
31815--- a/drivers/media/dvb/frontends/or51211.c
31816+++ b/drivers/media/dvb/frontends/or51211.c
31817@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
31818 u8 tudata[585];
31819 int i;
31820
31821+ pax_track_stack();
31822+
31823 dprintk("Firmware is %zd bytes\n",fw->size);
31824
31825 /* Get eprom data */
31826diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
31827index 0564192..75b16f5 100644
31828--- a/drivers/media/dvb/ngene/ngene-cards.c
31829+++ b/drivers/media/dvb/ngene/ngene-cards.c
31830@@ -477,7 +477,7 @@ static struct ngene_info ngene_info_m780 = {
31831
31832 /****************************************************************************/
31833
31834-static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
31835+static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
31836 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
31837 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
31838 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
31839diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
31840index 16a089f..ab1667d 100644
31841--- a/drivers/media/radio/radio-cadet.c
31842+++ b/drivers/media/radio/radio-cadet.c
31843@@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
31844 unsigned char readbuf[RDS_BUFFER];
31845 int i = 0;
31846
31847+ if (count > RDS_BUFFER)
31848+ return -EFAULT;
31849 mutex_lock(&dev->lock);
31850 if (dev->rdsstat == 0) {
31851 dev->rdsstat = 1;
31852diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
31853index 9cde353..8c6a1c3 100644
31854--- a/drivers/media/video/au0828/au0828.h
31855+++ b/drivers/media/video/au0828/au0828.h
31856@@ -191,7 +191,7 @@ struct au0828_dev {
31857
31858 /* I2C */
31859 struct i2c_adapter i2c_adap;
31860- struct i2c_algorithm i2c_algo;
31861+ i2c_algorithm_no_const i2c_algo;
31862 struct i2c_client i2c_client;
31863 u32 i2c_rc;
31864
31865diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
31866index 9e2f870..22e3a08 100644
31867--- a/drivers/media/video/cx18/cx18-driver.c
31868+++ b/drivers/media/video/cx18/cx18-driver.c
31869@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
31870 struct i2c_client c;
31871 u8 eedata[256];
31872
31873+ pax_track_stack();
31874+
31875 memset(&c, 0, sizeof(c));
31876 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
31877 c.adapter = &cx->i2c_adap[0];
31878diff --git a/drivers/media/video/cx23885/cx23885-input.c b/drivers/media/video/cx23885/cx23885-input.c
31879index ce765e3..f9e1b04 100644
31880--- a/drivers/media/video/cx23885/cx23885-input.c
31881+++ b/drivers/media/video/cx23885/cx23885-input.c
31882@@ -53,6 +53,8 @@ static void cx23885_input_process_measurements(struct cx23885_dev *dev,
31883 bool handle = false;
31884 struct ir_raw_event ir_core_event[64];
31885
31886+ pax_track_stack();
31887+
31888 do {
31889 num = 0;
31890 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
31891diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
31892index 68d1240..46b32eb 100644
31893--- a/drivers/media/video/cx88/cx88-alsa.c
31894+++ b/drivers/media/video/cx88/cx88-alsa.c
31895@@ -766,7 +766,7 @@ static struct snd_kcontrol_new snd_cx88_alc_switch = {
31896 * Only boards with eeprom and byte 1 at eeprom=1 have it
31897 */
31898
31899-static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
31900+static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
31901 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
31902 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
31903 {0, }
31904diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31905index 9515f3a..c9ecb85 100644
31906--- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31907+++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31908@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
31909 u8 *eeprom;
31910 struct tveeprom tvdata;
31911
31912+ pax_track_stack();
31913+
31914 memset(&tvdata,0,sizeof(tvdata));
31915
31916 eeprom = pvr2_eeprom_fetch(hdw);
31917diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31918index 305e6aa..0143317 100644
31919--- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31920+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31921@@ -196,7 +196,7 @@ struct pvr2_hdw {
31922
31923 /* I2C stuff */
31924 struct i2c_adapter i2c_adap;
31925- struct i2c_algorithm i2c_algo;
31926+ i2c_algorithm_no_const i2c_algo;
31927 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
31928 int i2c_cx25840_hack_state;
31929 int i2c_linked;
31930diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
31931index f9f29cc..5a2e330 100644
31932--- a/drivers/media/video/saa7134/saa6752hs.c
31933+++ b/drivers/media/video/saa7134/saa6752hs.c
31934@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
31935 unsigned char localPAT[256];
31936 unsigned char localPMT[256];
31937
31938+ pax_track_stack();
31939+
31940 /* Set video format - must be done first as it resets other settings */
31941 set_reg8(client, 0x41, h->video_format);
31942
31943diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
31944index 62fac7f..f29e0b9 100644
31945--- a/drivers/media/video/saa7164/saa7164-cmd.c
31946+++ b/drivers/media/video/saa7164/saa7164-cmd.c
31947@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
31948 u8 tmp[512];
31949 dprintk(DBGLVL_CMD, "%s()\n", __func__);
31950
31951+ pax_track_stack();
31952+
31953 /* While any outstand message on the bus exists... */
31954 do {
31955
31956@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
31957 u8 tmp[512];
31958 dprintk(DBGLVL_CMD, "%s()\n", __func__);
31959
31960+ pax_track_stack();
31961+
31962 while (loop) {
31963
31964 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
31965diff --git a/drivers/media/video/timblogiw.c b/drivers/media/video/timblogiw.c
31966index 84cd1b6..f741e07 100644
31967--- a/drivers/media/video/timblogiw.c
31968+++ b/drivers/media/video/timblogiw.c
31969@@ -744,7 +744,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
31970
31971 /* Platform device functions */
31972
31973-static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
31974+static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
31975 .vidioc_querycap = timblogiw_querycap,
31976 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
31977 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
31978@@ -766,7 +766,7 @@ static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
31979 .vidioc_enum_framesizes = timblogiw_enum_framesizes,
31980 };
31981
31982-static __devinitconst struct v4l2_file_operations timblogiw_fops = {
31983+static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
31984 .owner = THIS_MODULE,
31985 .open = timblogiw_open,
31986 .release = timblogiw_close,
31987diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
31988index f344411..6ae9974 100644
31989--- a/drivers/media/video/usbvision/usbvision-core.c
31990+++ b/drivers/media/video/usbvision/usbvision-core.c
31991@@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_compress(struct usb_usbvision *usbvision
31992 unsigned char rv, gv, bv;
31993 static unsigned char *Y, *U, *V;
31994
31995+ pax_track_stack();
31996+
31997 frame = usbvision->cur_frame;
31998 image_size = frame->frmwidth * frame->frmheight;
31999 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
32000diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
32001index f300dea..04834ba 100644
32002--- a/drivers/media/video/videobuf-dma-sg.c
32003+++ b/drivers/media/video/videobuf-dma-sg.c
32004@@ -607,6 +607,8 @@ void *videobuf_sg_alloc(size_t size)
32005 {
32006 struct videobuf_queue q;
32007
32008+ pax_track_stack();
32009+
32010 /* Required to make generic handler to call __videobuf_alloc */
32011 q.int_ops = &sg_ops;
32012
32013diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
32014index 7956a10..f39232f 100644
32015--- a/drivers/message/fusion/mptbase.c
32016+++ b/drivers/message/fusion/mptbase.c
32017@@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
32018 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
32019 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
32020
32021+#ifdef CONFIG_GRKERNSEC_HIDESYM
32022+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
32023+#else
32024 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
32025 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
32026+#endif
32027+
32028 /*
32029 * Rounding UP to nearest 4-kB boundary here...
32030 */
32031diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
32032index 7596aec..f7ae9aa 100644
32033--- a/drivers/message/fusion/mptsas.c
32034+++ b/drivers/message/fusion/mptsas.c
32035@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
32036 return 0;
32037 }
32038
32039+static inline void
32040+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32041+{
32042+ if (phy_info->port_details) {
32043+ phy_info->port_details->rphy = rphy;
32044+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32045+ ioc->name, rphy));
32046+ }
32047+
32048+ if (rphy) {
32049+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32050+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32051+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32052+ ioc->name, rphy, rphy->dev.release));
32053+ }
32054+}
32055+
32056 /* no mutex */
32057 static void
32058 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
32059@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
32060 return NULL;
32061 }
32062
32063-static inline void
32064-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32065-{
32066- if (phy_info->port_details) {
32067- phy_info->port_details->rphy = rphy;
32068- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32069- ioc->name, rphy));
32070- }
32071-
32072- if (rphy) {
32073- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32074- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32075- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32076- ioc->name, rphy, rphy->dev.release));
32077- }
32078-}
32079-
32080 static inline struct sas_port *
32081 mptsas_get_port(struct mptsas_phyinfo *phy_info)
32082 {
32083diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
32084index ce61a57..3da8862 100644
32085--- a/drivers/message/fusion/mptscsih.c
32086+++ b/drivers/message/fusion/mptscsih.c
32087@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
32088
32089 h = shost_priv(SChost);
32090
32091- if (h) {
32092- if (h->info_kbuf == NULL)
32093- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32094- return h->info_kbuf;
32095- h->info_kbuf[0] = '\0';
32096+ if (!h)
32097+ return NULL;
32098
32099- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32100- h->info_kbuf[size-1] = '\0';
32101- }
32102+ if (h->info_kbuf == NULL)
32103+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32104+ return h->info_kbuf;
32105+ h->info_kbuf[0] = '\0';
32106+
32107+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32108+ h->info_kbuf[size-1] = '\0';
32109
32110 return h->info_kbuf;
32111 }
32112diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
32113index 098de2b..fbb922c 100644
32114--- a/drivers/message/i2o/i2o_config.c
32115+++ b/drivers/message/i2o/i2o_config.c
32116@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned long arg)
32117 struct i2o_message *msg;
32118 unsigned int iop;
32119
32120+ pax_track_stack();
32121+
32122 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
32123 return -EFAULT;
32124
32125diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
32126index 07dbeaf..5533142 100644
32127--- a/drivers/message/i2o/i2o_proc.c
32128+++ b/drivers/message/i2o/i2o_proc.c
32129@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
32130 "Array Controller Device"
32131 };
32132
32133-static char *chtostr(u8 * chars, int n)
32134-{
32135- char tmp[256];
32136- tmp[0] = 0;
32137- return strncat(tmp, (char *)chars, n);
32138-}
32139-
32140 static int i2o_report_query_status(struct seq_file *seq, int block_status,
32141 char *group)
32142 {
32143@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
32144
32145 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
32146 seq_printf(seq, "%-#8x", ddm_table.module_id);
32147- seq_printf(seq, "%-29s",
32148- chtostr(ddm_table.module_name_version, 28));
32149+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
32150 seq_printf(seq, "%9d ", ddm_table.data_size);
32151 seq_printf(seq, "%8d", ddm_table.code_size);
32152
32153@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
32154
32155 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
32156 seq_printf(seq, "%-#8x", dst->module_id);
32157- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
32158- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
32159+ seq_printf(seq, "%-.28s", dst->module_name_version);
32160+ seq_printf(seq, "%-.8s", dst->date);
32161 seq_printf(seq, "%8d ", dst->module_size);
32162 seq_printf(seq, "%8d ", dst->mpb_size);
32163 seq_printf(seq, "0x%04x", dst->module_flags);
32164@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
32165 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
32166 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
32167 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
32168- seq_printf(seq, "Vendor info : %s\n",
32169- chtostr((u8 *) (work32 + 2), 16));
32170- seq_printf(seq, "Product info : %s\n",
32171- chtostr((u8 *) (work32 + 6), 16));
32172- seq_printf(seq, "Description : %s\n",
32173- chtostr((u8 *) (work32 + 10), 16));
32174- seq_printf(seq, "Product rev. : %s\n",
32175- chtostr((u8 *) (work32 + 14), 8));
32176+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
32177+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
32178+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
32179+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
32180
32181 seq_printf(seq, "Serial number : ");
32182 print_serial_number(seq, (u8 *) (work32 + 16),
32183@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
32184 }
32185
32186 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
32187- seq_printf(seq, "Module name : %s\n",
32188- chtostr(result.module_name, 24));
32189- seq_printf(seq, "Module revision : %s\n",
32190- chtostr(result.module_rev, 8));
32191+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
32192+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
32193
32194 seq_printf(seq, "Serial number : ");
32195 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
32196@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
32197 return 0;
32198 }
32199
32200- seq_printf(seq, "Device name : %s\n",
32201- chtostr(result.device_name, 64));
32202- seq_printf(seq, "Service name : %s\n",
32203- chtostr(result.service_name, 64));
32204- seq_printf(seq, "Physical name : %s\n",
32205- chtostr(result.physical_location, 64));
32206- seq_printf(seq, "Instance number : %s\n",
32207- chtostr(result.instance_number, 4));
32208+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
32209+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
32210+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
32211+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
32212
32213 return 0;
32214 }
32215diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
32216index a8c08f3..155fe3d 100644
32217--- a/drivers/message/i2o/iop.c
32218+++ b/drivers/message/i2o/iop.c
32219@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
32220
32221 spin_lock_irqsave(&c->context_list_lock, flags);
32222
32223- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
32224- atomic_inc(&c->context_list_counter);
32225+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
32226+ atomic_inc_unchecked(&c->context_list_counter);
32227
32228- entry->context = atomic_read(&c->context_list_counter);
32229+ entry->context = atomic_read_unchecked(&c->context_list_counter);
32230
32231 list_add(&entry->list, &c->context_list);
32232
32233@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(void)
32234
32235 #if BITS_PER_LONG == 64
32236 spin_lock_init(&c->context_list_lock);
32237- atomic_set(&c->context_list_counter, 0);
32238+ atomic_set_unchecked(&c->context_list_counter, 0);
32239 INIT_LIST_HEAD(&c->context_list);
32240 #endif
32241
32242diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
32243index a20e1c4..4f57255 100644
32244--- a/drivers/mfd/ab3100-core.c
32245+++ b/drivers/mfd/ab3100-core.c
32246@@ -809,7 +809,7 @@ struct ab_family_id {
32247 char *name;
32248 };
32249
32250-static const struct ab_family_id ids[] __devinitdata = {
32251+static const struct ab_family_id ids[] __devinitconst = {
32252 /* AB3100 */
32253 {
32254 .id = 0xc0,
32255diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
32256index f12720d..3c251fd 100644
32257--- a/drivers/mfd/abx500-core.c
32258+++ b/drivers/mfd/abx500-core.c
32259@@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list);
32260
32261 struct abx500_device_entry {
32262 struct list_head list;
32263- struct abx500_ops ops;
32264+ abx500_ops_no_const ops;
32265 struct device *dev;
32266 };
32267
32268diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
32269index 5c2a06a..8fa077c 100644
32270--- a/drivers/mfd/janz-cmodio.c
32271+++ b/drivers/mfd/janz-cmodio.c
32272@@ -13,6 +13,7 @@
32273
32274 #include <linux/kernel.h>
32275 #include <linux/module.h>
32276+#include <linux/slab.h>
32277 #include <linux/init.h>
32278 #include <linux/pci.h>
32279 #include <linux/interrupt.h>
32280diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
32281index 5fe5de1..af64f53 100644
32282--- a/drivers/mfd/wm8350-i2c.c
32283+++ b/drivers/mfd/wm8350-i2c.c
32284@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
32285 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
32286 int ret;
32287
32288+ pax_track_stack();
32289+
32290 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
32291 return -EINVAL;
32292
32293diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
32294index 8b51cd6..f628f8d 100644
32295--- a/drivers/misc/lis3lv02d/lis3lv02d.c
32296+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
32297@@ -437,7 +437,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
32298 * the lid is closed. This leads to interrupts as soon as a little move
32299 * is done.
32300 */
32301- atomic_inc(&lis3_dev.count);
32302+ atomic_inc_unchecked(&lis3_dev.count);
32303
32304 wake_up_interruptible(&lis3_dev.misc_wait);
32305 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
32306@@ -520,7 +520,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
32307 if (lis3_dev.pm_dev)
32308 pm_runtime_get_sync(lis3_dev.pm_dev);
32309
32310- atomic_set(&lis3_dev.count, 0);
32311+ atomic_set_unchecked(&lis3_dev.count, 0);
32312 return 0;
32313 }
32314
32315@@ -547,7 +547,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
32316 add_wait_queue(&lis3_dev.misc_wait, &wait);
32317 while (true) {
32318 set_current_state(TASK_INTERRUPTIBLE);
32319- data = atomic_xchg(&lis3_dev.count, 0);
32320+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
32321 if (data)
32322 break;
32323
32324@@ -585,7 +585,7 @@ out:
32325 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
32326 {
32327 poll_wait(file, &lis3_dev.misc_wait, wait);
32328- if (atomic_read(&lis3_dev.count))
32329+ if (atomic_read_unchecked(&lis3_dev.count))
32330 return POLLIN | POLLRDNORM;
32331 return 0;
32332 }
32333diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
32334index a193958..4d7ecd2 100644
32335--- a/drivers/misc/lis3lv02d/lis3lv02d.h
32336+++ b/drivers/misc/lis3lv02d/lis3lv02d.h
32337@@ -265,7 +265,7 @@ struct lis3lv02d {
32338 struct input_polled_dev *idev; /* input device */
32339 struct platform_device *pdev; /* platform device */
32340 struct regulator_bulk_data regulators[2];
32341- atomic_t count; /* interrupt count after last read */
32342+ atomic_unchecked_t count; /* interrupt count after last read */
32343 union axis_conversion ac; /* hw -> logical axis */
32344 int mapped_btns[3];
32345
32346diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
32347index 2f30bad..c4c13d0 100644
32348--- a/drivers/misc/sgi-gru/gruhandles.c
32349+++ b/drivers/misc/sgi-gru/gruhandles.c
32350@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
32351 unsigned long nsec;
32352
32353 nsec = CLKS2NSEC(clks);
32354- atomic_long_inc(&mcs_op_statistics[op].count);
32355- atomic_long_add(nsec, &mcs_op_statistics[op].total);
32356+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
32357+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
32358 if (mcs_op_statistics[op].max < nsec)
32359 mcs_op_statistics[op].max = nsec;
32360 }
32361diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
32362index 7768b87..f8aac38 100644
32363--- a/drivers/misc/sgi-gru/gruprocfs.c
32364+++ b/drivers/misc/sgi-gru/gruprocfs.c
32365@@ -32,9 +32,9 @@
32366
32367 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
32368
32369-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
32370+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
32371 {
32372- unsigned long val = atomic_long_read(v);
32373+ unsigned long val = atomic_long_read_unchecked(v);
32374
32375 seq_printf(s, "%16lu %s\n", val, id);
32376 }
32377@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
32378
32379 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
32380 for (op = 0; op < mcsop_last; op++) {
32381- count = atomic_long_read(&mcs_op_statistics[op].count);
32382- total = atomic_long_read(&mcs_op_statistics[op].total);
32383+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
32384+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
32385 max = mcs_op_statistics[op].max;
32386 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
32387 count ? total / count : 0, max);
32388diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
32389index 5c3ce24..4915ccb 100644
32390--- a/drivers/misc/sgi-gru/grutables.h
32391+++ b/drivers/misc/sgi-gru/grutables.h
32392@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
32393 * GRU statistics.
32394 */
32395 struct gru_stats_s {
32396- atomic_long_t vdata_alloc;
32397- atomic_long_t vdata_free;
32398- atomic_long_t gts_alloc;
32399- atomic_long_t gts_free;
32400- atomic_long_t gms_alloc;
32401- atomic_long_t gms_free;
32402- atomic_long_t gts_double_allocate;
32403- atomic_long_t assign_context;
32404- atomic_long_t assign_context_failed;
32405- atomic_long_t free_context;
32406- atomic_long_t load_user_context;
32407- atomic_long_t load_kernel_context;
32408- atomic_long_t lock_kernel_context;
32409- atomic_long_t unlock_kernel_context;
32410- atomic_long_t steal_user_context;
32411- atomic_long_t steal_kernel_context;
32412- atomic_long_t steal_context_failed;
32413- atomic_long_t nopfn;
32414- atomic_long_t asid_new;
32415- atomic_long_t asid_next;
32416- atomic_long_t asid_wrap;
32417- atomic_long_t asid_reuse;
32418- atomic_long_t intr;
32419- atomic_long_t intr_cbr;
32420- atomic_long_t intr_tfh;
32421- atomic_long_t intr_spurious;
32422- atomic_long_t intr_mm_lock_failed;
32423- atomic_long_t call_os;
32424- atomic_long_t call_os_wait_queue;
32425- atomic_long_t user_flush_tlb;
32426- atomic_long_t user_unload_context;
32427- atomic_long_t user_exception;
32428- atomic_long_t set_context_option;
32429- atomic_long_t check_context_retarget_intr;
32430- atomic_long_t check_context_unload;
32431- atomic_long_t tlb_dropin;
32432- atomic_long_t tlb_preload_page;
32433- atomic_long_t tlb_dropin_fail_no_asid;
32434- atomic_long_t tlb_dropin_fail_upm;
32435- atomic_long_t tlb_dropin_fail_invalid;
32436- atomic_long_t tlb_dropin_fail_range_active;
32437- atomic_long_t tlb_dropin_fail_idle;
32438- atomic_long_t tlb_dropin_fail_fmm;
32439- atomic_long_t tlb_dropin_fail_no_exception;
32440- atomic_long_t tfh_stale_on_fault;
32441- atomic_long_t mmu_invalidate_range;
32442- atomic_long_t mmu_invalidate_page;
32443- atomic_long_t flush_tlb;
32444- atomic_long_t flush_tlb_gru;
32445- atomic_long_t flush_tlb_gru_tgh;
32446- atomic_long_t flush_tlb_gru_zero_asid;
32447+ atomic_long_unchecked_t vdata_alloc;
32448+ atomic_long_unchecked_t vdata_free;
32449+ atomic_long_unchecked_t gts_alloc;
32450+ atomic_long_unchecked_t gts_free;
32451+ atomic_long_unchecked_t gms_alloc;
32452+ atomic_long_unchecked_t gms_free;
32453+ atomic_long_unchecked_t gts_double_allocate;
32454+ atomic_long_unchecked_t assign_context;
32455+ atomic_long_unchecked_t assign_context_failed;
32456+ atomic_long_unchecked_t free_context;
32457+ atomic_long_unchecked_t load_user_context;
32458+ atomic_long_unchecked_t load_kernel_context;
32459+ atomic_long_unchecked_t lock_kernel_context;
32460+ atomic_long_unchecked_t unlock_kernel_context;
32461+ atomic_long_unchecked_t steal_user_context;
32462+ atomic_long_unchecked_t steal_kernel_context;
32463+ atomic_long_unchecked_t steal_context_failed;
32464+ atomic_long_unchecked_t nopfn;
32465+ atomic_long_unchecked_t asid_new;
32466+ atomic_long_unchecked_t asid_next;
32467+ atomic_long_unchecked_t asid_wrap;
32468+ atomic_long_unchecked_t asid_reuse;
32469+ atomic_long_unchecked_t intr;
32470+ atomic_long_unchecked_t intr_cbr;
32471+ atomic_long_unchecked_t intr_tfh;
32472+ atomic_long_unchecked_t intr_spurious;
32473+ atomic_long_unchecked_t intr_mm_lock_failed;
32474+ atomic_long_unchecked_t call_os;
32475+ atomic_long_unchecked_t call_os_wait_queue;
32476+ atomic_long_unchecked_t user_flush_tlb;
32477+ atomic_long_unchecked_t user_unload_context;
32478+ atomic_long_unchecked_t user_exception;
32479+ atomic_long_unchecked_t set_context_option;
32480+ atomic_long_unchecked_t check_context_retarget_intr;
32481+ atomic_long_unchecked_t check_context_unload;
32482+ atomic_long_unchecked_t tlb_dropin;
32483+ atomic_long_unchecked_t tlb_preload_page;
32484+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
32485+ atomic_long_unchecked_t tlb_dropin_fail_upm;
32486+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
32487+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
32488+ atomic_long_unchecked_t tlb_dropin_fail_idle;
32489+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
32490+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
32491+ atomic_long_unchecked_t tfh_stale_on_fault;
32492+ atomic_long_unchecked_t mmu_invalidate_range;
32493+ atomic_long_unchecked_t mmu_invalidate_page;
32494+ atomic_long_unchecked_t flush_tlb;
32495+ atomic_long_unchecked_t flush_tlb_gru;
32496+ atomic_long_unchecked_t flush_tlb_gru_tgh;
32497+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
32498
32499- atomic_long_t copy_gpa;
32500- atomic_long_t read_gpa;
32501+ atomic_long_unchecked_t copy_gpa;
32502+ atomic_long_unchecked_t read_gpa;
32503
32504- atomic_long_t mesq_receive;
32505- atomic_long_t mesq_receive_none;
32506- atomic_long_t mesq_send;
32507- atomic_long_t mesq_send_failed;
32508- atomic_long_t mesq_noop;
32509- atomic_long_t mesq_send_unexpected_error;
32510- atomic_long_t mesq_send_lb_overflow;
32511- atomic_long_t mesq_send_qlimit_reached;
32512- atomic_long_t mesq_send_amo_nacked;
32513- atomic_long_t mesq_send_put_nacked;
32514- atomic_long_t mesq_page_overflow;
32515- atomic_long_t mesq_qf_locked;
32516- atomic_long_t mesq_qf_noop_not_full;
32517- atomic_long_t mesq_qf_switch_head_failed;
32518- atomic_long_t mesq_qf_unexpected_error;
32519- atomic_long_t mesq_noop_unexpected_error;
32520- atomic_long_t mesq_noop_lb_overflow;
32521- atomic_long_t mesq_noop_qlimit_reached;
32522- atomic_long_t mesq_noop_amo_nacked;
32523- atomic_long_t mesq_noop_put_nacked;
32524- atomic_long_t mesq_noop_page_overflow;
32525+ atomic_long_unchecked_t mesq_receive;
32526+ atomic_long_unchecked_t mesq_receive_none;
32527+ atomic_long_unchecked_t mesq_send;
32528+ atomic_long_unchecked_t mesq_send_failed;
32529+ atomic_long_unchecked_t mesq_noop;
32530+ atomic_long_unchecked_t mesq_send_unexpected_error;
32531+ atomic_long_unchecked_t mesq_send_lb_overflow;
32532+ atomic_long_unchecked_t mesq_send_qlimit_reached;
32533+ atomic_long_unchecked_t mesq_send_amo_nacked;
32534+ atomic_long_unchecked_t mesq_send_put_nacked;
32535+ atomic_long_unchecked_t mesq_page_overflow;
32536+ atomic_long_unchecked_t mesq_qf_locked;
32537+ atomic_long_unchecked_t mesq_qf_noop_not_full;
32538+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
32539+ atomic_long_unchecked_t mesq_qf_unexpected_error;
32540+ atomic_long_unchecked_t mesq_noop_unexpected_error;
32541+ atomic_long_unchecked_t mesq_noop_lb_overflow;
32542+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
32543+ atomic_long_unchecked_t mesq_noop_amo_nacked;
32544+ atomic_long_unchecked_t mesq_noop_put_nacked;
32545+ atomic_long_unchecked_t mesq_noop_page_overflow;
32546
32547 };
32548
32549@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
32550 tghop_invalidate, mcsop_last};
32551
32552 struct mcs_op_statistic {
32553- atomic_long_t count;
32554- atomic_long_t total;
32555+ atomic_long_unchecked_t count;
32556+ atomic_long_unchecked_t total;
32557 unsigned long max;
32558 };
32559
32560@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
32561
32562 #define STAT(id) do { \
32563 if (gru_options & OPT_STATS) \
32564- atomic_long_inc(&gru_stats.id); \
32565+ atomic_long_inc_unchecked(&gru_stats.id); \
32566 } while (0)
32567
32568 #ifdef CONFIG_SGI_GRU_DEBUG
32569diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
32570index 851b2f2..a4ec097 100644
32571--- a/drivers/misc/sgi-xp/xp.h
32572+++ b/drivers/misc/sgi-xp/xp.h
32573@@ -289,7 +289,7 @@ struct xpc_interface {
32574 xpc_notify_func, void *);
32575 void (*received) (short, int, void *);
32576 enum xp_retval (*partid_to_nasids) (short, void *);
32577-};
32578+} __no_const;
32579
32580 extern struct xpc_interface xpc_interface;
32581
32582diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
32583index b94d5f7..7f494c5 100644
32584--- a/drivers/misc/sgi-xp/xpc.h
32585+++ b/drivers/misc/sgi-xp/xpc.h
32586@@ -835,6 +835,7 @@ struct xpc_arch_operations {
32587 void (*received_payload) (struct xpc_channel *, void *);
32588 void (*notify_senders_of_disconnect) (struct xpc_channel *);
32589 };
32590+typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
32591
32592 /* struct xpc_partition act_state values (for XPC HB) */
32593
32594@@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
32595 /* found in xpc_main.c */
32596 extern struct device *xpc_part;
32597 extern struct device *xpc_chan;
32598-extern struct xpc_arch_operations xpc_arch_ops;
32599+extern xpc_arch_operations_no_const xpc_arch_ops;
32600 extern int xpc_disengage_timelimit;
32601 extern int xpc_disengage_timedout;
32602 extern int xpc_activate_IRQ_rcvd;
32603diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
32604index 8d082b4..aa749ae 100644
32605--- a/drivers/misc/sgi-xp/xpc_main.c
32606+++ b/drivers/misc/sgi-xp/xpc_main.c
32607@@ -162,7 +162,7 @@ static struct notifier_block xpc_die_notifier = {
32608 .notifier_call = xpc_system_die,
32609 };
32610
32611-struct xpc_arch_operations xpc_arch_ops;
32612+xpc_arch_operations_no_const xpc_arch_ops;
32613
32614 /*
32615 * Timer function to enforce the timelimit on the partition disengage.
32616diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
32617index 26c5286..292d261 100644
32618--- a/drivers/mmc/host/sdhci-pci.c
32619+++ b/drivers/mmc/host/sdhci-pci.c
32620@@ -542,7 +542,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
32621 .probe = via_probe,
32622 };
32623
32624-static const struct pci_device_id pci_ids[] __devinitdata = {
32625+static const struct pci_device_id pci_ids[] __devinitconst = {
32626 {
32627 .vendor = PCI_VENDOR_ID_RICOH,
32628 .device = PCI_DEVICE_ID_RICOH_R5C822,
32629diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
32630index e1e122f..d99a6ea 100644
32631--- a/drivers/mtd/chips/cfi_cmdset_0001.c
32632+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
32633@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
32634 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
32635 unsigned long timeo = jiffies + HZ;
32636
32637+ pax_track_stack();
32638+
32639 /* Prevent setting state FL_SYNCING for chip in suspended state. */
32640 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
32641 goto sleep;
32642@@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
32643 unsigned long initial_adr;
32644 int initial_len = len;
32645
32646+ pax_track_stack();
32647+
32648 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
32649 adr += chip->start;
32650 initial_adr = adr;
32651@@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
32652 int retries = 3;
32653 int ret;
32654
32655+ pax_track_stack();
32656+
32657 adr += chip->start;
32658
32659 retry:
32660diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
32661index 179814a..abe9d60 100644
32662--- a/drivers/mtd/chips/cfi_cmdset_0020.c
32663+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
32664@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
32665 unsigned long cmd_addr;
32666 struct cfi_private *cfi = map->fldrv_priv;
32667
32668+ pax_track_stack();
32669+
32670 adr += chip->start;
32671
32672 /* Ensure cmd read/writes are aligned. */
32673@@ -429,6 +431,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
32674 DECLARE_WAITQUEUE(wait, current);
32675 int wbufsize, z;
32676
32677+ pax_track_stack();
32678+
32679 /* M58LW064A requires bus alignment for buffer wriets -- saw */
32680 if (adr & (map_bankwidth(map)-1))
32681 return -EINVAL;
32682@@ -743,6 +747,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
32683 DECLARE_WAITQUEUE(wait, current);
32684 int ret = 0;
32685
32686+ pax_track_stack();
32687+
32688 adr += chip->start;
32689
32690 /* Let's determine this according to the interleave only once */
32691@@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
32692 unsigned long timeo = jiffies + HZ;
32693 DECLARE_WAITQUEUE(wait, current);
32694
32695+ pax_track_stack();
32696+
32697 adr += chip->start;
32698
32699 /* Let's determine this according to the interleave only once */
32700@@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
32701 unsigned long timeo = jiffies + HZ;
32702 DECLARE_WAITQUEUE(wait, current);
32703
32704+ pax_track_stack();
32705+
32706 adr += chip->start;
32707
32708 /* Let's determine this according to the interleave only once */
32709diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
32710index f7fbf60..9866457 100644
32711--- a/drivers/mtd/devices/doc2000.c
32712+++ b/drivers/mtd/devices/doc2000.c
32713@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
32714
32715 /* The ECC will not be calculated correctly if less than 512 is written */
32716 /* DBB-
32717- if (len != 0x200 && eccbuf)
32718+ if (len != 0x200)
32719 printk(KERN_WARNING
32720 "ECC needs a full sector write (adr: %lx size %lx)\n",
32721 (long) to, (long) len);
32722diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
32723index 241192f..d0c35a3 100644
32724--- a/drivers/mtd/devices/doc2001.c
32725+++ b/drivers/mtd/devices/doc2001.c
32726@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
32727 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
32728
32729 /* Don't allow read past end of device */
32730- if (from >= this->totlen)
32731+ if (from >= this->totlen || !len)
32732 return -EINVAL;
32733
32734 /* Don't allow a single read to cross a 512-byte block boundary */
32735diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
32736index 037b399..225a71d 100644
32737--- a/drivers/mtd/ftl.c
32738+++ b/drivers/mtd/ftl.c
32739@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
32740 loff_t offset;
32741 uint16_t srcunitswap = cpu_to_le16(srcunit);
32742
32743+ pax_track_stack();
32744+
32745 eun = &part->EUNInfo[srcunit];
32746 xfer = &part->XferInfo[xferunit];
32747 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
32748diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
32749index d7592e6..31c505c 100644
32750--- a/drivers/mtd/inftlcore.c
32751+++ b/drivers/mtd/inftlcore.c
32752@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
32753 struct inftl_oob oob;
32754 size_t retlen;
32755
32756+ pax_track_stack();
32757+
32758 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
32759 "pending=%d)\n", inftl, thisVUC, pendingblock);
32760
32761diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
32762index 104052e..6232be5 100644
32763--- a/drivers/mtd/inftlmount.c
32764+++ b/drivers/mtd/inftlmount.c
32765@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
32766 struct INFTLPartition *ip;
32767 size_t retlen;
32768
32769+ pax_track_stack();
32770+
32771 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
32772
32773 /*
32774diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
32775index dbfe17b..c7b0918 100644
32776--- a/drivers/mtd/lpddr/qinfo_probe.c
32777+++ b/drivers/mtd/lpddr/qinfo_probe.c
32778@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
32779 {
32780 map_word pfow_val[4];
32781
32782+ pax_track_stack();
32783+
32784 /* Check identification string */
32785 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
32786 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
32787diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
32788index 49e20a4..60fbfa5 100644
32789--- a/drivers/mtd/mtdchar.c
32790+++ b/drivers/mtd/mtdchar.c
32791@@ -554,6 +554,8 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
32792 u_long size;
32793 struct mtd_info_user info;
32794
32795+ pax_track_stack();
32796+
32797 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
32798
32799 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
32800diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
32801index d527621..2491fab 100644
32802--- a/drivers/mtd/nand/denali.c
32803+++ b/drivers/mtd/nand/denali.c
32804@@ -26,6 +26,7 @@
32805 #include <linux/pci.h>
32806 #include <linux/mtd/mtd.h>
32807 #include <linux/module.h>
32808+#include <linux/slab.h>
32809
32810 #include "denali.h"
32811
32812diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
32813index b155666..611b801 100644
32814--- a/drivers/mtd/nftlcore.c
32815+++ b/drivers/mtd/nftlcore.c
32816@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
32817 int inplace = 1;
32818 size_t retlen;
32819
32820+ pax_track_stack();
32821+
32822 memset(BlockMap, 0xff, sizeof(BlockMap));
32823 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
32824
32825diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
32826index e3cd1ff..0ea79a3 100644
32827--- a/drivers/mtd/nftlmount.c
32828+++ b/drivers/mtd/nftlmount.c
32829@@ -24,6 +24,7 @@
32830 #include <asm/errno.h>
32831 #include <linux/delay.h>
32832 #include <linux/slab.h>
32833+#include <linux/sched.h>
32834 #include <linux/mtd/mtd.h>
32835 #include <linux/mtd/nand.h>
32836 #include <linux/mtd/nftl.h>
32837@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
32838 struct mtd_info *mtd = nftl->mbd.mtd;
32839 unsigned int i;
32840
32841+ pax_track_stack();
32842+
32843 /* Assume logical EraseSize == physical erasesize for starting the scan.
32844 We'll sort it out later if we find a MediaHeader which says otherwise */
32845 /* Actually, we won't. The new DiskOnChip driver has already scanned
32846diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
32847index 6c3fb5a..c542a81 100644
32848--- a/drivers/mtd/ubi/build.c
32849+++ b/drivers/mtd/ubi/build.c
32850@@ -1311,7 +1311,7 @@ module_exit(ubi_exit);
32851 static int __init bytes_str_to_int(const char *str)
32852 {
32853 char *endp;
32854- unsigned long result;
32855+ unsigned long result, scale = 1;
32856
32857 result = simple_strtoul(str, &endp, 0);
32858 if (str == endp || result >= INT_MAX) {
32859@@ -1322,11 +1322,11 @@ static int __init bytes_str_to_int(const char *str)
32860
32861 switch (*endp) {
32862 case 'G':
32863- result *= 1024;
32864+ scale *= 1024;
32865 case 'M':
32866- result *= 1024;
32867+ scale *= 1024;
32868 case 'K':
32869- result *= 1024;
32870+ scale *= 1024;
32871 if (endp[1] == 'i' && endp[2] == 'B')
32872 endp += 2;
32873 case '\0':
32874@@ -1337,7 +1337,13 @@ static int __init bytes_str_to_int(const char *str)
32875 return -EINVAL;
32876 }
32877
32878- return result;
32879+ if ((intoverflow_t)result*scale >= INT_MAX) {
32880+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
32881+ str);
32882+ return -EINVAL;
32883+ }
32884+
32885+ return result*scale;
32886 }
32887
32888 /**
32889diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
32890index d4f7dda..d627d46 100644
32891--- a/drivers/net/atlx/atl2.c
32892+++ b/drivers/net/atlx/atl2.c
32893@@ -2857,7 +2857,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
32894 */
32895
32896 #define ATL2_PARAM(X, desc) \
32897- static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
32898+ static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
32899 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
32900 MODULE_PARM_DESC(X, desc);
32901 #else
32902diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
32903index 87aecdf..ec23470 100644
32904--- a/drivers/net/bna/bfa_ioc_ct.c
32905+++ b/drivers/net/bna/bfa_ioc_ct.c
32906@@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct bfa_ioc *ioc);
32907 static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc);
32908 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
32909
32910-static struct bfa_ioc_hwif nw_hwif_ct;
32911+static struct bfa_ioc_hwif nw_hwif_ct = {
32912+ .ioc_pll_init = bfa_ioc_ct_pll_init,
32913+ .ioc_firmware_lock = bfa_ioc_ct_firmware_lock,
32914+ .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock,
32915+ .ioc_reg_init = bfa_ioc_ct_reg_init,
32916+ .ioc_map_port = bfa_ioc_ct_map_port,
32917+ .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set,
32918+ .ioc_notify_fail = bfa_ioc_ct_notify_fail,
32919+ .ioc_ownership_reset = bfa_ioc_ct_ownership_reset,
32920+ .ioc_sync_start = bfa_ioc_ct_sync_start,
32921+ .ioc_sync_join = bfa_ioc_ct_sync_join,
32922+ .ioc_sync_leave = bfa_ioc_ct_sync_leave,
32923+ .ioc_sync_ack = bfa_ioc_ct_sync_ack,
32924+ .ioc_sync_complete = bfa_ioc_ct_sync_complete
32925+};
32926
32927 /**
32928 * Called from bfa_ioc_attach() to map asic specific calls.
32929@@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct;
32930 void
32931 bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
32932 {
32933- nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
32934- nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
32935- nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
32936- nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
32937- nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
32938- nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
32939- nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
32940- nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
32941- nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
32942- nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
32943- nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
32944- nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
32945- nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete;
32946-
32947 ioc->ioc_hwif = &nw_hwif_ct;
32948 }
32949
32950diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
32951index 8e35b25..c39f205 100644
32952--- a/drivers/net/bna/bnad.c
32953+++ b/drivers/net/bna/bnad.c
32954@@ -1673,7 +1673,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
32955 struct bna_intr_info *intr_info =
32956 &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
32957 struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
32958- struct bna_tx_event_cbfn tx_cbfn;
32959+ static struct bna_tx_event_cbfn tx_cbfn = {
32960+ /* Initialize the tx event handlers */
32961+ .tcb_setup_cbfn = bnad_cb_tcb_setup,
32962+ .tcb_destroy_cbfn = bnad_cb_tcb_destroy,
32963+ .tx_stall_cbfn = bnad_cb_tx_stall,
32964+ .tx_resume_cbfn = bnad_cb_tx_resume,
32965+ .tx_cleanup_cbfn = bnad_cb_tx_cleanup
32966+ };
32967 struct bna_tx *tx;
32968 unsigned long flags;
32969
32970@@ -1682,13 +1689,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
32971 tx_config->txq_depth = bnad->txq_depth;
32972 tx_config->tx_type = BNA_TX_T_REGULAR;
32973
32974- /* Initialize the tx event handlers */
32975- tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
32976- tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
32977- tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
32978- tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
32979- tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
32980-
32981 /* Get BNA's resource requirement for one tx object */
32982 spin_lock_irqsave(&bnad->bna_lock, flags);
32983 bna_tx_res_req(bnad->num_txq_per_tx,
32984@@ -1819,21 +1819,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx_id)
32985 struct bna_intr_info *intr_info =
32986 &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
32987 struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
32988- struct bna_rx_event_cbfn rx_cbfn;
32989+ static struct bna_rx_event_cbfn rx_cbfn = {
32990+ /* Initialize the Rx event handlers */
32991+ .rcb_setup_cbfn = bnad_cb_rcb_setup,
32992+ .rcb_destroy_cbfn = bnad_cb_rcb_destroy,
32993+ .ccb_setup_cbfn = bnad_cb_ccb_setup,
32994+ .ccb_destroy_cbfn = bnad_cb_ccb_destroy,
32995+ .rx_cleanup_cbfn = bnad_cb_rx_cleanup,
32996+ .rx_post_cbfn = bnad_cb_rx_post
32997+ };
32998 struct bna_rx *rx;
32999 unsigned long flags;
33000
33001 /* Initialize the Rx object configuration */
33002 bnad_init_rx_config(bnad, rx_config);
33003
33004- /* Initialize the Rx event handlers */
33005- rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
33006- rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
33007- rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
33008- rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
33009- rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
33010- rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
33011-
33012 /* Get BNA's resource requirement for one Rx object */
33013 spin_lock_irqsave(&bnad->bna_lock, flags);
33014 bna_rx_res_req(rx_config, res_info);
33015diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
33016index 4b2b570..31033f4 100644
33017--- a/drivers/net/bnx2.c
33018+++ b/drivers/net/bnx2.c
33019@@ -5877,6 +5877,8 @@ bnx2_test_nvram(struct bnx2 *bp)
33020 int rc = 0;
33021 u32 magic, csum;
33022
33023+ pax_track_stack();
33024+
33025 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
33026 goto test_nvram_done;
33027
33028diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
33029index cf3e479..5dc0ecc 100644
33030--- a/drivers/net/bnx2x/bnx2x_ethtool.c
33031+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
33032@@ -1943,6 +1943,8 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
33033 int i, rc;
33034 u32 magic, crc;
33035
33036+ pax_track_stack();
33037+
33038 if (BP_NOMCP(bp))
33039 return 0;
33040
33041diff --git a/drivers/net/bnx2x/bnx2x_sp.h b/drivers/net/bnx2x/bnx2x_sp.h
33042index 9a517c2..a50cfcb 100644
33043--- a/drivers/net/bnx2x/bnx2x_sp.h
33044+++ b/drivers/net/bnx2x/bnx2x_sp.h
33045@@ -449,7 +449,7 @@ struct bnx2x_rx_mode_obj {
33046
33047 int (*wait_comp)(struct bnx2x *bp,
33048 struct bnx2x_rx_mode_ramrod_params *p);
33049-};
33050+} __no_const;
33051
33052 /********************** Set multicast group ***********************************/
33053
33054diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
33055index c5f5479..2e8c260 100644
33056--- a/drivers/net/cxgb3/l2t.h
33057+++ b/drivers/net/cxgb3/l2t.h
33058@@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
33059 */
33060 struct l2t_skb_cb {
33061 arp_failure_handler_func arp_failure_handler;
33062-};
33063+} __no_const;
33064
33065 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
33066
33067diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
33068index b4efa29..c5f2703 100644
33069--- a/drivers/net/cxgb4/cxgb4_main.c
33070+++ b/drivers/net/cxgb4/cxgb4_main.c
33071@@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct adapter *adap)
33072 unsigned int nchan = adap->params.nports;
33073 struct msix_entry entries[MAX_INGQ + 1];
33074
33075+ pax_track_stack();
33076+
33077 for (i = 0; i < ARRAY_SIZE(entries); ++i)
33078 entries[i].entry = i;
33079
33080diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
33081index d1ec111..12735bc 100644
33082--- a/drivers/net/cxgb4/t4_hw.c
33083+++ b/drivers/net/cxgb4/t4_hw.c
33084@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
33085 u8 vpd[VPD_LEN], csum;
33086 unsigned int vpdr_len, kw_offset, id_len;
33087
33088+ pax_track_stack();
33089+
33090 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
33091 if (ret < 0)
33092 return ret;
33093diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
33094index 536b3a5..e6f8dcc 100644
33095--- a/drivers/net/e1000e/82571.c
33096+++ b/drivers/net/e1000e/82571.c
33097@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
33098 {
33099 struct e1000_hw *hw = &adapter->hw;
33100 struct e1000_mac_info *mac = &hw->mac;
33101- struct e1000_mac_operations *func = &mac->ops;
33102+ e1000_mac_operations_no_const *func = &mac->ops;
33103 u32 swsm = 0;
33104 u32 swsm2 = 0;
33105 bool force_clear_smbi = false;
33106diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
33107index e4f4225..24da2ea 100644
33108--- a/drivers/net/e1000e/es2lan.c
33109+++ b/drivers/net/e1000e/es2lan.c
33110@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
33111 {
33112 struct e1000_hw *hw = &adapter->hw;
33113 struct e1000_mac_info *mac = &hw->mac;
33114- struct e1000_mac_operations *func = &mac->ops;
33115+ e1000_mac_operations_no_const *func = &mac->ops;
33116
33117 /* Set media type */
33118 switch (adapter->pdev->device) {
33119diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
33120index 2967039..ca8c40c 100644
33121--- a/drivers/net/e1000e/hw.h
33122+++ b/drivers/net/e1000e/hw.h
33123@@ -778,6 +778,7 @@ struct e1000_mac_operations {
33124 void (*write_vfta)(struct e1000_hw *, u32, u32);
33125 s32 (*read_mac_addr)(struct e1000_hw *);
33126 };
33127+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33128
33129 /*
33130 * When to use various PHY register access functions:
33131@@ -818,6 +819,7 @@ struct e1000_phy_operations {
33132 void (*power_up)(struct e1000_hw *);
33133 void (*power_down)(struct e1000_hw *);
33134 };
33135+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33136
33137 /* Function pointers for the NVM. */
33138 struct e1000_nvm_operations {
33139@@ -829,9 +831,10 @@ struct e1000_nvm_operations {
33140 s32 (*validate)(struct e1000_hw *);
33141 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
33142 };
33143+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33144
33145 struct e1000_mac_info {
33146- struct e1000_mac_operations ops;
33147+ e1000_mac_operations_no_const ops;
33148 u8 addr[ETH_ALEN];
33149 u8 perm_addr[ETH_ALEN];
33150
33151@@ -872,7 +875,7 @@ struct e1000_mac_info {
33152 };
33153
33154 struct e1000_phy_info {
33155- struct e1000_phy_operations ops;
33156+ e1000_phy_operations_no_const ops;
33157
33158 enum e1000_phy_type type;
33159
33160@@ -906,7 +909,7 @@ struct e1000_phy_info {
33161 };
33162
33163 struct e1000_nvm_info {
33164- struct e1000_nvm_operations ops;
33165+ e1000_nvm_operations_no_const ops;
33166
33167 enum e1000_nvm_type type;
33168 enum e1000_nvm_override override;
33169diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
33170index fa8677c..196356f 100644
33171--- a/drivers/net/fealnx.c
33172+++ b/drivers/net/fealnx.c
33173@@ -150,7 +150,7 @@ struct chip_info {
33174 int flags;
33175 };
33176
33177-static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
33178+static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
33179 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33180 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
33181 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33182diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
33183index 2a5a34d..be871cc 100644
33184--- a/drivers/net/hamradio/6pack.c
33185+++ b/drivers/net/hamradio/6pack.c
33186@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
33187 unsigned char buf[512];
33188 int count1;
33189
33190+ pax_track_stack();
33191+
33192 if (!count)
33193 return;
33194
33195diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
33196index 4519a13..f97fcd0 100644
33197--- a/drivers/net/igb/e1000_hw.h
33198+++ b/drivers/net/igb/e1000_hw.h
33199@@ -314,6 +314,7 @@ struct e1000_mac_operations {
33200 s32 (*read_mac_addr)(struct e1000_hw *);
33201 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
33202 };
33203+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33204
33205 struct e1000_phy_operations {
33206 s32 (*acquire)(struct e1000_hw *);
33207@@ -330,6 +331,7 @@ struct e1000_phy_operations {
33208 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
33209 s32 (*write_reg)(struct e1000_hw *, u32, u16);
33210 };
33211+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33212
33213 struct e1000_nvm_operations {
33214 s32 (*acquire)(struct e1000_hw *);
33215@@ -339,6 +341,7 @@ struct e1000_nvm_operations {
33216 s32 (*update)(struct e1000_hw *);
33217 s32 (*validate)(struct e1000_hw *);
33218 };
33219+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33220
33221 struct e1000_info {
33222 s32 (*get_invariants)(struct e1000_hw *);
33223@@ -350,7 +353,7 @@ struct e1000_info {
33224 extern const struct e1000_info e1000_82575_info;
33225
33226 struct e1000_mac_info {
33227- struct e1000_mac_operations ops;
33228+ e1000_mac_operations_no_const ops;
33229
33230 u8 addr[6];
33231 u8 perm_addr[6];
33232@@ -388,7 +391,7 @@ struct e1000_mac_info {
33233 };
33234
33235 struct e1000_phy_info {
33236- struct e1000_phy_operations ops;
33237+ e1000_phy_operations_no_const ops;
33238
33239 enum e1000_phy_type type;
33240
33241@@ -423,7 +426,7 @@ struct e1000_phy_info {
33242 };
33243
33244 struct e1000_nvm_info {
33245- struct e1000_nvm_operations ops;
33246+ e1000_nvm_operations_no_const ops;
33247 enum e1000_nvm_type type;
33248 enum e1000_nvm_override override;
33249
33250@@ -468,6 +471,7 @@ struct e1000_mbx_operations {
33251 s32 (*check_for_ack)(struct e1000_hw *, u16);
33252 s32 (*check_for_rst)(struct e1000_hw *, u16);
33253 };
33254+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33255
33256 struct e1000_mbx_stats {
33257 u32 msgs_tx;
33258@@ -479,7 +483,7 @@ struct e1000_mbx_stats {
33259 };
33260
33261 struct e1000_mbx_info {
33262- struct e1000_mbx_operations ops;
33263+ e1000_mbx_operations_no_const ops;
33264 struct e1000_mbx_stats stats;
33265 u32 timeout;
33266 u32 usec_delay;
33267diff --git a/drivers/net/igbvf/vf.h b/drivers/net/igbvf/vf.h
33268index d7ed58f..64cde36 100644
33269--- a/drivers/net/igbvf/vf.h
33270+++ b/drivers/net/igbvf/vf.h
33271@@ -189,9 +189,10 @@ struct e1000_mac_operations {
33272 s32 (*read_mac_addr)(struct e1000_hw *);
33273 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
33274 };
33275+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33276
33277 struct e1000_mac_info {
33278- struct e1000_mac_operations ops;
33279+ e1000_mac_operations_no_const ops;
33280 u8 addr[6];
33281 u8 perm_addr[6];
33282
33283@@ -213,6 +214,7 @@ struct e1000_mbx_operations {
33284 s32 (*check_for_ack)(struct e1000_hw *);
33285 s32 (*check_for_rst)(struct e1000_hw *);
33286 };
33287+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33288
33289 struct e1000_mbx_stats {
33290 u32 msgs_tx;
33291@@ -224,7 +226,7 @@ struct e1000_mbx_stats {
33292 };
33293
33294 struct e1000_mbx_info {
33295- struct e1000_mbx_operations ops;
33296+ e1000_mbx_operations_no_const ops;
33297 struct e1000_mbx_stats stats;
33298 u32 timeout;
33299 u32 usec_delay;
33300diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
33301index 6a130eb..1aeb9e4 100644
33302--- a/drivers/net/ixgb/ixgb_main.c
33303+++ b/drivers/net/ixgb/ixgb_main.c
33304@@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev)
33305 u32 rctl;
33306 int i;
33307
33308+ pax_track_stack();
33309+
33310 /* Check for Promiscuous and All Multicast modes */
33311
33312 rctl = IXGB_READ_REG(hw, RCTL);
33313diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
33314index dd7fbeb..44b9bbf 100644
33315--- a/drivers/net/ixgb/ixgb_param.c
33316+++ b/drivers/net/ixgb/ixgb_param.c
33317@@ -261,6 +261,9 @@ void __devinit
33318 ixgb_check_options(struct ixgb_adapter *adapter)
33319 {
33320 int bd = adapter->bd_number;
33321+
33322+ pax_track_stack();
33323+
33324 if (bd >= IXGB_MAX_NIC) {
33325 pr_notice("Warning: no configuration for board #%i\n", bd);
33326 pr_notice("Using defaults for all values\n");
33327diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
33328index e0d970e..1cfdea5 100644
33329--- a/drivers/net/ixgbe/ixgbe_type.h
33330+++ b/drivers/net/ixgbe/ixgbe_type.h
33331@@ -2642,6 +2642,7 @@ struct ixgbe_eeprom_operations {
33332 s32 (*update_checksum)(struct ixgbe_hw *);
33333 u16 (*calc_checksum)(struct ixgbe_hw *);
33334 };
33335+typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
33336
33337 struct ixgbe_mac_operations {
33338 s32 (*init_hw)(struct ixgbe_hw *);
33339@@ -2703,6 +2704,7 @@ struct ixgbe_mac_operations {
33340 /* Manageability interface */
33341 s32 (*set_fw_drv_ver)(struct ixgbe_hw *, u8, u8, u8, u8);
33342 };
33343+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33344
33345 struct ixgbe_phy_operations {
33346 s32 (*identify)(struct ixgbe_hw *);
33347@@ -2722,9 +2724,10 @@ struct ixgbe_phy_operations {
33348 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
33349 s32 (*check_overtemp)(struct ixgbe_hw *);
33350 };
33351+typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
33352
33353 struct ixgbe_eeprom_info {
33354- struct ixgbe_eeprom_operations ops;
33355+ ixgbe_eeprom_operations_no_const ops;
33356 enum ixgbe_eeprom_type type;
33357 u32 semaphore_delay;
33358 u16 word_size;
33359@@ -2734,7 +2737,7 @@ struct ixgbe_eeprom_info {
33360
33361 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
33362 struct ixgbe_mac_info {
33363- struct ixgbe_mac_operations ops;
33364+ ixgbe_mac_operations_no_const ops;
33365 enum ixgbe_mac_type type;
33366 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33367 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33368@@ -2762,7 +2765,7 @@ struct ixgbe_mac_info {
33369 };
33370
33371 struct ixgbe_phy_info {
33372- struct ixgbe_phy_operations ops;
33373+ ixgbe_phy_operations_no_const ops;
33374 struct mdio_if_info mdio;
33375 enum ixgbe_phy_type type;
33376 u32 id;
33377@@ -2790,6 +2793,7 @@ struct ixgbe_mbx_operations {
33378 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
33379 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
33380 };
33381+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33382
33383 struct ixgbe_mbx_stats {
33384 u32 msgs_tx;
33385@@ -2801,7 +2805,7 @@ struct ixgbe_mbx_stats {
33386 };
33387
33388 struct ixgbe_mbx_info {
33389- struct ixgbe_mbx_operations ops;
33390+ ixgbe_mbx_operations_no_const ops;
33391 struct ixgbe_mbx_stats stats;
33392 u32 timeout;
33393 u32 usec_delay;
33394diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
33395index 10306b4..28df758 100644
33396--- a/drivers/net/ixgbevf/vf.h
33397+++ b/drivers/net/ixgbevf/vf.h
33398@@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
33399 s32 (*clear_vfta)(struct ixgbe_hw *);
33400 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
33401 };
33402+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33403
33404 enum ixgbe_mac_type {
33405 ixgbe_mac_unknown = 0,
33406@@ -79,7 +80,7 @@ enum ixgbe_mac_type {
33407 };
33408
33409 struct ixgbe_mac_info {
33410- struct ixgbe_mac_operations ops;
33411+ ixgbe_mac_operations_no_const ops;
33412 u8 addr[6];
33413 u8 perm_addr[6];
33414
33415@@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
33416 s32 (*check_for_ack)(struct ixgbe_hw *);
33417 s32 (*check_for_rst)(struct ixgbe_hw *);
33418 };
33419+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33420
33421 struct ixgbe_mbx_stats {
33422 u32 msgs_tx;
33423@@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
33424 };
33425
33426 struct ixgbe_mbx_info {
33427- struct ixgbe_mbx_operations ops;
33428+ ixgbe_mbx_operations_no_const ops;
33429 struct ixgbe_mbx_stats stats;
33430 u32 timeout;
33431 u32 udelay;
33432diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
33433index 27418d3..adf15bb 100644
33434--- a/drivers/net/ksz884x.c
33435+++ b/drivers/net/ksz884x.c
33436@@ -6533,6 +6533,8 @@ static void netdev_get_ethtool_stats(struct net_device *dev,
33437 int rc;
33438 u64 counter[TOTAL_PORT_COUNTER_NUM];
33439
33440+ pax_track_stack();
33441+
33442 mutex_lock(&hw_priv->lock);
33443 n = SWITCH_PORT_NUM;
33444 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
33445diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
33446index f0ee35d..3831c8a 100644
33447--- a/drivers/net/mlx4/main.c
33448+++ b/drivers/net/mlx4/main.c
33449@@ -40,6 +40,7 @@
33450 #include <linux/dma-mapping.h>
33451 #include <linux/slab.h>
33452 #include <linux/io-mapping.h>
33453+#include <linux/sched.h>
33454
33455 #include <linux/mlx4/device.h>
33456 #include <linux/mlx4/doorbell.h>
33457@@ -762,6 +763,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
33458 u64 icm_size;
33459 int err;
33460
33461+ pax_track_stack();
33462+
33463 err = mlx4_QUERY_FW(dev);
33464 if (err) {
33465 if (err == -EACCES)
33466diff --git a/drivers/net/niu.c b/drivers/net/niu.c
33467index ed47585..5e5be8f 100644
33468--- a/drivers/net/niu.c
33469+++ b/drivers/net/niu.c
33470@@ -9061,6 +9061,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
33471 int i, num_irqs, err;
33472 u8 first_ldg;
33473
33474+ pax_track_stack();
33475+
33476 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
33477 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
33478 ldg_num_map[i] = first_ldg + i;
33479diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
33480index 80b6f36..5cd8938 100644
33481--- a/drivers/net/pcnet32.c
33482+++ b/drivers/net/pcnet32.c
33483@@ -270,7 +270,7 @@ struct pcnet32_private {
33484 struct sk_buff **rx_skbuff;
33485 dma_addr_t *tx_dma_addr;
33486 dma_addr_t *rx_dma_addr;
33487- struct pcnet32_access a;
33488+ struct pcnet32_access *a;
33489 spinlock_t lock; /* Guard lock */
33490 unsigned int cur_rx, cur_tx; /* The next free ring entry */
33491 unsigned int rx_ring_size; /* current rx ring size */
33492@@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct net_device *dev)
33493 u16 val;
33494
33495 netif_wake_queue(dev);
33496- val = lp->a.read_csr(ioaddr, CSR3);
33497+ val = lp->a->read_csr(ioaddr, CSR3);
33498 val &= 0x00ff;
33499- lp->a.write_csr(ioaddr, CSR3, val);
33500+ lp->a->write_csr(ioaddr, CSR3, val);
33501 napi_enable(&lp->napi);
33502 }
33503
33504@@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
33505 r = mii_link_ok(&lp->mii_if);
33506 } else if (lp->chip_version >= PCNET32_79C970A) {
33507 ulong ioaddr = dev->base_addr; /* card base I/O address */
33508- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
33509+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
33510 } else { /* can not detect link on really old chips */
33511 r = 1;
33512 }
33513@@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
33514 pcnet32_netif_stop(dev);
33515
33516 spin_lock_irqsave(&lp->lock, flags);
33517- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33518+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33519
33520 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
33521
33522@@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
33523 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33524 {
33525 struct pcnet32_private *lp = netdev_priv(dev);
33526- struct pcnet32_access *a = &lp->a; /* access to registers */
33527+ struct pcnet32_access *a = lp->a; /* access to registers */
33528 ulong ioaddr = dev->base_addr; /* card base I/O address */
33529 struct sk_buff *skb; /* sk buff */
33530 int x, i; /* counters */
33531@@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33532 pcnet32_netif_stop(dev);
33533
33534 spin_lock_irqsave(&lp->lock, flags);
33535- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33536+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33537
33538 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
33539
33540 /* Reset the PCNET32 */
33541- lp->a.reset(ioaddr);
33542- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33543+ lp->a->reset(ioaddr);
33544+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33545
33546 /* switch pcnet32 to 32bit mode */
33547- lp->a.write_bcr(ioaddr, 20, 2);
33548+ lp->a->write_bcr(ioaddr, 20, 2);
33549
33550 /* purge & init rings but don't actually restart */
33551 pcnet32_restart(dev, 0x0000);
33552
33553- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33554+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33555
33556 /* Initialize Transmit buffers. */
33557 size = data_len + 15;
33558@@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33559
33560 /* set int loopback in CSR15 */
33561 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
33562- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
33563+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
33564
33565 teststatus = cpu_to_le16(0x8000);
33566- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33567+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33568
33569 /* Check status of descriptors */
33570 for (x = 0; x < numbuffs; x++) {
33571@@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33572 }
33573 }
33574
33575- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33576+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33577 wmb();
33578 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
33579 netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n");
33580@@ -1015,7 +1015,7 @@ clean_up:
33581 pcnet32_restart(dev, CSR0_NORMAL);
33582 } else {
33583 pcnet32_purge_rx_ring(dev);
33584- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33585+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33586 }
33587 spin_unlock_irqrestore(&lp->lock, flags);
33588
33589@@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct net_device *dev,
33590 enum ethtool_phys_id_state state)
33591 {
33592 struct pcnet32_private *lp = netdev_priv(dev);
33593- struct pcnet32_access *a = &lp->a;
33594+ struct pcnet32_access *a = lp->a;
33595 ulong ioaddr = dev->base_addr;
33596 unsigned long flags;
33597 int i;
33598@@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
33599 {
33600 int csr5;
33601 struct pcnet32_private *lp = netdev_priv(dev);
33602- struct pcnet32_access *a = &lp->a;
33603+ struct pcnet32_access *a = lp->a;
33604 ulong ioaddr = dev->base_addr;
33605 int ticks;
33606
33607@@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33608 spin_lock_irqsave(&lp->lock, flags);
33609 if (pcnet32_tx(dev)) {
33610 /* reset the chip to clear the error condition, then restart */
33611- lp->a.reset(ioaddr);
33612- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33613+ lp->a->reset(ioaddr);
33614+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33615 pcnet32_restart(dev, CSR0_START);
33616 netif_wake_queue(dev);
33617 }
33618@@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33619 __napi_complete(napi);
33620
33621 /* clear interrupt masks */
33622- val = lp->a.read_csr(ioaddr, CSR3);
33623+ val = lp->a->read_csr(ioaddr, CSR3);
33624 val &= 0x00ff;
33625- lp->a.write_csr(ioaddr, CSR3, val);
33626+ lp->a->write_csr(ioaddr, CSR3, val);
33627
33628 /* Set interrupt enable. */
33629- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
33630+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
33631
33632 spin_unlock_irqrestore(&lp->lock, flags);
33633 }
33634@@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33635 int i, csr0;
33636 u16 *buff = ptr;
33637 struct pcnet32_private *lp = netdev_priv(dev);
33638- struct pcnet32_access *a = &lp->a;
33639+ struct pcnet32_access *a = lp->a;
33640 ulong ioaddr = dev->base_addr;
33641 unsigned long flags;
33642
33643@@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33644 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
33645 if (lp->phymask & (1 << j)) {
33646 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
33647- lp->a.write_bcr(ioaddr, 33,
33648+ lp->a->write_bcr(ioaddr, 33,
33649 (j << 5) | i);
33650- *buff++ = lp->a.read_bcr(ioaddr, 34);
33651+ *buff++ = lp->a->read_bcr(ioaddr, 34);
33652 }
33653 }
33654 }
33655@@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33656 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
33657 lp->options |= PCNET32_PORT_FD;
33658
33659- lp->a = *a;
33660+ lp->a = a;
33661
33662 /* prior to register_netdev, dev->name is not yet correct */
33663 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
33664@@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33665 if (lp->mii) {
33666 /* lp->phycount and lp->phymask are set to 0 by memset above */
33667
33668- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33669+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33670 /* scan for PHYs */
33671 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33672 unsigned short id1, id2;
33673@@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33674 pr_info("Found PHY %04x:%04x at address %d\n",
33675 id1, id2, i);
33676 }
33677- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33678+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33679 if (lp->phycount > 1)
33680 lp->options |= PCNET32_PORT_MII;
33681 }
33682@@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_device *dev)
33683 }
33684
33685 /* Reset the PCNET32 */
33686- lp->a.reset(ioaddr);
33687+ lp->a->reset(ioaddr);
33688
33689 /* switch pcnet32 to 32bit mode */
33690- lp->a.write_bcr(ioaddr, 20, 2);
33691+ lp->a->write_bcr(ioaddr, 20, 2);
33692
33693 netif_printk(lp, ifup, KERN_DEBUG, dev,
33694 "%s() irq %d tx/rx rings %#x/%#x init %#x\n",
33695@@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_device *dev)
33696 (u32) (lp->init_dma_addr));
33697
33698 /* set/reset autoselect bit */
33699- val = lp->a.read_bcr(ioaddr, 2) & ~2;
33700+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
33701 if (lp->options & PCNET32_PORT_ASEL)
33702 val |= 2;
33703- lp->a.write_bcr(ioaddr, 2, val);
33704+ lp->a->write_bcr(ioaddr, 2, val);
33705
33706 /* handle full duplex setting */
33707 if (lp->mii_if.full_duplex) {
33708- val = lp->a.read_bcr(ioaddr, 9) & ~3;
33709+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
33710 if (lp->options & PCNET32_PORT_FD) {
33711 val |= 1;
33712 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
33713@@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_device *dev)
33714 if (lp->chip_version == 0x2627)
33715 val |= 3;
33716 }
33717- lp->a.write_bcr(ioaddr, 9, val);
33718+ lp->a->write_bcr(ioaddr, 9, val);
33719 }
33720
33721 /* set/reset GPSI bit in test register */
33722- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
33723+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
33724 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
33725 val |= 0x10;
33726- lp->a.write_csr(ioaddr, 124, val);
33727+ lp->a->write_csr(ioaddr, 124, val);
33728
33729 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
33730 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
33731@@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_device *dev)
33732 * duplex, and/or enable auto negotiation, and clear DANAS
33733 */
33734 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
33735- lp->a.write_bcr(ioaddr, 32,
33736- lp->a.read_bcr(ioaddr, 32) | 0x0080);
33737+ lp->a->write_bcr(ioaddr, 32,
33738+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
33739 /* disable Auto Negotiation, set 10Mpbs, HD */
33740- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
33741+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
33742 if (lp->options & PCNET32_PORT_FD)
33743 val |= 0x10;
33744 if (lp->options & PCNET32_PORT_100)
33745 val |= 0x08;
33746- lp->a.write_bcr(ioaddr, 32, val);
33747+ lp->a->write_bcr(ioaddr, 32, val);
33748 } else {
33749 if (lp->options & PCNET32_PORT_ASEL) {
33750- lp->a.write_bcr(ioaddr, 32,
33751- lp->a.read_bcr(ioaddr,
33752+ lp->a->write_bcr(ioaddr, 32,
33753+ lp->a->read_bcr(ioaddr,
33754 32) | 0x0080);
33755 /* enable auto negotiate, setup, disable fd */
33756- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
33757+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
33758 val |= 0x20;
33759- lp->a.write_bcr(ioaddr, 32, val);
33760+ lp->a->write_bcr(ioaddr, 32, val);
33761 }
33762 }
33763 } else {
33764@@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_device *dev)
33765 * There is really no good other way to handle multiple PHYs
33766 * other than turning off all automatics
33767 */
33768- val = lp->a.read_bcr(ioaddr, 2);
33769- lp->a.write_bcr(ioaddr, 2, val & ~2);
33770- val = lp->a.read_bcr(ioaddr, 32);
33771- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
33772+ val = lp->a->read_bcr(ioaddr, 2);
33773+ lp->a->write_bcr(ioaddr, 2, val & ~2);
33774+ val = lp->a->read_bcr(ioaddr, 32);
33775+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
33776
33777 if (!(lp->options & PCNET32_PORT_ASEL)) {
33778 /* setup ecmd */
33779@@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_device *dev)
33780 ethtool_cmd_speed_set(&ecmd,
33781 (lp->options & PCNET32_PORT_100) ?
33782 SPEED_100 : SPEED_10);
33783- bcr9 = lp->a.read_bcr(ioaddr, 9);
33784+ bcr9 = lp->a->read_bcr(ioaddr, 9);
33785
33786 if (lp->options & PCNET32_PORT_FD) {
33787 ecmd.duplex = DUPLEX_FULL;
33788@@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_device *dev)
33789 ecmd.duplex = DUPLEX_HALF;
33790 bcr9 |= ~(1 << 0);
33791 }
33792- lp->a.write_bcr(ioaddr, 9, bcr9);
33793+ lp->a->write_bcr(ioaddr, 9, bcr9);
33794 }
33795
33796 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33797@@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_device *dev)
33798
33799 #ifdef DO_DXSUFLO
33800 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
33801- val = lp->a.read_csr(ioaddr, CSR3);
33802+ val = lp->a->read_csr(ioaddr, CSR3);
33803 val |= 0x40;
33804- lp->a.write_csr(ioaddr, CSR3, val);
33805+ lp->a->write_csr(ioaddr, CSR3, val);
33806 }
33807 #endif
33808
33809@@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_device *dev)
33810 napi_enable(&lp->napi);
33811
33812 /* Re-initialize the PCNET32, and start it when done. */
33813- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
33814- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
33815+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
33816+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
33817
33818- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33819- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
33820+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33821+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
33822
33823 netif_start_queue(dev);
33824
33825@@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_device *dev)
33826
33827 i = 0;
33828 while (i++ < 100)
33829- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
33830+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
33831 break;
33832 /*
33833 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
33834 * reports that doing so triggers a bug in the '974.
33835 */
33836- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
33837+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
33838
33839 netif_printk(lp, ifup, KERN_DEBUG, dev,
33840 "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n",
33841 i,
33842 (u32) (lp->init_dma_addr),
33843- lp->a.read_csr(ioaddr, CSR0));
33844+ lp->a->read_csr(ioaddr, CSR0));
33845
33846 spin_unlock_irqrestore(&lp->lock, flags);
33847
33848@@ -2218,7 +2218,7 @@ err_free_ring:
33849 * Switch back to 16bit mode to avoid problems with dumb
33850 * DOS packet driver after a warm reboot
33851 */
33852- lp->a.write_bcr(ioaddr, 20, 4);
33853+ lp->a->write_bcr(ioaddr, 20, 4);
33854
33855 err_free_irq:
33856 spin_unlock_irqrestore(&lp->lock, flags);
33857@@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
33858
33859 /* wait for stop */
33860 for (i = 0; i < 100; i++)
33861- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
33862+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
33863 break;
33864
33865 if (i >= 100)
33866@@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
33867 return;
33868
33869 /* ReInit Ring */
33870- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
33871+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
33872 i = 0;
33873 while (i++ < 1000)
33874- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
33875+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
33876 break;
33877
33878- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
33879+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
33880 }
33881
33882 static void pcnet32_tx_timeout(struct net_device *dev)
33883@@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
33884 /* Transmitter timeout, serious problems. */
33885 if (pcnet32_debug & NETIF_MSG_DRV)
33886 pr_err("%s: transmit timed out, status %4.4x, resetting\n",
33887- dev->name, lp->a.read_csr(ioaddr, CSR0));
33888- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33889+ dev->name, lp->a->read_csr(ioaddr, CSR0));
33890+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33891 dev->stats.tx_errors++;
33892 if (netif_msg_tx_err(lp)) {
33893 int i;
33894@@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
33895
33896 netif_printk(lp, tx_queued, KERN_DEBUG, dev,
33897 "%s() called, csr0 %4.4x\n",
33898- __func__, lp->a.read_csr(ioaddr, CSR0));
33899+ __func__, lp->a->read_csr(ioaddr, CSR0));
33900
33901 /* Default status -- will not enable Successful-TxDone
33902 * interrupt when that option is available to us.
33903@@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
33904 dev->stats.tx_bytes += skb->len;
33905
33906 /* Trigger an immediate send poll. */
33907- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
33908+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
33909
33910 if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) {
33911 lp->tx_full = 1;
33912@@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id)
33913
33914 spin_lock(&lp->lock);
33915
33916- csr0 = lp->a.read_csr(ioaddr, CSR0);
33917+ csr0 = lp->a->read_csr(ioaddr, CSR0);
33918 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
33919 if (csr0 == 0xffff)
33920 break; /* PCMCIA remove happened */
33921 /* Acknowledge all of the current interrupt sources ASAP. */
33922- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
33923+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
33924
33925 netif_printk(lp, intr, KERN_DEBUG, dev,
33926 "interrupt csr0=%#2.2x new csr=%#2.2x\n",
33927- csr0, lp->a.read_csr(ioaddr, CSR0));
33928+ csr0, lp->a->read_csr(ioaddr, CSR0));
33929
33930 /* Log misc errors. */
33931 if (csr0 & 0x4000)
33932@@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id)
33933 if (napi_schedule_prep(&lp->napi)) {
33934 u16 val;
33935 /* set interrupt masks */
33936- val = lp->a.read_csr(ioaddr, CSR3);
33937+ val = lp->a->read_csr(ioaddr, CSR3);
33938 val |= 0x5f00;
33939- lp->a.write_csr(ioaddr, CSR3, val);
33940+ lp->a->write_csr(ioaddr, CSR3, val);
33941
33942 __napi_schedule(&lp->napi);
33943 break;
33944 }
33945- csr0 = lp->a.read_csr(ioaddr, CSR0);
33946+ csr0 = lp->a->read_csr(ioaddr, CSR0);
33947 }
33948
33949 netif_printk(lp, intr, KERN_DEBUG, dev,
33950 "exiting interrupt, csr0=%#4.4x\n",
33951- lp->a.read_csr(ioaddr, CSR0));
33952+ lp->a->read_csr(ioaddr, CSR0));
33953
33954 spin_unlock(&lp->lock);
33955
33956@@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_device *dev)
33957
33958 spin_lock_irqsave(&lp->lock, flags);
33959
33960- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
33961+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
33962
33963 netif_printk(lp, ifdown, KERN_DEBUG, dev,
33964 "Shutting down ethercard, status was %2.2x\n",
33965- lp->a.read_csr(ioaddr, CSR0));
33966+ lp->a->read_csr(ioaddr, CSR0));
33967
33968 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
33969- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33970+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33971
33972 /*
33973 * Switch back to 16bit mode to avoid problems with dumb
33974 * DOS packet driver after a warm reboot
33975 */
33976- lp->a.write_bcr(ioaddr, 20, 4);
33977+ lp->a->write_bcr(ioaddr, 20, 4);
33978
33979 spin_unlock_irqrestore(&lp->lock, flags);
33980
33981@@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
33982 unsigned long flags;
33983
33984 spin_lock_irqsave(&lp->lock, flags);
33985- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
33986+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
33987 spin_unlock_irqrestore(&lp->lock, flags);
33988
33989 return &dev->stats;
33990@@ -2577,10 +2577,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
33991 if (dev->flags & IFF_ALLMULTI) {
33992 ib->filter[0] = cpu_to_le32(~0U);
33993 ib->filter[1] = cpu_to_le32(~0U);
33994- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
33995- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
33996- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
33997- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
33998+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
33999+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
34000+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
34001+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
34002 return;
34003 }
34004 /* clear the multicast filter */
34005@@ -2594,7 +2594,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
34006 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
34007 }
34008 for (i = 0; i < 4; i++)
34009- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
34010+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
34011 le16_to_cpu(mcast_table[i]));
34012 }
34013
34014@@ -2609,28 +2609,28 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
34015
34016 spin_lock_irqsave(&lp->lock, flags);
34017 suspended = pcnet32_suspend(dev, &flags, 0);
34018- csr15 = lp->a.read_csr(ioaddr, CSR15);
34019+ csr15 = lp->a->read_csr(ioaddr, CSR15);
34020 if (dev->flags & IFF_PROMISC) {
34021 /* Log any net taps. */
34022 netif_info(lp, hw, dev, "Promiscuous mode enabled\n");
34023 lp->init_block->mode =
34024 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
34025 7);
34026- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
34027+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
34028 } else {
34029 lp->init_block->mode =
34030 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
34031- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34032+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34033 pcnet32_load_multicast(dev);
34034 }
34035
34036 if (suspended) {
34037 int csr5;
34038 /* clear SUSPEND (SPND) - CSR5 bit 0 */
34039- csr5 = lp->a.read_csr(ioaddr, CSR5);
34040- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34041+ csr5 = lp->a->read_csr(ioaddr, CSR5);
34042+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34043 } else {
34044- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34045+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34046 pcnet32_restart(dev, CSR0_NORMAL);
34047 netif_wake_queue(dev);
34048 }
34049@@ -2648,8 +2648,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
34050 if (!lp->mii)
34051 return 0;
34052
34053- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34054- val_out = lp->a.read_bcr(ioaddr, 34);
34055+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34056+ val_out = lp->a->read_bcr(ioaddr, 34);
34057
34058 return val_out;
34059 }
34060@@ -2663,8 +2663,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
34061 if (!lp->mii)
34062 return;
34063
34064- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34065- lp->a.write_bcr(ioaddr, 34, val);
34066+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34067+ lp->a->write_bcr(ioaddr, 34, val);
34068 }
34069
34070 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34071@@ -2741,7 +2741,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34072 curr_link = mii_link_ok(&lp->mii_if);
34073 } else {
34074 ulong ioaddr = dev->base_addr; /* card base I/O address */
34075- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
34076+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
34077 }
34078 if (!curr_link) {
34079 if (prev_link || verbose) {
34080@@ -2764,13 +2764,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34081 (ecmd.duplex == DUPLEX_FULL)
34082 ? "full" : "half");
34083 }
34084- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
34085+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
34086 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
34087 if (lp->mii_if.full_duplex)
34088 bcr9 |= (1 << 0);
34089 else
34090 bcr9 &= ~(1 << 0);
34091- lp->a.write_bcr(dev->base_addr, 9, bcr9);
34092+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
34093 }
34094 } else {
34095 netif_info(lp, link, dev, "link up\n");
34096diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
34097index edfa15d..002bfa9 100644
34098--- a/drivers/net/ppp_generic.c
34099+++ b/drivers/net/ppp_generic.c
34100@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34101 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
34102 struct ppp_stats stats;
34103 struct ppp_comp_stats cstats;
34104- char *vers;
34105
34106 switch (cmd) {
34107 case SIOCGPPPSTATS:
34108@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34109 break;
34110
34111 case SIOCGPPPVER:
34112- vers = PPP_VERSION;
34113- if (copy_to_user(addr, vers, strlen(vers) + 1))
34114+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
34115 break;
34116 err = 0;
34117 break;
34118diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
34119index 6d657ca..d1be94b 100644
34120--- a/drivers/net/r8169.c
34121+++ b/drivers/net/r8169.c
34122@@ -663,12 +663,12 @@ struct rtl8169_private {
34123 struct mdio_ops {
34124 void (*write)(void __iomem *, int, int);
34125 int (*read)(void __iomem *, int);
34126- } mdio_ops;
34127+ } __no_const mdio_ops;
34128
34129 struct pll_power_ops {
34130 void (*down)(struct rtl8169_private *);
34131 void (*up)(struct rtl8169_private *);
34132- } pll_power_ops;
34133+ } __no_const pll_power_ops;
34134
34135 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
34136 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
34137diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
34138index 3c0f131..17f8b02 100644
34139--- a/drivers/net/sis190.c
34140+++ b/drivers/net/sis190.c
34141@@ -1624,7 +1624,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
34142 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
34143 struct net_device *dev)
34144 {
34145- static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
34146+ static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
34147 struct sis190_private *tp = netdev_priv(dev);
34148 struct pci_dev *isa_bridge;
34149 u8 reg, tmp8;
34150diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
34151index 4793df8..44c9849 100644
34152--- a/drivers/net/sundance.c
34153+++ b/drivers/net/sundance.c
34154@@ -218,7 +218,7 @@ enum {
34155 struct pci_id_info {
34156 const char *name;
34157 };
34158-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34159+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34160 {"D-Link DFE-550TX FAST Ethernet Adapter"},
34161 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
34162 {"D-Link DFE-580TX 4 port Server Adapter"},
34163diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
34164index 2ea456d..3ad9523 100644
34165--- a/drivers/net/tg3.h
34166+++ b/drivers/net/tg3.h
34167@@ -134,6 +134,7 @@
34168 #define CHIPREV_ID_5750_A0 0x4000
34169 #define CHIPREV_ID_5750_A1 0x4001
34170 #define CHIPREV_ID_5750_A3 0x4003
34171+#define CHIPREV_ID_5750_C1 0x4201
34172 #define CHIPREV_ID_5750_C2 0x4202
34173 #define CHIPREV_ID_5752_A0_HW 0x5000
34174 #define CHIPREV_ID_5752_A0 0x6000
34175diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
34176index 515f122..41dd273 100644
34177--- a/drivers/net/tokenring/abyss.c
34178+++ b/drivers/net/tokenring/abyss.c
34179@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
34180
34181 static int __init abyss_init (void)
34182 {
34183- abyss_netdev_ops = tms380tr_netdev_ops;
34184+ pax_open_kernel();
34185+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34186
34187- abyss_netdev_ops.ndo_open = abyss_open;
34188- abyss_netdev_ops.ndo_stop = abyss_close;
34189+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
34190+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
34191+ pax_close_kernel();
34192
34193 return pci_register_driver(&abyss_driver);
34194 }
34195diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
34196index 6153cfd..cf69c1c 100644
34197--- a/drivers/net/tokenring/madgemc.c
34198+++ b/drivers/net/tokenring/madgemc.c
34199@@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver = {
34200
34201 static int __init madgemc_init (void)
34202 {
34203- madgemc_netdev_ops = tms380tr_netdev_ops;
34204- madgemc_netdev_ops.ndo_open = madgemc_open;
34205- madgemc_netdev_ops.ndo_stop = madgemc_close;
34206+ pax_open_kernel();
34207+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34208+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
34209+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
34210+ pax_close_kernel();
34211
34212 return mca_register_driver (&madgemc_driver);
34213 }
34214diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
34215index 8d362e6..f91cc52 100644
34216--- a/drivers/net/tokenring/proteon.c
34217+++ b/drivers/net/tokenring/proteon.c
34218@@ -353,9 +353,11 @@ static int __init proteon_init(void)
34219 struct platform_device *pdev;
34220 int i, num = 0, err = 0;
34221
34222- proteon_netdev_ops = tms380tr_netdev_ops;
34223- proteon_netdev_ops.ndo_open = proteon_open;
34224- proteon_netdev_ops.ndo_stop = tms380tr_close;
34225+ pax_open_kernel();
34226+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34227+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
34228+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
34229+ pax_close_kernel();
34230
34231 err = platform_driver_register(&proteon_driver);
34232 if (err)
34233diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
34234index 46db5c5..37c1536 100644
34235--- a/drivers/net/tokenring/skisa.c
34236+++ b/drivers/net/tokenring/skisa.c
34237@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
34238 struct platform_device *pdev;
34239 int i, num = 0, err = 0;
34240
34241- sk_isa_netdev_ops = tms380tr_netdev_ops;
34242- sk_isa_netdev_ops.ndo_open = sk_isa_open;
34243- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34244+ pax_open_kernel();
34245+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34246+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
34247+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34248+ pax_close_kernel();
34249
34250 err = platform_driver_register(&sk_isa_driver);
34251 if (err)
34252diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
34253index ce90efc..2676f89 100644
34254--- a/drivers/net/tulip/de2104x.c
34255+++ b/drivers/net/tulip/de2104x.c
34256@@ -1795,6 +1795,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
34257 struct de_srom_info_leaf *il;
34258 void *bufp;
34259
34260+ pax_track_stack();
34261+
34262 /* download entire eeprom */
34263 for (i = 0; i < DE_EEPROM_WORDS; i++)
34264 ((__le16 *)ee_data)[i] =
34265diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
34266index 959b410..c97fac2 100644
34267--- a/drivers/net/tulip/de4x5.c
34268+++ b/drivers/net/tulip/de4x5.c
34269@@ -5397,7 +5397,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34270 for (i=0; i<ETH_ALEN; i++) {
34271 tmp.addr[i] = dev->dev_addr[i];
34272 }
34273- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34274+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34275 break;
34276
34277 case DE4X5_SET_HWADDR: /* Set the hardware address */
34278@@ -5437,7 +5437,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34279 spin_lock_irqsave(&lp->lock, flags);
34280 memcpy(&statbuf, &lp->pktStats, ioc->len);
34281 spin_unlock_irqrestore(&lp->lock, flags);
34282- if (copy_to_user(ioc->data, &statbuf, ioc->len))
34283+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
34284 return -EFAULT;
34285 break;
34286 }
34287diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
34288index fa5eee9..e074432 100644
34289--- a/drivers/net/tulip/eeprom.c
34290+++ b/drivers/net/tulip/eeprom.c
34291@@ -81,7 +81,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
34292 {NULL}};
34293
34294
34295-static const char *block_name[] __devinitdata = {
34296+static const char *block_name[] __devinitconst = {
34297 "21140 non-MII",
34298 "21140 MII PHY",
34299 "21142 Serial PHY",
34300diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
34301index 862eadf..3eee1e6 100644
34302--- a/drivers/net/tulip/winbond-840.c
34303+++ b/drivers/net/tulip/winbond-840.c
34304@@ -236,7 +236,7 @@ struct pci_id_info {
34305 int drv_flags; /* Driver use, intended as capability flags. */
34306 };
34307
34308-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34309+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34310 { /* Sometime a Level-One switch card. */
34311 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
34312 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
34313diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
34314index 304fe78..db112fa 100644
34315--- a/drivers/net/usb/hso.c
34316+++ b/drivers/net/usb/hso.c
34317@@ -71,7 +71,7 @@
34318 #include <asm/byteorder.h>
34319 #include <linux/serial_core.h>
34320 #include <linux/serial.h>
34321-
34322+#include <asm/local.h>
34323
34324 #define MOD_AUTHOR "Option Wireless"
34325 #define MOD_DESCRIPTION "USB High Speed Option driver"
34326@@ -257,7 +257,7 @@ struct hso_serial {
34327
34328 /* from usb_serial_port */
34329 struct tty_struct *tty;
34330- int open_count;
34331+ local_t open_count;
34332 spinlock_t serial_lock;
34333
34334 int (*write_data) (struct hso_serial *serial);
34335@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
34336 struct urb *urb;
34337
34338 urb = serial->rx_urb[0];
34339- if (serial->open_count > 0) {
34340+ if (local_read(&serial->open_count) > 0) {
34341 count = put_rxbuf_data(urb, serial);
34342 if (count == -1)
34343 return;
34344@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
34345 DUMP1(urb->transfer_buffer, urb->actual_length);
34346
34347 /* Anyone listening? */
34348- if (serial->open_count == 0)
34349+ if (local_read(&serial->open_count) == 0)
34350 return;
34351
34352 if (status == 0) {
34353@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34354 spin_unlock_irq(&serial->serial_lock);
34355
34356 /* check for port already opened, if not set the termios */
34357- serial->open_count++;
34358- if (serial->open_count == 1) {
34359+ if (local_inc_return(&serial->open_count) == 1) {
34360 serial->rx_state = RX_IDLE;
34361 /* Force default termio settings */
34362 _hso_serial_set_termios(tty, NULL);
34363@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34364 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
34365 if (result) {
34366 hso_stop_serial_device(serial->parent);
34367- serial->open_count--;
34368+ local_dec(&serial->open_count);
34369 kref_put(&serial->parent->ref, hso_serial_ref_free);
34370 }
34371 } else {
34372@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
34373
34374 /* reset the rts and dtr */
34375 /* do the actual close */
34376- serial->open_count--;
34377+ local_dec(&serial->open_count);
34378
34379- if (serial->open_count <= 0) {
34380- serial->open_count = 0;
34381+ if (local_read(&serial->open_count) <= 0) {
34382+ local_set(&serial->open_count, 0);
34383 spin_lock_irq(&serial->serial_lock);
34384 if (serial->tty == tty) {
34385 serial->tty->driver_data = NULL;
34386@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
34387
34388 /* the actual setup */
34389 spin_lock_irqsave(&serial->serial_lock, flags);
34390- if (serial->open_count)
34391+ if (local_read(&serial->open_count))
34392 _hso_serial_set_termios(tty, old);
34393 else
34394 tty->termios = old;
34395@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *urb)
34396 D1("Pending read interrupt on port %d\n", i);
34397 spin_lock(&serial->serial_lock);
34398 if (serial->rx_state == RX_IDLE &&
34399- serial->open_count > 0) {
34400+ local_read(&serial->open_count) > 0) {
34401 /* Setup and send a ctrl req read on
34402 * port i */
34403 if (!serial->rx_urb_filled[0]) {
34404@@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interface *iface)
34405 /* Start all serial ports */
34406 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
34407 if (serial_table[i] && (serial_table[i]->interface == iface)) {
34408- if (dev2ser(serial_table[i])->open_count) {
34409+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
34410 result =
34411 hso_start_serial_device(serial_table[i], GFP_NOIO);
34412 hso_kick_transmit(dev2ser(serial_table[i]));
34413diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34414index 27400ed..c796e05 100644
34415--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
34416+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34417@@ -601,8 +601,7 @@ vmxnet3_set_rss_indir(struct net_device *netdev,
34418 * Return with error code if any of the queue indices
34419 * is out of range
34420 */
34421- if (p->ring_index[i] < 0 ||
34422- p->ring_index[i] >= adapter->num_rx_queues)
34423+ if (p->ring_index[i] >= adapter->num_rx_queues)
34424 return -EINVAL;
34425 }
34426
34427diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
34428index dd36258..e47fd31 100644
34429--- a/drivers/net/vxge/vxge-config.h
34430+++ b/drivers/net/vxge/vxge-config.h
34431@@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
34432 void (*link_down)(struct __vxge_hw_device *devh);
34433 void (*crit_err)(struct __vxge_hw_device *devh,
34434 enum vxge_hw_event type, u64 ext_data);
34435-};
34436+} __no_const;
34437
34438 /*
34439 * struct __vxge_hw_blockpool_entry - Block private data structure
34440diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
34441index 178348a2..18bb433 100644
34442--- a/drivers/net/vxge/vxge-main.c
34443+++ b/drivers/net/vxge/vxge-main.c
34444@@ -100,6 +100,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
34445 struct sk_buff *completed[NR_SKB_COMPLETED];
34446 int more;
34447
34448+ pax_track_stack();
34449+
34450 do {
34451 more = 0;
34452 skb_ptr = completed;
34453@@ -1915,6 +1917,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
34454 u8 mtable[256] = {0}; /* CPU to vpath mapping */
34455 int index;
34456
34457+ pax_track_stack();
34458+
34459 /*
34460 * Filling
34461 * - itable with bucket numbers
34462diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
34463index 4a518a3..936b334 100644
34464--- a/drivers/net/vxge/vxge-traffic.h
34465+++ b/drivers/net/vxge/vxge-traffic.h
34466@@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
34467 struct vxge_hw_mempool_dma *dma_object,
34468 u32 index,
34469 u32 is_last);
34470-};
34471+} __no_const;
34472
34473 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
34474 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
34475diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
34476index 56aeb01..547f71f 100644
34477--- a/drivers/net/wan/hdlc_x25.c
34478+++ b/drivers/net/wan/hdlc_x25.c
34479@@ -134,16 +134,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
34480
34481 static int x25_open(struct net_device *dev)
34482 {
34483- struct lapb_register_struct cb;
34484+ static struct lapb_register_struct cb = {
34485+ .connect_confirmation = x25_connected,
34486+ .connect_indication = x25_connected,
34487+ .disconnect_confirmation = x25_disconnected,
34488+ .disconnect_indication = x25_disconnected,
34489+ .data_indication = x25_data_indication,
34490+ .data_transmit = x25_data_transmit
34491+ };
34492 int result;
34493
34494- cb.connect_confirmation = x25_connected;
34495- cb.connect_indication = x25_connected;
34496- cb.disconnect_confirmation = x25_disconnected;
34497- cb.disconnect_indication = x25_disconnected;
34498- cb.data_indication = x25_data_indication;
34499- cb.data_transmit = x25_data_transmit;
34500-
34501 result = lapb_register(dev, &cb);
34502 if (result != LAPB_OK)
34503 return result;
34504diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
34505index 1fda46c..f2858f2 100644
34506--- a/drivers/net/wimax/i2400m/usb-fw.c
34507+++ b/drivers/net/wimax/i2400m/usb-fw.c
34508@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
34509 int do_autopm = 1;
34510 DECLARE_COMPLETION_ONSTACK(notif_completion);
34511
34512+ pax_track_stack();
34513+
34514 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
34515 i2400m, ack, ack_size);
34516 BUG_ON(_ack == i2400m->bm_ack_buf);
34517diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
34518index e1b3e3c..e413f18 100644
34519--- a/drivers/net/wireless/airo.c
34520+++ b/drivers/net/wireless/airo.c
34521@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
34522 BSSListElement * loop_net;
34523 BSSListElement * tmp_net;
34524
34525+ pax_track_stack();
34526+
34527 /* Blow away current list of scan results */
34528 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
34529 list_move_tail (&loop_net->list, &ai->network_free_list);
34530@@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
34531 WepKeyRid wkr;
34532 int rc;
34533
34534+ pax_track_stack();
34535+
34536 memset( &mySsid, 0, sizeof( mySsid ) );
34537 kfree (ai->flash);
34538 ai->flash = NULL;
34539@@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct inode *inode,
34540 __le32 *vals = stats.vals;
34541 int len;
34542
34543+ pax_track_stack();
34544+
34545 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34546 return -ENOMEM;
34547 data = file->private_data;
34548@@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
34549 /* If doLoseSync is not 1, we won't do a Lose Sync */
34550 int doLoseSync = -1;
34551
34552+ pax_track_stack();
34553+
34554 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34555 return -ENOMEM;
34556 data = file->private_data;
34557@@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_device *dev,
34558 int i;
34559 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
34560
34561+ pax_track_stack();
34562+
34563 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
34564 if (!qual)
34565 return -ENOMEM;
34566@@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
34567 CapabilityRid cap_rid;
34568 __le32 *vals = stats_rid.vals;
34569
34570+ pax_track_stack();
34571+
34572 /* Get stats out of the card */
34573 clear_bit(JOB_WSTATS, &local->jobs);
34574 if (local->power.event) {
34575diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
34576index 17c4b56..00d836f 100644
34577--- a/drivers/net/wireless/ath/ath.h
34578+++ b/drivers/net/wireless/ath/ath.h
34579@@ -121,6 +121,7 @@ struct ath_ops {
34580 void (*write_flush) (void *);
34581 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
34582 };
34583+typedef struct ath_ops __no_const ath_ops_no_const;
34584
34585 struct ath_common;
34586 struct ath_bus_ops;
34587diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
34588index ccca724..7afbadc 100644
34589--- a/drivers/net/wireless/ath/ath5k/debug.c
34590+++ b/drivers/net/wireless/ath/ath5k/debug.c
34591@@ -203,6 +203,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
34592 unsigned int v;
34593 u64 tsf;
34594
34595+ pax_track_stack();
34596+
34597 v = ath5k_hw_reg_read(ah, AR5K_BEACON);
34598 len += snprintf(buf + len, sizeof(buf) - len,
34599 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
34600@@ -321,6 +323,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
34601 unsigned int len = 0;
34602 unsigned int i;
34603
34604+ pax_track_stack();
34605+
34606 len += snprintf(buf + len, sizeof(buf) - len,
34607 "DEBUG LEVEL: 0x%08x\n\n", ah->debug.level);
34608
34609@@ -492,6 +496,8 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
34610 unsigned int len = 0;
34611 u32 filt = ath5k_hw_get_rx_filter(ah);
34612
34613+ pax_track_stack();
34614+
34615 len += snprintf(buf + len, sizeof(buf) - len, "bssid-mask: %pM\n",
34616 ah->bssidmask);
34617 len += snprintf(buf + len, sizeof(buf) - len, "filter-flags: 0x%x ",
34618@@ -548,6 +554,8 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
34619 unsigned int len = 0;
34620 int i;
34621
34622+ pax_track_stack();
34623+
34624 len += snprintf(buf + len, sizeof(buf) - len,
34625 "RX\n---------------------\n");
34626 len += snprintf(buf + len, sizeof(buf) - len, "CRC\t%u\t(%u%%)\n",
34627@@ -665,6 +673,8 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
34628 char buf[700];
34629 unsigned int len = 0;
34630
34631+ pax_track_stack();
34632+
34633 len += snprintf(buf + len, sizeof(buf) - len,
34634 "HW has PHY error counters:\t%s\n",
34635 ah->ah_capabilities.cap_has_phyerr_counters ?
34636@@ -829,6 +839,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34637 struct ath5k_buf *bf, *bf0;
34638 int i, n;
34639
34640+ pax_track_stack();
34641+
34642 len += snprintf(buf + len, sizeof(buf) - len,
34643 "available txbuffers: %d\n", ah->txbuf_len);
34644
34645diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34646index 7c2aaad..ad14dee 100644
34647--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34648+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34649@@ -758,6 +758,8 @@ static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah)
34650 int i, im, j;
34651 int nmeasurement;
34652
34653+ pax_track_stack();
34654+
34655 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
34656 if (ah->txchainmask & (1 << i))
34657 num_chains++;
34658diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34659index f80d1d6..08b773d 100644
34660--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34661+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34662@@ -406,6 +406,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
34663 int theta_low_bin = 0;
34664 int i;
34665
34666+ pax_track_stack();
34667+
34668 /* disregard any bin that contains <= 16 samples */
34669 thresh_accum_cnt = 16;
34670 scale_factor = 5;
34671diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
34672index d1eb896..8b67cd4 100644
34673--- a/drivers/net/wireless/ath/ath9k/debug.c
34674+++ b/drivers/net/wireless/ath/ath9k/debug.c
34675@@ -387,6 +387,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
34676 char buf[512];
34677 unsigned int len = 0;
34678
34679+ pax_track_stack();
34680+
34681 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
34682 len += snprintf(buf + len, sizeof(buf) - len,
34683 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
34684@@ -477,6 +479,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
34685 u8 addr[ETH_ALEN];
34686 u32 tmp;
34687
34688+ pax_track_stack();
34689+
34690 len += snprintf(buf + len, sizeof(buf) - len,
34691 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
34692 wiphy_name(sc->hw->wiphy),
34693diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34694index d3ff33c..309398e 100644
34695--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34696+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34697@@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
34698 unsigned int len = 0;
34699 int ret = 0;
34700
34701+ pax_track_stack();
34702+
34703 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34704
34705 ath9k_htc_ps_wakeup(priv);
34706@@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
34707 unsigned int len = 0;
34708 int ret = 0;
34709
34710+ pax_track_stack();
34711+
34712 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34713
34714 ath9k_htc_ps_wakeup(priv);
34715@@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
34716 unsigned int len = 0;
34717 int ret = 0;
34718
34719+ pax_track_stack();
34720+
34721 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34722
34723 ath9k_htc_ps_wakeup(priv);
34724@@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
34725 char buf[512];
34726 unsigned int len = 0;
34727
34728+ pax_track_stack();
34729+
34730 len += snprintf(buf + len, sizeof(buf) - len,
34731 "%20s : %10u\n", "Buffers queued",
34732 priv->debug.tx_stats.buf_queued);
34733@@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct file *file, char __user *user_buf,
34734 char buf[512];
34735 unsigned int len = 0;
34736
34737+ pax_track_stack();
34738+
34739 spin_lock_bh(&priv->tx.tx_lock);
34740
34741 len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
34742@@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34743 char buf[512];
34744 unsigned int len = 0;
34745
34746+ pax_track_stack();
34747+
34748 len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
34749 "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
34750
34751diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
34752index c798890..c19a8fb 100644
34753--- a/drivers/net/wireless/ath/ath9k/hw.h
34754+++ b/drivers/net/wireless/ath/ath9k/hw.h
34755@@ -588,7 +588,7 @@ struct ath_hw_private_ops {
34756
34757 /* ANI */
34758 void (*ani_cache_ini_regs)(struct ath_hw *ah);
34759-};
34760+} __no_const;
34761
34762 /**
34763 * struct ath_hw_ops - callbacks used by hardware code and driver code
34764@@ -639,7 +639,7 @@ struct ath_hw_ops {
34765 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
34766 struct ath_hw_antcomb_conf *antconf);
34767
34768-};
34769+} __no_const;
34770
34771 struct ath_nf_limits {
34772 s16 max;
34773@@ -652,7 +652,7 @@ struct ath_nf_limits {
34774 #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */
34775
34776 struct ath_hw {
34777- struct ath_ops reg_ops;
34778+ ath_ops_no_const reg_ops;
34779
34780 struct ieee80211_hw *hw;
34781 struct ath_common common;
34782diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
34783index ef9ad79..f5f8d80 100644
34784--- a/drivers/net/wireless/ipw2x00/ipw2100.c
34785+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
34786@@ -2102,6 +2102,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
34787 int err;
34788 DECLARE_SSID_BUF(ssid);
34789
34790+ pax_track_stack();
34791+
34792 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
34793
34794 if (ssid_len)
34795@@ -5451,6 +5453,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
34796 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
34797 int err;
34798
34799+ pax_track_stack();
34800+
34801 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
34802 idx, keylen, len);
34803
34804diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
34805index 32a9966..de69787 100644
34806--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
34807+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
34808@@ -1565,6 +1565,8 @@ static void libipw_process_probe_response(struct libipw_device
34809 unsigned long flags;
34810 DECLARE_SSID_BUF(ssid);
34811
34812+ pax_track_stack();
34813+
34814 LIBIPW_DEBUG_SCAN("'%s' (%pM"
34815 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
34816 print_ssid(ssid, info_element->data, info_element->len),
34817diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
34818index 66ee1562..b90412b 100644
34819--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
34820+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
34821@@ -3687,7 +3687,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
34822 */
34823 if (iwl3945_mod_params.disable_hw_scan) {
34824 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
34825- iwl3945_hw_ops.hw_scan = NULL;
34826+ pax_open_kernel();
34827+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
34828+ pax_close_kernel();
34829 }
34830
34831 IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
34832diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34833index 3789ff4..22ab151 100644
34834--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34835+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34836@@ -920,6 +920,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
34837 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
34838 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
34839
34840+ pax_track_stack();
34841+
34842 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
34843
34844 /* Treat uninitialized rate scaling data same as non-existing. */
34845@@ -2931,6 +2933,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
34846 container_of(lq_sta, struct iwl_station_priv, lq_sta);
34847 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
34848
34849+ pax_track_stack();
34850+
34851 /* Override starting rate (index 0) if needed for debug purposes */
34852 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
34853
34854diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
34855index f9a407e..a6f2bb7 100644
34856--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
34857+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
34858@@ -68,8 +68,8 @@ do { \
34859 } while (0)
34860
34861 #else
34862-#define IWL_DEBUG(__priv, level, fmt, args...)
34863-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
34864+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
34865+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
34866 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
34867 const void *p, u32 len)
34868 {}
34869diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34870index ec1485b..900c3bd 100644
34871--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34872+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34873@@ -561,6 +561,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
34874 int pos = 0;
34875 const size_t bufsz = sizeof(buf);
34876
34877+ pax_track_stack();
34878+
34879 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
34880 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
34881 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
34882@@ -693,6 +695,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
34883 char buf[256 * NUM_IWL_RXON_CTX];
34884 const size_t bufsz = sizeof(buf);
34885
34886+ pax_track_stack();
34887+
34888 for_each_context(priv, ctx) {
34889 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
34890 ctx->ctxid);
34891diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
34892index 0a0cc96..fd49ad8 100644
34893--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
34894+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
34895@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
34896 int buf_len = 512;
34897 size_t len = 0;
34898
34899+ pax_track_stack();
34900+
34901 if (*ppos != 0)
34902 return 0;
34903 if (count < sizeof(buf))
34904diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
34905index 031cd89..bdc8435 100644
34906--- a/drivers/net/wireless/mac80211_hwsim.c
34907+++ b/drivers/net/wireless/mac80211_hwsim.c
34908@@ -1670,9 +1670,11 @@ static int __init init_mac80211_hwsim(void)
34909 return -EINVAL;
34910
34911 if (fake_hw_scan) {
34912- mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
34913- mac80211_hwsim_ops.sw_scan_start = NULL;
34914- mac80211_hwsim_ops.sw_scan_complete = NULL;
34915+ pax_open_kernel();
34916+ *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
34917+ *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
34918+ *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
34919+ pax_close_kernel();
34920 }
34921
34922 spin_lock_init(&hwsim_radio_lock);
34923diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
34924index 2215c3c..64e6a47 100644
34925--- a/drivers/net/wireless/mwifiex/main.h
34926+++ b/drivers/net/wireless/mwifiex/main.h
34927@@ -560,7 +560,7 @@ struct mwifiex_if_ops {
34928
34929 void (*update_mp_end_port) (struct mwifiex_adapter *, u16);
34930 void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
34931-};
34932+} __no_const;
34933
34934 struct mwifiex_adapter {
34935 struct mwifiex_private *priv[MWIFIEX_MAX_BSS_NUM];
34936diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
34937index 29f9389..f6d2ce0 100644
34938--- a/drivers/net/wireless/rndis_wlan.c
34939+++ b/drivers/net/wireless/rndis_wlan.c
34940@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
34941
34942 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
34943
34944- if (rts_threshold < 0 || rts_threshold > 2347)
34945+ if (rts_threshold > 2347)
34946 rts_threshold = 2347;
34947
34948 tmp = cpu_to_le32(rts_threshold);
34949diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34950index 3b11642..d6bb049 100644
34951--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34952+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34953@@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
34954 u8 rfpath;
34955 u8 num_total_rfpath = rtlphy->num_total_rfpath;
34956
34957+ pax_track_stack();
34958+
34959 precommoncmdcnt = 0;
34960 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
34961 MAX_PRECMD_CNT,
34962diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
34963index a77f1bb..c608b2b 100644
34964--- a/drivers/net/wireless/wl1251/wl1251.h
34965+++ b/drivers/net/wireless/wl1251/wl1251.h
34966@@ -266,7 +266,7 @@ struct wl1251_if_operations {
34967 void (*reset)(struct wl1251 *wl);
34968 void (*enable_irq)(struct wl1251 *wl);
34969 void (*disable_irq)(struct wl1251 *wl);
34970-};
34971+} __no_const;
34972
34973 struct wl1251 {
34974 struct ieee80211_hw *hw;
34975diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
34976index e0b3736..4b466e6 100644
34977--- a/drivers/net/wireless/wl12xx/spi.c
34978+++ b/drivers/net/wireless/wl12xx/spi.c
34979@@ -281,6 +281,8 @@ static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
34980 u32 chunk_len;
34981 int i;
34982
34983+ pax_track_stack();
34984+
34985 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
34986
34987 spi_message_init(&m);
34988diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
34989index f34b5b2..b5abb9f 100644
34990--- a/drivers/oprofile/buffer_sync.c
34991+++ b/drivers/oprofile/buffer_sync.c
34992@@ -343,7 +343,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
34993 if (cookie == NO_COOKIE)
34994 offset = pc;
34995 if (cookie == INVALID_COOKIE) {
34996- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
34997+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
34998 offset = pc;
34999 }
35000 if (cookie != last_cookie) {
35001@@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
35002 /* add userspace sample */
35003
35004 if (!mm) {
35005- atomic_inc(&oprofile_stats.sample_lost_no_mm);
35006+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
35007 return 0;
35008 }
35009
35010 cookie = lookup_dcookie(mm, s->eip, &offset);
35011
35012 if (cookie == INVALID_COOKIE) {
35013- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35014+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35015 return 0;
35016 }
35017
35018@@ -563,7 +563,7 @@ void sync_buffer(int cpu)
35019 /* ignore backtraces if failed to add a sample */
35020 if (state == sb_bt_start) {
35021 state = sb_bt_ignore;
35022- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
35023+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
35024 }
35025 }
35026 release_mm(mm);
35027diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
35028index dd87e86..bc0148c 100644
35029--- a/drivers/oprofile/event_buffer.c
35030+++ b/drivers/oprofile/event_buffer.c
35031@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
35032 }
35033
35034 if (buffer_pos == buffer_size) {
35035- atomic_inc(&oprofile_stats.event_lost_overflow);
35036+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
35037 return;
35038 }
35039
35040diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
35041index f8c752e..28bf4fc 100644
35042--- a/drivers/oprofile/oprof.c
35043+++ b/drivers/oprofile/oprof.c
35044@@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
35045 if (oprofile_ops.switch_events())
35046 return;
35047
35048- atomic_inc(&oprofile_stats.multiplex_counter);
35049+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
35050 start_switch_worker();
35051 }
35052
35053diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
35054index 917d28e..d62d981 100644
35055--- a/drivers/oprofile/oprofile_stats.c
35056+++ b/drivers/oprofile/oprofile_stats.c
35057@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
35058 cpu_buf->sample_invalid_eip = 0;
35059 }
35060
35061- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
35062- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
35063- atomic_set(&oprofile_stats.event_lost_overflow, 0);
35064- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
35065- atomic_set(&oprofile_stats.multiplex_counter, 0);
35066+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
35067+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
35068+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
35069+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
35070+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
35071 }
35072
35073
35074diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
35075index 38b6fc0..b5cbfce 100644
35076--- a/drivers/oprofile/oprofile_stats.h
35077+++ b/drivers/oprofile/oprofile_stats.h
35078@@ -13,11 +13,11 @@
35079 #include <linux/atomic.h>
35080
35081 struct oprofile_stat_struct {
35082- atomic_t sample_lost_no_mm;
35083- atomic_t sample_lost_no_mapping;
35084- atomic_t bt_lost_no_mapping;
35085- atomic_t event_lost_overflow;
35086- atomic_t multiplex_counter;
35087+ atomic_unchecked_t sample_lost_no_mm;
35088+ atomic_unchecked_t sample_lost_no_mapping;
35089+ atomic_unchecked_t bt_lost_no_mapping;
35090+ atomic_unchecked_t event_lost_overflow;
35091+ atomic_unchecked_t multiplex_counter;
35092 };
35093
35094 extern struct oprofile_stat_struct oprofile_stats;
35095diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
35096index e9ff6f7..28e259a 100644
35097--- a/drivers/oprofile/oprofilefs.c
35098+++ b/drivers/oprofile/oprofilefs.c
35099@@ -186,7 +186,7 @@ static const struct file_operations atomic_ro_fops = {
35100
35101
35102 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
35103- char const *name, atomic_t *val)
35104+ char const *name, atomic_unchecked_t *val)
35105 {
35106 return __oprofilefs_create_file(sb, root, name,
35107 &atomic_ro_fops, 0444, val);
35108diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
35109index 3f56bc0..707d642 100644
35110--- a/drivers/parport/procfs.c
35111+++ b/drivers/parport/procfs.c
35112@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
35113
35114 *ppos += len;
35115
35116- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
35117+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
35118 }
35119
35120 #ifdef CONFIG_PARPORT_1284
35121@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
35122
35123 *ppos += len;
35124
35125- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
35126+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
35127 }
35128 #endif /* IEEE1284.3 support. */
35129
35130diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
35131index 9fff878..ad0ad53 100644
35132--- a/drivers/pci/hotplug/cpci_hotplug.h
35133+++ b/drivers/pci/hotplug/cpci_hotplug.h
35134@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
35135 int (*hardware_test) (struct slot* slot, u32 value);
35136 u8 (*get_power) (struct slot* slot);
35137 int (*set_power) (struct slot* slot, int value);
35138-};
35139+} __no_const;
35140
35141 struct cpci_hp_controller {
35142 unsigned int irq;
35143diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
35144index 76ba8a1..20ca857 100644
35145--- a/drivers/pci/hotplug/cpqphp_nvram.c
35146+++ b/drivers/pci/hotplug/cpqphp_nvram.c
35147@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
35148
35149 void compaq_nvram_init (void __iomem *rom_start)
35150 {
35151+
35152+#ifndef CONFIG_PAX_KERNEXEC
35153 if (rom_start) {
35154 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
35155 }
35156+#endif
35157+
35158 dbg("int15 entry = %p\n", compaq_int15_entry_point);
35159
35160 /* initialize our int15 lock */
35161diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
35162index cbfbab1..6a9fced 100644
35163--- a/drivers/pci/pcie/aspm.c
35164+++ b/drivers/pci/pcie/aspm.c
35165@@ -27,9 +27,9 @@
35166 #define MODULE_PARAM_PREFIX "pcie_aspm."
35167
35168 /* Note: those are not register definitions */
35169-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
35170-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
35171-#define ASPM_STATE_L1 (4) /* L1 state */
35172+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
35173+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
35174+#define ASPM_STATE_L1 (4U) /* L1 state */
35175 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
35176 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
35177
35178diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
35179index 6ab6bd3..72bdc69 100644
35180--- a/drivers/pci/probe.c
35181+++ b/drivers/pci/probe.c
35182@@ -136,7 +136,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
35183 u32 l, sz, mask;
35184 u16 orig_cmd;
35185
35186- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
35187+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
35188
35189 if (!dev->mmio_always_on) {
35190 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
35191diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
35192index 27911b5..5b6db88 100644
35193--- a/drivers/pci/proc.c
35194+++ b/drivers/pci/proc.c
35195@@ -476,7 +476,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
35196 static int __init pci_proc_init(void)
35197 {
35198 struct pci_dev *dev = NULL;
35199+
35200+#ifdef CONFIG_GRKERNSEC_PROC_ADD
35201+#ifdef CONFIG_GRKERNSEC_PROC_USER
35202+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
35203+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35204+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
35205+#endif
35206+#else
35207 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
35208+#endif
35209 proc_create("devices", 0, proc_bus_pci_dir,
35210 &proc_bus_pci_dev_operations);
35211 proc_initialized = 1;
35212diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
35213index 90832a9..419089a 100644
35214--- a/drivers/pci/xen-pcifront.c
35215+++ b/drivers/pci/xen-pcifront.c
35216@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_bus *bus, unsigned int devfn,
35217 struct pcifront_sd *sd = bus->sysdata;
35218 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35219
35220+ pax_track_stack();
35221+
35222 if (verbose_request)
35223 dev_info(&pdev->xdev->dev,
35224 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
35225@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci_bus *bus, unsigned int devfn,
35226 struct pcifront_sd *sd = bus->sysdata;
35227 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35228
35229+ pax_track_stack();
35230+
35231 if (verbose_request)
35232 dev_info(&pdev->xdev->dev,
35233 "write dev=%04x:%02x:%02x.%01x - "
35234@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(struct pci_dev *dev,
35235 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35236 struct msi_desc *entry;
35237
35238+ pax_track_stack();
35239+
35240 if (nvec > SH_INFO_MAX_VEC) {
35241 dev_err(&dev->dev, "too much vector for pci frontend: %x."
35242 " Increase SH_INFO_MAX_VEC.\n", nvec);
35243@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(struct pci_dev *dev)
35244 struct pcifront_sd *sd = dev->bus->sysdata;
35245 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35246
35247+ pax_track_stack();
35248+
35249 err = do_pci_op(pdev, &op);
35250
35251 /* What should do for error ? */
35252@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struct pci_dev *dev, int vector[])
35253 struct pcifront_sd *sd = dev->bus->sysdata;
35254 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35255
35256+ pax_track_stack();
35257+
35258 err = do_pci_op(pdev, &op);
35259 if (likely(!err)) {
35260 vector[0] = op.value;
35261diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
35262index 7bd829f..a3237ad 100644
35263--- a/drivers/platform/x86/thinkpad_acpi.c
35264+++ b/drivers/platform/x86/thinkpad_acpi.c
35265@@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
35266 return 0;
35267 }
35268
35269-void static hotkey_mask_warn_incomplete_mask(void)
35270+static void hotkey_mask_warn_incomplete_mask(void)
35271 {
35272 /* log only what the user can fix... */
35273 const u32 wantedmask = hotkey_driver_mask &
35274@@ -2325,11 +2325,6 @@ static void hotkey_read_nvram(struct tp_nvram_state *n, const u32 m)
35275 }
35276 }
35277
35278-static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35279- struct tp_nvram_state *newn,
35280- const u32 event_mask)
35281-{
35282-
35283 #define TPACPI_COMPARE_KEY(__scancode, __member) \
35284 do { \
35285 if ((event_mask & (1 << __scancode)) && \
35286@@ -2343,36 +2338,42 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35287 tpacpi_hotkey_send_key(__scancode); \
35288 } while (0)
35289
35290- void issue_volchange(const unsigned int oldvol,
35291- const unsigned int newvol)
35292- {
35293- unsigned int i = oldvol;
35294+static void issue_volchange(const unsigned int oldvol,
35295+ const unsigned int newvol,
35296+ const u32 event_mask)
35297+{
35298+ unsigned int i = oldvol;
35299
35300- while (i > newvol) {
35301- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35302- i--;
35303- }
35304- while (i < newvol) {
35305- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35306- i++;
35307- }
35308+ while (i > newvol) {
35309+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35310+ i--;
35311 }
35312+ while (i < newvol) {
35313+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35314+ i++;
35315+ }
35316+}
35317
35318- void issue_brightnesschange(const unsigned int oldbrt,
35319- const unsigned int newbrt)
35320- {
35321- unsigned int i = oldbrt;
35322+static void issue_brightnesschange(const unsigned int oldbrt,
35323+ const unsigned int newbrt,
35324+ const u32 event_mask)
35325+{
35326+ unsigned int i = oldbrt;
35327
35328- while (i > newbrt) {
35329- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35330- i--;
35331- }
35332- while (i < newbrt) {
35333- TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35334- i++;
35335- }
35336+ while (i > newbrt) {
35337+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35338+ i--;
35339+ }
35340+ while (i < newbrt) {
35341+ TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35342+ i++;
35343 }
35344+}
35345
35346+static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35347+ struct tp_nvram_state *newn,
35348+ const u32 event_mask)
35349+{
35350 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_THINKPAD, thinkpad_toggle);
35351 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNSPACE, zoom_toggle);
35352 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNF7, display_toggle);
35353@@ -2406,7 +2407,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35354 oldn->volume_level != newn->volume_level) {
35355 /* recently muted, or repeated mute keypress, or
35356 * multiple presses ending in mute */
35357- issue_volchange(oldn->volume_level, newn->volume_level);
35358+ issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35359 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_MUTE);
35360 }
35361 } else {
35362@@ -2416,7 +2417,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35363 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35364 }
35365 if (oldn->volume_level != newn->volume_level) {
35366- issue_volchange(oldn->volume_level, newn->volume_level);
35367+ issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35368 } else if (oldn->volume_toggle != newn->volume_toggle) {
35369 /* repeated vol up/down keypress at end of scale ? */
35370 if (newn->volume_level == 0)
35371@@ -2429,7 +2430,8 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35372 /* handle brightness */
35373 if (oldn->brightness_level != newn->brightness_level) {
35374 issue_brightnesschange(oldn->brightness_level,
35375- newn->brightness_level);
35376+ newn->brightness_level,
35377+ event_mask);
35378 } else if (oldn->brightness_toggle != newn->brightness_toggle) {
35379 /* repeated key presses that didn't change state */
35380 if (newn->brightness_level == 0)
35381@@ -2438,10 +2440,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35382 && !tp_features.bright_unkfw)
35383 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35384 }
35385+}
35386
35387 #undef TPACPI_COMPARE_KEY
35388 #undef TPACPI_MAY_SEND_KEY
35389-}
35390
35391 /*
35392 * Polling driver
35393diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
35394index b859d16..5cc6b1a 100644
35395--- a/drivers/pnp/pnpbios/bioscalls.c
35396+++ b/drivers/pnp/pnpbios/bioscalls.c
35397@@ -59,7 +59,7 @@ do { \
35398 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
35399 } while(0)
35400
35401-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
35402+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
35403 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
35404
35405 /*
35406@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35407
35408 cpu = get_cpu();
35409 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
35410+
35411+ pax_open_kernel();
35412 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
35413+ pax_close_kernel();
35414
35415 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
35416 spin_lock_irqsave(&pnp_bios_lock, flags);
35417@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35418 :"memory");
35419 spin_unlock_irqrestore(&pnp_bios_lock, flags);
35420
35421+ pax_open_kernel();
35422 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
35423+ pax_close_kernel();
35424+
35425 put_cpu();
35426
35427 /* If we get here and this is set then the PnP BIOS faulted on us. */
35428@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
35429 return status;
35430 }
35431
35432-void pnpbios_calls_init(union pnp_bios_install_struct *header)
35433+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
35434 {
35435 int i;
35436
35437@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35438 pnp_bios_callpoint.offset = header->fields.pm16offset;
35439 pnp_bios_callpoint.segment = PNP_CS16;
35440
35441+ pax_open_kernel();
35442+
35443 for_each_possible_cpu(i) {
35444 struct desc_struct *gdt = get_cpu_gdt_table(i);
35445 if (!gdt)
35446@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35447 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
35448 (unsigned long)__va(header->fields.pm16dseg));
35449 }
35450+
35451+ pax_close_kernel();
35452 }
35453diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
35454index b0ecacb..7c9da2e 100644
35455--- a/drivers/pnp/resource.c
35456+++ b/drivers/pnp/resource.c
35457@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
35458 return 1;
35459
35460 /* check if the resource is valid */
35461- if (*irq < 0 || *irq > 15)
35462+ if (*irq > 15)
35463 return 0;
35464
35465 /* check if the resource is reserved */
35466@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
35467 return 1;
35468
35469 /* check if the resource is valid */
35470- if (*dma < 0 || *dma == 4 || *dma > 7)
35471+ if (*dma == 4 || *dma > 7)
35472 return 0;
35473
35474 /* check if the resource is reserved */
35475diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
35476index bb16f5b..c751eef 100644
35477--- a/drivers/power/bq27x00_battery.c
35478+++ b/drivers/power/bq27x00_battery.c
35479@@ -67,7 +67,7 @@
35480 struct bq27x00_device_info;
35481 struct bq27x00_access_methods {
35482 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
35483-};
35484+} __no_const;
35485
35486 enum bq27x00_chip { BQ27000, BQ27500 };
35487
35488diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
35489index 33f5d9a..d957d3f 100644
35490--- a/drivers/regulator/max8660.c
35491+++ b/drivers/regulator/max8660.c
35492@@ -383,8 +383,10 @@ static int __devinit max8660_probe(struct i2c_client *client,
35493 max8660->shadow_regs[MAX8660_OVER1] = 5;
35494 } else {
35495 /* Otherwise devices can be toggled via software */
35496- max8660_dcdc_ops.enable = max8660_dcdc_enable;
35497- max8660_dcdc_ops.disable = max8660_dcdc_disable;
35498+ pax_open_kernel();
35499+ *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
35500+ *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
35501+ pax_close_kernel();
35502 }
35503
35504 /*
35505diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
35506index 3285d41..ab7c22a 100644
35507--- a/drivers/regulator/mc13892-regulator.c
35508+++ b/drivers/regulator/mc13892-regulator.c
35509@@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev)
35510 }
35511 mc13xxx_unlock(mc13892);
35512
35513- mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35514+ pax_open_kernel();
35515+ *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35516 = mc13892_vcam_set_mode;
35517- mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35518+ *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35519 = mc13892_vcam_get_mode;
35520+ pax_close_kernel();
35521 for (i = 0; i < pdata->num_regulators; i++) {
35522 init_data = &pdata->regulators[i];
35523 priv->regulators[i] = regulator_register(
35524diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
35525index cace6d3..f623fda 100644
35526--- a/drivers/rtc/rtc-dev.c
35527+++ b/drivers/rtc/rtc-dev.c
35528@@ -14,6 +14,7 @@
35529 #include <linux/module.h>
35530 #include <linux/rtc.h>
35531 #include <linux/sched.h>
35532+#include <linux/grsecurity.h>
35533 #include "rtc-core.h"
35534
35535 static dev_t rtc_devt;
35536@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *file,
35537 if (copy_from_user(&tm, uarg, sizeof(tm)))
35538 return -EFAULT;
35539
35540+ gr_log_timechange();
35541+
35542 return rtc_set_time(rtc, &tm);
35543
35544 case RTC_PIE_ON:
35545diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
35546index f66c33b..7ae5823 100644
35547--- a/drivers/scsi/BusLogic.c
35548+++ b/drivers/scsi/BusLogic.c
35549@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
35550 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
35551 *PrototypeHostAdapter)
35552 {
35553+ pax_track_stack();
35554+
35555 /*
35556 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
35557 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
35558diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
35559index ffb5878..e6d785c 100644
35560--- a/drivers/scsi/aacraid/aacraid.h
35561+++ b/drivers/scsi/aacraid/aacraid.h
35562@@ -492,7 +492,7 @@ struct adapter_ops
35563 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
35564 /* Administrative operations */
35565 int (*adapter_comm)(struct aac_dev * dev, int comm);
35566-};
35567+} __no_const;
35568
35569 /*
35570 * Define which interrupt handler needs to be installed
35571diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
35572index 8a0b330..b4286de 100644
35573--- a/drivers/scsi/aacraid/commctrl.c
35574+++ b/drivers/scsi/aacraid/commctrl.c
35575@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
35576 u32 actual_fibsize64, actual_fibsize = 0;
35577 int i;
35578
35579+ pax_track_stack();
35580
35581 if (dev->in_reset) {
35582 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
35583diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
35584index c7b6fed..4db0569 100644
35585--- a/drivers/scsi/aacraid/linit.c
35586+++ b/drivers/scsi/aacraid/linit.c
35587@@ -93,7 +93,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
35588 #elif defined(__devinitconst)
35589 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35590 #else
35591-static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
35592+static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35593 #endif
35594 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
35595 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
35596diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
35597index d5ff142..49c0ebb 100644
35598--- a/drivers/scsi/aic94xx/aic94xx_init.c
35599+++ b/drivers/scsi/aic94xx/aic94xx_init.c
35600@@ -1012,7 +1012,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
35601 .lldd_control_phy = asd_control_phy,
35602 };
35603
35604-static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
35605+static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
35606 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
35607 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
35608 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
35609diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
35610index a796de9..1ef20e1 100644
35611--- a/drivers/scsi/bfa/bfa.h
35612+++ b/drivers/scsi/bfa/bfa.h
35613@@ -196,7 +196,7 @@ struct bfa_hwif_s {
35614 u32 *end);
35615 int cpe_vec_q0;
35616 int rme_vec_q0;
35617-};
35618+} __no_const;
35619 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
35620
35621 struct bfa_faa_cbfn_s {
35622diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
35623index e07bd47..dbd260a 100644
35624--- a/drivers/scsi/bfa/bfa_fcpim.c
35625+++ b/drivers/scsi/bfa/bfa_fcpim.c
35626@@ -4179,7 +4179,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35627 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
35628 {
35629 struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
35630- struct bfa_itn_s *itn;
35631+ bfa_itn_s_no_const *itn;
35632
35633 itn = BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
35634 itn->isr = isr;
35635diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
35636index 1080bcb..a3b39e3 100644
35637--- a/drivers/scsi/bfa/bfa_fcpim.h
35638+++ b/drivers/scsi/bfa/bfa_fcpim.h
35639@@ -37,6 +37,7 @@ struct bfa_iotag_s {
35640 struct bfa_itn_s {
35641 bfa_isr_func_t isr;
35642 };
35643+typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
35644
35645 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35646 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
35647@@ -149,7 +150,7 @@ struct bfa_fcp_mod_s {
35648 struct list_head iotag_tio_free_q; /* free IO resources */
35649 struct list_head iotag_unused_q; /* unused IO resources*/
35650 struct bfa_iotag_s *iotag_arr;
35651- struct bfa_itn_s *itn_arr;
35652+ bfa_itn_s_no_const *itn_arr;
35653 int num_ioim_reqs;
35654 int num_fwtio_reqs;
35655 int num_itns;
35656diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
35657index d4f951f..197c350 100644
35658--- a/drivers/scsi/bfa/bfa_fcs_lport.c
35659+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
35660@@ -1700,6 +1700,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
35661 u16 len, count;
35662 u16 templen;
35663
35664+ pax_track_stack();
35665+
35666 /*
35667 * get hba attributes
35668 */
35669@@ -1977,6 +1979,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
35670 u8 count = 0;
35671 u16 templen;
35672
35673+ pax_track_stack();
35674+
35675 /*
35676 * get port attributes
35677 */
35678diff --git a/drivers/scsi/bfa/bfa_fcs_rport.c b/drivers/scsi/bfa/bfa_fcs_rport.c
35679index 52628d5..f89d033 100644
35680--- a/drivers/scsi/bfa/bfa_fcs_rport.c
35681+++ b/drivers/scsi/bfa/bfa_fcs_rport.c
35682@@ -1871,6 +1871,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fcs_rport_s *rport,
35683 struct fc_rpsc_speed_info_s speeds;
35684 struct bfa_port_attr_s pport_attr;
35685
35686+ pax_track_stack();
35687+
35688 bfa_trc(port->fcs, rx_fchs->s_id);
35689 bfa_trc(port->fcs, rx_fchs->d_id);
35690
35691diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
35692index 546d46b..642fa5b 100644
35693--- a/drivers/scsi/bfa/bfa_ioc.h
35694+++ b/drivers/scsi/bfa/bfa_ioc.h
35695@@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
35696 bfa_ioc_disable_cbfn_t disable_cbfn;
35697 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
35698 bfa_ioc_reset_cbfn_t reset_cbfn;
35699-};
35700+} __no_const;
35701
35702 /*
35703 * IOC event notification mechanism.
35704@@ -346,7 +346,7 @@ struct bfa_ioc_hwif_s {
35705 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
35706 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
35707 bfa_boolean_t (*ioc_lpu_read_stat) (struct bfa_ioc_s *ioc);
35708-};
35709+} __no_const;
35710
35711 /*
35712 * Queue element to wait for room in request queue. FIFO order is
35713diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
35714index 66fb725..0fe05ab 100644
35715--- a/drivers/scsi/bfa/bfad.c
35716+++ b/drivers/scsi/bfa/bfad.c
35717@@ -1019,6 +1019,8 @@ bfad_start_ops(struct bfad_s *bfad) {
35718 struct bfad_vport_s *vport, *vport_new;
35719 struct bfa_fcs_driver_info_s driver_info;
35720
35721+ pax_track_stack();
35722+
35723 /* Limit min/max. xfer size to [64k-32MB] */
35724 if (max_xfer_size < BFAD_MIN_SECTORS >> 1)
35725 max_xfer_size = BFAD_MIN_SECTORS >> 1;
35726diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
35727index b4f6c9a..0eb1938 100644
35728--- a/drivers/scsi/dpt_i2o.c
35729+++ b/drivers/scsi/dpt_i2o.c
35730@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
35731 dma_addr_t addr;
35732 ulong flags = 0;
35733
35734+ pax_track_stack();
35735+
35736 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
35737 // get user msg size in u32s
35738 if(get_user(size, &user_msg[0])){
35739@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
35740 s32 rcode;
35741 dma_addr_t addr;
35742
35743+ pax_track_stack();
35744+
35745 memset(msg, 0 , sizeof(msg));
35746 len = scsi_bufflen(cmd);
35747 direction = 0x00000000;
35748diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
35749index 94de889..ca4f0cf 100644
35750--- a/drivers/scsi/eata.c
35751+++ b/drivers/scsi/eata.c
35752@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
35753 struct hostdata *ha;
35754 char name[16];
35755
35756+ pax_track_stack();
35757+
35758 sprintf(name, "%s%d", driver_name, j);
35759
35760 if (!request_region(port_base, REGION_SIZE, driver_name)) {
35761diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
35762index c74c4b8..c41ca3f 100644
35763--- a/drivers/scsi/fcoe/fcoe_ctlr.c
35764+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
35765@@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
35766 } buf;
35767 int rc;
35768
35769+ pax_track_stack();
35770+
35771 fiph = (struct fip_header *)skb->data;
35772 sub = fiph->fip_subcode;
35773
35774diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
35775index 3242bca..45a83e7 100644
35776--- a/drivers/scsi/gdth.c
35777+++ b/drivers/scsi/gdth.c
35778@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
35779 unsigned long flags;
35780 gdth_ha_str *ha;
35781
35782+ pax_track_stack();
35783+
35784 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
35785 return -EFAULT;
35786 ha = gdth_find_ha(ldrv.ionode);
35787@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
35788 gdth_ha_str *ha;
35789 int rval;
35790
35791+ pax_track_stack();
35792+
35793 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
35794 res.number >= MAX_HDRIVES)
35795 return -EFAULT;
35796@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg, char *cmnd)
35797 gdth_ha_str *ha;
35798 int rval;
35799
35800+ pax_track_stack();
35801+
35802 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
35803 return -EFAULT;
35804 ha = gdth_find_ha(gen.ionode);
35805@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
35806 int i;
35807 gdth_cmd_str gdtcmd;
35808 char cmnd[MAX_COMMAND_SIZE];
35809+
35810+ pax_track_stack();
35811+
35812 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
35813
35814 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
35815diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
35816index 6527543..81e4fe2 100644
35817--- a/drivers/scsi/gdth_proc.c
35818+++ b/drivers/scsi/gdth_proc.c
35819@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
35820 u64 paddr;
35821
35822 char cmnd[MAX_COMMAND_SIZE];
35823+
35824+ pax_track_stack();
35825+
35826 memset(cmnd, 0xff, 12);
35827 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
35828
35829@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
35830 gdth_hget_str *phg;
35831 char cmnd[MAX_COMMAND_SIZE];
35832
35833+ pax_track_stack();
35834+
35835 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
35836 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
35837 if (!gdtcmd || !estr)
35838diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
35839index 351dc0b..951dc32 100644
35840--- a/drivers/scsi/hosts.c
35841+++ b/drivers/scsi/hosts.c
35842@@ -42,7 +42,7 @@
35843 #include "scsi_logging.h"
35844
35845
35846-static atomic_t scsi_host_next_hn; /* host_no for next new host */
35847+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
35848
35849
35850 static void scsi_host_cls_release(struct device *dev)
35851@@ -357,7 +357,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
35852 * subtract one because we increment first then return, but we need to
35853 * know what the next host number was before increment
35854 */
35855- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
35856+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
35857 shost->dma_channel = 0xff;
35858
35859 /* These three are default values which can be overridden */
35860diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
35861index 418ce83..7ee1225 100644
35862--- a/drivers/scsi/hpsa.c
35863+++ b/drivers/scsi/hpsa.c
35864@@ -499,7 +499,7 @@ static inline u32 next_command(struct ctlr_info *h)
35865 u32 a;
35866
35867 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
35868- return h->access.command_completed(h);
35869+ return h->access->command_completed(h);
35870
35871 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
35872 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
35873@@ -2956,7 +2956,7 @@ static void start_io(struct ctlr_info *h)
35874 while (!list_empty(&h->reqQ)) {
35875 c = list_entry(h->reqQ.next, struct CommandList, list);
35876 /* can't do anything if fifo is full */
35877- if ((h->access.fifo_full(h))) {
35878+ if ((h->access->fifo_full(h))) {
35879 dev_warn(&h->pdev->dev, "fifo full\n");
35880 break;
35881 }
35882@@ -2966,7 +2966,7 @@ static void start_io(struct ctlr_info *h)
35883 h->Qdepth--;
35884
35885 /* Tell the controller execute command */
35886- h->access.submit_command(h, c);
35887+ h->access->submit_command(h, c);
35888
35889 /* Put job onto the completed Q */
35890 addQ(&h->cmpQ, c);
35891@@ -2975,17 +2975,17 @@ static void start_io(struct ctlr_info *h)
35892
35893 static inline unsigned long get_next_completion(struct ctlr_info *h)
35894 {
35895- return h->access.command_completed(h);
35896+ return h->access->command_completed(h);
35897 }
35898
35899 static inline bool interrupt_pending(struct ctlr_info *h)
35900 {
35901- return h->access.intr_pending(h);
35902+ return h->access->intr_pending(h);
35903 }
35904
35905 static inline long interrupt_not_for_us(struct ctlr_info *h)
35906 {
35907- return (h->access.intr_pending(h) == 0) ||
35908+ return (h->access->intr_pending(h) == 0) ||
35909 (h->interrupts_enabled == 0);
35910 }
35911
35912@@ -3882,7 +3882,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
35913 if (prod_index < 0)
35914 return -ENODEV;
35915 h->product_name = products[prod_index].product_name;
35916- h->access = *(products[prod_index].access);
35917+ h->access = products[prod_index].access;
35918
35919 if (hpsa_board_disabled(h->pdev)) {
35920 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
35921@@ -4163,7 +4163,7 @@ reinit_after_soft_reset:
35922 }
35923
35924 /* make sure the board interrupts are off */
35925- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35926+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35927
35928 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
35929 goto clean2;
35930@@ -4197,7 +4197,7 @@ reinit_after_soft_reset:
35931 * fake ones to scoop up any residual completions.
35932 */
35933 spin_lock_irqsave(&h->lock, flags);
35934- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35935+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35936 spin_unlock_irqrestore(&h->lock, flags);
35937 free_irq(h->intr[h->intr_mode], h);
35938 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
35939@@ -4216,9 +4216,9 @@ reinit_after_soft_reset:
35940 dev_info(&h->pdev->dev, "Board READY.\n");
35941 dev_info(&h->pdev->dev,
35942 "Waiting for stale completions to drain.\n");
35943- h->access.set_intr_mask(h, HPSA_INTR_ON);
35944+ h->access->set_intr_mask(h, HPSA_INTR_ON);
35945 msleep(10000);
35946- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35947+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35948
35949 rc = controller_reset_failed(h->cfgtable);
35950 if (rc)
35951@@ -4239,7 +4239,7 @@ reinit_after_soft_reset:
35952 }
35953
35954 /* Turn the interrupts on so we can service requests */
35955- h->access.set_intr_mask(h, HPSA_INTR_ON);
35956+ h->access->set_intr_mask(h, HPSA_INTR_ON);
35957
35958 hpsa_hba_inquiry(h);
35959 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
35960@@ -4292,7 +4292,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
35961 * To write all data in the battery backed cache to disks
35962 */
35963 hpsa_flush_cache(h);
35964- h->access.set_intr_mask(h, HPSA_INTR_OFF);
35965+ h->access->set_intr_mask(h, HPSA_INTR_OFF);
35966 free_irq(h->intr[h->intr_mode], h);
35967 #ifdef CONFIG_PCI_MSI
35968 if (h->msix_vector)
35969@@ -4455,7 +4455,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
35970 return;
35971 }
35972 /* Change the access methods to the performant access methods */
35973- h->access = SA5_performant_access;
35974+ h->access = &SA5_performant_access;
35975 h->transMethod = CFGTBL_Trans_Performant;
35976 }
35977
35978diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
35979index 7f53cea..a8c7188 100644
35980--- a/drivers/scsi/hpsa.h
35981+++ b/drivers/scsi/hpsa.h
35982@@ -73,7 +73,7 @@ struct ctlr_info {
35983 unsigned int msix_vector;
35984 unsigned int msi_vector;
35985 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
35986- struct access_method access;
35987+ struct access_method *access;
35988
35989 /* queue and queue Info */
35990 struct list_head reqQ;
35991diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
35992index f2df059..a3a9930 100644
35993--- a/drivers/scsi/ips.h
35994+++ b/drivers/scsi/ips.h
35995@@ -1027,7 +1027,7 @@ typedef struct {
35996 int (*intr)(struct ips_ha *);
35997 void (*enableint)(struct ips_ha *);
35998 uint32_t (*statupd)(struct ips_ha *);
35999-} ips_hw_func_t;
36000+} __no_const ips_hw_func_t;
36001
36002 typedef struct ips_ha {
36003 uint8_t ha_id[IPS_MAX_CHANNELS+1];
36004diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
36005index d261e98..1e00f35 100644
36006--- a/drivers/scsi/libfc/fc_exch.c
36007+++ b/drivers/scsi/libfc/fc_exch.c
36008@@ -105,12 +105,12 @@ struct fc_exch_mgr {
36009 * all together if not used XXX
36010 */
36011 struct {
36012- atomic_t no_free_exch;
36013- atomic_t no_free_exch_xid;
36014- atomic_t xid_not_found;
36015- atomic_t xid_busy;
36016- atomic_t seq_not_found;
36017- atomic_t non_bls_resp;
36018+ atomic_unchecked_t no_free_exch;
36019+ atomic_unchecked_t no_free_exch_xid;
36020+ atomic_unchecked_t xid_not_found;
36021+ atomic_unchecked_t xid_busy;
36022+ atomic_unchecked_t seq_not_found;
36023+ atomic_unchecked_t non_bls_resp;
36024 } stats;
36025 };
36026
36027@@ -718,7 +718,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
36028 /* allocate memory for exchange */
36029 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
36030 if (!ep) {
36031- atomic_inc(&mp->stats.no_free_exch);
36032+ atomic_inc_unchecked(&mp->stats.no_free_exch);
36033 goto out;
36034 }
36035 memset(ep, 0, sizeof(*ep));
36036@@ -779,7 +779,7 @@ out:
36037 return ep;
36038 err:
36039 spin_unlock_bh(&pool->lock);
36040- atomic_inc(&mp->stats.no_free_exch_xid);
36041+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
36042 mempool_free(ep, mp->ep_pool);
36043 return NULL;
36044 }
36045@@ -922,7 +922,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36046 xid = ntohs(fh->fh_ox_id); /* we originated exch */
36047 ep = fc_exch_find(mp, xid);
36048 if (!ep) {
36049- atomic_inc(&mp->stats.xid_not_found);
36050+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36051 reject = FC_RJT_OX_ID;
36052 goto out;
36053 }
36054@@ -952,7 +952,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36055 ep = fc_exch_find(mp, xid);
36056 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
36057 if (ep) {
36058- atomic_inc(&mp->stats.xid_busy);
36059+ atomic_inc_unchecked(&mp->stats.xid_busy);
36060 reject = FC_RJT_RX_ID;
36061 goto rel;
36062 }
36063@@ -963,7 +963,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36064 }
36065 xid = ep->xid; /* get our XID */
36066 } else if (!ep) {
36067- atomic_inc(&mp->stats.xid_not_found);
36068+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36069 reject = FC_RJT_RX_ID; /* XID not found */
36070 goto out;
36071 }
36072@@ -980,7 +980,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36073 } else {
36074 sp = &ep->seq;
36075 if (sp->id != fh->fh_seq_id) {
36076- atomic_inc(&mp->stats.seq_not_found);
36077+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36078 if (f_ctl & FC_FC_END_SEQ) {
36079 /*
36080 * Update sequence_id based on incoming last
36081@@ -1430,22 +1430,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36082
36083 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
36084 if (!ep) {
36085- atomic_inc(&mp->stats.xid_not_found);
36086+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36087 goto out;
36088 }
36089 if (ep->esb_stat & ESB_ST_COMPLETE) {
36090- atomic_inc(&mp->stats.xid_not_found);
36091+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36092 goto rel;
36093 }
36094 if (ep->rxid == FC_XID_UNKNOWN)
36095 ep->rxid = ntohs(fh->fh_rx_id);
36096 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
36097- atomic_inc(&mp->stats.xid_not_found);
36098+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36099 goto rel;
36100 }
36101 if (ep->did != ntoh24(fh->fh_s_id) &&
36102 ep->did != FC_FID_FLOGI) {
36103- atomic_inc(&mp->stats.xid_not_found);
36104+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36105 goto rel;
36106 }
36107 sof = fr_sof(fp);
36108@@ -1454,7 +1454,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36109 sp->ssb_stat |= SSB_ST_RESP;
36110 sp->id = fh->fh_seq_id;
36111 } else if (sp->id != fh->fh_seq_id) {
36112- atomic_inc(&mp->stats.seq_not_found);
36113+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36114 goto rel;
36115 }
36116
36117@@ -1518,9 +1518,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36118 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
36119
36120 if (!sp)
36121- atomic_inc(&mp->stats.xid_not_found);
36122+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36123 else
36124- atomic_inc(&mp->stats.non_bls_resp);
36125+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
36126
36127 fc_frame_free(fp);
36128 }
36129diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
36130index db9238f..4378ed2 100644
36131--- a/drivers/scsi/libsas/sas_ata.c
36132+++ b/drivers/scsi/libsas/sas_ata.c
36133@@ -368,7 +368,7 @@ static struct ata_port_operations sas_sata_ops = {
36134 .postreset = ata_std_postreset,
36135 .error_handler = ata_std_error_handler,
36136 .post_internal_cmd = sas_ata_post_internal,
36137- .qc_defer = ata_std_qc_defer,
36138+ .qc_defer = ata_std_qc_defer,
36139 .qc_prep = ata_noop_qc_prep,
36140 .qc_issue = sas_ata_qc_issue,
36141 .qc_fill_rtf = sas_ata_qc_fill_rtf,
36142diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
36143index c088a36..01c73b0 100644
36144--- a/drivers/scsi/lpfc/lpfc.h
36145+++ b/drivers/scsi/lpfc/lpfc.h
36146@@ -425,7 +425,7 @@ struct lpfc_vport {
36147 struct dentry *debug_nodelist;
36148 struct dentry *vport_debugfs_root;
36149 struct lpfc_debugfs_trc *disc_trc;
36150- atomic_t disc_trc_cnt;
36151+ atomic_unchecked_t disc_trc_cnt;
36152 #endif
36153 uint8_t stat_data_enabled;
36154 uint8_t stat_data_blocked;
36155@@ -835,8 +835,8 @@ struct lpfc_hba {
36156 struct timer_list fabric_block_timer;
36157 unsigned long bit_flags;
36158 #define FABRIC_COMANDS_BLOCKED 0
36159- atomic_t num_rsrc_err;
36160- atomic_t num_cmd_success;
36161+ atomic_unchecked_t num_rsrc_err;
36162+ atomic_unchecked_t num_cmd_success;
36163 unsigned long last_rsrc_error_time;
36164 unsigned long last_ramp_down_time;
36165 unsigned long last_ramp_up_time;
36166@@ -850,7 +850,7 @@ struct lpfc_hba {
36167 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
36168 struct dentry *debug_slow_ring_trc;
36169 struct lpfc_debugfs_trc *slow_ring_trc;
36170- atomic_t slow_ring_trc_cnt;
36171+ atomic_unchecked_t slow_ring_trc_cnt;
36172 /* iDiag debugfs sub-directory */
36173 struct dentry *idiag_root;
36174 struct dentry *idiag_pci_cfg;
36175diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
36176index a0424dd..2499b6b 100644
36177--- a/drivers/scsi/lpfc/lpfc_debugfs.c
36178+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
36179@@ -105,7 +105,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
36180
36181 #include <linux/debugfs.h>
36182
36183-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36184+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36185 static unsigned long lpfc_debugfs_start_time = 0L;
36186
36187 /* iDiag */
36188@@ -146,7 +146,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
36189 lpfc_debugfs_enable = 0;
36190
36191 len = 0;
36192- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
36193+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
36194 (lpfc_debugfs_max_disc_trc - 1);
36195 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
36196 dtp = vport->disc_trc + i;
36197@@ -212,7 +212,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
36198 lpfc_debugfs_enable = 0;
36199
36200 len = 0;
36201- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
36202+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
36203 (lpfc_debugfs_max_slow_ring_trc - 1);
36204 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
36205 dtp = phba->slow_ring_trc + i;
36206@@ -635,14 +635,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
36207 !vport || !vport->disc_trc)
36208 return;
36209
36210- index = atomic_inc_return(&vport->disc_trc_cnt) &
36211+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
36212 (lpfc_debugfs_max_disc_trc - 1);
36213 dtp = vport->disc_trc + index;
36214 dtp->fmt = fmt;
36215 dtp->data1 = data1;
36216 dtp->data2 = data2;
36217 dtp->data3 = data3;
36218- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36219+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36220 dtp->jif = jiffies;
36221 #endif
36222 return;
36223@@ -673,14 +673,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
36224 !phba || !phba->slow_ring_trc)
36225 return;
36226
36227- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
36228+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
36229 (lpfc_debugfs_max_slow_ring_trc - 1);
36230 dtp = phba->slow_ring_trc + index;
36231 dtp->fmt = fmt;
36232 dtp->data1 = data1;
36233 dtp->data2 = data2;
36234 dtp->data3 = data3;
36235- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36236+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36237 dtp->jif = jiffies;
36238 #endif
36239 return;
36240@@ -3828,7 +3828,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36241 "slow_ring buffer\n");
36242 goto debug_failed;
36243 }
36244- atomic_set(&phba->slow_ring_trc_cnt, 0);
36245+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
36246 memset(phba->slow_ring_trc, 0,
36247 (sizeof(struct lpfc_debugfs_trc) *
36248 lpfc_debugfs_max_slow_ring_trc));
36249@@ -3874,7 +3874,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36250 "buffer\n");
36251 goto debug_failed;
36252 }
36253- atomic_set(&vport->disc_trc_cnt, 0);
36254+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
36255
36256 snprintf(name, sizeof(name), "discovery_trace");
36257 vport->debug_disc_trc =
36258diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
36259index a3c8200..31e562e 100644
36260--- a/drivers/scsi/lpfc/lpfc_init.c
36261+++ b/drivers/scsi/lpfc/lpfc_init.c
36262@@ -9969,8 +9969,10 @@ lpfc_init(void)
36263 printk(LPFC_COPYRIGHT "\n");
36264
36265 if (lpfc_enable_npiv) {
36266- lpfc_transport_functions.vport_create = lpfc_vport_create;
36267- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36268+ pax_open_kernel();
36269+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
36270+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36271+ pax_close_kernel();
36272 }
36273 lpfc_transport_template =
36274 fc_attach_transport(&lpfc_transport_functions);
36275diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
36276index eadd241..26c8e0f 100644
36277--- a/drivers/scsi/lpfc/lpfc_scsi.c
36278+++ b/drivers/scsi/lpfc/lpfc_scsi.c
36279@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
36280 uint32_t evt_posted;
36281
36282 spin_lock_irqsave(&phba->hbalock, flags);
36283- atomic_inc(&phba->num_rsrc_err);
36284+ atomic_inc_unchecked(&phba->num_rsrc_err);
36285 phba->last_rsrc_error_time = jiffies;
36286
36287 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
36288@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
36289 unsigned long flags;
36290 struct lpfc_hba *phba = vport->phba;
36291 uint32_t evt_posted;
36292- atomic_inc(&phba->num_cmd_success);
36293+ atomic_inc_unchecked(&phba->num_cmd_success);
36294
36295 if (vport->cfg_lun_queue_depth <= queue_depth)
36296 return;
36297@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36298 unsigned long num_rsrc_err, num_cmd_success;
36299 int i;
36300
36301- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
36302- num_cmd_success = atomic_read(&phba->num_cmd_success);
36303+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
36304+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
36305
36306 vports = lpfc_create_vport_work_array(phba);
36307 if (vports != NULL)
36308@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36309 }
36310 }
36311 lpfc_destroy_vport_work_array(phba, vports);
36312- atomic_set(&phba->num_rsrc_err, 0);
36313- atomic_set(&phba->num_cmd_success, 0);
36314+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36315+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36316 }
36317
36318 /**
36319@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
36320 }
36321 }
36322 lpfc_destroy_vport_work_array(phba, vports);
36323- atomic_set(&phba->num_rsrc_err, 0);
36324- atomic_set(&phba->num_cmd_success, 0);
36325+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36326+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36327 }
36328
36329 /**
36330diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
36331index 2e6619e..fa64494 100644
36332--- a/drivers/scsi/megaraid/megaraid_mbox.c
36333+++ b/drivers/scsi/megaraid/megaraid_mbox.c
36334@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
36335 int rval;
36336 int i;
36337
36338+ pax_track_stack();
36339+
36340 // Allocate memory for the base list of scb for management module.
36341 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
36342
36343diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
36344index 86afb13f..c912398 100644
36345--- a/drivers/scsi/osd/osd_initiator.c
36346+++ b/drivers/scsi/osd/osd_initiator.c
36347@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(struct osd_dev *od,
36348 int nelem = ARRAY_SIZE(get_attrs), a = 0;
36349 int ret;
36350
36351+ pax_track_stack();
36352+
36353 or = osd_start_request(od, GFP_KERNEL);
36354 if (!or)
36355 return -ENOMEM;
36356diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
36357index d079f9a..d26072c 100644
36358--- a/drivers/scsi/pmcraid.c
36359+++ b/drivers/scsi/pmcraid.c
36360@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
36361 res->scsi_dev = scsi_dev;
36362 scsi_dev->hostdata = res;
36363 res->change_detected = 0;
36364- atomic_set(&res->read_failures, 0);
36365- atomic_set(&res->write_failures, 0);
36366+ atomic_set_unchecked(&res->read_failures, 0);
36367+ atomic_set_unchecked(&res->write_failures, 0);
36368 rc = 0;
36369 }
36370 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
36371@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
36372
36373 /* If this was a SCSI read/write command keep count of errors */
36374 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
36375- atomic_inc(&res->read_failures);
36376+ atomic_inc_unchecked(&res->read_failures);
36377 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
36378- atomic_inc(&res->write_failures);
36379+ atomic_inc_unchecked(&res->write_failures);
36380
36381 if (!RES_IS_GSCSI(res->cfg_entry) &&
36382 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
36383@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
36384 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36385 * hrrq_id assigned here in queuecommand
36386 */
36387- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36388+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36389 pinstance->num_hrrq;
36390 cmd->cmd_done = pmcraid_io_done;
36391
36392@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
36393 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36394 * hrrq_id assigned here in queuecommand
36395 */
36396- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36397+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36398 pinstance->num_hrrq;
36399
36400 if (request_size) {
36401@@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
36402
36403 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
36404 /* add resources only after host is added into system */
36405- if (!atomic_read(&pinstance->expose_resources))
36406+ if (!atomic_read_unchecked(&pinstance->expose_resources))
36407 return;
36408
36409 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
36410@@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instance(
36411 init_waitqueue_head(&pinstance->reset_wait_q);
36412
36413 atomic_set(&pinstance->outstanding_cmds, 0);
36414- atomic_set(&pinstance->last_message_id, 0);
36415- atomic_set(&pinstance->expose_resources, 0);
36416+ atomic_set_unchecked(&pinstance->last_message_id, 0);
36417+ atomic_set_unchecked(&pinstance->expose_resources, 0);
36418
36419 INIT_LIST_HEAD(&pinstance->free_res_q);
36420 INIT_LIST_HEAD(&pinstance->used_res_q);
36421@@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe(
36422 /* Schedule worker thread to handle CCN and take care of adding and
36423 * removing devices to OS
36424 */
36425- atomic_set(&pinstance->expose_resources, 1);
36426+ atomic_set_unchecked(&pinstance->expose_resources, 1);
36427 schedule_work(&pinstance->worker_q);
36428 return rc;
36429
36430diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
36431index f920baf..4417389 100644
36432--- a/drivers/scsi/pmcraid.h
36433+++ b/drivers/scsi/pmcraid.h
36434@@ -749,7 +749,7 @@ struct pmcraid_instance {
36435 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
36436
36437 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
36438- atomic_t last_message_id;
36439+ atomic_unchecked_t last_message_id;
36440
36441 /* configuration table */
36442 struct pmcraid_config_table *cfg_table;
36443@@ -778,7 +778,7 @@ struct pmcraid_instance {
36444 atomic_t outstanding_cmds;
36445
36446 /* should add/delete resources to mid-layer now ?*/
36447- atomic_t expose_resources;
36448+ atomic_unchecked_t expose_resources;
36449
36450
36451
36452@@ -814,8 +814,8 @@ struct pmcraid_resource_entry {
36453 struct pmcraid_config_table_entry_ext cfg_entry_ext;
36454 };
36455 struct scsi_device *scsi_dev; /* Link scsi_device structure */
36456- atomic_t read_failures; /* count of failed READ commands */
36457- atomic_t write_failures; /* count of failed WRITE commands */
36458+ atomic_unchecked_t read_failures; /* count of failed READ commands */
36459+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
36460
36461 /* To indicate add/delete/modify during CCN */
36462 u8 change_detected;
36463diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
36464index a03eaf4..a6b3fd9 100644
36465--- a/drivers/scsi/qla2xxx/qla_def.h
36466+++ b/drivers/scsi/qla2xxx/qla_def.h
36467@@ -2244,7 +2244,7 @@ struct isp_operations {
36468 int (*get_flash_version) (struct scsi_qla_host *, void *);
36469 int (*start_scsi) (srb_t *);
36470 int (*abort_isp) (struct scsi_qla_host *);
36471-};
36472+} __no_const;
36473
36474 /* MSI-X Support *************************************************************/
36475
36476diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
36477index 473c5c8..4e2f24a 100644
36478--- a/drivers/scsi/qla4xxx/ql4_def.h
36479+++ b/drivers/scsi/qla4xxx/ql4_def.h
36480@@ -256,7 +256,7 @@ struct ddb_entry {
36481 atomic_t retry_relogin_timer; /* Min Time between relogins
36482 * (4000 only) */
36483 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
36484- atomic_t relogin_retry_count; /* Num of times relogin has been
36485+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
36486 * retried */
36487
36488 uint16_t port;
36489diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
36490index 42ed5db..0262f9e 100644
36491--- a/drivers/scsi/qla4xxx/ql4_init.c
36492+++ b/drivers/scsi/qla4xxx/ql4_init.c
36493@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
36494 ddb_entry->fw_ddb_index = fw_ddb_index;
36495 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
36496 atomic_set(&ddb_entry->relogin_timer, 0);
36497- atomic_set(&ddb_entry->relogin_retry_count, 0);
36498+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36499 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36500 list_add_tail(&ddb_entry->list, &ha->ddb_list);
36501 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
36502@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
36503 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
36504 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
36505 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36506- atomic_set(&ddb_entry->relogin_retry_count, 0);
36507+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36508 atomic_set(&ddb_entry->relogin_timer, 0);
36509 clear_bit(DF_RELOGIN, &ddb_entry->flags);
36510 iscsi_unblock_session(ddb_entry->sess);
36511diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
36512index f2364ec..44c42b1 100644
36513--- a/drivers/scsi/qla4xxx/ql4_os.c
36514+++ b/drivers/scsi/qla4xxx/ql4_os.c
36515@@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
36516 ddb_entry->fw_ddb_device_state ==
36517 DDB_DS_SESSION_FAILED) {
36518 /* Reset retry relogin timer */
36519- atomic_inc(&ddb_entry->relogin_retry_count);
36520+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
36521 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
36522 " timed out-retrying"
36523 " relogin (%d)\n",
36524 ha->host_no,
36525 ddb_entry->fw_ddb_index,
36526- atomic_read(&ddb_entry->
36527+ atomic_read_unchecked(&ddb_entry->
36528 relogin_retry_count))
36529 );
36530 start_dpc++;
36531diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
36532index 2aeb2e9..46e3925 100644
36533--- a/drivers/scsi/scsi.c
36534+++ b/drivers/scsi/scsi.c
36535@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
36536 unsigned long timeout;
36537 int rtn = 0;
36538
36539- atomic_inc(&cmd->device->iorequest_cnt);
36540+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36541
36542 /* check if the device is still usable */
36543 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
36544diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
36545index 6888b2c..45befa1 100644
36546--- a/drivers/scsi/scsi_debug.c
36547+++ b/drivers/scsi/scsi_debug.c
36548@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
36549 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
36550 unsigned char *cmd = (unsigned char *)scp->cmnd;
36551
36552+ pax_track_stack();
36553+
36554 if ((errsts = check_readiness(scp, 1, devip)))
36555 return errsts;
36556 memset(arr, 0, sizeof(arr));
36557@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
36558 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
36559 unsigned char *cmd = (unsigned char *)scp->cmnd;
36560
36561+ pax_track_stack();
36562+
36563 if ((errsts = check_readiness(scp, 1, devip)))
36564 return errsts;
36565 memset(arr, 0, sizeof(arr));
36566diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
36567index 6d219e4..eb3ded3 100644
36568--- a/drivers/scsi/scsi_lib.c
36569+++ b/drivers/scsi/scsi_lib.c
36570@@ -1415,7 +1415,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
36571 shost = sdev->host;
36572 scsi_init_cmd_errh(cmd);
36573 cmd->result = DID_NO_CONNECT << 16;
36574- atomic_inc(&cmd->device->iorequest_cnt);
36575+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36576
36577 /*
36578 * SCSI request completion path will do scsi_device_unbusy(),
36579@@ -1441,9 +1441,9 @@ static void scsi_softirq_done(struct request *rq)
36580
36581 INIT_LIST_HEAD(&cmd->eh_entry);
36582
36583- atomic_inc(&cmd->device->iodone_cnt);
36584+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
36585 if (cmd->result)
36586- atomic_inc(&cmd->device->ioerr_cnt);
36587+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
36588
36589 disposition = scsi_decide_disposition(cmd);
36590 if (disposition != SUCCESS &&
36591diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
36592index e0bd3f7..816b8a6 100644
36593--- a/drivers/scsi/scsi_sysfs.c
36594+++ b/drivers/scsi/scsi_sysfs.c
36595@@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
36596 char *buf) \
36597 { \
36598 struct scsi_device *sdev = to_scsi_device(dev); \
36599- unsigned long long count = atomic_read(&sdev->field); \
36600+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
36601 return snprintf(buf, 20, "0x%llx\n", count); \
36602 } \
36603 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
36604diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
36605index 84a1fdf..693b0d6 100644
36606--- a/drivers/scsi/scsi_tgt_lib.c
36607+++ b/drivers/scsi/scsi_tgt_lib.c
36608@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
36609 int err;
36610
36611 dprintk("%lx %u\n", uaddr, len);
36612- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
36613+ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
36614 if (err) {
36615 /*
36616 * TODO: need to fixup sg_tablesize, max_segment_size,
36617diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
36618index 1b21491..1b7f60e 100644
36619--- a/drivers/scsi/scsi_transport_fc.c
36620+++ b/drivers/scsi/scsi_transport_fc.c
36621@@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
36622 * Netlink Infrastructure
36623 */
36624
36625-static atomic_t fc_event_seq;
36626+static atomic_unchecked_t fc_event_seq;
36627
36628 /**
36629 * fc_get_event_number - Obtain the next sequential FC event number
36630@@ -497,7 +497,7 @@ static atomic_t fc_event_seq;
36631 u32
36632 fc_get_event_number(void)
36633 {
36634- return atomic_add_return(1, &fc_event_seq);
36635+ return atomic_add_return_unchecked(1, &fc_event_seq);
36636 }
36637 EXPORT_SYMBOL(fc_get_event_number);
36638
36639@@ -645,7 +645,7 @@ static __init int fc_transport_init(void)
36640 {
36641 int error;
36642
36643- atomic_set(&fc_event_seq, 0);
36644+ atomic_set_unchecked(&fc_event_seq, 0);
36645
36646 error = transport_class_register(&fc_host_class);
36647 if (error)
36648@@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
36649 char *cp;
36650
36651 *val = simple_strtoul(buf, &cp, 0);
36652- if ((*cp && (*cp != '\n')) || (*val < 0))
36653+ if (*cp && (*cp != '\n'))
36654 return -EINVAL;
36655 /*
36656 * Check for overflow; dev_loss_tmo is u32
36657diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
36658index 3fd16d7..ba0871f 100644
36659--- a/drivers/scsi/scsi_transport_iscsi.c
36660+++ b/drivers/scsi/scsi_transport_iscsi.c
36661@@ -83,7 +83,7 @@ struct iscsi_internal {
36662 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
36663 };
36664
36665-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
36666+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
36667 static struct workqueue_struct *iscsi_eh_timer_workq;
36668
36669 /*
36670@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
36671 int err;
36672
36673 ihost = shost->shost_data;
36674- session->sid = atomic_add_return(1, &iscsi_session_nr);
36675+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
36676
36677 if (id == ISCSI_MAX_TARGET) {
36678 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
36679@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(void)
36680 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
36681 ISCSI_TRANSPORT_VERSION);
36682
36683- atomic_set(&iscsi_session_nr, 0);
36684+ atomic_set_unchecked(&iscsi_session_nr, 0);
36685
36686 err = class_register(&iscsi_transport_class);
36687 if (err)
36688diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
36689index 21a045e..ec89e03 100644
36690--- a/drivers/scsi/scsi_transport_srp.c
36691+++ b/drivers/scsi/scsi_transport_srp.c
36692@@ -33,7 +33,7 @@
36693 #include "scsi_transport_srp_internal.h"
36694
36695 struct srp_host_attrs {
36696- atomic_t next_port_id;
36697+ atomic_unchecked_t next_port_id;
36698 };
36699 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
36700
36701@@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
36702 struct Scsi_Host *shost = dev_to_shost(dev);
36703 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
36704
36705- atomic_set(&srp_host->next_port_id, 0);
36706+ atomic_set_unchecked(&srp_host->next_port_id, 0);
36707 return 0;
36708 }
36709
36710@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
36711 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
36712 rport->roles = ids->roles;
36713
36714- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
36715+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
36716 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
36717
36718 transport_setup_device(&rport->dev);
36719diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
36720index 909ed9e..1ae290a 100644
36721--- a/drivers/scsi/sg.c
36722+++ b/drivers/scsi/sg.c
36723@@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
36724 sdp->disk->disk_name,
36725 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
36726 NULL,
36727- (char *)arg);
36728+ (char __user *)arg);
36729 case BLKTRACESTART:
36730 return blk_trace_startstop(sdp->device->request_queue, 1);
36731 case BLKTRACESTOP:
36732@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
36733 const struct file_operations * fops;
36734 };
36735
36736-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
36737+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
36738 {"allow_dio", &adio_fops},
36739 {"debug", &debug_fops},
36740 {"def_reserved_size", &dressz_fops},
36741@@ -2325,7 +2325,7 @@ sg_proc_init(void)
36742 {
36743 int k, mask;
36744 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
36745- struct sg_proc_leaf * leaf;
36746+ const struct sg_proc_leaf * leaf;
36747
36748 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
36749 if (!sg_proc_sgp)
36750diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
36751index b4543f5..e1b34b8 100644
36752--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
36753+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
36754@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
36755 int do_iounmap = 0;
36756 int do_disable_device = 1;
36757
36758+ pax_track_stack();
36759+
36760 memset(&sym_dev, 0, sizeof(sym_dev));
36761 memset(&nvram, 0, sizeof(nvram));
36762 sym_dev.pdev = pdev;
36763diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
36764index a18996d..fe993cb 100644
36765--- a/drivers/scsi/vmw_pvscsi.c
36766+++ b/drivers/scsi/vmw_pvscsi.c
36767@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
36768 dma_addr_t base;
36769 unsigned i;
36770
36771+ pax_track_stack();
36772+
36773 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
36774 cmd.reqRingNumPages = adapter->req_pages;
36775 cmd.cmpRingNumPages = adapter->cmp_pages;
36776diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
36777index c5f37f0..898d202 100644
36778--- a/drivers/spi/spi-dw-pci.c
36779+++ b/drivers/spi/spi-dw-pci.c
36780@@ -148,7 +148,7 @@ static int spi_resume(struct pci_dev *pdev)
36781 #define spi_resume NULL
36782 #endif
36783
36784-static const struct pci_device_id pci_ids[] __devinitdata = {
36785+static const struct pci_device_id pci_ids[] __devinitconst = {
36786 /* Intel MID platform SPI controller 0 */
36787 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
36788 {},
36789diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
36790index 4d1b9f5..8408fe3 100644
36791--- a/drivers/spi/spi.c
36792+++ b/drivers/spi/spi.c
36793@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *master)
36794 EXPORT_SYMBOL_GPL(spi_bus_unlock);
36795
36796 /* portable code must never pass more than 32 bytes */
36797-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
36798+#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
36799
36800 static u8 *buf;
36801
36802diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36803index 32ee39a..3004c3d 100644
36804--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36805+++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36806@@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
36807 (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
36808
36809
36810-static struct net_device_ops ar6000_netdev_ops = {
36811+static net_device_ops_no_const ar6000_netdev_ops = {
36812 .ndo_init = NULL,
36813 .ndo_open = ar6000_open,
36814 .ndo_stop = ar6000_close,
36815diff --git a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36816index 39e0873..0925710 100644
36817--- a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36818+++ b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36819@@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void *pHciPalInfo, void *skb);
36820 typedef struct ar6k_pal_config_s
36821 {
36822 ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
36823-}ar6k_pal_config_t;
36824+} __no_const ar6k_pal_config_t;
36825
36826 void register_pal_cb(ar6k_pal_config_t *palConfig_p);
36827 #endif /* _AR6K_PAL_H_ */
36828diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36829index 05dada9..96171c6 100644
36830--- a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36831+++ b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36832@@ -451,14 +451,14 @@ static void brcmf_op_if(struct brcmf_if *ifp)
36833 free_netdev(ifp->net);
36834 }
36835 /* Allocate etherdev, including space for private structure */
36836- ifp->net = alloc_etherdev(sizeof(drvr_priv));
36837+ ifp->net = alloc_etherdev(sizeof(*drvr_priv));
36838 if (!ifp->net) {
36839 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
36840 ret = -ENOMEM;
36841 }
36842 if (ret == 0) {
36843 strcpy(ifp->net->name, ifp->name);
36844- memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(drvr_priv));
36845+ memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(*drvr_priv));
36846 err = brcmf_net_attach(&drvr_priv->pub, ifp->idx);
36847 if (err != 0) {
36848 BRCMF_ERROR(("%s: brcmf_net_attach failed, "
36849@@ -1279,7 +1279,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36850 BRCMF_TRACE(("%s: Enter\n", __func__));
36851
36852 /* Allocate etherdev, including space for private structure */
36853- net = alloc_etherdev(sizeof(drvr_priv));
36854+ net = alloc_etherdev(sizeof(*drvr_priv));
36855 if (!net) {
36856 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
36857 goto fail;
36858@@ -1295,7 +1295,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36859 /*
36860 * Save the brcmf_info into the priv
36861 */
36862- memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
36863+ memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
36864
36865 /* Set network interface name if it was provided as module parameter */
36866 if (iface_name[0]) {
36867@@ -1352,7 +1352,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36868 /*
36869 * Save the brcmf_info into the priv
36870 */
36871- memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
36872+ memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
36873
36874 #if defined(CONFIG_PM_SLEEP)
36875 atomic_set(&brcmf_mmc_suspend, false);
36876diff --git a/drivers/staging/brcm80211/brcmfmac/sdio_host.h b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36877index d345472..cedb19e 100644
36878--- a/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36879+++ b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36880@@ -263,7 +263,7 @@ struct brcmf_sdioh_driver {
36881 u16 func, uint bustype, u32 regsva, void *param);
36882 /* detach from device */
36883 void (*detach) (void *ch);
36884-};
36885+} __no_const;
36886
36887 struct sdioh_info;
36888
36889diff --git a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36890index a01b01c..b3f721c 100644
36891--- a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36892+++ b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36893@@ -591,7 +591,7 @@ struct phy_func_ptr {
36894 initfn_t carrsuppr;
36895 rxsigpwrfn_t rxsigpwr;
36896 detachfn_t detach;
36897-};
36898+} __no_const;
36899
36900 struct brcms_phy {
36901 struct brcms_phy_pub pubpi_ro;
36902diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
36903index 8fb3051..a8b6c67 100644
36904--- a/drivers/staging/et131x/et1310_tx.c
36905+++ b/drivers/staging/et131x/et1310_tx.c
36906@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
36907 struct net_device_stats *stats = &etdev->net_stats;
36908
36909 if (tcb->flags & fMP_DEST_BROAD)
36910- atomic_inc(&etdev->stats.brdcstxmt);
36911+ atomic_inc_unchecked(&etdev->stats.brdcstxmt);
36912 else if (tcb->flags & fMP_DEST_MULTI)
36913- atomic_inc(&etdev->stats.multixmt);
36914+ atomic_inc_unchecked(&etdev->stats.multixmt);
36915 else
36916- atomic_inc(&etdev->stats.unixmt);
36917+ atomic_inc_unchecked(&etdev->stats.unixmt);
36918
36919 if (tcb->skb) {
36920 stats->tx_bytes += tcb->skb->len;
36921diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
36922index 408c50b..fd65e9f 100644
36923--- a/drivers/staging/et131x/et131x_adapter.h
36924+++ b/drivers/staging/et131x/et131x_adapter.h
36925@@ -106,11 +106,11 @@ struct ce_stats {
36926 * operations
36927 */
36928 u32 unircv; /* # multicast packets received */
36929- atomic_t unixmt; /* # multicast packets for Tx */
36930+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
36931 u32 multircv; /* # multicast packets received */
36932- atomic_t multixmt; /* # multicast packets for Tx */
36933+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
36934 u32 brdcstrcv; /* # broadcast packets received */
36935- atomic_t brdcstxmt; /* # broadcast packets for Tx */
36936+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
36937 u32 norcvbuf; /* # Rx packets discarded */
36938 u32 noxmtbuf; /* # Tx packets discarded */
36939
36940diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
36941index 455f47a..86205ff 100644
36942--- a/drivers/staging/hv/channel.c
36943+++ b/drivers/staging/hv/channel.c
36944@@ -447,8 +447,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
36945 int ret = 0;
36946 int t;
36947
36948- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
36949- atomic_inc(&vmbus_connection.next_gpadl_handle);
36950+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
36951+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
36952
36953 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
36954 if (ret)
36955diff --git a/drivers/staging/hv/hv.c b/drivers/staging/hv/hv.c
36956index 824f816..a800af7 100644
36957--- a/drivers/staging/hv/hv.c
36958+++ b/drivers/staging/hv/hv.c
36959@@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
36960 u64 output_address = (output) ? virt_to_phys(output) : 0;
36961 u32 output_address_hi = output_address >> 32;
36962 u32 output_address_lo = output_address & 0xFFFFFFFF;
36963- volatile void *hypercall_page = hv_context.hypercall_page;
36964+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
36965
36966 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
36967 "=a"(hv_status_lo) : "d" (control_hi),
36968diff --git a/drivers/staging/hv/hv_mouse.c b/drivers/staging/hv/hv_mouse.c
36969index d957fc2..43cedd9 100644
36970--- a/drivers/staging/hv/hv_mouse.c
36971+++ b/drivers/staging/hv/hv_mouse.c
36972@@ -878,8 +878,10 @@ static void reportdesc_callback(struct hv_device *dev, void *packet, u32 len)
36973 if (hid_dev) {
36974 DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
36975
36976- hid_dev->ll_driver->open = mousevsc_hid_open;
36977- hid_dev->ll_driver->close = mousevsc_hid_close;
36978+ pax_open_kernel();
36979+ *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open;
36980+ *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
36981+ pax_close_kernel();
36982
36983 hid_dev->bus = BUS_VIRTUAL;
36984 hid_dev->vendor = input_device_ctx->device_info.vendor;
36985diff --git a/drivers/staging/hv/hyperv_vmbus.h b/drivers/staging/hv/hyperv_vmbus.h
36986index 349ad80..3f75719 100644
36987--- a/drivers/staging/hv/hyperv_vmbus.h
36988+++ b/drivers/staging/hv/hyperv_vmbus.h
36989@@ -559,7 +559,7 @@ enum vmbus_connect_state {
36990 struct vmbus_connection {
36991 enum vmbus_connect_state conn_state;
36992
36993- atomic_t next_gpadl_handle;
36994+ atomic_unchecked_t next_gpadl_handle;
36995
36996 /*
36997 * Represents channel interrupts. Each bit position represents a
36998diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c
36999index dbb5201..d6047c6 100644
37000--- a/drivers/staging/hv/rndis_filter.c
37001+++ b/drivers/staging/hv/rndis_filter.c
37002@@ -43,7 +43,7 @@ struct rndis_device {
37003
37004 enum rndis_device_state state;
37005 u32 link_stat;
37006- atomic_t new_req_id;
37007+ atomic_unchecked_t new_req_id;
37008
37009 spinlock_t request_lock;
37010 struct list_head req_list;
37011@@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
37012 * template
37013 */
37014 set = &rndis_msg->msg.set_req;
37015- set->req_id = atomic_inc_return(&dev->new_req_id);
37016+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
37017
37018 /* Add to the request list */
37019 spin_lock_irqsave(&dev->request_lock, flags);
37020@@ -622,7 +622,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
37021
37022 /* Setup the rndis set */
37023 halt = &request->request_msg.msg.halt_req;
37024- halt->req_id = atomic_inc_return(&dev->new_req_id);
37025+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
37026
37027 /* Ignore return since this msg is optional. */
37028 rndis_filter_send_request(dev, request);
37029diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
37030index 1c949f5..7a8b104 100644
37031--- a/drivers/staging/hv/vmbus_drv.c
37032+++ b/drivers/staging/hv/vmbus_drv.c
37033@@ -660,11 +660,11 @@ int vmbus_child_device_register(struct hv_device *child_device_obj)
37034 {
37035 int ret = 0;
37036
37037- static atomic_t device_num = ATOMIC_INIT(0);
37038+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
37039
37040 /* Set the device name. Otherwise, device_register() will fail. */
37041 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
37042- atomic_inc_return(&device_num));
37043+ atomic_inc_return_unchecked(&device_num));
37044
37045 /* The new device belongs to this bus */
37046 child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */
37047diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
37048index 3f26f71..fb5c787 100644
37049--- a/drivers/staging/iio/ring_generic.h
37050+++ b/drivers/staging/iio/ring_generic.h
37051@@ -62,7 +62,7 @@ struct iio_ring_access_funcs {
37052
37053 int (*is_enabled)(struct iio_ring_buffer *ring);
37054 int (*enable)(struct iio_ring_buffer *ring);
37055-};
37056+} __no_const;
37057
37058 struct iio_ring_setup_ops {
37059 int (*preenable)(struct iio_dev *);
37060diff --git a/drivers/staging/mei/interface.c b/drivers/staging/mei/interface.c
37061index cfec92d..a65dacf 100644
37062--- a/drivers/staging/mei/interface.c
37063+++ b/drivers/staging/mei/interface.c
37064@@ -332,7 +332,7 @@ int mei_send_flow_control(struct mei_device *dev, struct mei_cl *cl)
37065 mei_hdr->reserved = 0;
37066
37067 mei_flow_control = (struct hbm_flow_control *) &dev->wr_msg_buf[1];
37068- memset(mei_flow_control, 0, sizeof(mei_flow_control));
37069+ memset(mei_flow_control, 0, sizeof(*mei_flow_control));
37070 mei_flow_control->host_addr = cl->host_client_id;
37071 mei_flow_control->me_addr = cl->me_client_id;
37072 mei_flow_control->cmd.cmd = MEI_FLOW_CONTROL_CMD;
37073@@ -396,7 +396,7 @@ int mei_disconnect(struct mei_device *dev, struct mei_cl *cl)
37074
37075 mei_cli_disconnect =
37076 (struct hbm_client_disconnect_request *) &dev->wr_msg_buf[1];
37077- memset(mei_cli_disconnect, 0, sizeof(mei_cli_disconnect));
37078+ memset(mei_cli_disconnect, 0, sizeof(*mei_cli_disconnect));
37079 mei_cli_disconnect->host_addr = cl->host_client_id;
37080 mei_cli_disconnect->me_addr = cl->me_client_id;
37081 mei_cli_disconnect->cmd.cmd = CLIENT_DISCONNECT_REQ_CMD;
37082diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
37083index 8b307b4..a97ac91 100644
37084--- a/drivers/staging/octeon/ethernet-rx.c
37085+++ b/drivers/staging/octeon/ethernet-rx.c
37086@@ -420,11 +420,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37087 /* Increment RX stats for virtual ports */
37088 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
37089 #ifdef CONFIG_64BIT
37090- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
37091- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
37092+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
37093+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
37094 #else
37095- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
37096- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
37097+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
37098+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
37099 #endif
37100 }
37101 netif_receive_skb(skb);
37102@@ -436,9 +436,9 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37103 dev->name);
37104 */
37105 #ifdef CONFIG_64BIT
37106- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
37107+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37108 #else
37109- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
37110+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
37111 #endif
37112 dev_kfree_skb_irq(skb);
37113 }
37114diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
37115index a8f780e..aef1098 100644
37116--- a/drivers/staging/octeon/ethernet.c
37117+++ b/drivers/staging/octeon/ethernet.c
37118@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
37119 * since the RX tasklet also increments it.
37120 */
37121 #ifdef CONFIG_64BIT
37122- atomic64_add(rx_status.dropped_packets,
37123- (atomic64_t *)&priv->stats.rx_dropped);
37124+ atomic64_add_unchecked(rx_status.dropped_packets,
37125+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37126 #else
37127- atomic_add(rx_status.dropped_packets,
37128- (atomic_t *)&priv->stats.rx_dropped);
37129+ atomic_add_unchecked(rx_status.dropped_packets,
37130+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
37131 #endif
37132 }
37133
37134diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
37135index f3c6060..56bf826 100644
37136--- a/drivers/staging/pohmelfs/inode.c
37137+++ b/drivers/staging/pohmelfs/inode.c
37138@@ -1861,7 +1861,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37139 mutex_init(&psb->mcache_lock);
37140 psb->mcache_root = RB_ROOT;
37141 psb->mcache_timeout = msecs_to_jiffies(5000);
37142- atomic_long_set(&psb->mcache_gen, 0);
37143+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
37144
37145 psb->trans_max_pages = 100;
37146
37147@@ -1876,7 +1876,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37148 INIT_LIST_HEAD(&psb->crypto_ready_list);
37149 INIT_LIST_HEAD(&psb->crypto_active_list);
37150
37151- atomic_set(&psb->trans_gen, 1);
37152+ atomic_set_unchecked(&psb->trans_gen, 1);
37153 atomic_long_set(&psb->total_inodes, 0);
37154
37155 mutex_init(&psb->state_lock);
37156diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
37157index e22665c..a2a9390 100644
37158--- a/drivers/staging/pohmelfs/mcache.c
37159+++ b/drivers/staging/pohmelfs/mcache.c
37160@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
37161 m->data = data;
37162 m->start = start;
37163 m->size = size;
37164- m->gen = atomic_long_inc_return(&psb->mcache_gen);
37165+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
37166
37167 mutex_lock(&psb->mcache_lock);
37168 err = pohmelfs_mcache_insert(psb, m);
37169diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
37170index 985b6b7..7699e05 100644
37171--- a/drivers/staging/pohmelfs/netfs.h
37172+++ b/drivers/staging/pohmelfs/netfs.h
37173@@ -571,14 +571,14 @@ struct pohmelfs_config;
37174 struct pohmelfs_sb {
37175 struct rb_root mcache_root;
37176 struct mutex mcache_lock;
37177- atomic_long_t mcache_gen;
37178+ atomic_long_unchecked_t mcache_gen;
37179 unsigned long mcache_timeout;
37180
37181 unsigned int idx;
37182
37183 unsigned int trans_retries;
37184
37185- atomic_t trans_gen;
37186+ atomic_unchecked_t trans_gen;
37187
37188 unsigned int crypto_attached_size;
37189 unsigned int crypto_align_size;
37190diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
37191index 36a2535..0591bf4 100644
37192--- a/drivers/staging/pohmelfs/trans.c
37193+++ b/drivers/staging/pohmelfs/trans.c
37194@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
37195 int err;
37196 struct netfs_cmd *cmd = t->iovec.iov_base;
37197
37198- t->gen = atomic_inc_return(&psb->trans_gen);
37199+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
37200
37201 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
37202 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
37203diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
37204index b70cb2b..4db41a7 100644
37205--- a/drivers/staging/rtl8712/rtl871x_io.h
37206+++ b/drivers/staging/rtl8712/rtl871x_io.h
37207@@ -83,7 +83,7 @@ struct _io_ops {
37208 u8 *pmem);
37209 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
37210 u8 *pmem);
37211-};
37212+} __no_const;
37213
37214 struct io_req {
37215 struct list_head list;
37216diff --git a/drivers/staging/sbe-2t3e3/netdev.c b/drivers/staging/sbe-2t3e3/netdev.c
37217index c7b5e8b..783d6cb 100644
37218--- a/drivers/staging/sbe-2t3e3/netdev.c
37219+++ b/drivers/staging/sbe-2t3e3/netdev.c
37220@@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
37221 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
37222
37223 if (rlen)
37224- if (copy_to_user(data, &resp, rlen))
37225+ if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
37226 return -EFAULT;
37227
37228 return 0;
37229diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
37230index be21617..0954e45 100644
37231--- a/drivers/staging/usbip/usbip_common.h
37232+++ b/drivers/staging/usbip/usbip_common.h
37233@@ -289,7 +289,7 @@ struct usbip_device {
37234 void (*shutdown)(struct usbip_device *);
37235 void (*reset)(struct usbip_device *);
37236 void (*unusable)(struct usbip_device *);
37237- } eh_ops;
37238+ } __no_const eh_ops;
37239 };
37240
37241 #if 0
37242diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
37243index 71a586e..4d8a91a 100644
37244--- a/drivers/staging/usbip/vhci.h
37245+++ b/drivers/staging/usbip/vhci.h
37246@@ -85,7 +85,7 @@ struct vhci_hcd {
37247 unsigned resuming:1;
37248 unsigned long re_timeout;
37249
37250- atomic_t seqnum;
37251+ atomic_unchecked_t seqnum;
37252
37253 /*
37254 * NOTE:
37255diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
37256index 2ee97e2..0420b86 100644
37257--- a/drivers/staging/usbip/vhci_hcd.c
37258+++ b/drivers/staging/usbip/vhci_hcd.c
37259@@ -527,7 +527,7 @@ static void vhci_tx_urb(struct urb *urb)
37260 return;
37261 }
37262
37263- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
37264+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37265 if (priv->seqnum == 0xffff)
37266 dev_info(&urb->dev->dev, "seqnum max\n");
37267
37268@@ -779,7 +779,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
37269 return -ENOMEM;
37270 }
37271
37272- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
37273+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37274 if (unlink->seqnum == 0xffff)
37275 pr_info("seqnum max\n");
37276
37277@@ -969,7 +969,7 @@ static int vhci_start(struct usb_hcd *hcd)
37278 vdev->rhport = rhport;
37279 }
37280
37281- atomic_set(&vhci->seqnum, 0);
37282+ atomic_set_unchecked(&vhci->seqnum, 0);
37283 spin_lock_init(&vhci->lock);
37284
37285 hcd->power_budget = 0; /* no limit */
37286diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
37287index 3872b8c..fe6d2f4 100644
37288--- a/drivers/staging/usbip/vhci_rx.c
37289+++ b/drivers/staging/usbip/vhci_rx.c
37290@@ -77,7 +77,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
37291 if (!urb) {
37292 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
37293 pr_info("max seqnum %d\n",
37294- atomic_read(&the_controller->seqnum));
37295+ atomic_read_unchecked(&the_controller->seqnum));
37296 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
37297 return;
37298 }
37299diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
37300index 7735027..30eed13 100644
37301--- a/drivers/staging/vt6655/hostap.c
37302+++ b/drivers/staging/vt6655/hostap.c
37303@@ -79,14 +79,13 @@ static int msglevel =MSG_LEVEL_INFO;
37304 *
37305 */
37306
37307+static net_device_ops_no_const apdev_netdev_ops;
37308+
37309 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37310 {
37311 PSDevice apdev_priv;
37312 struct net_device *dev = pDevice->dev;
37313 int ret;
37314- const struct net_device_ops apdev_netdev_ops = {
37315- .ndo_start_xmit = pDevice->tx_80211,
37316- };
37317
37318 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37319
37320@@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37321 *apdev_priv = *pDevice;
37322 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37323
37324+ /* only half broken now */
37325+ apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37326 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37327
37328 pDevice->apdev->type = ARPHRD_IEEE80211;
37329diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
37330index 51b5adf..098e320 100644
37331--- a/drivers/staging/vt6656/hostap.c
37332+++ b/drivers/staging/vt6656/hostap.c
37333@@ -80,14 +80,13 @@ static int msglevel =MSG_LEVEL_INFO;
37334 *
37335 */
37336
37337+static net_device_ops_no_const apdev_netdev_ops;
37338+
37339 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37340 {
37341 PSDevice apdev_priv;
37342 struct net_device *dev = pDevice->dev;
37343 int ret;
37344- const struct net_device_ops apdev_netdev_ops = {
37345- .ndo_start_xmit = pDevice->tx_80211,
37346- };
37347
37348 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37349
37350@@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37351 *apdev_priv = *pDevice;
37352 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37353
37354+ /* only half broken now */
37355+ apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37356 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37357
37358 pDevice->apdev->type = ARPHRD_IEEE80211;
37359diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
37360index 7843dfd..3db105f 100644
37361--- a/drivers/staging/wlan-ng/hfa384x_usb.c
37362+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
37363@@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
37364
37365 struct usbctlx_completor {
37366 int (*complete) (struct usbctlx_completor *);
37367-};
37368+} __no_const;
37369
37370 static int
37371 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
37372diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
37373index 1ca66ea..76f1343 100644
37374--- a/drivers/staging/zcache/tmem.c
37375+++ b/drivers/staging/zcache/tmem.c
37376@@ -39,7 +39,7 @@
37377 * A tmem host implementation must use this function to register callbacks
37378 * for memory allocation.
37379 */
37380-static struct tmem_hostops tmem_hostops;
37381+static tmem_hostops_no_const tmem_hostops;
37382
37383 static void tmem_objnode_tree_init(void);
37384
37385@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_hostops *m)
37386 * A tmem host implementation must use this function to register
37387 * callbacks for a page-accessible memory (PAM) implementation
37388 */
37389-static struct tmem_pamops tmem_pamops;
37390+static tmem_pamops_no_const tmem_pamops;
37391
37392 void tmem_register_pamops(struct tmem_pamops *m)
37393 {
37394diff --git a/drivers/staging/zcache/tmem.h b/drivers/staging/zcache/tmem.h
37395index ed147c4..94fc3c6 100644
37396--- a/drivers/staging/zcache/tmem.h
37397+++ b/drivers/staging/zcache/tmem.h
37398@@ -180,6 +180,7 @@ struct tmem_pamops {
37399 void (*new_obj)(struct tmem_obj *);
37400 int (*replace_in_obj)(void *, struct tmem_obj *);
37401 };
37402+typedef struct tmem_pamops __no_const tmem_pamops_no_const;
37403 extern void tmem_register_pamops(struct tmem_pamops *m);
37404
37405 /* memory allocation methods provided by the host implementation */
37406@@ -189,6 +190,7 @@ struct tmem_hostops {
37407 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
37408 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
37409 };
37410+typedef struct tmem_hostops __no_const tmem_hostops_no_const;
37411 extern void tmem_register_hostops(struct tmem_hostops *m);
37412
37413 /* core tmem accessor functions */
37414diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
37415index c4ac6f6..4f90f53 100644
37416--- a/drivers/target/iscsi/iscsi_target.c
37417+++ b/drivers/target/iscsi/iscsi_target.c
37418@@ -1370,7 +1370,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
37419 * outstanding_r2ts reaches zero, go ahead and send the delayed
37420 * TASK_ABORTED status.
37421 */
37422- if (atomic_read(&se_cmd->t_transport_aborted) != 0) {
37423+ if (atomic_read_unchecked(&se_cmd->t_transport_aborted) != 0) {
37424 if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
37425 if (--cmd->outstanding_r2ts < 1) {
37426 iscsit_stop_dataout_timer(cmd);
37427diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
37428index 8badcb4..94c9ac6 100644
37429--- a/drivers/target/target_core_alua.c
37430+++ b/drivers/target/target_core_alua.c
37431@@ -723,6 +723,8 @@ static int core_alua_update_tpg_primary_metadata(
37432 char path[ALUA_METADATA_PATH_LEN];
37433 int len;
37434
37435+ pax_track_stack();
37436+
37437 memset(path, 0, ALUA_METADATA_PATH_LEN);
37438
37439 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
37440@@ -986,6 +988,8 @@ static int core_alua_update_tpg_secondary_metadata(
37441 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
37442 int len;
37443
37444+ pax_track_stack();
37445+
37446 memset(path, 0, ALUA_METADATA_PATH_LEN);
37447 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
37448
37449diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
37450index 5f91397..dcc2d25 100644
37451--- a/drivers/target/target_core_cdb.c
37452+++ b/drivers/target/target_core_cdb.c
37453@@ -933,6 +933,8 @@ target_emulate_modesense(struct se_cmd *cmd, int ten)
37454 int length = 0;
37455 unsigned char buf[SE_MODE_PAGE_BUF];
37456
37457+ pax_track_stack();
37458+
37459 memset(buf, 0, SE_MODE_PAGE_BUF);
37460
37461 switch (cdb[2] & 0x3f) {
37462diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
37463index b2575d8..b6b28fd 100644
37464--- a/drivers/target/target_core_configfs.c
37465+++ b/drivers/target/target_core_configfs.c
37466@@ -1267,6 +1267,8 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
37467 ssize_t len = 0;
37468 int reg_count = 0, prf_isid;
37469
37470+ pax_track_stack();
37471+
37472 if (!su_dev->se_dev_ptr)
37473 return -ENODEV;
37474
37475diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
37476index 7fd3a16..bc2fb3e 100644
37477--- a/drivers/target/target_core_pr.c
37478+++ b/drivers/target/target_core_pr.c
37479@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_registration(
37480 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
37481 u16 tpgt;
37482
37483+ pax_track_stack();
37484+
37485 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
37486 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
37487 /*
37488@@ -1867,6 +1869,8 @@ static int __core_scsi3_update_aptpl_buf(
37489 ssize_t len = 0;
37490 int reg_count = 0;
37491
37492+ pax_track_stack();
37493+
37494 memset(buf, 0, pr_aptpl_buf_len);
37495 /*
37496 * Called to clear metadata once APTPL has been deactivated.
37497@@ -1989,6 +1993,8 @@ static int __core_scsi3_write_aptpl_to_file(
37498 char path[512];
37499 int ret;
37500
37501+ pax_track_stack();
37502+
37503 memset(iov, 0, sizeof(struct iovec));
37504 memset(path, 0, 512);
37505
37506diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
37507index 5c1b8c5..0cb7d0e 100644
37508--- a/drivers/target/target_core_tmr.c
37509+++ b/drivers/target/target_core_tmr.c
37510@@ -255,7 +255,7 @@ static void core_tmr_drain_task_list(
37511 cmd->se_tfo->get_task_tag(cmd), cmd->pr_res_key,
37512 cmd->t_task_list_num,
37513 atomic_read(&cmd->t_task_cdbs_left),
37514- atomic_read(&cmd->t_task_cdbs_sent),
37515+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37516 atomic_read(&cmd->t_transport_active),
37517 atomic_read(&cmd->t_transport_stop),
37518 atomic_read(&cmd->t_transport_sent));
37519@@ -291,7 +291,7 @@ static void core_tmr_drain_task_list(
37520 pr_debug("LUN_RESET: got t_transport_active = 1 for"
37521 " task: %p, t_fe_count: %d dev: %p\n", task,
37522 fe_count, dev);
37523- atomic_set(&cmd->t_transport_aborted, 1);
37524+ atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37525 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37526
37527 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37528@@ -299,7 +299,7 @@ static void core_tmr_drain_task_list(
37529 }
37530 pr_debug("LUN_RESET: Got t_transport_active = 0 for task: %p,"
37531 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
37532- atomic_set(&cmd->t_transport_aborted, 1);
37533+ atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37534 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37535
37536 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37537diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
37538index e2added..ccb5251 100644
37539--- a/drivers/target/target_core_transport.c
37540+++ b/drivers/target/target_core_transport.c
37541@@ -1445,7 +1445,7 @@ struct se_device *transport_add_device_to_core_hba(
37542
37543 dev->queue_depth = dev_limits->queue_depth;
37544 atomic_set(&dev->depth_left, dev->queue_depth);
37545- atomic_set(&dev->dev_ordered_id, 0);
37546+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
37547
37548 se_dev_set_default_attribs(dev, dev_limits);
37549
37550@@ -1633,7 +1633,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
37551 * Used to determine when ORDERED commands should go from
37552 * Dormant to Active status.
37553 */
37554- cmd->se_ordered_id = atomic_inc_return(&cmd->se_dev->dev_ordered_id);
37555+ cmd->se_ordered_id = atomic_inc_return_unchecked(&cmd->se_dev->dev_ordered_id);
37556 smp_mb__after_atomic_inc();
37557 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
37558 cmd->se_ordered_id, cmd->sam_task_attr,
37559@@ -1960,7 +1960,7 @@ static void transport_generic_request_failure(
37560 " t_transport_active: %d t_transport_stop: %d"
37561 " t_transport_sent: %d\n", cmd->t_task_list_num,
37562 atomic_read(&cmd->t_task_cdbs_left),
37563- atomic_read(&cmd->t_task_cdbs_sent),
37564+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37565 atomic_read(&cmd->t_task_cdbs_ex_left),
37566 atomic_read(&cmd->t_transport_active),
37567 atomic_read(&cmd->t_transport_stop),
37568@@ -2460,9 +2460,9 @@ check_depth:
37569 spin_lock_irqsave(&cmd->t_state_lock, flags);
37570 atomic_set(&task->task_active, 1);
37571 atomic_set(&task->task_sent, 1);
37572- atomic_inc(&cmd->t_task_cdbs_sent);
37573+ atomic_inc_unchecked(&cmd->t_task_cdbs_sent);
37574
37575- if (atomic_read(&cmd->t_task_cdbs_sent) ==
37576+ if (atomic_read_unchecked(&cmd->t_task_cdbs_sent) ==
37577 cmd->t_task_list_num)
37578 atomic_set(&cmd->transport_sent, 1);
37579
37580@@ -4682,7 +4682,7 @@ static void transport_generic_wait_for_tasks(
37581 atomic_set(&cmd->transport_lun_stop, 0);
37582 }
37583 if (!atomic_read(&cmd->t_transport_active) ||
37584- atomic_read(&cmd->t_transport_aborted))
37585+ atomic_read_unchecked(&cmd->t_transport_aborted))
37586 goto remove;
37587
37588 atomic_set(&cmd->t_transport_stop, 1);
37589@@ -4917,7 +4917,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
37590 {
37591 int ret = 0;
37592
37593- if (atomic_read(&cmd->t_transport_aborted) != 0) {
37594+ if (atomic_read_unchecked(&cmd->t_transport_aborted) != 0) {
37595 if (!send_status ||
37596 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
37597 return 1;
37598@@ -4954,7 +4954,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
37599 */
37600 if (cmd->data_direction == DMA_TO_DEVICE) {
37601 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
37602- atomic_inc(&cmd->t_transport_aborted);
37603+ atomic_inc_unchecked(&cmd->t_transport_aborted);
37604 smp_mb__after_atomic_inc();
37605 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
37606 transport_new_cmd_failure(cmd);
37607@@ -5068,7 +5068,7 @@ static void transport_processing_shutdown(struct se_device *dev)
37608 cmd->se_tfo->get_task_tag(cmd),
37609 cmd->t_task_list_num,
37610 atomic_read(&cmd->t_task_cdbs_left),
37611- atomic_read(&cmd->t_task_cdbs_sent),
37612+ atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37613 atomic_read(&cmd->t_transport_active),
37614 atomic_read(&cmd->t_transport_stop),
37615 atomic_read(&cmd->t_transport_sent));
37616diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
37617index d5f923b..9c78228 100644
37618--- a/drivers/telephony/ixj.c
37619+++ b/drivers/telephony/ixj.c
37620@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
37621 bool mContinue;
37622 char *pIn, *pOut;
37623
37624+ pax_track_stack();
37625+
37626 if (!SCI_Prepare(j))
37627 return 0;
37628
37629diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
37630index 4c8b665..1d931eb 100644
37631--- a/drivers/tty/hvc/hvcs.c
37632+++ b/drivers/tty/hvc/hvcs.c
37633@@ -83,6 +83,7 @@
37634 #include <asm/hvcserver.h>
37635 #include <asm/uaccess.h>
37636 #include <asm/vio.h>
37637+#include <asm/local.h>
37638
37639 /*
37640 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
37641@@ -270,7 +271,7 @@ struct hvcs_struct {
37642 unsigned int index;
37643
37644 struct tty_struct *tty;
37645- int open_count;
37646+ local_t open_count;
37647
37648 /*
37649 * Used to tell the driver kernel_thread what operations need to take
37650@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
37651
37652 spin_lock_irqsave(&hvcsd->lock, flags);
37653
37654- if (hvcsd->open_count > 0) {
37655+ if (local_read(&hvcsd->open_count) > 0) {
37656 spin_unlock_irqrestore(&hvcsd->lock, flags);
37657 printk(KERN_INFO "HVCS: vterm state unchanged. "
37658 "The hvcs device node is still in use.\n");
37659@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
37660 if ((retval = hvcs_partner_connect(hvcsd)))
37661 goto error_release;
37662
37663- hvcsd->open_count = 1;
37664+ local_set(&hvcsd->open_count, 1);
37665 hvcsd->tty = tty;
37666 tty->driver_data = hvcsd;
37667
37668@@ -1179,7 +1180,7 @@ fast_open:
37669
37670 spin_lock_irqsave(&hvcsd->lock, flags);
37671 kref_get(&hvcsd->kref);
37672- hvcsd->open_count++;
37673+ local_inc(&hvcsd->open_count);
37674 hvcsd->todo_mask |= HVCS_SCHED_READ;
37675 spin_unlock_irqrestore(&hvcsd->lock, flags);
37676
37677@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37678 hvcsd = tty->driver_data;
37679
37680 spin_lock_irqsave(&hvcsd->lock, flags);
37681- if (--hvcsd->open_count == 0) {
37682+ if (local_dec_and_test(&hvcsd->open_count)) {
37683
37684 vio_disable_interrupts(hvcsd->vdev);
37685
37686@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37687 free_irq(irq, hvcsd);
37688 kref_put(&hvcsd->kref, destroy_hvcs_struct);
37689 return;
37690- } else if (hvcsd->open_count < 0) {
37691+ } else if (local_read(&hvcsd->open_count) < 0) {
37692 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
37693 " is missmanaged.\n",
37694- hvcsd->vdev->unit_address, hvcsd->open_count);
37695+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
37696 }
37697
37698 spin_unlock_irqrestore(&hvcsd->lock, flags);
37699@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37700
37701 spin_lock_irqsave(&hvcsd->lock, flags);
37702 /* Preserve this so that we know how many kref refs to put */
37703- temp_open_count = hvcsd->open_count;
37704+ temp_open_count = local_read(&hvcsd->open_count);
37705
37706 /*
37707 * Don't kref put inside the spinlock because the destruction
37708@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37709 hvcsd->tty->driver_data = NULL;
37710 hvcsd->tty = NULL;
37711
37712- hvcsd->open_count = 0;
37713+ local_set(&hvcsd->open_count, 0);
37714
37715 /* This will drop any buffered data on the floor which is OK in a hangup
37716 * scenario. */
37717@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct *tty,
37718 * the middle of a write operation? This is a crummy place to do this
37719 * but we want to keep it all in the spinlock.
37720 */
37721- if (hvcsd->open_count <= 0) {
37722+ if (local_read(&hvcsd->open_count) <= 0) {
37723 spin_unlock_irqrestore(&hvcsd->lock, flags);
37724 return -ENODEV;
37725 }
37726@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_struct *tty)
37727 {
37728 struct hvcs_struct *hvcsd = tty->driver_data;
37729
37730- if (!hvcsd || hvcsd->open_count <= 0)
37731+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
37732 return 0;
37733
37734 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
37735diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
37736index ef92869..f4ebd88 100644
37737--- a/drivers/tty/ipwireless/tty.c
37738+++ b/drivers/tty/ipwireless/tty.c
37739@@ -29,6 +29,7 @@
37740 #include <linux/tty_driver.h>
37741 #include <linux/tty_flip.h>
37742 #include <linux/uaccess.h>
37743+#include <asm/local.h>
37744
37745 #include "tty.h"
37746 #include "network.h"
37747@@ -51,7 +52,7 @@ struct ipw_tty {
37748 int tty_type;
37749 struct ipw_network *network;
37750 struct tty_struct *linux_tty;
37751- int open_count;
37752+ local_t open_count;
37753 unsigned int control_lines;
37754 struct mutex ipw_tty_mutex;
37755 int tx_bytes_queued;
37756@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37757 mutex_unlock(&tty->ipw_tty_mutex);
37758 return -ENODEV;
37759 }
37760- if (tty->open_count == 0)
37761+ if (local_read(&tty->open_count) == 0)
37762 tty->tx_bytes_queued = 0;
37763
37764- tty->open_count++;
37765+ local_inc(&tty->open_count);
37766
37767 tty->linux_tty = linux_tty;
37768 linux_tty->driver_data = tty;
37769@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37770
37771 static void do_ipw_close(struct ipw_tty *tty)
37772 {
37773- tty->open_count--;
37774-
37775- if (tty->open_count == 0) {
37776+ if (local_dec_return(&tty->open_count) == 0) {
37777 struct tty_struct *linux_tty = tty->linux_tty;
37778
37779 if (linux_tty != NULL) {
37780@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
37781 return;
37782
37783 mutex_lock(&tty->ipw_tty_mutex);
37784- if (tty->open_count == 0) {
37785+ if (local_read(&tty->open_count) == 0) {
37786 mutex_unlock(&tty->ipw_tty_mutex);
37787 return;
37788 }
37789@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
37790 return;
37791 }
37792
37793- if (!tty->open_count) {
37794+ if (!local_read(&tty->open_count)) {
37795 mutex_unlock(&tty->ipw_tty_mutex);
37796 return;
37797 }
37798@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *linux_tty,
37799 return -ENODEV;
37800
37801 mutex_lock(&tty->ipw_tty_mutex);
37802- if (!tty->open_count) {
37803+ if (!local_read(&tty->open_count)) {
37804 mutex_unlock(&tty->ipw_tty_mutex);
37805 return -EINVAL;
37806 }
37807@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
37808 if (!tty)
37809 return -ENODEV;
37810
37811- if (!tty->open_count)
37812+ if (!local_read(&tty->open_count))
37813 return -EINVAL;
37814
37815 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
37816@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
37817 if (!tty)
37818 return 0;
37819
37820- if (!tty->open_count)
37821+ if (!local_read(&tty->open_count))
37822 return 0;
37823
37824 return tty->tx_bytes_queued;
37825@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
37826 if (!tty)
37827 return -ENODEV;
37828
37829- if (!tty->open_count)
37830+ if (!local_read(&tty->open_count))
37831 return -EINVAL;
37832
37833 return get_control_lines(tty);
37834@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
37835 if (!tty)
37836 return -ENODEV;
37837
37838- if (!tty->open_count)
37839+ if (!local_read(&tty->open_count))
37840 return -EINVAL;
37841
37842 return set_control_lines(tty, set, clear);
37843@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
37844 if (!tty)
37845 return -ENODEV;
37846
37847- if (!tty->open_count)
37848+ if (!local_read(&tty->open_count))
37849 return -EINVAL;
37850
37851 /* FIXME: Exactly how is the tty object locked here .. */
37852@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
37853 against a parallel ioctl etc */
37854 mutex_lock(&ttyj->ipw_tty_mutex);
37855 }
37856- while (ttyj->open_count)
37857+ while (local_read(&ttyj->open_count))
37858 do_ipw_close(ttyj);
37859 ipwireless_disassociate_network_ttys(network,
37860 ttyj->channel_idx);
37861diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
37862index 8a50e4e..7d9ca3d 100644
37863--- a/drivers/tty/n_gsm.c
37864+++ b/drivers/tty/n_gsm.c
37865@@ -1625,7 +1625,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
37866 kref_init(&dlci->ref);
37867 mutex_init(&dlci->mutex);
37868 dlci->fifo = &dlci->_fifo;
37869- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
37870+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
37871 kfree(dlci);
37872 return NULL;
37873 }
37874diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
37875index 39d6ab6..eb97f41 100644
37876--- a/drivers/tty/n_tty.c
37877+++ b/drivers/tty/n_tty.c
37878@@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
37879 {
37880 *ops = tty_ldisc_N_TTY;
37881 ops->owner = NULL;
37882- ops->refcount = ops->flags = 0;
37883+ atomic_set(&ops->refcount, 0);
37884+ ops->flags = 0;
37885 }
37886 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
37887diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
37888index e18604b..a7d5a11 100644
37889--- a/drivers/tty/pty.c
37890+++ b/drivers/tty/pty.c
37891@@ -773,8 +773,10 @@ static void __init unix98_pty_init(void)
37892 register_sysctl_table(pty_root_table);
37893
37894 /* Now create the /dev/ptmx special device */
37895+ pax_open_kernel();
37896 tty_default_fops(&ptmx_fops);
37897- ptmx_fops.open = ptmx_open;
37898+ *(void **)&ptmx_fops.open = ptmx_open;
37899+ pax_close_kernel();
37900
37901 cdev_init(&ptmx_cdev, &ptmx_fops);
37902 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
37903diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
37904index 6a1241c..d04ab0d 100644
37905--- a/drivers/tty/rocket.c
37906+++ b/drivers/tty/rocket.c
37907@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
37908 struct rocket_ports tmp;
37909 int board;
37910
37911+ pax_track_stack();
37912+
37913 if (!retports)
37914 return -EFAULT;
37915 memset(&tmp, 0, sizeof (tmp));
37916diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
37917index 87e7e6c..89744e0 100644
37918--- a/drivers/tty/serial/kgdboc.c
37919+++ b/drivers/tty/serial/kgdboc.c
37920@@ -23,8 +23,9 @@
37921 #define MAX_CONFIG_LEN 40
37922
37923 static struct kgdb_io kgdboc_io_ops;
37924+static struct kgdb_io kgdboc_io_ops_console;
37925
37926-/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
37927+/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
37928 static int configured = -1;
37929
37930 static char config[MAX_CONFIG_LEN];
37931@@ -147,6 +148,8 @@ static void cleanup_kgdboc(void)
37932 kgdboc_unregister_kbd();
37933 if (configured == 1)
37934 kgdb_unregister_io_module(&kgdboc_io_ops);
37935+ else if (configured == 2)
37936+ kgdb_unregister_io_module(&kgdboc_io_ops_console);
37937 }
37938
37939 static int configure_kgdboc(void)
37940@@ -156,13 +159,13 @@ static int configure_kgdboc(void)
37941 int err;
37942 char *cptr = config;
37943 struct console *cons;
37944+ int is_console = 0;
37945
37946 err = kgdboc_option_setup(config);
37947 if (err || !strlen(config) || isspace(config[0]))
37948 goto noconfig;
37949
37950 err = -ENODEV;
37951- kgdboc_io_ops.is_console = 0;
37952 kgdb_tty_driver = NULL;
37953
37954 kgdboc_use_kms = 0;
37955@@ -183,7 +186,7 @@ static int configure_kgdboc(void)
37956 int idx;
37957 if (cons->device && cons->device(cons, &idx) == p &&
37958 idx == tty_line) {
37959- kgdboc_io_ops.is_console = 1;
37960+ is_console = 1;
37961 break;
37962 }
37963 cons = cons->next;
37964@@ -193,12 +196,16 @@ static int configure_kgdboc(void)
37965 kgdb_tty_line = tty_line;
37966
37967 do_register:
37968- err = kgdb_register_io_module(&kgdboc_io_ops);
37969+ if (is_console) {
37970+ err = kgdb_register_io_module(&kgdboc_io_ops_console);
37971+ configured = 2;
37972+ } else {
37973+ err = kgdb_register_io_module(&kgdboc_io_ops);
37974+ configured = 1;
37975+ }
37976 if (err)
37977 goto noconfig;
37978
37979- configured = 1;
37980-
37981 return 0;
37982
37983 noconfig:
37984@@ -212,7 +219,7 @@ noconfig:
37985 static int __init init_kgdboc(void)
37986 {
37987 /* Already configured? */
37988- if (configured == 1)
37989+ if (configured >= 1)
37990 return 0;
37991
37992 return configure_kgdboc();
37993@@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
37994 if (config[len - 1] == '\n')
37995 config[len - 1] = '\0';
37996
37997- if (configured == 1)
37998+ if (configured >= 1)
37999 cleanup_kgdboc();
38000
38001 /* Go and configure with the new params. */
38002@@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = {
38003 .post_exception = kgdboc_post_exp_handler,
38004 };
38005
38006+static struct kgdb_io kgdboc_io_ops_console = {
38007+ .name = "kgdboc",
38008+ .read_char = kgdboc_get_char,
38009+ .write_char = kgdboc_put_char,
38010+ .pre_exception = kgdboc_pre_exp_handler,
38011+ .post_exception = kgdboc_post_exp_handler,
38012+ .is_console = 1
38013+};
38014+
38015 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
38016 /* This is only available if kgdboc is a built in for early debugging */
38017 static int __init kgdboc_early_init(char *opt)
38018diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
38019index cab52f4..29fc6aa 100644
38020--- a/drivers/tty/serial/mfd.c
38021+++ b/drivers/tty/serial/mfd.c
38022@@ -1423,7 +1423,7 @@ static void serial_hsu_remove(struct pci_dev *pdev)
38023 }
38024
38025 /* First 3 are UART ports, and the 4th is the DMA */
38026-static const struct pci_device_id pci_ids[] __devinitdata = {
38027+static const struct pci_device_id pci_ids[] __devinitconst = {
38028 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
38029 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
38030 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
38031diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
38032index 23bc743..d425c07 100644
38033--- a/drivers/tty/serial/mrst_max3110.c
38034+++ b/drivers/tty/serial/mrst_max3110.c
38035@@ -393,6 +393,8 @@ static void max3110_con_receive(struct uart_max3110 *max)
38036 int loop = 1, num, total = 0;
38037 u8 recv_buf[512], *pbuf;
38038
38039+ pax_track_stack();
38040+
38041 pbuf = recv_buf;
38042 do {
38043 num = max3110_read_multi(max, pbuf);
38044diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
38045index 1a890e2..1d8139c 100644
38046--- a/drivers/tty/tty_io.c
38047+++ b/drivers/tty/tty_io.c
38048@@ -3238,7 +3238,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
38049
38050 void tty_default_fops(struct file_operations *fops)
38051 {
38052- *fops = tty_fops;
38053+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
38054 }
38055
38056 /*
38057diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
38058index a76c808..ecbc743 100644
38059--- a/drivers/tty/tty_ldisc.c
38060+++ b/drivers/tty/tty_ldisc.c
38061@@ -75,7 +75,7 @@ static void put_ldisc(struct tty_ldisc *ld)
38062 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
38063 struct tty_ldisc_ops *ldo = ld->ops;
38064
38065- ldo->refcount--;
38066+ atomic_dec(&ldo->refcount);
38067 module_put(ldo->owner);
38068 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38069
38070@@ -110,7 +110,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
38071 spin_lock_irqsave(&tty_ldisc_lock, flags);
38072 tty_ldiscs[disc] = new_ldisc;
38073 new_ldisc->num = disc;
38074- new_ldisc->refcount = 0;
38075+ atomic_set(&new_ldisc->refcount, 0);
38076 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38077
38078 return ret;
38079@@ -138,7 +138,7 @@ int tty_unregister_ldisc(int disc)
38080 return -EINVAL;
38081
38082 spin_lock_irqsave(&tty_ldisc_lock, flags);
38083- if (tty_ldiscs[disc]->refcount)
38084+ if (atomic_read(&tty_ldiscs[disc]->refcount))
38085 ret = -EBUSY;
38086 else
38087 tty_ldiscs[disc] = NULL;
38088@@ -159,7 +159,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
38089 if (ldops) {
38090 ret = ERR_PTR(-EAGAIN);
38091 if (try_module_get(ldops->owner)) {
38092- ldops->refcount++;
38093+ atomic_inc(&ldops->refcount);
38094 ret = ldops;
38095 }
38096 }
38097@@ -172,7 +172,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
38098 unsigned long flags;
38099
38100 spin_lock_irqsave(&tty_ldisc_lock, flags);
38101- ldops->refcount--;
38102+ atomic_dec(&ldops->refcount);
38103 module_put(ldops->owner);
38104 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38105 }
38106diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
38107index 3761ccf..2c613b3 100644
38108--- a/drivers/tty/vt/keyboard.c
38109+++ b/drivers/tty/vt/keyboard.c
38110@@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
38111 kbd->kbdmode == VC_OFF) &&
38112 value != KVAL(K_SAK))
38113 return; /* SAK is allowed even in raw mode */
38114+
38115+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
38116+ {
38117+ void *func = fn_handler[value];
38118+ if (func == fn_show_state || func == fn_show_ptregs ||
38119+ func == fn_show_mem)
38120+ return;
38121+ }
38122+#endif
38123+
38124 fn_handler[value](vc);
38125 }
38126
38127diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
38128index b3915b7..e716839 100644
38129--- a/drivers/tty/vt/vt.c
38130+++ b/drivers/tty/vt/vt.c
38131@@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
38132
38133 static void notify_write(struct vc_data *vc, unsigned int unicode)
38134 {
38135- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
38136+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
38137 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
38138 }
38139
38140diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
38141index 5e096f4..0da1363 100644
38142--- a/drivers/tty/vt/vt_ioctl.c
38143+++ b/drivers/tty/vt/vt_ioctl.c
38144@@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38145 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
38146 return -EFAULT;
38147
38148- if (!capable(CAP_SYS_TTY_CONFIG))
38149- perm = 0;
38150-
38151 switch (cmd) {
38152 case KDGKBENT:
38153 key_map = key_maps[s];
38154@@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38155 val = (i ? K_HOLE : K_NOSUCHMAP);
38156 return put_user(val, &user_kbe->kb_value);
38157 case KDSKBENT:
38158+ if (!capable(CAP_SYS_TTY_CONFIG))
38159+ perm = 0;
38160+
38161 if (!perm)
38162 return -EPERM;
38163 if (!i && v == K_NOSUCHMAP) {
38164@@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38165 int i, j, k;
38166 int ret;
38167
38168- if (!capable(CAP_SYS_TTY_CONFIG))
38169- perm = 0;
38170-
38171 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
38172 if (!kbs) {
38173 ret = -ENOMEM;
38174@@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38175 kfree(kbs);
38176 return ((p && *p) ? -EOVERFLOW : 0);
38177 case KDSKBSENT:
38178+ if (!capable(CAP_SYS_TTY_CONFIG))
38179+ perm = 0;
38180+
38181 if (!perm) {
38182 ret = -EPERM;
38183 goto reterr;
38184diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
38185index d2efe82..9440ab6 100644
38186--- a/drivers/uio/uio.c
38187+++ b/drivers/uio/uio.c
38188@@ -25,6 +25,7 @@
38189 #include <linux/kobject.h>
38190 #include <linux/cdev.h>
38191 #include <linux/uio_driver.h>
38192+#include <asm/local.h>
38193
38194 #define UIO_MAX_DEVICES (1U << MINORBITS)
38195
38196@@ -32,10 +33,10 @@ struct uio_device {
38197 struct module *owner;
38198 struct device *dev;
38199 int minor;
38200- atomic_t event;
38201+ atomic_unchecked_t event;
38202 struct fasync_struct *async_queue;
38203 wait_queue_head_t wait;
38204- int vma_count;
38205+ local_t vma_count;
38206 struct uio_info *info;
38207 struct kobject *map_dir;
38208 struct kobject *portio_dir;
38209@@ -242,7 +243,7 @@ static ssize_t show_event(struct device *dev,
38210 struct device_attribute *attr, char *buf)
38211 {
38212 struct uio_device *idev = dev_get_drvdata(dev);
38213- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
38214+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
38215 }
38216
38217 static struct device_attribute uio_class_attributes[] = {
38218@@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *info)
38219 {
38220 struct uio_device *idev = info->uio_dev;
38221
38222- atomic_inc(&idev->event);
38223+ atomic_inc_unchecked(&idev->event);
38224 wake_up_interruptible(&idev->wait);
38225 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
38226 }
38227@@ -461,7 +462,7 @@ static int uio_open(struct inode *inode, struct file *filep)
38228 }
38229
38230 listener->dev = idev;
38231- listener->event_count = atomic_read(&idev->event);
38232+ listener->event_count = atomic_read_unchecked(&idev->event);
38233 filep->private_data = listener;
38234
38235 if (idev->info->open) {
38236@@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
38237 return -EIO;
38238
38239 poll_wait(filep, &idev->wait, wait);
38240- if (listener->event_count != atomic_read(&idev->event))
38241+ if (listener->event_count != atomic_read_unchecked(&idev->event))
38242 return POLLIN | POLLRDNORM;
38243 return 0;
38244 }
38245@@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
38246 do {
38247 set_current_state(TASK_INTERRUPTIBLE);
38248
38249- event_count = atomic_read(&idev->event);
38250+ event_count = atomic_read_unchecked(&idev->event);
38251 if (event_count != listener->event_count) {
38252 if (copy_to_user(buf, &event_count, count))
38253 retval = -EFAULT;
38254@@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
38255 static void uio_vma_open(struct vm_area_struct *vma)
38256 {
38257 struct uio_device *idev = vma->vm_private_data;
38258- idev->vma_count++;
38259+ local_inc(&idev->vma_count);
38260 }
38261
38262 static void uio_vma_close(struct vm_area_struct *vma)
38263 {
38264 struct uio_device *idev = vma->vm_private_data;
38265- idev->vma_count--;
38266+ local_dec(&idev->vma_count);
38267 }
38268
38269 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
38270@@ -823,7 +824,7 @@ int __uio_register_device(struct module *owner,
38271 idev->owner = owner;
38272 idev->info = info;
38273 init_waitqueue_head(&idev->wait);
38274- atomic_set(&idev->event, 0);
38275+ atomic_set_unchecked(&idev->event, 0);
38276
38277 ret = uio_get_minor(idev);
38278 if (ret)
38279diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
38280index a845f8b..4f54072 100644
38281--- a/drivers/usb/atm/cxacru.c
38282+++ b/drivers/usb/atm/cxacru.c
38283@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
38284 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
38285 if (ret < 2)
38286 return -EINVAL;
38287- if (index < 0 || index > 0x7f)
38288+ if (index > 0x7f)
38289 return -EINVAL;
38290 pos += tmp;
38291
38292diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
38293index d3448ca..d2864ca 100644
38294--- a/drivers/usb/atm/usbatm.c
38295+++ b/drivers/usb/atm/usbatm.c
38296@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38297 if (printk_ratelimit())
38298 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
38299 __func__, vpi, vci);
38300- atomic_inc(&vcc->stats->rx_err);
38301+ atomic_inc_unchecked(&vcc->stats->rx_err);
38302 return;
38303 }
38304
38305@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38306 if (length > ATM_MAX_AAL5_PDU) {
38307 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
38308 __func__, length, vcc);
38309- atomic_inc(&vcc->stats->rx_err);
38310+ atomic_inc_unchecked(&vcc->stats->rx_err);
38311 goto out;
38312 }
38313
38314@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38315 if (sarb->len < pdu_length) {
38316 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
38317 __func__, pdu_length, sarb->len, vcc);
38318- atomic_inc(&vcc->stats->rx_err);
38319+ atomic_inc_unchecked(&vcc->stats->rx_err);
38320 goto out;
38321 }
38322
38323 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
38324 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
38325 __func__, vcc);
38326- atomic_inc(&vcc->stats->rx_err);
38327+ atomic_inc_unchecked(&vcc->stats->rx_err);
38328 goto out;
38329 }
38330
38331@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38332 if (printk_ratelimit())
38333 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
38334 __func__, length);
38335- atomic_inc(&vcc->stats->rx_drop);
38336+ atomic_inc_unchecked(&vcc->stats->rx_drop);
38337 goto out;
38338 }
38339
38340@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38341
38342 vcc->push(vcc, skb);
38343
38344- atomic_inc(&vcc->stats->rx);
38345+ atomic_inc_unchecked(&vcc->stats->rx);
38346 out:
38347 skb_trim(sarb, 0);
38348 }
38349@@ -615,7 +615,7 @@ static void usbatm_tx_process(unsigned long data)
38350 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
38351
38352 usbatm_pop(vcc, skb);
38353- atomic_inc(&vcc->stats->tx);
38354+ atomic_inc_unchecked(&vcc->stats->tx);
38355
38356 skb = skb_dequeue(&instance->sndqueue);
38357 }
38358@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
38359 if (!left--)
38360 return sprintf(page,
38361 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
38362- atomic_read(&atm_dev->stats.aal5.tx),
38363- atomic_read(&atm_dev->stats.aal5.tx_err),
38364- atomic_read(&atm_dev->stats.aal5.rx),
38365- atomic_read(&atm_dev->stats.aal5.rx_err),
38366- atomic_read(&atm_dev->stats.aal5.rx_drop));
38367+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
38368+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
38369+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
38370+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
38371+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
38372
38373 if (!left--) {
38374 if (instance->disconnected)
38375diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
38376index 0149c09..f108812 100644
38377--- a/drivers/usb/core/devices.c
38378+++ b/drivers/usb/core/devices.c
38379@@ -126,7 +126,7 @@ static const char format_endpt[] =
38380 * time it gets called.
38381 */
38382 static struct device_connect_event {
38383- atomic_t count;
38384+ atomic_unchecked_t count;
38385 wait_queue_head_t wait;
38386 } device_event = {
38387 .count = ATOMIC_INIT(1),
38388@@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
38389
38390 void usbfs_conn_disc_event(void)
38391 {
38392- atomic_add(2, &device_event.count);
38393+ atomic_add_unchecked(2, &device_event.count);
38394 wake_up(&device_event.wait);
38395 }
38396
38397@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(struct file *file,
38398
38399 poll_wait(file, &device_event.wait, wait);
38400
38401- event_count = atomic_read(&device_event.count);
38402+ event_count = atomic_read_unchecked(&device_event.count);
38403 if (file->f_version != event_count) {
38404 file->f_version = event_count;
38405 return POLLIN | POLLRDNORM;
38406diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
38407index 0b5ec23..0da3d76 100644
38408--- a/drivers/usb/core/message.c
38409+++ b/drivers/usb/core/message.c
38410@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device *udev, int index)
38411 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
38412 if (buf) {
38413 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
38414- if (len > 0) {
38415- smallbuf = kmalloc(++len, GFP_NOIO);
38416+ if (len++ > 0) {
38417+ smallbuf = kmalloc(len, GFP_NOIO);
38418 if (!smallbuf)
38419 return buf;
38420 memcpy(smallbuf, buf, len);
38421diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
38422index 1fc8f12..20647c1 100644
38423--- a/drivers/usb/early/ehci-dbgp.c
38424+++ b/drivers/usb/early/ehci-dbgp.c
38425@@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
38426
38427 #ifdef CONFIG_KGDB
38428 static struct kgdb_io kgdbdbgp_io_ops;
38429-#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
38430+static struct kgdb_io kgdbdbgp_io_ops_console;
38431+#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
38432 #else
38433 #define dbgp_kgdb_mode (0)
38434 #endif
38435@@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
38436 .write_char = kgdbdbgp_write_char,
38437 };
38438
38439+static struct kgdb_io kgdbdbgp_io_ops_console = {
38440+ .name = "kgdbdbgp",
38441+ .read_char = kgdbdbgp_read_char,
38442+ .write_char = kgdbdbgp_write_char,
38443+ .is_console = 1
38444+};
38445+
38446 static int kgdbdbgp_wait_time;
38447
38448 static int __init kgdbdbgp_parse_config(char *str)
38449@@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(char *str)
38450 ptr++;
38451 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
38452 }
38453- kgdb_register_io_module(&kgdbdbgp_io_ops);
38454- kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
38455+ if (early_dbgp_console.index != -1)
38456+ kgdb_register_io_module(&kgdbdbgp_io_ops_console);
38457+ else
38458+ kgdb_register_io_module(&kgdbdbgp_io_ops);
38459
38460 return 0;
38461 }
38462diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
38463index d718033..6075579 100644
38464--- a/drivers/usb/host/xhci-mem.c
38465+++ b/drivers/usb/host/xhci-mem.c
38466@@ -1685,6 +1685,8 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
38467 unsigned int num_tests;
38468 int i, ret;
38469
38470+ pax_track_stack();
38471+
38472 num_tests = ARRAY_SIZE(simple_test_vector);
38473 for (i = 0; i < num_tests; i++) {
38474 ret = xhci_test_trb_in_td(xhci,
38475diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
38476index d6bea3e..60b250e 100644
38477--- a/drivers/usb/wusbcore/wa-hc.h
38478+++ b/drivers/usb/wusbcore/wa-hc.h
38479@@ -192,7 +192,7 @@ struct wahc {
38480 struct list_head xfer_delayed_list;
38481 spinlock_t xfer_list_lock;
38482 struct work_struct xfer_work;
38483- atomic_t xfer_id_count;
38484+ atomic_unchecked_t xfer_id_count;
38485 };
38486
38487
38488@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
38489 INIT_LIST_HEAD(&wa->xfer_delayed_list);
38490 spin_lock_init(&wa->xfer_list_lock);
38491 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
38492- atomic_set(&wa->xfer_id_count, 1);
38493+ atomic_set_unchecked(&wa->xfer_id_count, 1);
38494 }
38495
38496 /**
38497diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
38498index 4193345..49ae93d 100644
38499--- a/drivers/usb/wusbcore/wa-xfer.c
38500+++ b/drivers/usb/wusbcore/wa-xfer.c
38501@@ -295,7 +295,7 @@ out:
38502 */
38503 static void wa_xfer_id_init(struct wa_xfer *xfer)
38504 {
38505- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
38506+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
38507 }
38508
38509 /*
38510diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
38511index c14c42b..f955cc2 100644
38512--- a/drivers/vhost/vhost.c
38513+++ b/drivers/vhost/vhost.c
38514@@ -629,7 +629,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
38515 return 0;
38516 }
38517
38518-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
38519+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
38520 {
38521 struct file *eventfp, *filep = NULL,
38522 *pollstart = NULL, *pollstop = NULL;
38523diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
38524index b0b2ac3..89a4399 100644
38525--- a/drivers/video/aty/aty128fb.c
38526+++ b/drivers/video/aty/aty128fb.c
38527@@ -148,7 +148,7 @@ enum {
38528 };
38529
38530 /* Must match above enum */
38531-static const char *r128_family[] __devinitdata = {
38532+static const char *r128_family[] __devinitconst = {
38533 "AGP",
38534 "PCI",
38535 "PRO AGP",
38536diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
38537index 5c3960d..15cf8fc 100644
38538--- a/drivers/video/fbcmap.c
38539+++ b/drivers/video/fbcmap.c
38540@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
38541 rc = -ENODEV;
38542 goto out;
38543 }
38544- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
38545- !info->fbops->fb_setcmap)) {
38546+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
38547 rc = -EINVAL;
38548 goto out1;
38549 }
38550diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
38551index ad93629..ca6a218 100644
38552--- a/drivers/video/fbmem.c
38553+++ b/drivers/video/fbmem.c
38554@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38555 image->dx += image->width + 8;
38556 }
38557 } else if (rotate == FB_ROTATE_UD) {
38558- for (x = 0; x < num && image->dx >= 0; x++) {
38559+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
38560 info->fbops->fb_imageblit(info, image);
38561 image->dx -= image->width + 8;
38562 }
38563@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38564 image->dy += image->height + 8;
38565 }
38566 } else if (rotate == FB_ROTATE_CCW) {
38567- for (x = 0; x < num && image->dy >= 0; x++) {
38568+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
38569 info->fbops->fb_imageblit(info, image);
38570 image->dy -= image->height + 8;
38571 }
38572@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
38573 int flags = info->flags;
38574 int ret = 0;
38575
38576+ pax_track_stack();
38577+
38578 if (var->activate & FB_ACTIVATE_INV_MODE) {
38579 struct fb_videomode mode1, mode2;
38580
38581@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38582 void __user *argp = (void __user *)arg;
38583 long ret = 0;
38584
38585+ pax_track_stack();
38586+
38587 switch (cmd) {
38588 case FBIOGET_VSCREENINFO:
38589 if (!lock_fb_info(info))
38590@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38591 return -EFAULT;
38592 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
38593 return -EINVAL;
38594- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
38595+ if (con2fb.framebuffer >= FB_MAX)
38596 return -EINVAL;
38597 if (!registered_fb[con2fb.framebuffer])
38598 request_module("fb%d", con2fb.framebuffer);
38599diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
38600index 5a5d092..265c5ed 100644
38601--- a/drivers/video/geode/gx1fb_core.c
38602+++ b/drivers/video/geode/gx1fb_core.c
38603@@ -29,7 +29,7 @@ static int crt_option = 1;
38604 static char panel_option[32] = "";
38605
38606 /* Modes relevant to the GX1 (taken from modedb.c) */
38607-static const struct fb_videomode __devinitdata gx1_modedb[] = {
38608+static const struct fb_videomode __devinitconst gx1_modedb[] = {
38609 /* 640x480-60 VESA */
38610 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
38611 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
38612diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
38613index 896e53d..4d87d0b 100644
38614--- a/drivers/video/gxt4500.c
38615+++ b/drivers/video/gxt4500.c
38616@@ -156,7 +156,7 @@ struct gxt4500_par {
38617 static char *mode_option;
38618
38619 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
38620-static const struct fb_videomode defaultmode __devinitdata = {
38621+static const struct fb_videomode defaultmode __devinitconst = {
38622 .refresh = 60,
38623 .xres = 1280,
38624 .yres = 1024,
38625@@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
38626 return 0;
38627 }
38628
38629-static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
38630+static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
38631 .id = "IBM GXT4500P",
38632 .type = FB_TYPE_PACKED_PIXELS,
38633 .visual = FB_VISUAL_PSEUDOCOLOR,
38634diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
38635index 7672d2e..b56437f 100644
38636--- a/drivers/video/i810/i810_accel.c
38637+++ b/drivers/video/i810/i810_accel.c
38638@@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
38639 }
38640 }
38641 printk("ringbuffer lockup!!!\n");
38642+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
38643 i810_report_error(mmio);
38644 par->dev_flags |= LOCKUP;
38645 info->pixmap.scan_align = 1;
38646diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
38647index 318f6fb..9a389c1 100644
38648--- a/drivers/video/i810/i810_main.c
38649+++ b/drivers/video/i810/i810_main.c
38650@@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
38651 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
38652
38653 /* PCI */
38654-static const char *i810_pci_list[] __devinitdata = {
38655+static const char *i810_pci_list[] __devinitconst = {
38656 "Intel(R) 810 Framebuffer Device" ,
38657 "Intel(R) 810-DC100 Framebuffer Device" ,
38658 "Intel(R) 810E Framebuffer Device" ,
38659diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
38660index de36693..3c63fc2 100644
38661--- a/drivers/video/jz4740_fb.c
38662+++ b/drivers/video/jz4740_fb.c
38663@@ -136,7 +136,7 @@ struct jzfb {
38664 uint32_t pseudo_palette[16];
38665 };
38666
38667-static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
38668+static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
38669 .id = "JZ4740 FB",
38670 .type = FB_TYPE_PACKED_PIXELS,
38671 .visual = FB_VISUAL_TRUECOLOR,
38672diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
38673index 3c14e43..eafa544 100644
38674--- a/drivers/video/logo/logo_linux_clut224.ppm
38675+++ b/drivers/video/logo/logo_linux_clut224.ppm
38676@@ -1,1604 +1,1123 @@
38677 P3
38678-# Standard 224-color Linux logo
38679 80 80
38680 255
38681- 0 0 0 0 0 0 0 0 0 0 0 0
38682- 0 0 0 0 0 0 0 0 0 0 0 0
38683- 0 0 0 0 0 0 0 0 0 0 0 0
38684- 0 0 0 0 0 0 0 0 0 0 0 0
38685- 0 0 0 0 0 0 0 0 0 0 0 0
38686- 0 0 0 0 0 0 0 0 0 0 0 0
38687- 0 0 0 0 0 0 0 0 0 0 0 0
38688- 0 0 0 0 0 0 0 0 0 0 0 0
38689- 0 0 0 0 0 0 0 0 0 0 0 0
38690- 6 6 6 6 6 6 10 10 10 10 10 10
38691- 10 10 10 6 6 6 6 6 6 6 6 6
38692- 0 0 0 0 0 0 0 0 0 0 0 0
38693- 0 0 0 0 0 0 0 0 0 0 0 0
38694- 0 0 0 0 0 0 0 0 0 0 0 0
38695- 0 0 0 0 0 0 0 0 0 0 0 0
38696- 0 0 0 0 0 0 0 0 0 0 0 0
38697- 0 0 0 0 0 0 0 0 0 0 0 0
38698- 0 0 0 0 0 0 0 0 0 0 0 0
38699- 0 0 0 0 0 0 0 0 0 0 0 0
38700- 0 0 0 0 0 0 0 0 0 0 0 0
38701- 0 0 0 0 0 0 0 0 0 0 0 0
38702- 0 0 0 0 0 0 0 0 0 0 0 0
38703- 0 0 0 0 0 0 0 0 0 0 0 0
38704- 0 0 0 0 0 0 0 0 0 0 0 0
38705- 0 0 0 0 0 0 0 0 0 0 0 0
38706- 0 0 0 0 0 0 0 0 0 0 0 0
38707- 0 0 0 0 0 0 0 0 0 0 0 0
38708- 0 0 0 0 0 0 0 0 0 0 0 0
38709- 0 0 0 6 6 6 10 10 10 14 14 14
38710- 22 22 22 26 26 26 30 30 30 34 34 34
38711- 30 30 30 30 30 30 26 26 26 18 18 18
38712- 14 14 14 10 10 10 6 6 6 0 0 0
38713- 0 0 0 0 0 0 0 0 0 0 0 0
38714- 0 0 0 0 0 0 0 0 0 0 0 0
38715- 0 0 0 0 0 0 0 0 0 0 0 0
38716- 0 0 0 0 0 0 0 0 0 0 0 0
38717- 0 0 0 0 0 0 0 0 0 0 0 0
38718- 0 0 0 0 0 0 0 0 0 0 0 0
38719- 0 0 0 0 0 0 0 0 0 0 0 0
38720- 0 0 0 0 0 0 0 0 0 0 0 0
38721- 0 0 0 0 0 0 0 0 0 0 0 0
38722- 0 0 0 0 0 1 0 0 1 0 0 0
38723- 0 0 0 0 0 0 0 0 0 0 0 0
38724- 0 0 0 0 0 0 0 0 0 0 0 0
38725- 0 0 0 0 0 0 0 0 0 0 0 0
38726- 0 0 0 0 0 0 0 0 0 0 0 0
38727- 0 0 0 0 0 0 0 0 0 0 0 0
38728- 0 0 0 0 0 0 0 0 0 0 0 0
38729- 6 6 6 14 14 14 26 26 26 42 42 42
38730- 54 54 54 66 66 66 78 78 78 78 78 78
38731- 78 78 78 74 74 74 66 66 66 54 54 54
38732- 42 42 42 26 26 26 18 18 18 10 10 10
38733- 6 6 6 0 0 0 0 0 0 0 0 0
38734- 0 0 0 0 0 0 0 0 0 0 0 0
38735- 0 0 0 0 0 0 0 0 0 0 0 0
38736- 0 0 0 0 0 0 0 0 0 0 0 0
38737- 0 0 0 0 0 0 0 0 0 0 0 0
38738- 0 0 0 0 0 0 0 0 0 0 0 0
38739- 0 0 0 0 0 0 0 0 0 0 0 0
38740- 0 0 0 0 0 0 0 0 0 0 0 0
38741- 0 0 0 0 0 0 0 0 0 0 0 0
38742- 0 0 1 0 0 0 0 0 0 0 0 0
38743- 0 0 0 0 0 0 0 0 0 0 0 0
38744- 0 0 0 0 0 0 0 0 0 0 0 0
38745- 0 0 0 0 0 0 0 0 0 0 0 0
38746- 0 0 0 0 0 0 0 0 0 0 0 0
38747- 0 0 0 0 0 0 0 0 0 0 0 0
38748- 0 0 0 0 0 0 0 0 0 10 10 10
38749- 22 22 22 42 42 42 66 66 66 86 86 86
38750- 66 66 66 38 38 38 38 38 38 22 22 22
38751- 26 26 26 34 34 34 54 54 54 66 66 66
38752- 86 86 86 70 70 70 46 46 46 26 26 26
38753- 14 14 14 6 6 6 0 0 0 0 0 0
38754- 0 0 0 0 0 0 0 0 0 0 0 0
38755- 0 0 0 0 0 0 0 0 0 0 0 0
38756- 0 0 0 0 0 0 0 0 0 0 0 0
38757- 0 0 0 0 0 0 0 0 0 0 0 0
38758- 0 0 0 0 0 0 0 0 0 0 0 0
38759- 0 0 0 0 0 0 0 0 0 0 0 0
38760- 0 0 0 0 0 0 0 0 0 0 0 0
38761- 0 0 0 0 0 0 0 0 0 0 0 0
38762- 0 0 1 0 0 1 0 0 1 0 0 0
38763- 0 0 0 0 0 0 0 0 0 0 0 0
38764- 0 0 0 0 0 0 0 0 0 0 0 0
38765- 0 0 0 0 0 0 0 0 0 0 0 0
38766- 0 0 0 0 0 0 0 0 0 0 0 0
38767- 0 0 0 0 0 0 0 0 0 0 0 0
38768- 0 0 0 0 0 0 10 10 10 26 26 26
38769- 50 50 50 82 82 82 58 58 58 6 6 6
38770- 2 2 6 2 2 6 2 2 6 2 2 6
38771- 2 2 6 2 2 6 2 2 6 2 2 6
38772- 6 6 6 54 54 54 86 86 86 66 66 66
38773- 38 38 38 18 18 18 6 6 6 0 0 0
38774- 0 0 0 0 0 0 0 0 0 0 0 0
38775- 0 0 0 0 0 0 0 0 0 0 0 0
38776- 0 0 0 0 0 0 0 0 0 0 0 0
38777- 0 0 0 0 0 0 0 0 0 0 0 0
38778- 0 0 0 0 0 0 0 0 0 0 0 0
38779- 0 0 0 0 0 0 0 0 0 0 0 0
38780- 0 0 0 0 0 0 0 0 0 0 0 0
38781- 0 0 0 0 0 0 0 0 0 0 0 0
38782- 0 0 0 0 0 0 0 0 0 0 0 0
38783- 0 0 0 0 0 0 0 0 0 0 0 0
38784- 0 0 0 0 0 0 0 0 0 0 0 0
38785- 0 0 0 0 0 0 0 0 0 0 0 0
38786- 0 0 0 0 0 0 0 0 0 0 0 0
38787- 0 0 0 0 0 0 0 0 0 0 0 0
38788- 0 0 0 6 6 6 22 22 22 50 50 50
38789- 78 78 78 34 34 34 2 2 6 2 2 6
38790- 2 2 6 2 2 6 2 2 6 2 2 6
38791- 2 2 6 2 2 6 2 2 6 2 2 6
38792- 2 2 6 2 2 6 6 6 6 70 70 70
38793- 78 78 78 46 46 46 22 22 22 6 6 6
38794- 0 0 0 0 0 0 0 0 0 0 0 0
38795- 0 0 0 0 0 0 0 0 0 0 0 0
38796- 0 0 0 0 0 0 0 0 0 0 0 0
38797- 0 0 0 0 0 0 0 0 0 0 0 0
38798- 0 0 0 0 0 0 0 0 0 0 0 0
38799- 0 0 0 0 0 0 0 0 0 0 0 0
38800- 0 0 0 0 0 0 0 0 0 0 0 0
38801- 0 0 0 0 0 0 0 0 0 0 0 0
38802- 0 0 1 0 0 1 0 0 1 0 0 0
38803- 0 0 0 0 0 0 0 0 0 0 0 0
38804- 0 0 0 0 0 0 0 0 0 0 0 0
38805- 0 0 0 0 0 0 0 0 0 0 0 0
38806- 0 0 0 0 0 0 0 0 0 0 0 0
38807- 0 0 0 0 0 0 0 0 0 0 0 0
38808- 6 6 6 18 18 18 42 42 42 82 82 82
38809- 26 26 26 2 2 6 2 2 6 2 2 6
38810- 2 2 6 2 2 6 2 2 6 2 2 6
38811- 2 2 6 2 2 6 2 2 6 14 14 14
38812- 46 46 46 34 34 34 6 6 6 2 2 6
38813- 42 42 42 78 78 78 42 42 42 18 18 18
38814- 6 6 6 0 0 0 0 0 0 0 0 0
38815- 0 0 0 0 0 0 0 0 0 0 0 0
38816- 0 0 0 0 0 0 0 0 0 0 0 0
38817- 0 0 0 0 0 0 0 0 0 0 0 0
38818- 0 0 0 0 0 0 0 0 0 0 0 0
38819- 0 0 0 0 0 0 0 0 0 0 0 0
38820- 0 0 0 0 0 0 0 0 0 0 0 0
38821- 0 0 0 0 0 0 0 0 0 0 0 0
38822- 0 0 1 0 0 0 0 0 1 0 0 0
38823- 0 0 0 0 0 0 0 0 0 0 0 0
38824- 0 0 0 0 0 0 0 0 0 0 0 0
38825- 0 0 0 0 0 0 0 0 0 0 0 0
38826- 0 0 0 0 0 0 0 0 0 0 0 0
38827- 0 0 0 0 0 0 0 0 0 0 0 0
38828- 10 10 10 30 30 30 66 66 66 58 58 58
38829- 2 2 6 2 2 6 2 2 6 2 2 6
38830- 2 2 6 2 2 6 2 2 6 2 2 6
38831- 2 2 6 2 2 6 2 2 6 26 26 26
38832- 86 86 86 101 101 101 46 46 46 10 10 10
38833- 2 2 6 58 58 58 70 70 70 34 34 34
38834- 10 10 10 0 0 0 0 0 0 0 0 0
38835- 0 0 0 0 0 0 0 0 0 0 0 0
38836- 0 0 0 0 0 0 0 0 0 0 0 0
38837- 0 0 0 0 0 0 0 0 0 0 0 0
38838- 0 0 0 0 0 0 0 0 0 0 0 0
38839- 0 0 0 0 0 0 0 0 0 0 0 0
38840- 0 0 0 0 0 0 0 0 0 0 0 0
38841- 0 0 0 0 0 0 0 0 0 0 0 0
38842- 0 0 1 0 0 1 0 0 1 0 0 0
38843- 0 0 0 0 0 0 0 0 0 0 0 0
38844- 0 0 0 0 0 0 0 0 0 0 0 0
38845- 0 0 0 0 0 0 0 0 0 0 0 0
38846- 0 0 0 0 0 0 0 0 0 0 0 0
38847- 0 0 0 0 0 0 0 0 0 0 0 0
38848- 14 14 14 42 42 42 86 86 86 10 10 10
38849- 2 2 6 2 2 6 2 2 6 2 2 6
38850- 2 2 6 2 2 6 2 2 6 2 2 6
38851- 2 2 6 2 2 6 2 2 6 30 30 30
38852- 94 94 94 94 94 94 58 58 58 26 26 26
38853- 2 2 6 6 6 6 78 78 78 54 54 54
38854- 22 22 22 6 6 6 0 0 0 0 0 0
38855- 0 0 0 0 0 0 0 0 0 0 0 0
38856- 0 0 0 0 0 0 0 0 0 0 0 0
38857- 0 0 0 0 0 0 0 0 0 0 0 0
38858- 0 0 0 0 0 0 0 0 0 0 0 0
38859- 0 0 0 0 0 0 0 0 0 0 0 0
38860- 0 0 0 0 0 0 0 0 0 0 0 0
38861- 0 0 0 0 0 0 0 0 0 0 0 0
38862- 0 0 0 0 0 0 0 0 0 0 0 0
38863- 0 0 0 0 0 0 0 0 0 0 0 0
38864- 0 0 0 0 0 0 0 0 0 0 0 0
38865- 0 0 0 0 0 0 0 0 0 0 0 0
38866- 0 0 0 0 0 0 0 0 0 0 0 0
38867- 0 0 0 0 0 0 0 0 0 6 6 6
38868- 22 22 22 62 62 62 62 62 62 2 2 6
38869- 2 2 6 2 2 6 2 2 6 2 2 6
38870- 2 2 6 2 2 6 2 2 6 2 2 6
38871- 2 2 6 2 2 6 2 2 6 26 26 26
38872- 54 54 54 38 38 38 18 18 18 10 10 10
38873- 2 2 6 2 2 6 34 34 34 82 82 82
38874- 38 38 38 14 14 14 0 0 0 0 0 0
38875- 0 0 0 0 0 0 0 0 0 0 0 0
38876- 0 0 0 0 0 0 0 0 0 0 0 0
38877- 0 0 0 0 0 0 0 0 0 0 0 0
38878- 0 0 0 0 0 0 0 0 0 0 0 0
38879- 0 0 0 0 0 0 0 0 0 0 0 0
38880- 0 0 0 0 0 0 0 0 0 0 0 0
38881- 0 0 0 0 0 0 0 0 0 0 0 0
38882- 0 0 0 0 0 1 0 0 1 0 0 0
38883- 0 0 0 0 0 0 0 0 0 0 0 0
38884- 0 0 0 0 0 0 0 0 0 0 0 0
38885- 0 0 0 0 0 0 0 0 0 0 0 0
38886- 0 0 0 0 0 0 0 0 0 0 0 0
38887- 0 0 0 0 0 0 0 0 0 6 6 6
38888- 30 30 30 78 78 78 30 30 30 2 2 6
38889- 2 2 6 2 2 6 2 2 6 2 2 6
38890- 2 2 6 2 2 6 2 2 6 2 2 6
38891- 2 2 6 2 2 6 2 2 6 10 10 10
38892- 10 10 10 2 2 6 2 2 6 2 2 6
38893- 2 2 6 2 2 6 2 2 6 78 78 78
38894- 50 50 50 18 18 18 6 6 6 0 0 0
38895- 0 0 0 0 0 0 0 0 0 0 0 0
38896- 0 0 0 0 0 0 0 0 0 0 0 0
38897- 0 0 0 0 0 0 0 0 0 0 0 0
38898- 0 0 0 0 0 0 0 0 0 0 0 0
38899- 0 0 0 0 0 0 0 0 0 0 0 0
38900- 0 0 0 0 0 0 0 0 0 0 0 0
38901- 0 0 0 0 0 0 0 0 0 0 0 0
38902- 0 0 1 0 0 0 0 0 0 0 0 0
38903- 0 0 0 0 0 0 0 0 0 0 0 0
38904- 0 0 0 0 0 0 0 0 0 0 0 0
38905- 0 0 0 0 0 0 0 0 0 0 0 0
38906- 0 0 0 0 0 0 0 0 0 0 0 0
38907- 0 0 0 0 0 0 0 0 0 10 10 10
38908- 38 38 38 86 86 86 14 14 14 2 2 6
38909- 2 2 6 2 2 6 2 2 6 2 2 6
38910- 2 2 6 2 2 6 2 2 6 2 2 6
38911- 2 2 6 2 2 6 2 2 6 2 2 6
38912- 2 2 6 2 2 6 2 2 6 2 2 6
38913- 2 2 6 2 2 6 2 2 6 54 54 54
38914- 66 66 66 26 26 26 6 6 6 0 0 0
38915- 0 0 0 0 0 0 0 0 0 0 0 0
38916- 0 0 0 0 0 0 0 0 0 0 0 0
38917- 0 0 0 0 0 0 0 0 0 0 0 0
38918- 0 0 0 0 0 0 0 0 0 0 0 0
38919- 0 0 0 0 0 0 0 0 0 0 0 0
38920- 0 0 0 0 0 0 0 0 0 0 0 0
38921- 0 0 0 0 0 0 0 0 0 0 0 0
38922- 0 0 0 0 0 1 0 0 1 0 0 0
38923- 0 0 0 0 0 0 0 0 0 0 0 0
38924- 0 0 0 0 0 0 0 0 0 0 0 0
38925- 0 0 0 0 0 0 0 0 0 0 0 0
38926- 0 0 0 0 0 0 0 0 0 0 0 0
38927- 0 0 0 0 0 0 0 0 0 14 14 14
38928- 42 42 42 82 82 82 2 2 6 2 2 6
38929- 2 2 6 6 6 6 10 10 10 2 2 6
38930- 2 2 6 2 2 6 2 2 6 2 2 6
38931- 2 2 6 2 2 6 2 2 6 6 6 6
38932- 14 14 14 10 10 10 2 2 6 2 2 6
38933- 2 2 6 2 2 6 2 2 6 18 18 18
38934- 82 82 82 34 34 34 10 10 10 0 0 0
38935- 0 0 0 0 0 0 0 0 0 0 0 0
38936- 0 0 0 0 0 0 0 0 0 0 0 0
38937- 0 0 0 0 0 0 0 0 0 0 0 0
38938- 0 0 0 0 0 0 0 0 0 0 0 0
38939- 0 0 0 0 0 0 0 0 0 0 0 0
38940- 0 0 0 0 0 0 0 0 0 0 0 0
38941- 0 0 0 0 0 0 0 0 0 0 0 0
38942- 0 0 1 0 0 0 0 0 0 0 0 0
38943- 0 0 0 0 0 0 0 0 0 0 0 0
38944- 0 0 0 0 0 0 0 0 0 0 0 0
38945- 0 0 0 0 0 0 0 0 0 0 0 0
38946- 0 0 0 0 0 0 0 0 0 0 0 0
38947- 0 0 0 0 0 0 0 0 0 14 14 14
38948- 46 46 46 86 86 86 2 2 6 2 2 6
38949- 6 6 6 6 6 6 22 22 22 34 34 34
38950- 6 6 6 2 2 6 2 2 6 2 2 6
38951- 2 2 6 2 2 6 18 18 18 34 34 34
38952- 10 10 10 50 50 50 22 22 22 2 2 6
38953- 2 2 6 2 2 6 2 2 6 10 10 10
38954- 86 86 86 42 42 42 14 14 14 0 0 0
38955- 0 0 0 0 0 0 0 0 0 0 0 0
38956- 0 0 0 0 0 0 0 0 0 0 0 0
38957- 0 0 0 0 0 0 0 0 0 0 0 0
38958- 0 0 0 0 0 0 0 0 0 0 0 0
38959- 0 0 0 0 0 0 0 0 0 0 0 0
38960- 0 0 0 0 0 0 0 0 0 0 0 0
38961- 0 0 0 0 0 0 0 0 0 0 0 0
38962- 0 0 1 0 0 1 0 0 1 0 0 0
38963- 0 0 0 0 0 0 0 0 0 0 0 0
38964- 0 0 0 0 0 0 0 0 0 0 0 0
38965- 0 0 0 0 0 0 0 0 0 0 0 0
38966- 0 0 0 0 0 0 0 0 0 0 0 0
38967- 0 0 0 0 0 0 0 0 0 14 14 14
38968- 46 46 46 86 86 86 2 2 6 2 2 6
38969- 38 38 38 116 116 116 94 94 94 22 22 22
38970- 22 22 22 2 2 6 2 2 6 2 2 6
38971- 14 14 14 86 86 86 138 138 138 162 162 162
38972-154 154 154 38 38 38 26 26 26 6 6 6
38973- 2 2 6 2 2 6 2 2 6 2 2 6
38974- 86 86 86 46 46 46 14 14 14 0 0 0
38975- 0 0 0 0 0 0 0 0 0 0 0 0
38976- 0 0 0 0 0 0 0 0 0 0 0 0
38977- 0 0 0 0 0 0 0 0 0 0 0 0
38978- 0 0 0 0 0 0 0 0 0 0 0 0
38979- 0 0 0 0 0 0 0 0 0 0 0 0
38980- 0 0 0 0 0 0 0 0 0 0 0 0
38981- 0 0 0 0 0 0 0 0 0 0 0 0
38982- 0 0 0 0 0 0 0 0 0 0 0 0
38983- 0 0 0 0 0 0 0 0 0 0 0 0
38984- 0 0 0 0 0 0 0 0 0 0 0 0
38985- 0 0 0 0 0 0 0 0 0 0 0 0
38986- 0 0 0 0 0 0 0 0 0 0 0 0
38987- 0 0 0 0 0 0 0 0 0 14 14 14
38988- 46 46 46 86 86 86 2 2 6 14 14 14
38989-134 134 134 198 198 198 195 195 195 116 116 116
38990- 10 10 10 2 2 6 2 2 6 6 6 6
38991-101 98 89 187 187 187 210 210 210 218 218 218
38992-214 214 214 134 134 134 14 14 14 6 6 6
38993- 2 2 6 2 2 6 2 2 6 2 2 6
38994- 86 86 86 50 50 50 18 18 18 6 6 6
38995- 0 0 0 0 0 0 0 0 0 0 0 0
38996- 0 0 0 0 0 0 0 0 0 0 0 0
38997- 0 0 0 0 0 0 0 0 0 0 0 0
38998- 0 0 0 0 0 0 0 0 0 0 0 0
38999- 0 0 0 0 0 0 0 0 0 0 0 0
39000- 0 0 0 0 0 0 0 0 0 0 0 0
39001- 0 0 0 0 0 0 0 0 1 0 0 0
39002- 0 0 1 0 0 1 0 0 1 0 0 0
39003- 0 0 0 0 0 0 0 0 0 0 0 0
39004- 0 0 0 0 0 0 0 0 0 0 0 0
39005- 0 0 0 0 0 0 0 0 0 0 0 0
39006- 0 0 0 0 0 0 0 0 0 0 0 0
39007- 0 0 0 0 0 0 0 0 0 14 14 14
39008- 46 46 46 86 86 86 2 2 6 54 54 54
39009-218 218 218 195 195 195 226 226 226 246 246 246
39010- 58 58 58 2 2 6 2 2 6 30 30 30
39011-210 210 210 253 253 253 174 174 174 123 123 123
39012-221 221 221 234 234 234 74 74 74 2 2 6
39013- 2 2 6 2 2 6 2 2 6 2 2 6
39014- 70 70 70 58 58 58 22 22 22 6 6 6
39015- 0 0 0 0 0 0 0 0 0 0 0 0
39016- 0 0 0 0 0 0 0 0 0 0 0 0
39017- 0 0 0 0 0 0 0 0 0 0 0 0
39018- 0 0 0 0 0 0 0 0 0 0 0 0
39019- 0 0 0 0 0 0 0 0 0 0 0 0
39020- 0 0 0 0 0 0 0 0 0 0 0 0
39021- 0 0 0 0 0 0 0 0 0 0 0 0
39022- 0 0 0 0 0 0 0 0 0 0 0 0
39023- 0 0 0 0 0 0 0 0 0 0 0 0
39024- 0 0 0 0 0 0 0 0 0 0 0 0
39025- 0 0 0 0 0 0 0 0 0 0 0 0
39026- 0 0 0 0 0 0 0 0 0 0 0 0
39027- 0 0 0 0 0 0 0 0 0 14 14 14
39028- 46 46 46 82 82 82 2 2 6 106 106 106
39029-170 170 170 26 26 26 86 86 86 226 226 226
39030-123 123 123 10 10 10 14 14 14 46 46 46
39031-231 231 231 190 190 190 6 6 6 70 70 70
39032- 90 90 90 238 238 238 158 158 158 2 2 6
39033- 2 2 6 2 2 6 2 2 6 2 2 6
39034- 70 70 70 58 58 58 22 22 22 6 6 6
39035- 0 0 0 0 0 0 0 0 0 0 0 0
39036- 0 0 0 0 0 0 0 0 0 0 0 0
39037- 0 0 0 0 0 0 0 0 0 0 0 0
39038- 0 0 0 0 0 0 0 0 0 0 0 0
39039- 0 0 0 0 0 0 0 0 0 0 0 0
39040- 0 0 0 0 0 0 0 0 0 0 0 0
39041- 0 0 0 0 0 0 0 0 1 0 0 0
39042- 0 0 1 0 0 1 0 0 1 0 0 0
39043- 0 0 0 0 0 0 0 0 0 0 0 0
39044- 0 0 0 0 0 0 0 0 0 0 0 0
39045- 0 0 0 0 0 0 0 0 0 0 0 0
39046- 0 0 0 0 0 0 0 0 0 0 0 0
39047- 0 0 0 0 0 0 0 0 0 14 14 14
39048- 42 42 42 86 86 86 6 6 6 116 116 116
39049-106 106 106 6 6 6 70 70 70 149 149 149
39050-128 128 128 18 18 18 38 38 38 54 54 54
39051-221 221 221 106 106 106 2 2 6 14 14 14
39052- 46 46 46 190 190 190 198 198 198 2 2 6
39053- 2 2 6 2 2 6 2 2 6 2 2 6
39054- 74 74 74 62 62 62 22 22 22 6 6 6
39055- 0 0 0 0 0 0 0 0 0 0 0 0
39056- 0 0 0 0 0 0 0 0 0 0 0 0
39057- 0 0 0 0 0 0 0 0 0 0 0 0
39058- 0 0 0 0 0 0 0 0 0 0 0 0
39059- 0 0 0 0 0 0 0 0 0 0 0 0
39060- 0 0 0 0 0 0 0 0 0 0 0 0
39061- 0 0 0 0 0 0 0 0 1 0 0 0
39062- 0 0 1 0 0 0 0 0 1 0 0 0
39063- 0 0 0 0 0 0 0 0 0 0 0 0
39064- 0 0 0 0 0 0 0 0 0 0 0 0
39065- 0 0 0 0 0 0 0 0 0 0 0 0
39066- 0 0 0 0 0 0 0 0 0 0 0 0
39067- 0 0 0 0 0 0 0 0 0 14 14 14
39068- 42 42 42 94 94 94 14 14 14 101 101 101
39069-128 128 128 2 2 6 18 18 18 116 116 116
39070-118 98 46 121 92 8 121 92 8 98 78 10
39071-162 162 162 106 106 106 2 2 6 2 2 6
39072- 2 2 6 195 195 195 195 195 195 6 6 6
39073- 2 2 6 2 2 6 2 2 6 2 2 6
39074- 74 74 74 62 62 62 22 22 22 6 6 6
39075- 0 0 0 0 0 0 0 0 0 0 0 0
39076- 0 0 0 0 0 0 0 0 0 0 0 0
39077- 0 0 0 0 0 0 0 0 0 0 0 0
39078- 0 0 0 0 0 0 0 0 0 0 0 0
39079- 0 0 0 0 0 0 0 0 0 0 0 0
39080- 0 0 0 0 0 0 0 0 0 0 0 0
39081- 0 0 0 0 0 0 0 0 1 0 0 1
39082- 0 0 1 0 0 0 0 0 1 0 0 0
39083- 0 0 0 0 0 0 0 0 0 0 0 0
39084- 0 0 0 0 0 0 0 0 0 0 0 0
39085- 0 0 0 0 0 0 0 0 0 0 0 0
39086- 0 0 0 0 0 0 0 0 0 0 0 0
39087- 0 0 0 0 0 0 0 0 0 10 10 10
39088- 38 38 38 90 90 90 14 14 14 58 58 58
39089-210 210 210 26 26 26 54 38 6 154 114 10
39090-226 170 11 236 186 11 225 175 15 184 144 12
39091-215 174 15 175 146 61 37 26 9 2 2 6
39092- 70 70 70 246 246 246 138 138 138 2 2 6
39093- 2 2 6 2 2 6 2 2 6 2 2 6
39094- 70 70 70 66 66 66 26 26 26 6 6 6
39095- 0 0 0 0 0 0 0 0 0 0 0 0
39096- 0 0 0 0 0 0 0 0 0 0 0 0
39097- 0 0 0 0 0 0 0 0 0 0 0 0
39098- 0 0 0 0 0 0 0 0 0 0 0 0
39099- 0 0 0 0 0 0 0 0 0 0 0 0
39100- 0 0 0 0 0 0 0 0 0 0 0 0
39101- 0 0 0 0 0 0 0 0 0 0 0 0
39102- 0 0 0 0 0 0 0 0 0 0 0 0
39103- 0 0 0 0 0 0 0 0 0 0 0 0
39104- 0 0 0 0 0 0 0 0 0 0 0 0
39105- 0 0 0 0 0 0 0 0 0 0 0 0
39106- 0 0 0 0 0 0 0 0 0 0 0 0
39107- 0 0 0 0 0 0 0 0 0 10 10 10
39108- 38 38 38 86 86 86 14 14 14 10 10 10
39109-195 195 195 188 164 115 192 133 9 225 175 15
39110-239 182 13 234 190 10 232 195 16 232 200 30
39111-245 207 45 241 208 19 232 195 16 184 144 12
39112-218 194 134 211 206 186 42 42 42 2 2 6
39113- 2 2 6 2 2 6 2 2 6 2 2 6
39114- 50 50 50 74 74 74 30 30 30 6 6 6
39115- 0 0 0 0 0 0 0 0 0 0 0 0
39116- 0 0 0 0 0 0 0 0 0 0 0 0
39117- 0 0 0 0 0 0 0 0 0 0 0 0
39118- 0 0 0 0 0 0 0 0 0 0 0 0
39119- 0 0 0 0 0 0 0 0 0 0 0 0
39120- 0 0 0 0 0 0 0 0 0 0 0 0
39121- 0 0 0 0 0 0 0 0 0 0 0 0
39122- 0 0 0 0 0 0 0 0 0 0 0 0
39123- 0 0 0 0 0 0 0 0 0 0 0 0
39124- 0 0 0 0 0 0 0 0 0 0 0 0
39125- 0 0 0 0 0 0 0 0 0 0 0 0
39126- 0 0 0 0 0 0 0 0 0 0 0 0
39127- 0 0 0 0 0 0 0 0 0 10 10 10
39128- 34 34 34 86 86 86 14 14 14 2 2 6
39129-121 87 25 192 133 9 219 162 10 239 182 13
39130-236 186 11 232 195 16 241 208 19 244 214 54
39131-246 218 60 246 218 38 246 215 20 241 208 19
39132-241 208 19 226 184 13 121 87 25 2 2 6
39133- 2 2 6 2 2 6 2 2 6 2 2 6
39134- 50 50 50 82 82 82 34 34 34 10 10 10
39135- 0 0 0 0 0 0 0 0 0 0 0 0
39136- 0 0 0 0 0 0 0 0 0 0 0 0
39137- 0 0 0 0 0 0 0 0 0 0 0 0
39138- 0 0 0 0 0 0 0 0 0 0 0 0
39139- 0 0 0 0 0 0 0 0 0 0 0 0
39140- 0 0 0 0 0 0 0 0 0 0 0 0
39141- 0 0 0 0 0 0 0 0 0 0 0 0
39142- 0 0 0 0 0 0 0 0 0 0 0 0
39143- 0 0 0 0 0 0 0 0 0 0 0 0
39144- 0 0 0 0 0 0 0 0 0 0 0 0
39145- 0 0 0 0 0 0 0 0 0 0 0 0
39146- 0 0 0 0 0 0 0 0 0 0 0 0
39147- 0 0 0 0 0 0 0 0 0 10 10 10
39148- 34 34 34 82 82 82 30 30 30 61 42 6
39149-180 123 7 206 145 10 230 174 11 239 182 13
39150-234 190 10 238 202 15 241 208 19 246 218 74
39151-246 218 38 246 215 20 246 215 20 246 215 20
39152-226 184 13 215 174 15 184 144 12 6 6 6
39153- 2 2 6 2 2 6 2 2 6 2 2 6
39154- 26 26 26 94 94 94 42 42 42 14 14 14
39155- 0 0 0 0 0 0 0 0 0 0 0 0
39156- 0 0 0 0 0 0 0 0 0 0 0 0
39157- 0 0 0 0 0 0 0 0 0 0 0 0
39158- 0 0 0 0 0 0 0 0 0 0 0 0
39159- 0 0 0 0 0 0 0 0 0 0 0 0
39160- 0 0 0 0 0 0 0 0 0 0 0 0
39161- 0 0 0 0 0 0 0 0 0 0 0 0
39162- 0 0 0 0 0 0 0 0 0 0 0 0
39163- 0 0 0 0 0 0 0 0 0 0 0 0
39164- 0 0 0 0 0 0 0 0 0 0 0 0
39165- 0 0 0 0 0 0 0 0 0 0 0 0
39166- 0 0 0 0 0 0 0 0 0 0 0 0
39167- 0 0 0 0 0 0 0 0 0 10 10 10
39168- 30 30 30 78 78 78 50 50 50 104 69 6
39169-192 133 9 216 158 10 236 178 12 236 186 11
39170-232 195 16 241 208 19 244 214 54 245 215 43
39171-246 215 20 246 215 20 241 208 19 198 155 10
39172-200 144 11 216 158 10 156 118 10 2 2 6
39173- 2 2 6 2 2 6 2 2 6 2 2 6
39174- 6 6 6 90 90 90 54 54 54 18 18 18
39175- 6 6 6 0 0 0 0 0 0 0 0 0
39176- 0 0 0 0 0 0 0 0 0 0 0 0
39177- 0 0 0 0 0 0 0 0 0 0 0 0
39178- 0 0 0 0 0 0 0 0 0 0 0 0
39179- 0 0 0 0 0 0 0 0 0 0 0 0
39180- 0 0 0 0 0 0 0 0 0 0 0 0
39181- 0 0 0 0 0 0 0 0 0 0 0 0
39182- 0 0 0 0 0 0 0 0 0 0 0 0
39183- 0 0 0 0 0 0 0 0 0 0 0 0
39184- 0 0 0 0 0 0 0 0 0 0 0 0
39185- 0 0 0 0 0 0 0 0 0 0 0 0
39186- 0 0 0 0 0 0 0 0 0 0 0 0
39187- 0 0 0 0 0 0 0 0 0 10 10 10
39188- 30 30 30 78 78 78 46 46 46 22 22 22
39189-137 92 6 210 162 10 239 182 13 238 190 10
39190-238 202 15 241 208 19 246 215 20 246 215 20
39191-241 208 19 203 166 17 185 133 11 210 150 10
39192-216 158 10 210 150 10 102 78 10 2 2 6
39193- 6 6 6 54 54 54 14 14 14 2 2 6
39194- 2 2 6 62 62 62 74 74 74 30 30 30
39195- 10 10 10 0 0 0 0 0 0 0 0 0
39196- 0 0 0 0 0 0 0 0 0 0 0 0
39197- 0 0 0 0 0 0 0 0 0 0 0 0
39198- 0 0 0 0 0 0 0 0 0 0 0 0
39199- 0 0 0 0 0 0 0 0 0 0 0 0
39200- 0 0 0 0 0 0 0 0 0 0 0 0
39201- 0 0 0 0 0 0 0 0 0 0 0 0
39202- 0 0 0 0 0 0 0 0 0 0 0 0
39203- 0 0 0 0 0 0 0 0 0 0 0 0
39204- 0 0 0 0 0 0 0 0 0 0 0 0
39205- 0 0 0 0 0 0 0 0 0 0 0 0
39206- 0 0 0 0 0 0 0 0 0 0 0 0
39207- 0 0 0 0 0 0 0 0 0 10 10 10
39208- 34 34 34 78 78 78 50 50 50 6 6 6
39209- 94 70 30 139 102 15 190 146 13 226 184 13
39210-232 200 30 232 195 16 215 174 15 190 146 13
39211-168 122 10 192 133 9 210 150 10 213 154 11
39212-202 150 34 182 157 106 101 98 89 2 2 6
39213- 2 2 6 78 78 78 116 116 116 58 58 58
39214- 2 2 6 22 22 22 90 90 90 46 46 46
39215- 18 18 18 6 6 6 0 0 0 0 0 0
39216- 0 0 0 0 0 0 0 0 0 0 0 0
39217- 0 0 0 0 0 0 0 0 0 0 0 0
39218- 0 0 0 0 0 0 0 0 0 0 0 0
39219- 0 0 0 0 0 0 0 0 0 0 0 0
39220- 0 0 0 0 0 0 0 0 0 0 0 0
39221- 0 0 0 0 0 0 0 0 0 0 0 0
39222- 0 0 0 0 0 0 0 0 0 0 0 0
39223- 0 0 0 0 0 0 0 0 0 0 0 0
39224- 0 0 0 0 0 0 0 0 0 0 0 0
39225- 0 0 0 0 0 0 0 0 0 0 0 0
39226- 0 0 0 0 0 0 0 0 0 0 0 0
39227- 0 0 0 0 0 0 0 0 0 10 10 10
39228- 38 38 38 86 86 86 50 50 50 6 6 6
39229-128 128 128 174 154 114 156 107 11 168 122 10
39230-198 155 10 184 144 12 197 138 11 200 144 11
39231-206 145 10 206 145 10 197 138 11 188 164 115
39232-195 195 195 198 198 198 174 174 174 14 14 14
39233- 2 2 6 22 22 22 116 116 116 116 116 116
39234- 22 22 22 2 2 6 74 74 74 70 70 70
39235- 30 30 30 10 10 10 0 0 0 0 0 0
39236- 0 0 0 0 0 0 0 0 0 0 0 0
39237- 0 0 0 0 0 0 0 0 0 0 0 0
39238- 0 0 0 0 0 0 0 0 0 0 0 0
39239- 0 0 0 0 0 0 0 0 0 0 0 0
39240- 0 0 0 0 0 0 0 0 0 0 0 0
39241- 0 0 0 0 0 0 0 0 0 0 0 0
39242- 0 0 0 0 0 0 0 0 0 0 0 0
39243- 0 0 0 0 0 0 0 0 0 0 0 0
39244- 0 0 0 0 0 0 0 0 0 0 0 0
39245- 0 0 0 0 0 0 0 0 0 0 0 0
39246- 0 0 0 0 0 0 0 0 0 0 0 0
39247- 0 0 0 0 0 0 6 6 6 18 18 18
39248- 50 50 50 101 101 101 26 26 26 10 10 10
39249-138 138 138 190 190 190 174 154 114 156 107 11
39250-197 138 11 200 144 11 197 138 11 192 133 9
39251-180 123 7 190 142 34 190 178 144 187 187 187
39252-202 202 202 221 221 221 214 214 214 66 66 66
39253- 2 2 6 2 2 6 50 50 50 62 62 62
39254- 6 6 6 2 2 6 10 10 10 90 90 90
39255- 50 50 50 18 18 18 6 6 6 0 0 0
39256- 0 0 0 0 0 0 0 0 0 0 0 0
39257- 0 0 0 0 0 0 0 0 0 0 0 0
39258- 0 0 0 0 0 0 0 0 0 0 0 0
39259- 0 0 0 0 0 0 0 0 0 0 0 0
39260- 0 0 0 0 0 0 0 0 0 0 0 0
39261- 0 0 0 0 0 0 0 0 0 0 0 0
39262- 0 0 0 0 0 0 0 0 0 0 0 0
39263- 0 0 0 0 0 0 0 0 0 0 0 0
39264- 0 0 0 0 0 0 0 0 0 0 0 0
39265- 0 0 0 0 0 0 0 0 0 0 0 0
39266- 0 0 0 0 0 0 0 0 0 0 0 0
39267- 0 0 0 0 0 0 10 10 10 34 34 34
39268- 74 74 74 74 74 74 2 2 6 6 6 6
39269-144 144 144 198 198 198 190 190 190 178 166 146
39270-154 121 60 156 107 11 156 107 11 168 124 44
39271-174 154 114 187 187 187 190 190 190 210 210 210
39272-246 246 246 253 253 253 253 253 253 182 182 182
39273- 6 6 6 2 2 6 2 2 6 2 2 6
39274- 2 2 6 2 2 6 2 2 6 62 62 62
39275- 74 74 74 34 34 34 14 14 14 0 0 0
39276- 0 0 0 0 0 0 0 0 0 0 0 0
39277- 0 0 0 0 0 0 0 0 0 0 0 0
39278- 0 0 0 0 0 0 0 0 0 0 0 0
39279- 0 0 0 0 0 0 0 0 0 0 0 0
39280- 0 0 0 0 0 0 0 0 0 0 0 0
39281- 0 0 0 0 0 0 0 0 0 0 0 0
39282- 0 0 0 0 0 0 0 0 0 0 0 0
39283- 0 0 0 0 0 0 0 0 0 0 0 0
39284- 0 0 0 0 0 0 0 0 0 0 0 0
39285- 0 0 0 0 0 0 0 0 0 0 0 0
39286- 0 0 0 0 0 0 0 0 0 0 0 0
39287- 0 0 0 10 10 10 22 22 22 54 54 54
39288- 94 94 94 18 18 18 2 2 6 46 46 46
39289-234 234 234 221 221 221 190 190 190 190 190 190
39290-190 190 190 187 187 187 187 187 187 190 190 190
39291-190 190 190 195 195 195 214 214 214 242 242 242
39292-253 253 253 253 253 253 253 253 253 253 253 253
39293- 82 82 82 2 2 6 2 2 6 2 2 6
39294- 2 2 6 2 2 6 2 2 6 14 14 14
39295- 86 86 86 54 54 54 22 22 22 6 6 6
39296- 0 0 0 0 0 0 0 0 0 0 0 0
39297- 0 0 0 0 0 0 0 0 0 0 0 0
39298- 0 0 0 0 0 0 0 0 0 0 0 0
39299- 0 0 0 0 0 0 0 0 0 0 0 0
39300- 0 0 0 0 0 0 0 0 0 0 0 0
39301- 0 0 0 0 0 0 0 0 0 0 0 0
39302- 0 0 0 0 0 0 0 0 0 0 0 0
39303- 0 0 0 0 0 0 0 0 0 0 0 0
39304- 0 0 0 0 0 0 0 0 0 0 0 0
39305- 0 0 0 0 0 0 0 0 0 0 0 0
39306- 0 0 0 0 0 0 0 0 0 0 0 0
39307- 6 6 6 18 18 18 46 46 46 90 90 90
39308- 46 46 46 18 18 18 6 6 6 182 182 182
39309-253 253 253 246 246 246 206 206 206 190 190 190
39310-190 190 190 190 190 190 190 190 190 190 190 190
39311-206 206 206 231 231 231 250 250 250 253 253 253
39312-253 253 253 253 253 253 253 253 253 253 253 253
39313-202 202 202 14 14 14 2 2 6 2 2 6
39314- 2 2 6 2 2 6 2 2 6 2 2 6
39315- 42 42 42 86 86 86 42 42 42 18 18 18
39316- 6 6 6 0 0 0 0 0 0 0 0 0
39317- 0 0 0 0 0 0 0 0 0 0 0 0
39318- 0 0 0 0 0 0 0 0 0 0 0 0
39319- 0 0 0 0 0 0 0 0 0 0 0 0
39320- 0 0 0 0 0 0 0 0 0 0 0 0
39321- 0 0 0 0 0 0 0 0 0 0 0 0
39322- 0 0 0 0 0 0 0 0 0 0 0 0
39323- 0 0 0 0 0 0 0 0 0 0 0 0
39324- 0 0 0 0 0 0 0 0 0 0 0 0
39325- 0 0 0 0 0 0 0 0 0 0 0 0
39326- 0 0 0 0 0 0 0 0 0 6 6 6
39327- 14 14 14 38 38 38 74 74 74 66 66 66
39328- 2 2 6 6 6 6 90 90 90 250 250 250
39329-253 253 253 253 253 253 238 238 238 198 198 198
39330-190 190 190 190 190 190 195 195 195 221 221 221
39331-246 246 246 253 253 253 253 253 253 253 253 253
39332-253 253 253 253 253 253 253 253 253 253 253 253
39333-253 253 253 82 82 82 2 2 6 2 2 6
39334- 2 2 6 2 2 6 2 2 6 2 2 6
39335- 2 2 6 78 78 78 70 70 70 34 34 34
39336- 14 14 14 6 6 6 0 0 0 0 0 0
39337- 0 0 0 0 0 0 0 0 0 0 0 0
39338- 0 0 0 0 0 0 0 0 0 0 0 0
39339- 0 0 0 0 0 0 0 0 0 0 0 0
39340- 0 0 0 0 0 0 0 0 0 0 0 0
39341- 0 0 0 0 0 0 0 0 0 0 0 0
39342- 0 0 0 0 0 0 0 0 0 0 0 0
39343- 0 0 0 0 0 0 0 0 0 0 0 0
39344- 0 0 0 0 0 0 0 0 0 0 0 0
39345- 0 0 0 0 0 0 0 0 0 0 0 0
39346- 0 0 0 0 0 0 0 0 0 14 14 14
39347- 34 34 34 66 66 66 78 78 78 6 6 6
39348- 2 2 6 18 18 18 218 218 218 253 253 253
39349-253 253 253 253 253 253 253 253 253 246 246 246
39350-226 226 226 231 231 231 246 246 246 253 253 253
39351-253 253 253 253 253 253 253 253 253 253 253 253
39352-253 253 253 253 253 253 253 253 253 253 253 253
39353-253 253 253 178 178 178 2 2 6 2 2 6
39354- 2 2 6 2 2 6 2 2 6 2 2 6
39355- 2 2 6 18 18 18 90 90 90 62 62 62
39356- 30 30 30 10 10 10 0 0 0 0 0 0
39357- 0 0 0 0 0 0 0 0 0 0 0 0
39358- 0 0 0 0 0 0 0 0 0 0 0 0
39359- 0 0 0 0 0 0 0 0 0 0 0 0
39360- 0 0 0 0 0 0 0 0 0 0 0 0
39361- 0 0 0 0 0 0 0 0 0 0 0 0
39362- 0 0 0 0 0 0 0 0 0 0 0 0
39363- 0 0 0 0 0 0 0 0 0 0 0 0
39364- 0 0 0 0 0 0 0 0 0 0 0 0
39365- 0 0 0 0 0 0 0 0 0 0 0 0
39366- 0 0 0 0 0 0 10 10 10 26 26 26
39367- 58 58 58 90 90 90 18 18 18 2 2 6
39368- 2 2 6 110 110 110 253 253 253 253 253 253
39369-253 253 253 253 253 253 253 253 253 253 253 253
39370-250 250 250 253 253 253 253 253 253 253 253 253
39371-253 253 253 253 253 253 253 253 253 253 253 253
39372-253 253 253 253 253 253 253 253 253 253 253 253
39373-253 253 253 231 231 231 18 18 18 2 2 6
39374- 2 2 6 2 2 6 2 2 6 2 2 6
39375- 2 2 6 2 2 6 18 18 18 94 94 94
39376- 54 54 54 26 26 26 10 10 10 0 0 0
39377- 0 0 0 0 0 0 0 0 0 0 0 0
39378- 0 0 0 0 0 0 0 0 0 0 0 0
39379- 0 0 0 0 0 0 0 0 0 0 0 0
39380- 0 0 0 0 0 0 0 0 0 0 0 0
39381- 0 0 0 0 0 0 0 0 0 0 0 0
39382- 0 0 0 0 0 0 0 0 0 0 0 0
39383- 0 0 0 0 0 0 0 0 0 0 0 0
39384- 0 0 0 0 0 0 0 0 0 0 0 0
39385- 0 0 0 0 0 0 0 0 0 0 0 0
39386- 0 0 0 6 6 6 22 22 22 50 50 50
39387- 90 90 90 26 26 26 2 2 6 2 2 6
39388- 14 14 14 195 195 195 250 250 250 253 253 253
39389-253 253 253 253 253 253 253 253 253 253 253 253
39390-253 253 253 253 253 253 253 253 253 253 253 253
39391-253 253 253 253 253 253 253 253 253 253 253 253
39392-253 253 253 253 253 253 253 253 253 253 253 253
39393-250 250 250 242 242 242 54 54 54 2 2 6
39394- 2 2 6 2 2 6 2 2 6 2 2 6
39395- 2 2 6 2 2 6 2 2 6 38 38 38
39396- 86 86 86 50 50 50 22 22 22 6 6 6
39397- 0 0 0 0 0 0 0 0 0 0 0 0
39398- 0 0 0 0 0 0 0 0 0 0 0 0
39399- 0 0 0 0 0 0 0 0 0 0 0 0
39400- 0 0 0 0 0 0 0 0 0 0 0 0
39401- 0 0 0 0 0 0 0 0 0 0 0 0
39402- 0 0 0 0 0 0 0 0 0 0 0 0
39403- 0 0 0 0 0 0 0 0 0 0 0 0
39404- 0 0 0 0 0 0 0 0 0 0 0 0
39405- 0 0 0 0 0 0 0 0 0 0 0 0
39406- 6 6 6 14 14 14 38 38 38 82 82 82
39407- 34 34 34 2 2 6 2 2 6 2 2 6
39408- 42 42 42 195 195 195 246 246 246 253 253 253
39409-253 253 253 253 253 253 253 253 253 250 250 250
39410-242 242 242 242 242 242 250 250 250 253 253 253
39411-253 253 253 253 253 253 253 253 253 253 253 253
39412-253 253 253 250 250 250 246 246 246 238 238 238
39413-226 226 226 231 231 231 101 101 101 6 6 6
39414- 2 2 6 2 2 6 2 2 6 2 2 6
39415- 2 2 6 2 2 6 2 2 6 2 2 6
39416- 38 38 38 82 82 82 42 42 42 14 14 14
39417- 6 6 6 0 0 0 0 0 0 0 0 0
39418- 0 0 0 0 0 0 0 0 0 0 0 0
39419- 0 0 0 0 0 0 0 0 0 0 0 0
39420- 0 0 0 0 0 0 0 0 0 0 0 0
39421- 0 0 0 0 0 0 0 0 0 0 0 0
39422- 0 0 0 0 0 0 0 0 0 0 0 0
39423- 0 0 0 0 0 0 0 0 0 0 0 0
39424- 0 0 0 0 0 0 0 0 0 0 0 0
39425- 0 0 0 0 0 0 0 0 0 0 0 0
39426- 10 10 10 26 26 26 62 62 62 66 66 66
39427- 2 2 6 2 2 6 2 2 6 6 6 6
39428- 70 70 70 170 170 170 206 206 206 234 234 234
39429-246 246 246 250 250 250 250 250 250 238 238 238
39430-226 226 226 231 231 231 238 238 238 250 250 250
39431-250 250 250 250 250 250 246 246 246 231 231 231
39432-214 214 214 206 206 206 202 202 202 202 202 202
39433-198 198 198 202 202 202 182 182 182 18 18 18
39434- 2 2 6 2 2 6 2 2 6 2 2 6
39435- 2 2 6 2 2 6 2 2 6 2 2 6
39436- 2 2 6 62 62 62 66 66 66 30 30 30
39437- 10 10 10 0 0 0 0 0 0 0 0 0
39438- 0 0 0 0 0 0 0 0 0 0 0 0
39439- 0 0 0 0 0 0 0 0 0 0 0 0
39440- 0 0 0 0 0 0 0 0 0 0 0 0
39441- 0 0 0 0 0 0 0 0 0 0 0 0
39442- 0 0 0 0 0 0 0 0 0 0 0 0
39443- 0 0 0 0 0 0 0 0 0 0 0 0
39444- 0 0 0 0 0 0 0 0 0 0 0 0
39445- 0 0 0 0 0 0 0 0 0 0 0 0
39446- 14 14 14 42 42 42 82 82 82 18 18 18
39447- 2 2 6 2 2 6 2 2 6 10 10 10
39448- 94 94 94 182 182 182 218 218 218 242 242 242
39449-250 250 250 253 253 253 253 253 253 250 250 250
39450-234 234 234 253 253 253 253 253 253 253 253 253
39451-253 253 253 253 253 253 253 253 253 246 246 246
39452-238 238 238 226 226 226 210 210 210 202 202 202
39453-195 195 195 195 195 195 210 210 210 158 158 158
39454- 6 6 6 14 14 14 50 50 50 14 14 14
39455- 2 2 6 2 2 6 2 2 6 2 2 6
39456- 2 2 6 6 6 6 86 86 86 46 46 46
39457- 18 18 18 6 6 6 0 0 0 0 0 0
39458- 0 0 0 0 0 0 0 0 0 0 0 0
39459- 0 0 0 0 0 0 0 0 0 0 0 0
39460- 0 0 0 0 0 0 0 0 0 0 0 0
39461- 0 0 0 0 0 0 0 0 0 0 0 0
39462- 0 0 0 0 0 0 0 0 0 0 0 0
39463- 0 0 0 0 0 0 0 0 0 0 0 0
39464- 0 0 0 0 0 0 0 0 0 0 0 0
39465- 0 0 0 0 0 0 0 0 0 6 6 6
39466- 22 22 22 54 54 54 70 70 70 2 2 6
39467- 2 2 6 10 10 10 2 2 6 22 22 22
39468-166 166 166 231 231 231 250 250 250 253 253 253
39469-253 253 253 253 253 253 253 253 253 250 250 250
39470-242 242 242 253 253 253 253 253 253 253 253 253
39471-253 253 253 253 253 253 253 253 253 253 253 253
39472-253 253 253 253 253 253 253 253 253 246 246 246
39473-231 231 231 206 206 206 198 198 198 226 226 226
39474- 94 94 94 2 2 6 6 6 6 38 38 38
39475- 30 30 30 2 2 6 2 2 6 2 2 6
39476- 2 2 6 2 2 6 62 62 62 66 66 66
39477- 26 26 26 10 10 10 0 0 0 0 0 0
39478- 0 0 0 0 0 0 0 0 0 0 0 0
39479- 0 0 0 0 0 0 0 0 0 0 0 0
39480- 0 0 0 0 0 0 0 0 0 0 0 0
39481- 0 0 0 0 0 0 0 0 0 0 0 0
39482- 0 0 0 0 0 0 0 0 0 0 0 0
39483- 0 0 0 0 0 0 0 0 0 0 0 0
39484- 0 0 0 0 0 0 0 0 0 0 0 0
39485- 0 0 0 0 0 0 0 0 0 10 10 10
39486- 30 30 30 74 74 74 50 50 50 2 2 6
39487- 26 26 26 26 26 26 2 2 6 106 106 106
39488-238 238 238 253 253 253 253 253 253 253 253 253
39489-253 253 253 253 253 253 253 253 253 253 253 253
39490-253 253 253 253 253 253 253 253 253 253 253 253
39491-253 253 253 253 253 253 253 253 253 253 253 253
39492-253 253 253 253 253 253 253 253 253 253 253 253
39493-253 253 253 246 246 246 218 218 218 202 202 202
39494-210 210 210 14 14 14 2 2 6 2 2 6
39495- 30 30 30 22 22 22 2 2 6 2 2 6
39496- 2 2 6 2 2 6 18 18 18 86 86 86
39497- 42 42 42 14 14 14 0 0 0 0 0 0
39498- 0 0 0 0 0 0 0 0 0 0 0 0
39499- 0 0 0 0 0 0 0 0 0 0 0 0
39500- 0 0 0 0 0 0 0 0 0 0 0 0
39501- 0 0 0 0 0 0 0 0 0 0 0 0
39502- 0 0 0 0 0 0 0 0 0 0 0 0
39503- 0 0 0 0 0 0 0 0 0 0 0 0
39504- 0 0 0 0 0 0 0 0 0 0 0 0
39505- 0 0 0 0 0 0 0 0 0 14 14 14
39506- 42 42 42 90 90 90 22 22 22 2 2 6
39507- 42 42 42 2 2 6 18 18 18 218 218 218
39508-253 253 253 253 253 253 253 253 253 253 253 253
39509-253 253 253 253 253 253 253 253 253 253 253 253
39510-253 253 253 253 253 253 253 253 253 253 253 253
39511-253 253 253 253 253 253 253 253 253 253 253 253
39512-253 253 253 253 253 253 253 253 253 253 253 253
39513-253 253 253 253 253 253 250 250 250 221 221 221
39514-218 218 218 101 101 101 2 2 6 14 14 14
39515- 18 18 18 38 38 38 10 10 10 2 2 6
39516- 2 2 6 2 2 6 2 2 6 78 78 78
39517- 58 58 58 22 22 22 6 6 6 0 0 0
39518- 0 0 0 0 0 0 0 0 0 0 0 0
39519- 0 0 0 0 0 0 0 0 0 0 0 0
39520- 0 0 0 0 0 0 0 0 0 0 0 0
39521- 0 0 0 0 0 0 0 0 0 0 0 0
39522- 0 0 0 0 0 0 0 0 0 0 0 0
39523- 0 0 0 0 0 0 0 0 0 0 0 0
39524- 0 0 0 0 0 0 0 0 0 0 0 0
39525- 0 0 0 0 0 0 6 6 6 18 18 18
39526- 54 54 54 82 82 82 2 2 6 26 26 26
39527- 22 22 22 2 2 6 123 123 123 253 253 253
39528-253 253 253 253 253 253 253 253 253 253 253 253
39529-253 253 253 253 253 253 253 253 253 253 253 253
39530-253 253 253 253 253 253 253 253 253 253 253 253
39531-253 253 253 253 253 253 253 253 253 253 253 253
39532-253 253 253 253 253 253 253 253 253 253 253 253
39533-253 253 253 253 253 253 253 253 253 250 250 250
39534-238 238 238 198 198 198 6 6 6 38 38 38
39535- 58 58 58 26 26 26 38 38 38 2 2 6
39536- 2 2 6 2 2 6 2 2 6 46 46 46
39537- 78 78 78 30 30 30 10 10 10 0 0 0
39538- 0 0 0 0 0 0 0 0 0 0 0 0
39539- 0 0 0 0 0 0 0 0 0 0 0 0
39540- 0 0 0 0 0 0 0 0 0 0 0 0
39541- 0 0 0 0 0 0 0 0 0 0 0 0
39542- 0 0 0 0 0 0 0 0 0 0 0 0
39543- 0 0 0 0 0 0 0 0 0 0 0 0
39544- 0 0 0 0 0 0 0 0 0 0 0 0
39545- 0 0 0 0 0 0 10 10 10 30 30 30
39546- 74 74 74 58 58 58 2 2 6 42 42 42
39547- 2 2 6 22 22 22 231 231 231 253 253 253
39548-253 253 253 253 253 253 253 253 253 253 253 253
39549-253 253 253 253 253 253 253 253 253 250 250 250
39550-253 253 253 253 253 253 253 253 253 253 253 253
39551-253 253 253 253 253 253 253 253 253 253 253 253
39552-253 253 253 253 253 253 253 253 253 253 253 253
39553-253 253 253 253 253 253 253 253 253 253 253 253
39554-253 253 253 246 246 246 46 46 46 38 38 38
39555- 42 42 42 14 14 14 38 38 38 14 14 14
39556- 2 2 6 2 2 6 2 2 6 6 6 6
39557- 86 86 86 46 46 46 14 14 14 0 0 0
39558- 0 0 0 0 0 0 0 0 0 0 0 0
39559- 0 0 0 0 0 0 0 0 0 0 0 0
39560- 0 0 0 0 0 0 0 0 0 0 0 0
39561- 0 0 0 0 0 0 0 0 0 0 0 0
39562- 0 0 0 0 0 0 0 0 0 0 0 0
39563- 0 0 0 0 0 0 0 0 0 0 0 0
39564- 0 0 0 0 0 0 0 0 0 0 0 0
39565- 0 0 0 6 6 6 14 14 14 42 42 42
39566- 90 90 90 18 18 18 18 18 18 26 26 26
39567- 2 2 6 116 116 116 253 253 253 253 253 253
39568-253 253 253 253 253 253 253 253 253 253 253 253
39569-253 253 253 253 253 253 250 250 250 238 238 238
39570-253 253 253 253 253 253 253 253 253 253 253 253
39571-253 253 253 253 253 253 253 253 253 253 253 253
39572-253 253 253 253 253 253 253 253 253 253 253 253
39573-253 253 253 253 253 253 253 253 253 253 253 253
39574-253 253 253 253 253 253 94 94 94 6 6 6
39575- 2 2 6 2 2 6 10 10 10 34 34 34
39576- 2 2 6 2 2 6 2 2 6 2 2 6
39577- 74 74 74 58 58 58 22 22 22 6 6 6
39578- 0 0 0 0 0 0 0 0 0 0 0 0
39579- 0 0 0 0 0 0 0 0 0 0 0 0
39580- 0 0 0 0 0 0 0 0 0 0 0 0
39581- 0 0 0 0 0 0 0 0 0 0 0 0
39582- 0 0 0 0 0 0 0 0 0 0 0 0
39583- 0 0 0 0 0 0 0 0 0 0 0 0
39584- 0 0 0 0 0 0 0 0 0 0 0 0
39585- 0 0 0 10 10 10 26 26 26 66 66 66
39586- 82 82 82 2 2 6 38 38 38 6 6 6
39587- 14 14 14 210 210 210 253 253 253 253 253 253
39588-253 253 253 253 253 253 253 253 253 253 253 253
39589-253 253 253 253 253 253 246 246 246 242 242 242
39590-253 253 253 253 253 253 253 253 253 253 253 253
39591-253 253 253 253 253 253 253 253 253 253 253 253
39592-253 253 253 253 253 253 253 253 253 253 253 253
39593-253 253 253 253 253 253 253 253 253 253 253 253
39594-253 253 253 253 253 253 144 144 144 2 2 6
39595- 2 2 6 2 2 6 2 2 6 46 46 46
39596- 2 2 6 2 2 6 2 2 6 2 2 6
39597- 42 42 42 74 74 74 30 30 30 10 10 10
39598- 0 0 0 0 0 0 0 0 0 0 0 0
39599- 0 0 0 0 0 0 0 0 0 0 0 0
39600- 0 0 0 0 0 0 0 0 0 0 0 0
39601- 0 0 0 0 0 0 0 0 0 0 0 0
39602- 0 0 0 0 0 0 0 0 0 0 0 0
39603- 0 0 0 0 0 0 0 0 0 0 0 0
39604- 0 0 0 0 0 0 0 0 0 0 0 0
39605- 6 6 6 14 14 14 42 42 42 90 90 90
39606- 26 26 26 6 6 6 42 42 42 2 2 6
39607- 74 74 74 250 250 250 253 253 253 253 253 253
39608-253 253 253 253 253 253 253 253 253 253 253 253
39609-253 253 253 253 253 253 242 242 242 242 242 242
39610-253 253 253 253 253 253 253 253 253 253 253 253
39611-253 253 253 253 253 253 253 253 253 253 253 253
39612-253 253 253 253 253 253 253 253 253 253 253 253
39613-253 253 253 253 253 253 253 253 253 253 253 253
39614-253 253 253 253 253 253 182 182 182 2 2 6
39615- 2 2 6 2 2 6 2 2 6 46 46 46
39616- 2 2 6 2 2 6 2 2 6 2 2 6
39617- 10 10 10 86 86 86 38 38 38 10 10 10
39618- 0 0 0 0 0 0 0 0 0 0 0 0
39619- 0 0 0 0 0 0 0 0 0 0 0 0
39620- 0 0 0 0 0 0 0 0 0 0 0 0
39621- 0 0 0 0 0 0 0 0 0 0 0 0
39622- 0 0 0 0 0 0 0 0 0 0 0 0
39623- 0 0 0 0 0 0 0 0 0 0 0 0
39624- 0 0 0 0 0 0 0 0 0 0 0 0
39625- 10 10 10 26 26 26 66 66 66 82 82 82
39626- 2 2 6 22 22 22 18 18 18 2 2 6
39627-149 149 149 253 253 253 253 253 253 253 253 253
39628-253 253 253 253 253 253 253 253 253 253 253 253
39629-253 253 253 253 253 253 234 234 234 242 242 242
39630-253 253 253 253 253 253 253 253 253 253 253 253
39631-253 253 253 253 253 253 253 253 253 253 253 253
39632-253 253 253 253 253 253 253 253 253 253 253 253
39633-253 253 253 253 253 253 253 253 253 253 253 253
39634-253 253 253 253 253 253 206 206 206 2 2 6
39635- 2 2 6 2 2 6 2 2 6 38 38 38
39636- 2 2 6 2 2 6 2 2 6 2 2 6
39637- 6 6 6 86 86 86 46 46 46 14 14 14
39638- 0 0 0 0 0 0 0 0 0 0 0 0
39639- 0 0 0 0 0 0 0 0 0 0 0 0
39640- 0 0 0 0 0 0 0 0 0 0 0 0
39641- 0 0 0 0 0 0 0 0 0 0 0 0
39642- 0 0 0 0 0 0 0 0 0 0 0 0
39643- 0 0 0 0 0 0 0 0 0 0 0 0
39644- 0 0 0 0 0 0 0 0 0 6 6 6
39645- 18 18 18 46 46 46 86 86 86 18 18 18
39646- 2 2 6 34 34 34 10 10 10 6 6 6
39647-210 210 210 253 253 253 253 253 253 253 253 253
39648-253 253 253 253 253 253 253 253 253 253 253 253
39649-253 253 253 253 253 253 234 234 234 242 242 242
39650-253 253 253 253 253 253 253 253 253 253 253 253
39651-253 253 253 253 253 253 253 253 253 253 253 253
39652-253 253 253 253 253 253 253 253 253 253 253 253
39653-253 253 253 253 253 253 253 253 253 253 253 253
39654-253 253 253 253 253 253 221 221 221 6 6 6
39655- 2 2 6 2 2 6 6 6 6 30 30 30
39656- 2 2 6 2 2 6 2 2 6 2 2 6
39657- 2 2 6 82 82 82 54 54 54 18 18 18
39658- 6 6 6 0 0 0 0 0 0 0 0 0
39659- 0 0 0 0 0 0 0 0 0 0 0 0
39660- 0 0 0 0 0 0 0 0 0 0 0 0
39661- 0 0 0 0 0 0 0 0 0 0 0 0
39662- 0 0 0 0 0 0 0 0 0 0 0 0
39663- 0 0 0 0 0 0 0 0 0 0 0 0
39664- 0 0 0 0 0 0 0 0 0 10 10 10
39665- 26 26 26 66 66 66 62 62 62 2 2 6
39666- 2 2 6 38 38 38 10 10 10 26 26 26
39667-238 238 238 253 253 253 253 253 253 253 253 253
39668-253 253 253 253 253 253 253 253 253 253 253 253
39669-253 253 253 253 253 253 231 231 231 238 238 238
39670-253 253 253 253 253 253 253 253 253 253 253 253
39671-253 253 253 253 253 253 253 253 253 253 253 253
39672-253 253 253 253 253 253 253 253 253 253 253 253
39673-253 253 253 253 253 253 253 253 253 253 253 253
39674-253 253 253 253 253 253 231 231 231 6 6 6
39675- 2 2 6 2 2 6 10 10 10 30 30 30
39676- 2 2 6 2 2 6 2 2 6 2 2 6
39677- 2 2 6 66 66 66 58 58 58 22 22 22
39678- 6 6 6 0 0 0 0 0 0 0 0 0
39679- 0 0 0 0 0 0 0 0 0 0 0 0
39680- 0 0 0 0 0 0 0 0 0 0 0 0
39681- 0 0 0 0 0 0 0 0 0 0 0 0
39682- 0 0 0 0 0 0 0 0 0 0 0 0
39683- 0 0 0 0 0 0 0 0 0 0 0 0
39684- 0 0 0 0 0 0 0 0 0 10 10 10
39685- 38 38 38 78 78 78 6 6 6 2 2 6
39686- 2 2 6 46 46 46 14 14 14 42 42 42
39687-246 246 246 253 253 253 253 253 253 253 253 253
39688-253 253 253 253 253 253 253 253 253 253 253 253
39689-253 253 253 253 253 253 231 231 231 242 242 242
39690-253 253 253 253 253 253 253 253 253 253 253 253
39691-253 253 253 253 253 253 253 253 253 253 253 253
39692-253 253 253 253 253 253 253 253 253 253 253 253
39693-253 253 253 253 253 253 253 253 253 253 253 253
39694-253 253 253 253 253 253 234 234 234 10 10 10
39695- 2 2 6 2 2 6 22 22 22 14 14 14
39696- 2 2 6 2 2 6 2 2 6 2 2 6
39697- 2 2 6 66 66 66 62 62 62 22 22 22
39698- 6 6 6 0 0 0 0 0 0 0 0 0
39699- 0 0 0 0 0 0 0 0 0 0 0 0
39700- 0 0 0 0 0 0 0 0 0 0 0 0
39701- 0 0 0 0 0 0 0 0 0 0 0 0
39702- 0 0 0 0 0 0 0 0 0 0 0 0
39703- 0 0 0 0 0 0 0 0 0 0 0 0
39704- 0 0 0 0 0 0 6 6 6 18 18 18
39705- 50 50 50 74 74 74 2 2 6 2 2 6
39706- 14 14 14 70 70 70 34 34 34 62 62 62
39707-250 250 250 253 253 253 253 253 253 253 253 253
39708-253 253 253 253 253 253 253 253 253 253 253 253
39709-253 253 253 253 253 253 231 231 231 246 246 246
39710-253 253 253 253 253 253 253 253 253 253 253 253
39711-253 253 253 253 253 253 253 253 253 253 253 253
39712-253 253 253 253 253 253 253 253 253 253 253 253
39713-253 253 253 253 253 253 253 253 253 253 253 253
39714-253 253 253 253 253 253 234 234 234 14 14 14
39715- 2 2 6 2 2 6 30 30 30 2 2 6
39716- 2 2 6 2 2 6 2 2 6 2 2 6
39717- 2 2 6 66 66 66 62 62 62 22 22 22
39718- 6 6 6 0 0 0 0 0 0 0 0 0
39719- 0 0 0 0 0 0 0 0 0 0 0 0
39720- 0 0 0 0 0 0 0 0 0 0 0 0
39721- 0 0 0 0 0 0 0 0 0 0 0 0
39722- 0 0 0 0 0 0 0 0 0 0 0 0
39723- 0 0 0 0 0 0 0 0 0 0 0 0
39724- 0 0 0 0 0 0 6 6 6 18 18 18
39725- 54 54 54 62 62 62 2 2 6 2 2 6
39726- 2 2 6 30 30 30 46 46 46 70 70 70
39727-250 250 250 253 253 253 253 253 253 253 253 253
39728-253 253 253 253 253 253 253 253 253 253 253 253
39729-253 253 253 253 253 253 231 231 231 246 246 246
39730-253 253 253 253 253 253 253 253 253 253 253 253
39731-253 253 253 253 253 253 253 253 253 253 253 253
39732-253 253 253 253 253 253 253 253 253 253 253 253
39733-253 253 253 253 253 253 253 253 253 253 253 253
39734-253 253 253 253 253 253 226 226 226 10 10 10
39735- 2 2 6 6 6 6 30 30 30 2 2 6
39736- 2 2 6 2 2 6 2 2 6 2 2 6
39737- 2 2 6 66 66 66 58 58 58 22 22 22
39738- 6 6 6 0 0 0 0 0 0 0 0 0
39739- 0 0 0 0 0 0 0 0 0 0 0 0
39740- 0 0 0 0 0 0 0 0 0 0 0 0
39741- 0 0 0 0 0 0 0 0 0 0 0 0
39742- 0 0 0 0 0 0 0 0 0 0 0 0
39743- 0 0 0 0 0 0 0 0 0 0 0 0
39744- 0 0 0 0 0 0 6 6 6 22 22 22
39745- 58 58 58 62 62 62 2 2 6 2 2 6
39746- 2 2 6 2 2 6 30 30 30 78 78 78
39747-250 250 250 253 253 253 253 253 253 253 253 253
39748-253 253 253 253 253 253 253 253 253 253 253 253
39749-253 253 253 253 253 253 231 231 231 246 246 246
39750-253 253 253 253 253 253 253 253 253 253 253 253
39751-253 253 253 253 253 253 253 253 253 253 253 253
39752-253 253 253 253 253 253 253 253 253 253 253 253
39753-253 253 253 253 253 253 253 253 253 253 253 253
39754-253 253 253 253 253 253 206 206 206 2 2 6
39755- 22 22 22 34 34 34 18 14 6 22 22 22
39756- 26 26 26 18 18 18 6 6 6 2 2 6
39757- 2 2 6 82 82 82 54 54 54 18 18 18
39758- 6 6 6 0 0 0 0 0 0 0 0 0
39759- 0 0 0 0 0 0 0 0 0 0 0 0
39760- 0 0 0 0 0 0 0 0 0 0 0 0
39761- 0 0 0 0 0 0 0 0 0 0 0 0
39762- 0 0 0 0 0 0 0 0 0 0 0 0
39763- 0 0 0 0 0 0 0 0 0 0 0 0
39764- 0 0 0 0 0 0 6 6 6 26 26 26
39765- 62 62 62 106 106 106 74 54 14 185 133 11
39766-210 162 10 121 92 8 6 6 6 62 62 62
39767-238 238 238 253 253 253 253 253 253 253 253 253
39768-253 253 253 253 253 253 253 253 253 253 253 253
39769-253 253 253 253 253 253 231 231 231 246 246 246
39770-253 253 253 253 253 253 253 253 253 253 253 253
39771-253 253 253 253 253 253 253 253 253 253 253 253
39772-253 253 253 253 253 253 253 253 253 253 253 253
39773-253 253 253 253 253 253 253 253 253 253 253 253
39774-253 253 253 253 253 253 158 158 158 18 18 18
39775- 14 14 14 2 2 6 2 2 6 2 2 6
39776- 6 6 6 18 18 18 66 66 66 38 38 38
39777- 6 6 6 94 94 94 50 50 50 18 18 18
39778- 6 6 6 0 0 0 0 0 0 0 0 0
39779- 0 0 0 0 0 0 0 0 0 0 0 0
39780- 0 0 0 0 0 0 0 0 0 0 0 0
39781- 0 0 0 0 0 0 0 0 0 0 0 0
39782- 0 0 0 0 0 0 0 0 0 0 0 0
39783- 0 0 0 0 0 0 0 0 0 6 6 6
39784- 10 10 10 10 10 10 18 18 18 38 38 38
39785- 78 78 78 142 134 106 216 158 10 242 186 14
39786-246 190 14 246 190 14 156 118 10 10 10 10
39787- 90 90 90 238 238 238 253 253 253 253 253 253
39788-253 253 253 253 253 253 253 253 253 253 253 253
39789-253 253 253 253 253 253 231 231 231 250 250 250
39790-253 253 253 253 253 253 253 253 253 253 253 253
39791-253 253 253 253 253 253 253 253 253 253 253 253
39792-253 253 253 253 253 253 253 253 253 253 253 253
39793-253 253 253 253 253 253 253 253 253 246 230 190
39794-238 204 91 238 204 91 181 142 44 37 26 9
39795- 2 2 6 2 2 6 2 2 6 2 2 6
39796- 2 2 6 2 2 6 38 38 38 46 46 46
39797- 26 26 26 106 106 106 54 54 54 18 18 18
39798- 6 6 6 0 0 0 0 0 0 0 0 0
39799- 0 0 0 0 0 0 0 0 0 0 0 0
39800- 0 0 0 0 0 0 0 0 0 0 0 0
39801- 0 0 0 0 0 0 0 0 0 0 0 0
39802- 0 0 0 0 0 0 0 0 0 0 0 0
39803- 0 0 0 6 6 6 14 14 14 22 22 22
39804- 30 30 30 38 38 38 50 50 50 70 70 70
39805-106 106 106 190 142 34 226 170 11 242 186 14
39806-246 190 14 246 190 14 246 190 14 154 114 10
39807- 6 6 6 74 74 74 226 226 226 253 253 253
39808-253 253 253 253 253 253 253 253 253 253 253 253
39809-253 253 253 253 253 253 231 231 231 250 250 250
39810-253 253 253 253 253 253 253 253 253 253 253 253
39811-253 253 253 253 253 253 253 253 253 253 253 253
39812-253 253 253 253 253 253 253 253 253 253 253 253
39813-253 253 253 253 253 253 253 253 253 228 184 62
39814-241 196 14 241 208 19 232 195 16 38 30 10
39815- 2 2 6 2 2 6 2 2 6 2 2 6
39816- 2 2 6 6 6 6 30 30 30 26 26 26
39817-203 166 17 154 142 90 66 66 66 26 26 26
39818- 6 6 6 0 0 0 0 0 0 0 0 0
39819- 0 0 0 0 0 0 0 0 0 0 0 0
39820- 0 0 0 0 0 0 0 0 0 0 0 0
39821- 0 0 0 0 0 0 0 0 0 0 0 0
39822- 0 0 0 0 0 0 0 0 0 0 0 0
39823- 6 6 6 18 18 18 38 38 38 58 58 58
39824- 78 78 78 86 86 86 101 101 101 123 123 123
39825-175 146 61 210 150 10 234 174 13 246 186 14
39826-246 190 14 246 190 14 246 190 14 238 190 10
39827-102 78 10 2 2 6 46 46 46 198 198 198
39828-253 253 253 253 253 253 253 253 253 253 253 253
39829-253 253 253 253 253 253 234 234 234 242 242 242
39830-253 253 253 253 253 253 253 253 253 253 253 253
39831-253 253 253 253 253 253 253 253 253 253 253 253
39832-253 253 253 253 253 253 253 253 253 253 253 253
39833-253 253 253 253 253 253 253 253 253 224 178 62
39834-242 186 14 241 196 14 210 166 10 22 18 6
39835- 2 2 6 2 2 6 2 2 6 2 2 6
39836- 2 2 6 2 2 6 6 6 6 121 92 8
39837-238 202 15 232 195 16 82 82 82 34 34 34
39838- 10 10 10 0 0 0 0 0 0 0 0 0
39839- 0 0 0 0 0 0 0 0 0 0 0 0
39840- 0 0 0 0 0 0 0 0 0 0 0 0
39841- 0 0 0 0 0 0 0 0 0 0 0 0
39842- 0 0 0 0 0 0 0 0 0 0 0 0
39843- 14 14 14 38 38 38 70 70 70 154 122 46
39844-190 142 34 200 144 11 197 138 11 197 138 11
39845-213 154 11 226 170 11 242 186 14 246 190 14
39846-246 190 14 246 190 14 246 190 14 246 190 14
39847-225 175 15 46 32 6 2 2 6 22 22 22
39848-158 158 158 250 250 250 253 253 253 253 253 253
39849-253 253 253 253 253 253 253 253 253 253 253 253
39850-253 253 253 253 253 253 253 253 253 253 253 253
39851-253 253 253 253 253 253 253 253 253 253 253 253
39852-253 253 253 253 253 253 253 253 253 253 253 253
39853-253 253 253 250 250 250 242 242 242 224 178 62
39854-239 182 13 236 186 11 213 154 11 46 32 6
39855- 2 2 6 2 2 6 2 2 6 2 2 6
39856- 2 2 6 2 2 6 61 42 6 225 175 15
39857-238 190 10 236 186 11 112 100 78 42 42 42
39858- 14 14 14 0 0 0 0 0 0 0 0 0
39859- 0 0 0 0 0 0 0 0 0 0 0 0
39860- 0 0 0 0 0 0 0 0 0 0 0 0
39861- 0 0 0 0 0 0 0 0 0 0 0 0
39862- 0 0 0 0 0 0 0 0 0 6 6 6
39863- 22 22 22 54 54 54 154 122 46 213 154 11
39864-226 170 11 230 174 11 226 170 11 226 170 11
39865-236 178 12 242 186 14 246 190 14 246 190 14
39866-246 190 14 246 190 14 246 190 14 246 190 14
39867-241 196 14 184 144 12 10 10 10 2 2 6
39868- 6 6 6 116 116 116 242 242 242 253 253 253
39869-253 253 253 253 253 253 253 253 253 253 253 253
39870-253 253 253 253 253 253 253 253 253 253 253 253
39871-253 253 253 253 253 253 253 253 253 253 253 253
39872-253 253 253 253 253 253 253 253 253 253 253 253
39873-253 253 253 231 231 231 198 198 198 214 170 54
39874-236 178 12 236 178 12 210 150 10 137 92 6
39875- 18 14 6 2 2 6 2 2 6 2 2 6
39876- 6 6 6 70 47 6 200 144 11 236 178 12
39877-239 182 13 239 182 13 124 112 88 58 58 58
39878- 22 22 22 6 6 6 0 0 0 0 0 0
39879- 0 0 0 0 0 0 0 0 0 0 0 0
39880- 0 0 0 0 0 0 0 0 0 0 0 0
39881- 0 0 0 0 0 0 0 0 0 0 0 0
39882- 0 0 0 0 0 0 0 0 0 10 10 10
39883- 30 30 30 70 70 70 180 133 36 226 170 11
39884-239 182 13 242 186 14 242 186 14 246 186 14
39885-246 190 14 246 190 14 246 190 14 246 190 14
39886-246 190 14 246 190 14 246 190 14 246 190 14
39887-246 190 14 232 195 16 98 70 6 2 2 6
39888- 2 2 6 2 2 6 66 66 66 221 221 221
39889-253 253 253 253 253 253 253 253 253 253 253 253
39890-253 253 253 253 253 253 253 253 253 253 253 253
39891-253 253 253 253 253 253 253 253 253 253 253 253
39892-253 253 253 253 253 253 253 253 253 253 253 253
39893-253 253 253 206 206 206 198 198 198 214 166 58
39894-230 174 11 230 174 11 216 158 10 192 133 9
39895-163 110 8 116 81 8 102 78 10 116 81 8
39896-167 114 7 197 138 11 226 170 11 239 182 13
39897-242 186 14 242 186 14 162 146 94 78 78 78
39898- 34 34 34 14 14 14 6 6 6 0 0 0
39899- 0 0 0 0 0 0 0 0 0 0 0 0
39900- 0 0 0 0 0 0 0 0 0 0 0 0
39901- 0 0 0 0 0 0 0 0 0 0 0 0
39902- 0 0 0 0 0 0 0 0 0 6 6 6
39903- 30 30 30 78 78 78 190 142 34 226 170 11
39904-239 182 13 246 190 14 246 190 14 246 190 14
39905-246 190 14 246 190 14 246 190 14 246 190 14
39906-246 190 14 246 190 14 246 190 14 246 190 14
39907-246 190 14 241 196 14 203 166 17 22 18 6
39908- 2 2 6 2 2 6 2 2 6 38 38 38
39909-218 218 218 253 253 253 253 253 253 253 253 253
39910-253 253 253 253 253 253 253 253 253 253 253 253
39911-253 253 253 253 253 253 253 253 253 253 253 253
39912-253 253 253 253 253 253 253 253 253 253 253 253
39913-250 250 250 206 206 206 198 198 198 202 162 69
39914-226 170 11 236 178 12 224 166 10 210 150 10
39915-200 144 11 197 138 11 192 133 9 197 138 11
39916-210 150 10 226 170 11 242 186 14 246 190 14
39917-246 190 14 246 186 14 225 175 15 124 112 88
39918- 62 62 62 30 30 30 14 14 14 6 6 6
39919- 0 0 0 0 0 0 0 0 0 0 0 0
39920- 0 0 0 0 0 0 0 0 0 0 0 0
39921- 0 0 0 0 0 0 0 0 0 0 0 0
39922- 0 0 0 0 0 0 0 0 0 10 10 10
39923- 30 30 30 78 78 78 174 135 50 224 166 10
39924-239 182 13 246 190 14 246 190 14 246 190 14
39925-246 190 14 246 190 14 246 190 14 246 190 14
39926-246 190 14 246 190 14 246 190 14 246 190 14
39927-246 190 14 246 190 14 241 196 14 139 102 15
39928- 2 2 6 2 2 6 2 2 6 2 2 6
39929- 78 78 78 250 250 250 253 253 253 253 253 253
39930-253 253 253 253 253 253 253 253 253 253 253 253
39931-253 253 253 253 253 253 253 253 253 253 253 253
39932-253 253 253 253 253 253 253 253 253 253 253 253
39933-250 250 250 214 214 214 198 198 198 190 150 46
39934-219 162 10 236 178 12 234 174 13 224 166 10
39935-216 158 10 213 154 11 213 154 11 216 158 10
39936-226 170 11 239 182 13 246 190 14 246 190 14
39937-246 190 14 246 190 14 242 186 14 206 162 42
39938-101 101 101 58 58 58 30 30 30 14 14 14
39939- 6 6 6 0 0 0 0 0 0 0 0 0
39940- 0 0 0 0 0 0 0 0 0 0 0 0
39941- 0 0 0 0 0 0 0 0 0 0 0 0
39942- 0 0 0 0 0 0 0 0 0 10 10 10
39943- 30 30 30 74 74 74 174 135 50 216 158 10
39944-236 178 12 246 190 14 246 190 14 246 190 14
39945-246 190 14 246 190 14 246 190 14 246 190 14
39946-246 190 14 246 190 14 246 190 14 246 190 14
39947-246 190 14 246 190 14 241 196 14 226 184 13
39948- 61 42 6 2 2 6 2 2 6 2 2 6
39949- 22 22 22 238 238 238 253 253 253 253 253 253
39950-253 253 253 253 253 253 253 253 253 253 253 253
39951-253 253 253 253 253 253 253 253 253 253 253 253
39952-253 253 253 253 253 253 253 253 253 253 253 253
39953-253 253 253 226 226 226 187 187 187 180 133 36
39954-216 158 10 236 178 12 239 182 13 236 178 12
39955-230 174 11 226 170 11 226 170 11 230 174 11
39956-236 178 12 242 186 14 246 190 14 246 190 14
39957-246 190 14 246 190 14 246 186 14 239 182 13
39958-206 162 42 106 106 106 66 66 66 34 34 34
39959- 14 14 14 6 6 6 0 0 0 0 0 0
39960- 0 0 0 0 0 0 0 0 0 0 0 0
39961- 0 0 0 0 0 0 0 0 0 0 0 0
39962- 0 0 0 0 0 0 0 0 0 6 6 6
39963- 26 26 26 70 70 70 163 133 67 213 154 11
39964-236 178 12 246 190 14 246 190 14 246 190 14
39965-246 190 14 246 190 14 246 190 14 246 190 14
39966-246 190 14 246 190 14 246 190 14 246 190 14
39967-246 190 14 246 190 14 246 190 14 241 196 14
39968-190 146 13 18 14 6 2 2 6 2 2 6
39969- 46 46 46 246 246 246 253 253 253 253 253 253
39970-253 253 253 253 253 253 253 253 253 253 253 253
39971-253 253 253 253 253 253 253 253 253 253 253 253
39972-253 253 253 253 253 253 253 253 253 253 253 253
39973-253 253 253 221 221 221 86 86 86 156 107 11
39974-216 158 10 236 178 12 242 186 14 246 186 14
39975-242 186 14 239 182 13 239 182 13 242 186 14
39976-242 186 14 246 186 14 246 190 14 246 190 14
39977-246 190 14 246 190 14 246 190 14 246 190 14
39978-242 186 14 225 175 15 142 122 72 66 66 66
39979- 30 30 30 10 10 10 0 0 0 0 0 0
39980- 0 0 0 0 0 0 0 0 0 0 0 0
39981- 0 0 0 0 0 0 0 0 0 0 0 0
39982- 0 0 0 0 0 0 0 0 0 6 6 6
39983- 26 26 26 70 70 70 163 133 67 210 150 10
39984-236 178 12 246 190 14 246 190 14 246 190 14
39985-246 190 14 246 190 14 246 190 14 246 190 14
39986-246 190 14 246 190 14 246 190 14 246 190 14
39987-246 190 14 246 190 14 246 190 14 246 190 14
39988-232 195 16 121 92 8 34 34 34 106 106 106
39989-221 221 221 253 253 253 253 253 253 253 253 253
39990-253 253 253 253 253 253 253 253 253 253 253 253
39991-253 253 253 253 253 253 253 253 253 253 253 253
39992-253 253 253 253 253 253 253 253 253 253 253 253
39993-242 242 242 82 82 82 18 14 6 163 110 8
39994-216 158 10 236 178 12 242 186 14 246 190 14
39995-246 190 14 246 190 14 246 190 14 246 190 14
39996-246 190 14 246 190 14 246 190 14 246 190 14
39997-246 190 14 246 190 14 246 190 14 246 190 14
39998-246 190 14 246 190 14 242 186 14 163 133 67
39999- 46 46 46 18 18 18 6 6 6 0 0 0
40000- 0 0 0 0 0 0 0 0 0 0 0 0
40001- 0 0 0 0 0 0 0 0 0 0 0 0
40002- 0 0 0 0 0 0 0 0 0 10 10 10
40003- 30 30 30 78 78 78 163 133 67 210 150 10
40004-236 178 12 246 186 14 246 190 14 246 190 14
40005-246 190 14 246 190 14 246 190 14 246 190 14
40006-246 190 14 246 190 14 246 190 14 246 190 14
40007-246 190 14 246 190 14 246 190 14 246 190 14
40008-241 196 14 215 174 15 190 178 144 253 253 253
40009-253 253 253 253 253 253 253 253 253 253 253 253
40010-253 253 253 253 253 253 253 253 253 253 253 253
40011-253 253 253 253 253 253 253 253 253 253 253 253
40012-253 253 253 253 253 253 253 253 253 218 218 218
40013- 58 58 58 2 2 6 22 18 6 167 114 7
40014-216 158 10 236 178 12 246 186 14 246 190 14
40015-246 190 14 246 190 14 246 190 14 246 190 14
40016-246 190 14 246 190 14 246 190 14 246 190 14
40017-246 190 14 246 190 14 246 190 14 246 190 14
40018-246 190 14 246 186 14 242 186 14 190 150 46
40019- 54 54 54 22 22 22 6 6 6 0 0 0
40020- 0 0 0 0 0 0 0 0 0 0 0 0
40021- 0 0 0 0 0 0 0 0 0 0 0 0
40022- 0 0 0 0 0 0 0 0 0 14 14 14
40023- 38 38 38 86 86 86 180 133 36 213 154 11
40024-236 178 12 246 186 14 246 190 14 246 190 14
40025-246 190 14 246 190 14 246 190 14 246 190 14
40026-246 190 14 246 190 14 246 190 14 246 190 14
40027-246 190 14 246 190 14 246 190 14 246 190 14
40028-246 190 14 232 195 16 190 146 13 214 214 214
40029-253 253 253 253 253 253 253 253 253 253 253 253
40030-253 253 253 253 253 253 253 253 253 253 253 253
40031-253 253 253 253 253 253 253 253 253 253 253 253
40032-253 253 253 250 250 250 170 170 170 26 26 26
40033- 2 2 6 2 2 6 37 26 9 163 110 8
40034-219 162 10 239 182 13 246 186 14 246 190 14
40035-246 190 14 246 190 14 246 190 14 246 190 14
40036-246 190 14 246 190 14 246 190 14 246 190 14
40037-246 190 14 246 190 14 246 190 14 246 190 14
40038-246 186 14 236 178 12 224 166 10 142 122 72
40039- 46 46 46 18 18 18 6 6 6 0 0 0
40040- 0 0 0 0 0 0 0 0 0 0 0 0
40041- 0 0 0 0 0 0 0 0 0 0 0 0
40042- 0 0 0 0 0 0 6 6 6 18 18 18
40043- 50 50 50 109 106 95 192 133 9 224 166 10
40044-242 186 14 246 190 14 246 190 14 246 190 14
40045-246 190 14 246 190 14 246 190 14 246 190 14
40046-246 190 14 246 190 14 246 190 14 246 190 14
40047-246 190 14 246 190 14 246 190 14 246 190 14
40048-242 186 14 226 184 13 210 162 10 142 110 46
40049-226 226 226 253 253 253 253 253 253 253 253 253
40050-253 253 253 253 253 253 253 253 253 253 253 253
40051-253 253 253 253 253 253 253 253 253 253 253 253
40052-198 198 198 66 66 66 2 2 6 2 2 6
40053- 2 2 6 2 2 6 50 34 6 156 107 11
40054-219 162 10 239 182 13 246 186 14 246 190 14
40055-246 190 14 246 190 14 246 190 14 246 190 14
40056-246 190 14 246 190 14 246 190 14 246 190 14
40057-246 190 14 246 190 14 246 190 14 242 186 14
40058-234 174 13 213 154 11 154 122 46 66 66 66
40059- 30 30 30 10 10 10 0 0 0 0 0 0
40060- 0 0 0 0 0 0 0 0 0 0 0 0
40061- 0 0 0 0 0 0 0 0 0 0 0 0
40062- 0 0 0 0 0 0 6 6 6 22 22 22
40063- 58 58 58 154 121 60 206 145 10 234 174 13
40064-242 186 14 246 186 14 246 190 14 246 190 14
40065-246 190 14 246 190 14 246 190 14 246 190 14
40066-246 190 14 246 190 14 246 190 14 246 190 14
40067-246 190 14 246 190 14 246 190 14 246 190 14
40068-246 186 14 236 178 12 210 162 10 163 110 8
40069- 61 42 6 138 138 138 218 218 218 250 250 250
40070-253 253 253 253 253 253 253 253 253 250 250 250
40071-242 242 242 210 210 210 144 144 144 66 66 66
40072- 6 6 6 2 2 6 2 2 6 2 2 6
40073- 2 2 6 2 2 6 61 42 6 163 110 8
40074-216 158 10 236 178 12 246 190 14 246 190 14
40075-246 190 14 246 190 14 246 190 14 246 190 14
40076-246 190 14 246 190 14 246 190 14 246 190 14
40077-246 190 14 239 182 13 230 174 11 216 158 10
40078-190 142 34 124 112 88 70 70 70 38 38 38
40079- 18 18 18 6 6 6 0 0 0 0 0 0
40080- 0 0 0 0 0 0 0 0 0 0 0 0
40081- 0 0 0 0 0 0 0 0 0 0 0 0
40082- 0 0 0 0 0 0 6 6 6 22 22 22
40083- 62 62 62 168 124 44 206 145 10 224 166 10
40084-236 178 12 239 182 13 242 186 14 242 186 14
40085-246 186 14 246 190 14 246 190 14 246 190 14
40086-246 190 14 246 190 14 246 190 14 246 190 14
40087-246 190 14 246 190 14 246 190 14 246 190 14
40088-246 190 14 236 178 12 216 158 10 175 118 6
40089- 80 54 7 2 2 6 6 6 6 30 30 30
40090- 54 54 54 62 62 62 50 50 50 38 38 38
40091- 14 14 14 2 2 6 2 2 6 2 2 6
40092- 2 2 6 2 2 6 2 2 6 2 2 6
40093- 2 2 6 6 6 6 80 54 7 167 114 7
40094-213 154 11 236 178 12 246 190 14 246 190 14
40095-246 190 14 246 190 14 246 190 14 246 190 14
40096-246 190 14 242 186 14 239 182 13 239 182 13
40097-230 174 11 210 150 10 174 135 50 124 112 88
40098- 82 82 82 54 54 54 34 34 34 18 18 18
40099- 6 6 6 0 0 0 0 0 0 0 0 0
40100- 0 0 0 0 0 0 0 0 0 0 0 0
40101- 0 0 0 0 0 0 0 0 0 0 0 0
40102- 0 0 0 0 0 0 6 6 6 18 18 18
40103- 50 50 50 158 118 36 192 133 9 200 144 11
40104-216 158 10 219 162 10 224 166 10 226 170 11
40105-230 174 11 236 178 12 239 182 13 239 182 13
40106-242 186 14 246 186 14 246 190 14 246 190 14
40107-246 190 14 246 190 14 246 190 14 246 190 14
40108-246 186 14 230 174 11 210 150 10 163 110 8
40109-104 69 6 10 10 10 2 2 6 2 2 6
40110- 2 2 6 2 2 6 2 2 6 2 2 6
40111- 2 2 6 2 2 6 2 2 6 2 2 6
40112- 2 2 6 2 2 6 2 2 6 2 2 6
40113- 2 2 6 6 6 6 91 60 6 167 114 7
40114-206 145 10 230 174 11 242 186 14 246 190 14
40115-246 190 14 246 190 14 246 186 14 242 186 14
40116-239 182 13 230 174 11 224 166 10 213 154 11
40117-180 133 36 124 112 88 86 86 86 58 58 58
40118- 38 38 38 22 22 22 10 10 10 6 6 6
40119- 0 0 0 0 0 0 0 0 0 0 0 0
40120- 0 0 0 0 0 0 0 0 0 0 0 0
40121- 0 0 0 0 0 0 0 0 0 0 0 0
40122- 0 0 0 0 0 0 0 0 0 14 14 14
40123- 34 34 34 70 70 70 138 110 50 158 118 36
40124-167 114 7 180 123 7 192 133 9 197 138 11
40125-200 144 11 206 145 10 213 154 11 219 162 10
40126-224 166 10 230 174 11 239 182 13 242 186 14
40127-246 186 14 246 186 14 246 186 14 246 186 14
40128-239 182 13 216 158 10 185 133 11 152 99 6
40129-104 69 6 18 14 6 2 2 6 2 2 6
40130- 2 2 6 2 2 6 2 2 6 2 2 6
40131- 2 2 6 2 2 6 2 2 6 2 2 6
40132- 2 2 6 2 2 6 2 2 6 2 2 6
40133- 2 2 6 6 6 6 80 54 7 152 99 6
40134-192 133 9 219 162 10 236 178 12 239 182 13
40135-246 186 14 242 186 14 239 182 13 236 178 12
40136-224 166 10 206 145 10 192 133 9 154 121 60
40137- 94 94 94 62 62 62 42 42 42 22 22 22
40138- 14 14 14 6 6 6 0 0 0 0 0 0
40139- 0 0 0 0 0 0 0 0 0 0 0 0
40140- 0 0 0 0 0 0 0 0 0 0 0 0
40141- 0 0 0 0 0 0 0 0 0 0 0 0
40142- 0 0 0 0 0 0 0 0 0 6 6 6
40143- 18 18 18 34 34 34 58 58 58 78 78 78
40144-101 98 89 124 112 88 142 110 46 156 107 11
40145-163 110 8 167 114 7 175 118 6 180 123 7
40146-185 133 11 197 138 11 210 150 10 219 162 10
40147-226 170 11 236 178 12 236 178 12 234 174 13
40148-219 162 10 197 138 11 163 110 8 130 83 6
40149- 91 60 6 10 10 10 2 2 6 2 2 6
40150- 18 18 18 38 38 38 38 38 38 38 38 38
40151- 38 38 38 38 38 38 38 38 38 38 38 38
40152- 38 38 38 38 38 38 26 26 26 2 2 6
40153- 2 2 6 6 6 6 70 47 6 137 92 6
40154-175 118 6 200 144 11 219 162 10 230 174 11
40155-234 174 13 230 174 11 219 162 10 210 150 10
40156-192 133 9 163 110 8 124 112 88 82 82 82
40157- 50 50 50 30 30 30 14 14 14 6 6 6
40158- 0 0 0 0 0 0 0 0 0 0 0 0
40159- 0 0 0 0 0 0 0 0 0 0 0 0
40160- 0 0 0 0 0 0 0 0 0 0 0 0
40161- 0 0 0 0 0 0 0 0 0 0 0 0
40162- 0 0 0 0 0 0 0 0 0 0 0 0
40163- 6 6 6 14 14 14 22 22 22 34 34 34
40164- 42 42 42 58 58 58 74 74 74 86 86 86
40165-101 98 89 122 102 70 130 98 46 121 87 25
40166-137 92 6 152 99 6 163 110 8 180 123 7
40167-185 133 11 197 138 11 206 145 10 200 144 11
40168-180 123 7 156 107 11 130 83 6 104 69 6
40169- 50 34 6 54 54 54 110 110 110 101 98 89
40170- 86 86 86 82 82 82 78 78 78 78 78 78
40171- 78 78 78 78 78 78 78 78 78 78 78 78
40172- 78 78 78 82 82 82 86 86 86 94 94 94
40173-106 106 106 101 101 101 86 66 34 124 80 6
40174-156 107 11 180 123 7 192 133 9 200 144 11
40175-206 145 10 200 144 11 192 133 9 175 118 6
40176-139 102 15 109 106 95 70 70 70 42 42 42
40177- 22 22 22 10 10 10 0 0 0 0 0 0
40178- 0 0 0 0 0 0 0 0 0 0 0 0
40179- 0 0 0 0 0 0 0 0 0 0 0 0
40180- 0 0 0 0 0 0 0 0 0 0 0 0
40181- 0 0 0 0 0 0 0 0 0 0 0 0
40182- 0 0 0 0 0 0 0 0 0 0 0 0
40183- 0 0 0 0 0 0 6 6 6 10 10 10
40184- 14 14 14 22 22 22 30 30 30 38 38 38
40185- 50 50 50 62 62 62 74 74 74 90 90 90
40186-101 98 89 112 100 78 121 87 25 124 80 6
40187-137 92 6 152 99 6 152 99 6 152 99 6
40188-138 86 6 124 80 6 98 70 6 86 66 30
40189-101 98 89 82 82 82 58 58 58 46 46 46
40190- 38 38 38 34 34 34 34 34 34 34 34 34
40191- 34 34 34 34 34 34 34 34 34 34 34 34
40192- 34 34 34 34 34 34 38 38 38 42 42 42
40193- 54 54 54 82 82 82 94 86 76 91 60 6
40194-134 86 6 156 107 11 167 114 7 175 118 6
40195-175 118 6 167 114 7 152 99 6 121 87 25
40196-101 98 89 62 62 62 34 34 34 18 18 18
40197- 6 6 6 0 0 0 0 0 0 0 0 0
40198- 0 0 0 0 0 0 0 0 0 0 0 0
40199- 0 0 0 0 0 0 0 0 0 0 0 0
40200- 0 0 0 0 0 0 0 0 0 0 0 0
40201- 0 0 0 0 0 0 0 0 0 0 0 0
40202- 0 0 0 0 0 0 0 0 0 0 0 0
40203- 0 0 0 0 0 0 0 0 0 0 0 0
40204- 0 0 0 6 6 6 6 6 6 10 10 10
40205- 18 18 18 22 22 22 30 30 30 42 42 42
40206- 50 50 50 66 66 66 86 86 86 101 98 89
40207-106 86 58 98 70 6 104 69 6 104 69 6
40208-104 69 6 91 60 6 82 62 34 90 90 90
40209- 62 62 62 38 38 38 22 22 22 14 14 14
40210- 10 10 10 10 10 10 10 10 10 10 10 10
40211- 10 10 10 10 10 10 6 6 6 10 10 10
40212- 10 10 10 10 10 10 10 10 10 14 14 14
40213- 22 22 22 42 42 42 70 70 70 89 81 66
40214- 80 54 7 104 69 6 124 80 6 137 92 6
40215-134 86 6 116 81 8 100 82 52 86 86 86
40216- 58 58 58 30 30 30 14 14 14 6 6 6
40217- 0 0 0 0 0 0 0 0 0 0 0 0
40218- 0 0 0 0 0 0 0 0 0 0 0 0
40219- 0 0 0 0 0 0 0 0 0 0 0 0
40220- 0 0 0 0 0 0 0 0 0 0 0 0
40221- 0 0 0 0 0 0 0 0 0 0 0 0
40222- 0 0 0 0 0 0 0 0 0 0 0 0
40223- 0 0 0 0 0 0 0 0 0 0 0 0
40224- 0 0 0 0 0 0 0 0 0 0 0 0
40225- 0 0 0 6 6 6 10 10 10 14 14 14
40226- 18 18 18 26 26 26 38 38 38 54 54 54
40227- 70 70 70 86 86 86 94 86 76 89 81 66
40228- 89 81 66 86 86 86 74 74 74 50 50 50
40229- 30 30 30 14 14 14 6 6 6 0 0 0
40230- 0 0 0 0 0 0 0 0 0 0 0 0
40231- 0 0 0 0 0 0 0 0 0 0 0 0
40232- 0 0 0 0 0 0 0 0 0 0 0 0
40233- 6 6 6 18 18 18 34 34 34 58 58 58
40234- 82 82 82 89 81 66 89 81 66 89 81 66
40235- 94 86 66 94 86 76 74 74 74 50 50 50
40236- 26 26 26 14 14 14 6 6 6 0 0 0
40237- 0 0 0 0 0 0 0 0 0 0 0 0
40238- 0 0 0 0 0 0 0 0 0 0 0 0
40239- 0 0 0 0 0 0 0 0 0 0 0 0
40240- 0 0 0 0 0 0 0 0 0 0 0 0
40241- 0 0 0 0 0 0 0 0 0 0 0 0
40242- 0 0 0 0 0 0 0 0 0 0 0 0
40243- 0 0 0 0 0 0 0 0 0 0 0 0
40244- 0 0 0 0 0 0 0 0 0 0 0 0
40245- 0 0 0 0 0 0 0 0 0 0 0 0
40246- 6 6 6 6 6 6 14 14 14 18 18 18
40247- 30 30 30 38 38 38 46 46 46 54 54 54
40248- 50 50 50 42 42 42 30 30 30 18 18 18
40249- 10 10 10 0 0 0 0 0 0 0 0 0
40250- 0 0 0 0 0 0 0 0 0 0 0 0
40251- 0 0 0 0 0 0 0 0 0 0 0 0
40252- 0 0 0 0 0 0 0 0 0 0 0 0
40253- 0 0 0 6 6 6 14 14 14 26 26 26
40254- 38 38 38 50 50 50 58 58 58 58 58 58
40255- 54 54 54 42 42 42 30 30 30 18 18 18
40256- 10 10 10 0 0 0 0 0 0 0 0 0
40257- 0 0 0 0 0 0 0 0 0 0 0 0
40258- 0 0 0 0 0 0 0 0 0 0 0 0
40259- 0 0 0 0 0 0 0 0 0 0 0 0
40260- 0 0 0 0 0 0 0 0 0 0 0 0
40261- 0 0 0 0 0 0 0 0 0 0 0 0
40262- 0 0 0 0 0 0 0 0 0 0 0 0
40263- 0 0 0 0 0 0 0 0 0 0 0 0
40264- 0 0 0 0 0 0 0 0 0 0 0 0
40265- 0 0 0 0 0 0 0 0 0 0 0 0
40266- 0 0 0 0 0 0 0 0 0 6 6 6
40267- 6 6 6 10 10 10 14 14 14 18 18 18
40268- 18 18 18 14 14 14 10 10 10 6 6 6
40269- 0 0 0 0 0 0 0 0 0 0 0 0
40270- 0 0 0 0 0 0 0 0 0 0 0 0
40271- 0 0 0 0 0 0 0 0 0 0 0 0
40272- 0 0 0 0 0 0 0 0 0 0 0 0
40273- 0 0 0 0 0 0 0 0 0 6 6 6
40274- 14 14 14 18 18 18 22 22 22 22 22 22
40275- 18 18 18 14 14 14 10 10 10 6 6 6
40276- 0 0 0 0 0 0 0 0 0 0 0 0
40277- 0 0 0 0 0 0 0 0 0 0 0 0
40278- 0 0 0 0 0 0 0 0 0 0 0 0
40279- 0 0 0 0 0 0 0 0 0 0 0 0
40280- 0 0 0 0 0 0 0 0 0 0 0 0
40281+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40282+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40283+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40284+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40285+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40286+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40287+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40288+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40289+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40290+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40291+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40292+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40293+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40294+4 4 4 4 4 4
40295+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40296+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40297+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40298+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40299+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40300+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40301+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40302+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40303+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40304+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40305+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40306+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40307+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40308+4 4 4 4 4 4
40309+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40310+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40311+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40312+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40313+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40314+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40315+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40316+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40317+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40318+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40319+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40320+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40321+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40322+4 4 4 4 4 4
40323+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40324+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40325+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40326+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40327+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40328+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40329+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40330+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40331+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40332+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40333+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40334+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40335+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40336+4 4 4 4 4 4
40337+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40338+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40339+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40340+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40341+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40342+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40343+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40344+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40345+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40346+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40347+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40348+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40349+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40350+4 4 4 4 4 4
40351+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40352+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40353+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40354+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40355+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40356+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40357+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40358+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40359+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40360+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40361+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40362+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40363+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40364+4 4 4 4 4 4
40365+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40366+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40367+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40368+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40369+4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
40370+0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
40371+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40372+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40373+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40374+4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
40375+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40376+4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
40377+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40378+4 4 4 4 4 4
40379+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40380+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40381+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40382+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40383+4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
40384+37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
40385+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40386+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40387+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40388+4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
40389+2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
40390+4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
40391+1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40392+4 4 4 4 4 4
40393+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40394+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40395+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40396+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40397+2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
40398+153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
40399+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40400+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40401+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40402+4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
40403+60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
40404+4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
40405+2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
40406+4 4 4 4 4 4
40407+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40408+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40409+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40410+4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
40411+4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
40412+165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
40413+1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
40414+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40415+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40416+3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
40417+163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
40418+0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
40419+37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
40420+4 4 4 4 4 4
40421+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40422+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40423+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40424+4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
40425+37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
40426+156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
40427+125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
40428+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40429+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
40430+0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
40431+174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
40432+0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
40433+64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
40434+4 4 4 4 4 4
40435+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40436+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40437+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
40438+5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
40439+156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
40440+156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
40441+174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
40442+1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
40443+4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
40444+13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
40445+174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
40446+22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
40447+90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
40448+4 4 4 4 4 4
40449+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40450+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40451+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
40452+0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
40453+174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
40454+156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
40455+163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
40456+4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
40457+5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
40458+131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
40459+190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
40460+90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
40461+31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
40462+4 4 4 4 4 4
40463+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40464+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40465+4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
40466+4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
40467+155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
40468+167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
40469+153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
40470+41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
40471+1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
40472+177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
40473+125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
40474+136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
40475+7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
40476+4 4 4 4 4 4
40477+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40478+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40479+4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
40480+125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
40481+156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
40482+137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
40483+156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
40484+167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
40485+0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
40486+166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
40487+6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
40488+90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
40489+1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40490+4 4 4 4 4 4
40491+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40492+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40493+1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
40494+167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
40495+157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
40496+26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
40497+158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
40498+165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
40499+60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
40500+137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
40501+52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
40502+13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
40503+4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
40504+4 4 4 4 4 4
40505+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40506+4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
40507+0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
40508+158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
40509+167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
40510+4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
40511+174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
40512+155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
40513+137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
40514+16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
40515+136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
40516+2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
40517+4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
40518+4 4 4 4 4 4
40519+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40520+4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
40521+37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
40522+157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
40523+153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
40524+4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
40525+125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
40526+156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
40527+174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
40528+4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
40529+136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
40530+1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
40531+2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
40532+0 0 0 4 4 4
40533+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40534+4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
40535+158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
40536+153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
40537+37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
40538+4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
40539+4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
40540+154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
40541+174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
40542+32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
40543+28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
40544+50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
40545+0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
40546+2 0 0 0 0 0
40547+4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
40548+0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
40549+174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
40550+165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
40551+4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
40552+4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
40553+4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
40554+174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
40555+60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
40556+136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
40557+22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
40558+136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
40559+26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
40560+37 38 37 0 0 0
40561+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40562+13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
40563+153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
40564+177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
40565+4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
40566+5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
40567+6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
40568+166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
40569+4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
40570+146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
40571+71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
40572+90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
40573+125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
40574+85 115 134 4 0 0
40575+4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
40576+125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
40577+155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
40578+125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
40579+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
40580+0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
40581+5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
40582+37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
40583+4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
40584+90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
40585+2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
40586+13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
40587+166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
40588+60 73 81 4 0 0
40589+4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
40590+174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
40591+156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
40592+4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
40593+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
40594+10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
40595+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
40596+4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
40597+80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
40598+28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
40599+50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
40600+1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
40601+167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
40602+16 19 21 4 0 0
40603+4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
40604+158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
40605+167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
40606+4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
40607+4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
40608+80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
40609+4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
40610+3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
40611+146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
40612+68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
40613+136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
40614+24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
40615+163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
40616+4 0 0 4 3 3
40617+3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
40618+156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
40619+155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
40620+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
40621+2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
40622+136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
40623+0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
40624+0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
40625+136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
40626+28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
40627+22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
40628+137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
40629+60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
40630+3 2 2 4 4 4
40631+3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
40632+157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
40633+37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
40634+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40635+0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
40636+101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
40637+14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
40638+22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
40639+136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
40640+17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
40641+2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
40642+166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
40643+13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
40644+4 4 4 4 4 4
40645+1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
40646+163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
40647+4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
40648+4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
40649+40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
40650+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
40651+101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
40652+136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
40653+136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
40654+136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
40655+3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
40656+174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
40657+4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
40658+4 4 4 4 4 4
40659+4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
40660+155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
40661+4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
40662+4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
40663+101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
40664+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40665+136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
40666+136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
40667+136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
40668+90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
40669+85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
40670+167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
40671+6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
40672+5 5 5 5 5 5
40673+1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
40674+131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
40675+6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
40676+0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
40677+101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
40678+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40679+101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
40680+136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
40681+101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
40682+7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
40683+174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
40684+24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
40685+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
40686+5 5 5 4 4 4
40687+4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
40688+131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
40689+6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
40690+13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
40691+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40692+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
40693+101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
40694+136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
40695+136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
40696+2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
40697+174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
40698+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
40699+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40700+4 4 4 4 4 4
40701+1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
40702+137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
40703+4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
40704+64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
40705+90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
40706+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40707+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40708+136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
40709+101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
40710+37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
40711+167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
40712+3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
40713+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40714+4 4 4 4 4 4
40715+4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
40716+153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
40717+4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
40718+90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
40719+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40720+90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
40721+101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
40722+101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
40723+35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
40724+154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
40725+60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
40726+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40727+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40728+4 4 4 4 4 4
40729+1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
40730+153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
40731+4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
40732+64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
40733+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40734+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40735+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40736+136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
40737+13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
40738+174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
40739+6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
40740+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40741+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40742+4 4 4 4 4 4
40743+4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
40744+156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
40745+4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
40746+90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
40747+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40748+90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
40749+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40750+101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
40751+2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
40752+174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
40753+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40754+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40755+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40756+4 4 4 4 4 4
40757+3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
40758+158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
40759+4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
40760+37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
40761+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40762+90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
40763+101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
40764+90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
40765+5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
40766+167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
40767+6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
40768+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40769+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40770+4 4 4 4 4 4
40771+4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
40772+163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
40773+4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
40774+18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
40775+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40776+90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
40777+101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
40778+13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
40779+3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
40780+174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
40781+4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
40782+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40783+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40784+4 4 4 4 4 4
40785+1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
40786+167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
40787+4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
40788+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40789+26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
40790+90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
40791+101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
40792+7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
40793+4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
40794+174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
40795+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40796+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40797+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40798+4 4 4 4 4 4
40799+4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
40800+174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
40801+5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
40802+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40803+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40804+90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
40805+101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
40806+2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
40807+3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
40808+153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
40809+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40810+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40811+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40812+4 4 4 4 4 4
40813+1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
40814+174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
40815+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40816+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40817+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40818+26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
40819+35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
40820+2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
40821+3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
40822+131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
40823+4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40824+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40825+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40826+4 4 4 4 4 4
40827+3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
40828+174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
40829+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40830+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40831+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40832+26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
40833+7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
40834+4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
40835+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40836+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40837+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40838+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40839+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40840+4 4 4 4 4 4
40841+1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40842+174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
40843+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40844+18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
40845+18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
40846+26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
40847+28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
40848+3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
40849+4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40850+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40851+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40852+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40853+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40854+4 4 4 4 4 4
40855+4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40856+174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
40857+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40858+10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
40859+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40860+18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
40861+90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
40862+3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
40863+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40864+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40865+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40866+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40867+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40868+4 4 4 4 4 4
40869+1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
40870+177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
40871+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40872+10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
40873+26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
40874+6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
40875+10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
40876+2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
40877+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40878+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40879+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40880+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40881+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40882+4 4 4 4 4 4
40883+4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
40884+177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
40885+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40886+10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
40887+26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
40888+7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
40889+3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
40890+21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
40891+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40892+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40893+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40894+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40895+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40896+4 4 4 4 4 4
40897+3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40898+190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
40899+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40900+10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
40901+24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
40902+18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
40903+28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
40904+26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
40905+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40906+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40907+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40908+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40909+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40910+4 4 4 4 4 4
40911+4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
40912+190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
40913+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40914+10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
40915+0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
40916+26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
40917+37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
40918+90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
40919+4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
40920+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40921+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40922+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40923+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40924+4 4 4 4 4 4
40925+4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40926+193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
40927+5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
40928+10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
40929+1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
40930+26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
40931+22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
40932+26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
40933+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40934+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40935+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40936+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40937+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40938+4 4 4 4 4 4
40939+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40940+190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
40941+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40942+10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
40943+2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
40944+26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
40945+10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
40946+26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
40947+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40948+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40949+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40950+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40951+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40952+4 4 4 4 4 4
40953+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40954+193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
40955+5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
40956+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
40957+13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
40958+10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
40959+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40960+26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
40961+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40962+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40963+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40964+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40965+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40966+4 4 4 4 4 4
40967+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40968+190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
40969+5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
40970+28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
40971+10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
40972+28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
40973+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40974+26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
40975+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40976+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40977+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40978+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40979+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40980+4 4 4 4 4 4
40981+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40982+193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
40983+5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
40984+4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
40985+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
40986+10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
40987+18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
40988+22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
40989+4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
40990+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40991+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40992+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40993+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40994+4 4 4 4 4 4
40995+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40996+190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
40997+6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
40998+1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
40999+18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
41000+10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
41001+26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
41002+1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
41003+5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
41004+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41005+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41006+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41007+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41008+4 4 4 4 4 4
41009+4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
41010+193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
41011+2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
41012+4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
41013+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41014+10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
41015+26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
41016+2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
41017+3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
41018+131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41019+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41020+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41021+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41022+4 4 4 4 4 4
41023+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41024+193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
41025+0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
41026+4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
41027+13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
41028+10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
41029+28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
41030+4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
41031+0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
41032+125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41033+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41034+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41035+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41036+4 4 4 4 4 4
41037+4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
41038+193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
41039+120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
41040+4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
41041+4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
41042+10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
41043+4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
41044+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
41045+24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
41046+125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
41047+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41048+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41049+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41050+4 4 4 4 4 4
41051+4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
41052+174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41053+220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
41054+3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
41055+4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
41056+10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
41057+1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
41058+5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
41059+137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
41060+125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
41061+0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41062+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41063+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41064+4 4 4 4 4 4
41065+5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
41066+193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41067+220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
41068+4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
41069+4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
41070+22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
41071+4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41072+1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
41073+166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
41074+125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
41075+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41076+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41077+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41078+4 4 4 4 4 4
41079+4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
41080+220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
41081+205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
41082+24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
41083+4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
41084+4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
41085+4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
41086+2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
41087+156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
41088+137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
41089+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41090+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41091+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41092+4 4 4 4 4 4
41093+5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
41094+125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
41095+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41096+193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
41097+5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
41098+1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
41099+5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
41100+60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
41101+153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
41102+125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
41103+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41104+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41105+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41106+4 4 4 4 4 4
41107+4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41108+6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
41109+193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
41110+244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
41111+0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
41112+4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
41113+3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
41114+220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
41115+153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
41116+13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41117+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41118+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41119+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41120+4 4 4 4 4 4
41121+5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
41122+6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
41123+244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
41124+220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
41125+3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
41126+4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
41127+0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
41128+177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
41129+158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
41130+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41131+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41132+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41133+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41134+4 4 4 4 4 4
41135+5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
41136+6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
41137+177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
41138+220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
41139+125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
41140+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
41141+37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
41142+174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
41143+158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41144+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41145+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41146+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41147+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41148+4 4 4 4 4 4
41149+4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
41150+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41151+26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
41152+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41153+244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
41154+0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
41155+177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
41156+174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
41157+60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
41158+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41159+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41160+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41161+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41162+4 4 4 4 4 4
41163+5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
41164+6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
41165+6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
41166+220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
41167+220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
41168+0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
41169+220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
41170+174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
41171+4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
41172+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41173+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41174+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41175+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41176+4 4 4 4 4 4
41177+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41178+6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
41179+4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
41180+220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
41181+205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
41182+60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
41183+177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
41184+190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
41185+4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41186+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41187+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41188+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41189+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41190+4 4 4 4 4 4
41191+4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
41192+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
41193+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41194+125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
41195+205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
41196+193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
41197+190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
41198+153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
41199+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41200+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41201+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41202+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41203+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41204+4 4 4 4 4 4
41205+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41206+6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
41207+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
41208+4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
41209+205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
41210+220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
41211+174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
41212+6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41213+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41214+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41215+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41216+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41217+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41218+4 4 4 4 4 4
41219+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41220+5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
41221+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41222+4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
41223+220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
41224+190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
41225+193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
41226+4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
41227+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41228+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41229+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41230+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41231+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41232+4 4 4 4 4 4
41233+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41234+4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
41235+4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
41236+6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
41237+174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
41238+193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
41239+193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
41240+6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
41241+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41242+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41243+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41244+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41245+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41246+4 4 4 4 4 4
41247+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41248+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41249+5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
41250+5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41251+6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
41252+193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
41253+60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
41254+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41255+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41256+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41257+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41258+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41259+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41260+4 4 4 4 4 4
41261+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41262+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41263+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41264+5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
41265+4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
41266+193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
41267+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
41268+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41269+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41270+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41271+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41272+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41273+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41274+4 4 4 4 4 4
41275+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41276+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41277+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41278+4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41279+6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
41280+153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
41281+6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
41282+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41283+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41284+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41285+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41286+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41287+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41288+4 4 4 4 4 4
41289+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41290+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41291+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41292+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41293+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41294+24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
41295+6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
41296+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41297+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41298+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41299+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41300+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41301+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41302+4 4 4 4 4 4
41303+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41304+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41305+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41306+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41307+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41308+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41309+4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
41310+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41311+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41312+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41313+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41314+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41315+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41316+4 4 4 4 4 4
41317+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41318+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41319+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41320+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
41321+5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
41322+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
41323+6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
41324+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41325+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41326+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41327+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41328+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41329+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41330+4 4 4 4 4 4
41331+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41332+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41333+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41334+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41335+4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
41336+4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41337+6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41338+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41339+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41340+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41341+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41342+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41343+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41344+4 4 4 4 4 4
41345+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41346+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41347+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41348+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41349+4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
41350+6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
41351+4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41352+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41353+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41354+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41355+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41356+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41357+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41358+4 4 4 4 4 4
41359+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41360+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41361+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41362+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41363+4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
41364+4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
41365+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41366+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41367+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41368+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41369+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41370+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41371+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41372+4 4 4 4 4 4
41373+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41374+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41375+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41376+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41377+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
41378+5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
41379+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41380+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41381+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41382+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41383+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41384+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41385+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41386+4 4 4 4 4 4
41387+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41388+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41389+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41390+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41391+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41392+5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
41393+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41394+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41395+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41396+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41397+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41398+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41399+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41400+4 4 4 4 4 4
41401diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
41402index 087fc99..f85ed76 100644
41403--- a/drivers/video/udlfb.c
41404+++ b/drivers/video/udlfb.c
41405@@ -585,11 +585,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
41406 dlfb_urb_completion(urb);
41407
41408 error:
41409- atomic_add(bytes_sent, &dev->bytes_sent);
41410- atomic_add(bytes_identical, &dev->bytes_identical);
41411- atomic_add(width*height*2, &dev->bytes_rendered);
41412+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41413+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41414+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
41415 end_cycles = get_cycles();
41416- atomic_add(((unsigned int) ((end_cycles - start_cycles)
41417+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41418 >> 10)), /* Kcycles */
41419 &dev->cpu_kcycles_used);
41420
41421@@ -710,11 +710,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
41422 dlfb_urb_completion(urb);
41423
41424 error:
41425- atomic_add(bytes_sent, &dev->bytes_sent);
41426- atomic_add(bytes_identical, &dev->bytes_identical);
41427- atomic_add(bytes_rendered, &dev->bytes_rendered);
41428+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41429+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41430+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
41431 end_cycles = get_cycles();
41432- atomic_add(((unsigned int) ((end_cycles - start_cycles)
41433+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41434 >> 10)), /* Kcycles */
41435 &dev->cpu_kcycles_used);
41436 }
41437@@ -1306,7 +1306,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
41438 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41439 struct dlfb_data *dev = fb_info->par;
41440 return snprintf(buf, PAGE_SIZE, "%u\n",
41441- atomic_read(&dev->bytes_rendered));
41442+ atomic_read_unchecked(&dev->bytes_rendered));
41443 }
41444
41445 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41446@@ -1314,7 +1314,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41447 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41448 struct dlfb_data *dev = fb_info->par;
41449 return snprintf(buf, PAGE_SIZE, "%u\n",
41450- atomic_read(&dev->bytes_identical));
41451+ atomic_read_unchecked(&dev->bytes_identical));
41452 }
41453
41454 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41455@@ -1322,7 +1322,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41456 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41457 struct dlfb_data *dev = fb_info->par;
41458 return snprintf(buf, PAGE_SIZE, "%u\n",
41459- atomic_read(&dev->bytes_sent));
41460+ atomic_read_unchecked(&dev->bytes_sent));
41461 }
41462
41463 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41464@@ -1330,7 +1330,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41465 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41466 struct dlfb_data *dev = fb_info->par;
41467 return snprintf(buf, PAGE_SIZE, "%u\n",
41468- atomic_read(&dev->cpu_kcycles_used));
41469+ atomic_read_unchecked(&dev->cpu_kcycles_used));
41470 }
41471
41472 static ssize_t edid_show(
41473@@ -1387,10 +1387,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
41474 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41475 struct dlfb_data *dev = fb_info->par;
41476
41477- atomic_set(&dev->bytes_rendered, 0);
41478- atomic_set(&dev->bytes_identical, 0);
41479- atomic_set(&dev->bytes_sent, 0);
41480- atomic_set(&dev->cpu_kcycles_used, 0);
41481+ atomic_set_unchecked(&dev->bytes_rendered, 0);
41482+ atomic_set_unchecked(&dev->bytes_identical, 0);
41483+ atomic_set_unchecked(&dev->bytes_sent, 0);
41484+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
41485
41486 return count;
41487 }
41488diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
41489index 7f8472c..9842e87 100644
41490--- a/drivers/video/uvesafb.c
41491+++ b/drivers/video/uvesafb.c
41492@@ -19,6 +19,7 @@
41493 #include <linux/io.h>
41494 #include <linux/mutex.h>
41495 #include <linux/slab.h>
41496+#include <linux/moduleloader.h>
41497 #include <video/edid.h>
41498 #include <video/uvesafb.h>
41499 #ifdef CONFIG_X86
41500@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
41501 NULL,
41502 };
41503
41504- return call_usermodehelper(v86d_path, argv, envp, 1);
41505+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
41506 }
41507
41508 /*
41509@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
41510 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
41511 par->pmi_setpal = par->ypan = 0;
41512 } else {
41513+
41514+#ifdef CONFIG_PAX_KERNEXEC
41515+#ifdef CONFIG_MODULES
41516+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
41517+#endif
41518+ if (!par->pmi_code) {
41519+ par->pmi_setpal = par->ypan = 0;
41520+ return 0;
41521+ }
41522+#endif
41523+
41524 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
41525 + task->t.regs.edi);
41526+
41527+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41528+ pax_open_kernel();
41529+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
41530+ pax_close_kernel();
41531+
41532+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
41533+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
41534+#else
41535 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
41536 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
41537+#endif
41538+
41539 printk(KERN_INFO "uvesafb: protected mode interface info at "
41540 "%04x:%04x\n",
41541 (u16)task->t.regs.es, (u16)task->t.regs.edi);
41542@@ -1821,6 +1844,11 @@ out:
41543 if (par->vbe_modes)
41544 kfree(par->vbe_modes);
41545
41546+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41547+ if (par->pmi_code)
41548+ module_free_exec(NULL, par->pmi_code);
41549+#endif
41550+
41551 framebuffer_release(info);
41552 return err;
41553 }
41554@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platform_device *dev)
41555 kfree(par->vbe_state_orig);
41556 if (par->vbe_state_saved)
41557 kfree(par->vbe_state_saved);
41558+
41559+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41560+ if (par->pmi_code)
41561+ module_free_exec(NULL, par->pmi_code);
41562+#endif
41563+
41564 }
41565
41566 framebuffer_release(info);
41567diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
41568index 501b340..86bd4cf 100644
41569--- a/drivers/video/vesafb.c
41570+++ b/drivers/video/vesafb.c
41571@@ -9,6 +9,7 @@
41572 */
41573
41574 #include <linux/module.h>
41575+#include <linux/moduleloader.h>
41576 #include <linux/kernel.h>
41577 #include <linux/errno.h>
41578 #include <linux/string.h>
41579@@ -52,8 +53,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
41580 static int vram_total __initdata; /* Set total amount of memory */
41581 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
41582 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
41583-static void (*pmi_start)(void) __read_mostly;
41584-static void (*pmi_pal) (void) __read_mostly;
41585+static void (*pmi_start)(void) __read_only;
41586+static void (*pmi_pal) (void) __read_only;
41587 static int depth __read_mostly;
41588 static int vga_compat __read_mostly;
41589 /* --------------------------------------------------------------------- */
41590@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
41591 unsigned int size_vmode;
41592 unsigned int size_remap;
41593 unsigned int size_total;
41594+ void *pmi_code = NULL;
41595
41596 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
41597 return -ENODEV;
41598@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
41599 size_remap = size_total;
41600 vesafb_fix.smem_len = size_remap;
41601
41602-#ifndef __i386__
41603- screen_info.vesapm_seg = 0;
41604-#endif
41605-
41606 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
41607 printk(KERN_WARNING
41608 "vesafb: cannot reserve video memory at 0x%lx\n",
41609@@ -307,9 +305,21 @@ static int __init vesafb_probe(struct platform_device *dev)
41610 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
41611 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
41612
41613+#ifdef __i386__
41614+
41615+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41616+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
41617+ if (!pmi_code)
41618+#elif !defined(CONFIG_PAX_KERNEXEC)
41619+ if (0)
41620+#endif
41621+
41622+#endif
41623+ screen_info.vesapm_seg = 0;
41624+
41625 if (screen_info.vesapm_seg) {
41626- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
41627- screen_info.vesapm_seg,screen_info.vesapm_off);
41628+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
41629+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
41630 }
41631
41632 if (screen_info.vesapm_seg < 0xc000)
41633@@ -317,9 +327,25 @@ static int __init vesafb_probe(struct platform_device *dev)
41634
41635 if (ypan || pmi_setpal) {
41636 unsigned short *pmi_base;
41637+
41638 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
41639- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
41640- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
41641+
41642+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41643+ pax_open_kernel();
41644+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
41645+#else
41646+ pmi_code = pmi_base;
41647+#endif
41648+
41649+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
41650+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
41651+
41652+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41653+ pmi_start = ktva_ktla(pmi_start);
41654+ pmi_pal = ktva_ktla(pmi_pal);
41655+ pax_close_kernel();
41656+#endif
41657+
41658 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
41659 if (pmi_base[3]) {
41660 printk(KERN_INFO "vesafb: pmi: ports = ");
41661@@ -488,6 +514,11 @@ static int __init vesafb_probe(struct platform_device *dev)
41662 info->node, info->fix.id);
41663 return 0;
41664 err:
41665+
41666+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41667+ module_free_exec(NULL, pmi_code);
41668+#endif
41669+
41670 if (info->screen_base)
41671 iounmap(info->screen_base);
41672 framebuffer_release(info);
41673diff --git a/drivers/video/via/via_clock.h b/drivers/video/via/via_clock.h
41674index 88714ae..16c2e11 100644
41675--- a/drivers/video/via/via_clock.h
41676+++ b/drivers/video/via/via_clock.h
41677@@ -56,7 +56,7 @@ struct via_clock {
41678
41679 void (*set_engine_pll_state)(u8 state);
41680 void (*set_engine_pll)(struct via_pll_config config);
41681-};
41682+} __no_const;
41683
41684
41685 static inline u32 get_pll_internal_frequency(u32 ref_freq,
41686diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
41687index e058ace..2424d93 100644
41688--- a/drivers/virtio/virtio_balloon.c
41689+++ b/drivers/virtio/virtio_balloon.c
41690@@ -174,6 +174,8 @@ static void update_balloon_stats(struct virtio_balloon *vb)
41691 struct sysinfo i;
41692 int idx = 0;
41693
41694+ pax_track_stack();
41695+
41696 all_vm_events(events);
41697 si_meminfo(&i);
41698
41699diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
41700index e56c934..fc22f4b 100644
41701--- a/drivers/xen/xen-pciback/conf_space.h
41702+++ b/drivers/xen/xen-pciback/conf_space.h
41703@@ -44,15 +44,15 @@ struct config_field {
41704 struct {
41705 conf_dword_write write;
41706 conf_dword_read read;
41707- } dw;
41708+ } __no_const dw;
41709 struct {
41710 conf_word_write write;
41711 conf_word_read read;
41712- } w;
41713+ } __no_const w;
41714 struct {
41715 conf_byte_write write;
41716 conf_byte_read read;
41717- } b;
41718+ } __no_const b;
41719 } u;
41720 struct list_head list;
41721 };
41722diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
41723index e3c03db..93b0172 100644
41724--- a/fs/9p/vfs_inode.c
41725+++ b/fs/9p/vfs_inode.c
41726@@ -1288,7 +1288,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
41727 void
41728 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41729 {
41730- char *s = nd_get_link(nd);
41731+ const char *s = nd_get_link(nd);
41732
41733 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
41734 IS_ERR(s) ? "<error>" : s);
41735diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
41736index 79e2ca7..5828ad1 100644
41737--- a/fs/Kconfig.binfmt
41738+++ b/fs/Kconfig.binfmt
41739@@ -86,7 +86,7 @@ config HAVE_AOUT
41740
41741 config BINFMT_AOUT
41742 tristate "Kernel support for a.out and ECOFF binaries"
41743- depends on HAVE_AOUT
41744+ depends on HAVE_AOUT && BROKEN
41745 ---help---
41746 A.out (Assembler.OUTput) is a set of formats for libraries and
41747 executables used in the earliest versions of UNIX. Linux used
41748diff --git a/fs/aio.c b/fs/aio.c
41749index e29ec48..f083e5e 100644
41750--- a/fs/aio.c
41751+++ b/fs/aio.c
41752@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
41753 size += sizeof(struct io_event) * nr_events;
41754 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
41755
41756- if (nr_pages < 0)
41757+ if (nr_pages <= 0)
41758 return -EINVAL;
41759
41760 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
41761@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ctx,
41762 struct aio_timeout to;
41763 int retry = 0;
41764
41765+ pax_track_stack();
41766+
41767 /* needed to zero any padding within an entry (there shouldn't be
41768 * any, but C is fun!
41769 */
41770@@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
41771 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
41772 {
41773 ssize_t ret;
41774+ struct iovec iovstack;
41775
41776 #ifdef CONFIG_COMPAT
41777 if (compat)
41778 ret = compat_rw_copy_check_uvector(type,
41779 (struct compat_iovec __user *)kiocb->ki_buf,
41780- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
41781+ kiocb->ki_nbytes, 1, &iovstack,
41782 &kiocb->ki_iovec);
41783 else
41784 #endif
41785 ret = rw_copy_check_uvector(type,
41786 (struct iovec __user *)kiocb->ki_buf,
41787- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
41788+ kiocb->ki_nbytes, 1, &iovstack,
41789 &kiocb->ki_iovec);
41790 if (ret < 0)
41791 goto out;
41792
41793+ if (kiocb->ki_iovec == &iovstack) {
41794+ kiocb->ki_inline_vec = iovstack;
41795+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
41796+ }
41797 kiocb->ki_nr_segs = kiocb->ki_nbytes;
41798 kiocb->ki_cur_seg = 0;
41799 /* ki_nbytes/left now reflect bytes instead of segs */
41800diff --git a/fs/attr.c b/fs/attr.c
41801index 538e279..046cc6d 100644
41802--- a/fs/attr.c
41803+++ b/fs/attr.c
41804@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
41805 unsigned long limit;
41806
41807 limit = rlimit(RLIMIT_FSIZE);
41808+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
41809 if (limit != RLIM_INFINITY && offset > limit)
41810 goto out_sig;
41811 if (offset > inode->i_sb->s_maxbytes)
41812diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
41813index e1fbdee..cd5ea56 100644
41814--- a/fs/autofs4/waitq.c
41815+++ b/fs/autofs4/waitq.c
41816@@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
41817 {
41818 unsigned long sigpipe, flags;
41819 mm_segment_t fs;
41820- const char *data = (const char *)addr;
41821+ const char __user *data = (const char __force_user *)addr;
41822 ssize_t wr = 0;
41823
41824 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
41825diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
41826index 720d885..012e7f0 100644
41827--- a/fs/befs/linuxvfs.c
41828+++ b/fs/befs/linuxvfs.c
41829@@ -503,7 +503,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41830 {
41831 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
41832 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
41833- char *link = nd_get_link(nd);
41834+ const char *link = nd_get_link(nd);
41835 if (!IS_ERR(link))
41836 kfree(link);
41837 }
41838diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
41839index a6395bd..a5b24c4 100644
41840--- a/fs/binfmt_aout.c
41841+++ b/fs/binfmt_aout.c
41842@@ -16,6 +16,7 @@
41843 #include <linux/string.h>
41844 #include <linux/fs.h>
41845 #include <linux/file.h>
41846+#include <linux/security.h>
41847 #include <linux/stat.h>
41848 #include <linux/fcntl.h>
41849 #include <linux/ptrace.h>
41850@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredump_params *cprm)
41851 #endif
41852 # define START_STACK(u) ((void __user *)u.start_stack)
41853
41854+ memset(&dump, 0, sizeof(dump));
41855+
41856 fs = get_fs();
41857 set_fs(KERNEL_DS);
41858 has_dumped = 1;
41859@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredump_params *cprm)
41860
41861 /* If the size of the dump file exceeds the rlimit, then see what would happen
41862 if we wrote the stack, but not the data area. */
41863+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
41864 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
41865 dump.u_dsize = 0;
41866
41867 /* Make sure we have enough room to write the stack and data areas. */
41868+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
41869 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
41870 dump.u_ssize = 0;
41871
41872@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41873 rlim = rlimit(RLIMIT_DATA);
41874 if (rlim >= RLIM_INFINITY)
41875 rlim = ~0;
41876+
41877+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
41878 if (ex.a_data + ex.a_bss > rlim)
41879 return -ENOMEM;
41880
41881@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41882 install_exec_creds(bprm);
41883 current->flags &= ~PF_FORKNOEXEC;
41884
41885+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
41886+ current->mm->pax_flags = 0UL;
41887+#endif
41888+
41889+#ifdef CONFIG_PAX_PAGEEXEC
41890+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
41891+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
41892+
41893+#ifdef CONFIG_PAX_EMUTRAMP
41894+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
41895+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
41896+#endif
41897+
41898+#ifdef CONFIG_PAX_MPROTECT
41899+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
41900+ current->mm->pax_flags |= MF_PAX_MPROTECT;
41901+#endif
41902+
41903+ }
41904+#endif
41905+
41906 if (N_MAGIC(ex) == OMAGIC) {
41907 unsigned long text_addr, map_size;
41908 loff_t pos;
41909@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41910
41911 down_write(&current->mm->mmap_sem);
41912 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
41913- PROT_READ | PROT_WRITE | PROT_EXEC,
41914+ PROT_READ | PROT_WRITE,
41915 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
41916 fd_offset + ex.a_text);
41917 up_write(&current->mm->mmap_sem);
41918diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
41919index 21ac5ee..171b1d0 100644
41920--- a/fs/binfmt_elf.c
41921+++ b/fs/binfmt_elf.c
41922@@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump_params *cprm);
41923 #define elf_core_dump NULL
41924 #endif
41925
41926+#ifdef CONFIG_PAX_MPROTECT
41927+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
41928+#endif
41929+
41930 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
41931 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
41932 #else
41933@@ -70,6 +74,11 @@ static struct linux_binfmt elf_format = {
41934 .load_binary = load_elf_binary,
41935 .load_shlib = load_elf_library,
41936 .core_dump = elf_core_dump,
41937+
41938+#ifdef CONFIG_PAX_MPROTECT
41939+ .handle_mprotect= elf_handle_mprotect,
41940+#endif
41941+
41942 .min_coredump = ELF_EXEC_PAGESIZE,
41943 };
41944
41945@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = {
41946
41947 static int set_brk(unsigned long start, unsigned long end)
41948 {
41949+ unsigned long e = end;
41950+
41951 start = ELF_PAGEALIGN(start);
41952 end = ELF_PAGEALIGN(end);
41953 if (end > start) {
41954@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, unsigned long end)
41955 if (BAD_ADDR(addr))
41956 return addr;
41957 }
41958- current->mm->start_brk = current->mm->brk = end;
41959+ current->mm->start_brk = current->mm->brk = e;
41960 return 0;
41961 }
41962
41963@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41964 elf_addr_t __user *u_rand_bytes;
41965 const char *k_platform = ELF_PLATFORM;
41966 const char *k_base_platform = ELF_BASE_PLATFORM;
41967- unsigned char k_rand_bytes[16];
41968+ u32 k_rand_bytes[4];
41969 int items;
41970 elf_addr_t *elf_info;
41971 int ei_index = 0;
41972 const struct cred *cred = current_cred();
41973 struct vm_area_struct *vma;
41974+ unsigned long saved_auxv[AT_VECTOR_SIZE];
41975+
41976+ pax_track_stack();
41977
41978 /*
41979 * In some cases (e.g. Hyper-Threading), we want to avoid L1
41980@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41981 * Generate 16 random bytes for userspace PRNG seeding.
41982 */
41983 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
41984- u_rand_bytes = (elf_addr_t __user *)
41985- STACK_ALLOC(p, sizeof(k_rand_bytes));
41986+ srandom32(k_rand_bytes[0] ^ random32());
41987+ srandom32(k_rand_bytes[1] ^ random32());
41988+ srandom32(k_rand_bytes[2] ^ random32());
41989+ srandom32(k_rand_bytes[3] ^ random32());
41990+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
41991+ u_rand_bytes = (elf_addr_t __user *) p;
41992 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
41993 return -EFAULT;
41994
41995@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41996 return -EFAULT;
41997 current->mm->env_end = p;
41998
41999+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
42000+
42001 /* Put the elf_info on the stack in the right place. */
42002 sp = (elf_addr_t __user *)envp + 1;
42003- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
42004+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
42005 return -EFAULT;
42006 return 0;
42007 }
42008@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42009 {
42010 struct elf_phdr *elf_phdata;
42011 struct elf_phdr *eppnt;
42012- unsigned long load_addr = 0;
42013+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
42014 int load_addr_set = 0;
42015 unsigned long last_bss = 0, elf_bss = 0;
42016- unsigned long error = ~0UL;
42017+ unsigned long error = -EINVAL;
42018 unsigned long total_size;
42019 int retval, i, size;
42020
42021@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42022 goto out_close;
42023 }
42024
42025+#ifdef CONFIG_PAX_SEGMEXEC
42026+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
42027+ pax_task_size = SEGMEXEC_TASK_SIZE;
42028+#endif
42029+
42030 eppnt = elf_phdata;
42031 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
42032 if (eppnt->p_type == PT_LOAD) {
42033@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42034 k = load_addr + eppnt->p_vaddr;
42035 if (BAD_ADDR(k) ||
42036 eppnt->p_filesz > eppnt->p_memsz ||
42037- eppnt->p_memsz > TASK_SIZE ||
42038- TASK_SIZE - eppnt->p_memsz < k) {
42039+ eppnt->p_memsz > pax_task_size ||
42040+ pax_task_size - eppnt->p_memsz < k) {
42041 error = -ENOMEM;
42042 goto out_close;
42043 }
42044@@ -528,6 +553,193 @@ out:
42045 return error;
42046 }
42047
42048+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
42049+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
42050+{
42051+ unsigned long pax_flags = 0UL;
42052+
42053+#ifdef CONFIG_PAX_PAGEEXEC
42054+ if (elf_phdata->p_flags & PF_PAGEEXEC)
42055+ pax_flags |= MF_PAX_PAGEEXEC;
42056+#endif
42057+
42058+#ifdef CONFIG_PAX_SEGMEXEC
42059+ if (elf_phdata->p_flags & PF_SEGMEXEC)
42060+ pax_flags |= MF_PAX_SEGMEXEC;
42061+#endif
42062+
42063+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42064+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42065+ if ((__supported_pte_mask & _PAGE_NX))
42066+ pax_flags &= ~MF_PAX_SEGMEXEC;
42067+ else
42068+ pax_flags &= ~MF_PAX_PAGEEXEC;
42069+ }
42070+#endif
42071+
42072+#ifdef CONFIG_PAX_EMUTRAMP
42073+ if (elf_phdata->p_flags & PF_EMUTRAMP)
42074+ pax_flags |= MF_PAX_EMUTRAMP;
42075+#endif
42076+
42077+#ifdef CONFIG_PAX_MPROTECT
42078+ if (elf_phdata->p_flags & PF_MPROTECT)
42079+ pax_flags |= MF_PAX_MPROTECT;
42080+#endif
42081+
42082+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42083+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
42084+ pax_flags |= MF_PAX_RANDMMAP;
42085+#endif
42086+
42087+ return pax_flags;
42088+}
42089+#endif
42090+
42091+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42092+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
42093+{
42094+ unsigned long pax_flags = 0UL;
42095+
42096+#ifdef CONFIG_PAX_PAGEEXEC
42097+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
42098+ pax_flags |= MF_PAX_PAGEEXEC;
42099+#endif
42100+
42101+#ifdef CONFIG_PAX_SEGMEXEC
42102+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
42103+ pax_flags |= MF_PAX_SEGMEXEC;
42104+#endif
42105+
42106+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42107+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42108+ if ((__supported_pte_mask & _PAGE_NX))
42109+ pax_flags &= ~MF_PAX_SEGMEXEC;
42110+ else
42111+ pax_flags &= ~MF_PAX_PAGEEXEC;
42112+ }
42113+#endif
42114+
42115+#ifdef CONFIG_PAX_EMUTRAMP
42116+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
42117+ pax_flags |= MF_PAX_EMUTRAMP;
42118+#endif
42119+
42120+#ifdef CONFIG_PAX_MPROTECT
42121+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
42122+ pax_flags |= MF_PAX_MPROTECT;
42123+#endif
42124+
42125+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42126+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
42127+ pax_flags |= MF_PAX_RANDMMAP;
42128+#endif
42129+
42130+ return pax_flags;
42131+}
42132+#endif
42133+
42134+#ifdef CONFIG_PAX_EI_PAX
42135+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
42136+{
42137+ unsigned long pax_flags = 0UL;
42138+
42139+#ifdef CONFIG_PAX_PAGEEXEC
42140+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
42141+ pax_flags |= MF_PAX_PAGEEXEC;
42142+#endif
42143+
42144+#ifdef CONFIG_PAX_SEGMEXEC
42145+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
42146+ pax_flags |= MF_PAX_SEGMEXEC;
42147+#endif
42148+
42149+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42150+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42151+ if ((__supported_pte_mask & _PAGE_NX))
42152+ pax_flags &= ~MF_PAX_SEGMEXEC;
42153+ else
42154+ pax_flags &= ~MF_PAX_PAGEEXEC;
42155+ }
42156+#endif
42157+
42158+#ifdef CONFIG_PAX_EMUTRAMP
42159+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
42160+ pax_flags |= MF_PAX_EMUTRAMP;
42161+#endif
42162+
42163+#ifdef CONFIG_PAX_MPROTECT
42164+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
42165+ pax_flags |= MF_PAX_MPROTECT;
42166+#endif
42167+
42168+#ifdef CONFIG_PAX_ASLR
42169+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
42170+ pax_flags |= MF_PAX_RANDMMAP;
42171+#endif
42172+
42173+ return pax_flags;
42174+}
42175+#endif
42176+
42177+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42178+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
42179+{
42180+ unsigned long pax_flags = 0UL;
42181+
42182+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42183+ unsigned long i;
42184+ int found_flags = 0;
42185+#endif
42186+
42187+#ifdef CONFIG_PAX_EI_PAX
42188+ pax_flags = pax_parse_ei_pax(elf_ex);
42189+#endif
42190+
42191+#ifdef CONFIG_PAX_PT_PAX_FLAGS
42192+ for (i = 0UL; i < elf_ex->e_phnum; i++)
42193+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
42194+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
42195+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
42196+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
42197+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
42198+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
42199+ return -EINVAL;
42200+
42201+#ifdef CONFIG_PAX_SOFTMODE
42202+ if (pax_softmode)
42203+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
42204+ else
42205+#endif
42206+
42207+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
42208+ found_flags = 1;
42209+ break;
42210+ }
42211+#endif
42212+
42213+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
42214+ if (found_flags == 0) {
42215+ struct elf_phdr phdr;
42216+ memset(&phdr, 0, sizeof(phdr));
42217+ phdr.p_flags = PF_NOEMUTRAMP;
42218+#ifdef CONFIG_PAX_SOFTMODE
42219+ if (pax_softmode)
42220+ pax_flags = pax_parse_softmode(&phdr);
42221+ else
42222+#endif
42223+ pax_flags = pax_parse_hardmode(&phdr);
42224+ }
42225+#endif
42226+
42227+ if (0 > pax_check_flags(&pax_flags))
42228+ return -EINVAL;
42229+
42230+ current->mm->pax_flags = pax_flags;
42231+ return 0;
42232+}
42233+#endif
42234+
42235 /*
42236 * These are the functions used to load ELF style executables and shared
42237 * libraries. There is no binary dependent code anywhere else.
42238@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
42239 {
42240 unsigned int random_variable = 0;
42241
42242+#ifdef CONFIG_PAX_RANDUSTACK
42243+ if (randomize_va_space)
42244+ return stack_top - current->mm->delta_stack;
42245+#endif
42246+
42247 if ((current->flags & PF_RANDOMIZE) &&
42248 !(current->personality & ADDR_NO_RANDOMIZE)) {
42249 random_variable = get_random_int() & STACK_RND_MASK;
42250@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42251 unsigned long load_addr = 0, load_bias = 0;
42252 int load_addr_set = 0;
42253 char * elf_interpreter = NULL;
42254- unsigned long error;
42255+ unsigned long error = 0;
42256 struct elf_phdr *elf_ppnt, *elf_phdata;
42257 unsigned long elf_bss, elf_brk;
42258 int retval, i;
42259@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42260 unsigned long start_code, end_code, start_data, end_data;
42261 unsigned long reloc_func_desc __maybe_unused = 0;
42262 int executable_stack = EXSTACK_DEFAULT;
42263- unsigned long def_flags = 0;
42264 struct {
42265 struct elfhdr elf_ex;
42266 struct elfhdr interp_elf_ex;
42267 } *loc;
42268+ unsigned long pax_task_size = TASK_SIZE;
42269
42270 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
42271 if (!loc) {
42272@@ -713,11 +930,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42273
42274 /* OK, This is the point of no return */
42275 current->flags &= ~PF_FORKNOEXEC;
42276- current->mm->def_flags = def_flags;
42277+
42278+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42279+ current->mm->pax_flags = 0UL;
42280+#endif
42281+
42282+#ifdef CONFIG_PAX_DLRESOLVE
42283+ current->mm->call_dl_resolve = 0UL;
42284+#endif
42285+
42286+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
42287+ current->mm->call_syscall = 0UL;
42288+#endif
42289+
42290+#ifdef CONFIG_PAX_ASLR
42291+ current->mm->delta_mmap = 0UL;
42292+ current->mm->delta_stack = 0UL;
42293+#endif
42294+
42295+ current->mm->def_flags = 0;
42296+
42297+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42298+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
42299+ send_sig(SIGKILL, current, 0);
42300+ goto out_free_dentry;
42301+ }
42302+#endif
42303+
42304+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
42305+ pax_set_initial_flags(bprm);
42306+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
42307+ if (pax_set_initial_flags_func)
42308+ (pax_set_initial_flags_func)(bprm);
42309+#endif
42310+
42311+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
42312+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
42313+ current->mm->context.user_cs_limit = PAGE_SIZE;
42314+ current->mm->def_flags |= VM_PAGEEXEC;
42315+ }
42316+#endif
42317+
42318+#ifdef CONFIG_PAX_SEGMEXEC
42319+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
42320+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
42321+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
42322+ pax_task_size = SEGMEXEC_TASK_SIZE;
42323+ current->mm->def_flags |= VM_NOHUGEPAGE;
42324+ }
42325+#endif
42326+
42327+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
42328+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42329+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
42330+ put_cpu();
42331+ }
42332+#endif
42333
42334 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
42335 may depend on the personality. */
42336 SET_PERSONALITY(loc->elf_ex);
42337+
42338+#ifdef CONFIG_PAX_ASLR
42339+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
42340+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
42341+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
42342+ }
42343+#endif
42344+
42345+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
42346+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42347+ executable_stack = EXSTACK_DISABLE_X;
42348+ current->personality &= ~READ_IMPLIES_EXEC;
42349+ } else
42350+#endif
42351+
42352 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
42353 current->personality |= READ_IMPLIES_EXEC;
42354
42355@@ -808,6 +1095,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42356 #else
42357 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
42358 #endif
42359+
42360+#ifdef CONFIG_PAX_RANDMMAP
42361+ /* PaX: randomize base address at the default exe base if requested */
42362+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
42363+#ifdef CONFIG_SPARC64
42364+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
42365+#else
42366+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
42367+#endif
42368+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
42369+ elf_flags |= MAP_FIXED;
42370+ }
42371+#endif
42372+
42373 }
42374
42375 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
42376@@ -840,9 +1141,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42377 * allowed task size. Note that p_filesz must always be
42378 * <= p_memsz so it is only necessary to check p_memsz.
42379 */
42380- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42381- elf_ppnt->p_memsz > TASK_SIZE ||
42382- TASK_SIZE - elf_ppnt->p_memsz < k) {
42383+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42384+ elf_ppnt->p_memsz > pax_task_size ||
42385+ pax_task_size - elf_ppnt->p_memsz < k) {
42386 /* set_brk can never work. Avoid overflows. */
42387 send_sig(SIGKILL, current, 0);
42388 retval = -EINVAL;
42389@@ -870,6 +1171,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42390 start_data += load_bias;
42391 end_data += load_bias;
42392
42393+#ifdef CONFIG_PAX_RANDMMAP
42394+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
42395+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
42396+#endif
42397+
42398 /* Calling set_brk effectively mmaps the pages that we need
42399 * for the bss and break sections. We must do this before
42400 * mapping in the interpreter, to make sure it doesn't wind
42401@@ -881,9 +1187,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42402 goto out_free_dentry;
42403 }
42404 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
42405- send_sig(SIGSEGV, current, 0);
42406- retval = -EFAULT; /* Nobody gets to see this, but.. */
42407- goto out_free_dentry;
42408+ /*
42409+ * This bss-zeroing can fail if the ELF
42410+ * file specifies odd protections. So
42411+ * we don't check the return value
42412+ */
42413 }
42414
42415 if (elf_interpreter) {
42416@@ -1098,7 +1406,7 @@ out:
42417 * Decide what to dump of a segment, part, all or none.
42418 */
42419 static unsigned long vma_dump_size(struct vm_area_struct *vma,
42420- unsigned long mm_flags)
42421+ unsigned long mm_flags, long signr)
42422 {
42423 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
42424
42425@@ -1132,7 +1440,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
42426 if (vma->vm_file == NULL)
42427 return 0;
42428
42429- if (FILTER(MAPPED_PRIVATE))
42430+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
42431 goto whole;
42432
42433 /*
42434@@ -1354,9 +1662,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
42435 {
42436 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
42437 int i = 0;
42438- do
42439+ do {
42440 i += 2;
42441- while (auxv[i - 2] != AT_NULL);
42442+ } while (auxv[i - 2] != AT_NULL);
42443 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
42444 }
42445
42446@@ -1862,14 +2170,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
42447 }
42448
42449 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
42450- unsigned long mm_flags)
42451+ struct coredump_params *cprm)
42452 {
42453 struct vm_area_struct *vma;
42454 size_t size = 0;
42455
42456 for (vma = first_vma(current, gate_vma); vma != NULL;
42457 vma = next_vma(vma, gate_vma))
42458- size += vma_dump_size(vma, mm_flags);
42459+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42460 return size;
42461 }
42462
42463@@ -1963,7 +2271,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42464
42465 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
42466
42467- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
42468+ offset += elf_core_vma_data_size(gate_vma, cprm);
42469 offset += elf_core_extra_data_size();
42470 e_shoff = offset;
42471
42472@@ -1977,10 +2285,12 @@ static int elf_core_dump(struct coredump_params *cprm)
42473 offset = dataoff;
42474
42475 size += sizeof(*elf);
42476+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42477 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
42478 goto end_coredump;
42479
42480 size += sizeof(*phdr4note);
42481+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42482 if (size > cprm->limit
42483 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
42484 goto end_coredump;
42485@@ -1994,7 +2304,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42486 phdr.p_offset = offset;
42487 phdr.p_vaddr = vma->vm_start;
42488 phdr.p_paddr = 0;
42489- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
42490+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42491 phdr.p_memsz = vma->vm_end - vma->vm_start;
42492 offset += phdr.p_filesz;
42493 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
42494@@ -2005,6 +2315,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42495 phdr.p_align = ELF_EXEC_PAGESIZE;
42496
42497 size += sizeof(phdr);
42498+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42499 if (size > cprm->limit
42500 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
42501 goto end_coredump;
42502@@ -2029,7 +2340,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42503 unsigned long addr;
42504 unsigned long end;
42505
42506- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
42507+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42508
42509 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
42510 struct page *page;
42511@@ -2038,6 +2349,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42512 page = get_dump_page(addr);
42513 if (page) {
42514 void *kaddr = kmap(page);
42515+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
42516 stop = ((size += PAGE_SIZE) > cprm->limit) ||
42517 !dump_write(cprm->file, kaddr,
42518 PAGE_SIZE);
42519@@ -2055,6 +2367,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42520
42521 if (e_phnum == PN_XNUM) {
42522 size += sizeof(*shdr4extnum);
42523+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
42524 if (size > cprm->limit
42525 || !dump_write(cprm->file, shdr4extnum,
42526 sizeof(*shdr4extnum)))
42527@@ -2075,6 +2388,97 @@ out:
42528
42529 #endif /* CONFIG_ELF_CORE */
42530
42531+#ifdef CONFIG_PAX_MPROTECT
42532+/* PaX: non-PIC ELF libraries need relocations on their executable segments
42533+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
42534+ * we'll remove VM_MAYWRITE for good on RELRO segments.
42535+ *
42536+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
42537+ * basis because we want to allow the common case and not the special ones.
42538+ */
42539+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
42540+{
42541+ struct elfhdr elf_h;
42542+ struct elf_phdr elf_p;
42543+ unsigned long i;
42544+ unsigned long oldflags;
42545+ bool is_textrel_rw, is_textrel_rx, is_relro;
42546+
42547+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
42548+ return;
42549+
42550+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
42551+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
42552+
42553+#ifdef CONFIG_PAX_ELFRELOCS
42554+ /* possible TEXTREL */
42555+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
42556+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
42557+#else
42558+ is_textrel_rw = false;
42559+ is_textrel_rx = false;
42560+#endif
42561+
42562+ /* possible RELRO */
42563+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
42564+
42565+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
42566+ return;
42567+
42568+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
42569+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
42570+
42571+#ifdef CONFIG_PAX_ETEXECRELOCS
42572+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42573+#else
42574+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
42575+#endif
42576+
42577+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42578+ !elf_check_arch(&elf_h) ||
42579+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
42580+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
42581+ return;
42582+
42583+ for (i = 0UL; i < elf_h.e_phnum; i++) {
42584+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
42585+ return;
42586+ switch (elf_p.p_type) {
42587+ case PT_DYNAMIC:
42588+ if (!is_textrel_rw && !is_textrel_rx)
42589+ continue;
42590+ i = 0UL;
42591+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
42592+ elf_dyn dyn;
42593+
42594+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
42595+ return;
42596+ if (dyn.d_tag == DT_NULL)
42597+ return;
42598+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
42599+ gr_log_textrel(vma);
42600+ if (is_textrel_rw)
42601+ vma->vm_flags |= VM_MAYWRITE;
42602+ else
42603+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
42604+ vma->vm_flags &= ~VM_MAYWRITE;
42605+ return;
42606+ }
42607+ i++;
42608+ }
42609+ return;
42610+
42611+ case PT_GNU_RELRO:
42612+ if (!is_relro)
42613+ continue;
42614+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
42615+ vma->vm_flags &= ~VM_MAYWRITE;
42616+ return;
42617+ }
42618+ }
42619+}
42620+#endif
42621+
42622 static int __init init_elf_binfmt(void)
42623 {
42624 return register_binfmt(&elf_format);
42625diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
42626index 1bffbe0..c8c283e 100644
42627--- a/fs/binfmt_flat.c
42628+++ b/fs/binfmt_flat.c
42629@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_binprm * bprm,
42630 realdatastart = (unsigned long) -ENOMEM;
42631 printk("Unable to allocate RAM for process data, errno %d\n",
42632 (int)-realdatastart);
42633+ down_write(&current->mm->mmap_sem);
42634 do_munmap(current->mm, textpos, text_len);
42635+ up_write(&current->mm->mmap_sem);
42636 ret = realdatastart;
42637 goto err;
42638 }
42639@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_binprm * bprm,
42640 }
42641 if (IS_ERR_VALUE(result)) {
42642 printk("Unable to read data+bss, errno %d\n", (int)-result);
42643+ down_write(&current->mm->mmap_sem);
42644 do_munmap(current->mm, textpos, text_len);
42645 do_munmap(current->mm, realdatastart, len);
42646+ up_write(&current->mm->mmap_sem);
42647 ret = result;
42648 goto err;
42649 }
42650@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_binprm * bprm,
42651 }
42652 if (IS_ERR_VALUE(result)) {
42653 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
42654+ down_write(&current->mm->mmap_sem);
42655 do_munmap(current->mm, textpos, text_len + data_len + extra +
42656 MAX_SHARED_LIBS * sizeof(unsigned long));
42657+ up_write(&current->mm->mmap_sem);
42658 ret = result;
42659 goto err;
42660 }
42661diff --git a/fs/bio.c b/fs/bio.c
42662index 9bfade8..782f3b9 100644
42663--- a/fs/bio.c
42664+++ b/fs/bio.c
42665@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
42666 const int read = bio_data_dir(bio) == READ;
42667 struct bio_map_data *bmd = bio->bi_private;
42668 int i;
42669- char *p = bmd->sgvecs[0].iov_base;
42670+ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
42671
42672 __bio_for_each_segment(bvec, bio, i, 0) {
42673 char *addr = page_address(bvec->bv_page);
42674diff --git a/fs/block_dev.c b/fs/block_dev.c
42675index 1c44b8d..e2507b4 100644
42676--- a/fs/block_dev.c
42677+++ b/fs/block_dev.c
42678@@ -681,7 +681,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
42679 else if (bdev->bd_contains == bdev)
42680 return true; /* is a whole device which isn't held */
42681
42682- else if (whole->bd_holder == bd_may_claim)
42683+ else if (whole->bd_holder == (void *)bd_may_claim)
42684 return true; /* is a partition of a device that is being partitioned */
42685 else if (whole->bd_holder != NULL)
42686 return false; /* is a partition of a held device */
42687diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
42688index 011cab3..9ace713 100644
42689--- a/fs/btrfs/ctree.c
42690+++ b/fs/btrfs/ctree.c
42691@@ -488,9 +488,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
42692 free_extent_buffer(buf);
42693 add_root_to_dirty_list(root);
42694 } else {
42695- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
42696- parent_start = parent->start;
42697- else
42698+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
42699+ if (parent)
42700+ parent_start = parent->start;
42701+ else
42702+ parent_start = 0;
42703+ } else
42704 parent_start = 0;
42705
42706 WARN_ON(trans->transid != btrfs_header_generation(parent));
42707diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
42708index b2d004a..6bb543d 100644
42709--- a/fs/btrfs/inode.c
42710+++ b/fs/btrfs/inode.c
42711@@ -6922,7 +6922,7 @@ fail:
42712 return -ENOMEM;
42713 }
42714
42715-static int btrfs_getattr(struct vfsmount *mnt,
42716+int btrfs_getattr(struct vfsmount *mnt,
42717 struct dentry *dentry, struct kstat *stat)
42718 {
42719 struct inode *inode = dentry->d_inode;
42720@@ -6934,6 +6934,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
42721 return 0;
42722 }
42723
42724+EXPORT_SYMBOL(btrfs_getattr);
42725+
42726+dev_t get_btrfs_dev_from_inode(struct inode *inode)
42727+{
42728+ return BTRFS_I(inode)->root->anon_dev;
42729+}
42730+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
42731+
42732 /*
42733 * If a file is moved, it will inherit the cow and compression flags of the new
42734 * directory.
42735diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
42736index dae5dfe..6aa01b1 100644
42737--- a/fs/btrfs/ioctl.c
42738+++ b/fs/btrfs/ioctl.c
42739@@ -2704,9 +2704,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
42740 for (i = 0; i < num_types; i++) {
42741 struct btrfs_space_info *tmp;
42742
42743+ /* Don't copy in more than we allocated */
42744 if (!slot_count)
42745 break;
42746
42747+ slot_count--;
42748+
42749 info = NULL;
42750 rcu_read_lock();
42751 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
42752@@ -2728,15 +2731,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
42753 memcpy(dest, &space, sizeof(space));
42754 dest++;
42755 space_args.total_spaces++;
42756- slot_count--;
42757 }
42758- if (!slot_count)
42759- break;
42760 }
42761 up_read(&info->groups_sem);
42762 }
42763
42764- user_dest = (struct btrfs_ioctl_space_info *)
42765+ user_dest = (struct btrfs_ioctl_space_info __user *)
42766 (arg + sizeof(struct btrfs_ioctl_space_args));
42767
42768 if (copy_to_user(user_dest, dest_orig, alloc_size))
42769diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
42770index 59bb176..be9977d 100644
42771--- a/fs/btrfs/relocation.c
42772+++ b/fs/btrfs/relocation.c
42773@@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
42774 }
42775 spin_unlock(&rc->reloc_root_tree.lock);
42776
42777- BUG_ON((struct btrfs_root *)node->data != root);
42778+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
42779
42780 if (!del) {
42781 spin_lock(&rc->reloc_root_tree.lock);
42782diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
42783index 622f469..e8d2d55 100644
42784--- a/fs/cachefiles/bind.c
42785+++ b/fs/cachefiles/bind.c
42786@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
42787 args);
42788
42789 /* start by checking things over */
42790- ASSERT(cache->fstop_percent >= 0 &&
42791- cache->fstop_percent < cache->fcull_percent &&
42792+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
42793 cache->fcull_percent < cache->frun_percent &&
42794 cache->frun_percent < 100);
42795
42796- ASSERT(cache->bstop_percent >= 0 &&
42797- cache->bstop_percent < cache->bcull_percent &&
42798+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
42799 cache->bcull_percent < cache->brun_percent &&
42800 cache->brun_percent < 100);
42801
42802diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
42803index 0a1467b..6a53245 100644
42804--- a/fs/cachefiles/daemon.c
42805+++ b/fs/cachefiles/daemon.c
42806@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(struct file *file, char __user *_buffer,
42807 if (n > buflen)
42808 return -EMSGSIZE;
42809
42810- if (copy_to_user(_buffer, buffer, n) != 0)
42811+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
42812 return -EFAULT;
42813
42814 return n;
42815@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
42816 if (test_bit(CACHEFILES_DEAD, &cache->flags))
42817 return -EIO;
42818
42819- if (datalen < 0 || datalen > PAGE_SIZE - 1)
42820+ if (datalen > PAGE_SIZE - 1)
42821 return -EOPNOTSUPP;
42822
42823 /* drag the command string into the kernel so we can parse it */
42824@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
42825 if (args[0] != '%' || args[1] != '\0')
42826 return -EINVAL;
42827
42828- if (fstop < 0 || fstop >= cache->fcull_percent)
42829+ if (fstop >= cache->fcull_percent)
42830 return cachefiles_daemon_range_error(cache, args);
42831
42832 cache->fstop_percent = fstop;
42833@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
42834 if (args[0] != '%' || args[1] != '\0')
42835 return -EINVAL;
42836
42837- if (bstop < 0 || bstop >= cache->bcull_percent)
42838+ if (bstop >= cache->bcull_percent)
42839 return cachefiles_daemon_range_error(cache, args);
42840
42841 cache->bstop_percent = bstop;
42842diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
42843index bd6bc1b..b627b53 100644
42844--- a/fs/cachefiles/internal.h
42845+++ b/fs/cachefiles/internal.h
42846@@ -57,7 +57,7 @@ struct cachefiles_cache {
42847 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
42848 struct rb_root active_nodes; /* active nodes (can't be culled) */
42849 rwlock_t active_lock; /* lock for active_nodes */
42850- atomic_t gravecounter; /* graveyard uniquifier */
42851+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
42852 unsigned frun_percent; /* when to stop culling (% files) */
42853 unsigned fcull_percent; /* when to start culling (% files) */
42854 unsigned fstop_percent; /* when to stop allocating (% files) */
42855@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
42856 * proc.c
42857 */
42858 #ifdef CONFIG_CACHEFILES_HISTOGRAM
42859-extern atomic_t cachefiles_lookup_histogram[HZ];
42860-extern atomic_t cachefiles_mkdir_histogram[HZ];
42861-extern atomic_t cachefiles_create_histogram[HZ];
42862+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42863+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42864+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
42865
42866 extern int __init cachefiles_proc_init(void);
42867 extern void cachefiles_proc_cleanup(void);
42868 static inline
42869-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
42870+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
42871 {
42872 unsigned long jif = jiffies - start_jif;
42873 if (jif >= HZ)
42874 jif = HZ - 1;
42875- atomic_inc(&histogram[jif]);
42876+ atomic_inc_unchecked(&histogram[jif]);
42877 }
42878
42879 #else
42880diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
42881index a0358c2..d6137f2 100644
42882--- a/fs/cachefiles/namei.c
42883+++ b/fs/cachefiles/namei.c
42884@@ -318,7 +318,7 @@ try_again:
42885 /* first step is to make up a grave dentry in the graveyard */
42886 sprintf(nbuffer, "%08x%08x",
42887 (uint32_t) get_seconds(),
42888- (uint32_t) atomic_inc_return(&cache->gravecounter));
42889+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
42890
42891 /* do the multiway lock magic */
42892 trap = lock_rename(cache->graveyard, dir);
42893diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
42894index eccd339..4c1d995 100644
42895--- a/fs/cachefiles/proc.c
42896+++ b/fs/cachefiles/proc.c
42897@@ -14,9 +14,9 @@
42898 #include <linux/seq_file.h>
42899 #include "internal.h"
42900
42901-atomic_t cachefiles_lookup_histogram[HZ];
42902-atomic_t cachefiles_mkdir_histogram[HZ];
42903-atomic_t cachefiles_create_histogram[HZ];
42904+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42905+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42906+atomic_unchecked_t cachefiles_create_histogram[HZ];
42907
42908 /*
42909 * display the latency histogram
42910@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
42911 return 0;
42912 default:
42913 index = (unsigned long) v - 3;
42914- x = atomic_read(&cachefiles_lookup_histogram[index]);
42915- y = atomic_read(&cachefiles_mkdir_histogram[index]);
42916- z = atomic_read(&cachefiles_create_histogram[index]);
42917+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
42918+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
42919+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
42920 if (x == 0 && y == 0 && z == 0)
42921 return 0;
42922
42923diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
42924index 0e3c092..818480e 100644
42925--- a/fs/cachefiles/rdwr.c
42926+++ b/fs/cachefiles/rdwr.c
42927@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
42928 old_fs = get_fs();
42929 set_fs(KERNEL_DS);
42930 ret = file->f_op->write(
42931- file, (const void __user *) data, len, &pos);
42932+ file, (const void __force_user *) data, len, &pos);
42933 set_fs(old_fs);
42934 kunmap(page);
42935 if (ret != len)
42936diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
42937index 382abc9..bd89646 100644
42938--- a/fs/ceph/dir.c
42939+++ b/fs/ceph/dir.c
42940@@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
42941 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
42942 struct ceph_mds_client *mdsc = fsc->mdsc;
42943 unsigned frag = fpos_frag(filp->f_pos);
42944- int off = fpos_off(filp->f_pos);
42945+ unsigned int off = fpos_off(filp->f_pos);
42946 int err;
42947 u32 ftype;
42948 struct ceph_mds_reply_info_parsed *rinfo;
42949diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
42950index 6d40656..bc1f825 100644
42951--- a/fs/cifs/cifs_debug.c
42952+++ b/fs/cifs/cifs_debug.c
42953@@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
42954
42955 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
42956 #ifdef CONFIG_CIFS_STATS2
42957- atomic_set(&totBufAllocCount, 0);
42958- atomic_set(&totSmBufAllocCount, 0);
42959+ atomic_set_unchecked(&totBufAllocCount, 0);
42960+ atomic_set_unchecked(&totSmBufAllocCount, 0);
42961 #endif /* CONFIG_CIFS_STATS2 */
42962 spin_lock(&cifs_tcp_ses_lock);
42963 list_for_each(tmp1, &cifs_tcp_ses_list) {
42964@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
42965 tcon = list_entry(tmp3,
42966 struct cifs_tcon,
42967 tcon_list);
42968- atomic_set(&tcon->num_smbs_sent, 0);
42969- atomic_set(&tcon->num_writes, 0);
42970- atomic_set(&tcon->num_reads, 0);
42971- atomic_set(&tcon->num_oplock_brks, 0);
42972- atomic_set(&tcon->num_opens, 0);
42973- atomic_set(&tcon->num_posixopens, 0);
42974- atomic_set(&tcon->num_posixmkdirs, 0);
42975- atomic_set(&tcon->num_closes, 0);
42976- atomic_set(&tcon->num_deletes, 0);
42977- atomic_set(&tcon->num_mkdirs, 0);
42978- atomic_set(&tcon->num_rmdirs, 0);
42979- atomic_set(&tcon->num_renames, 0);
42980- atomic_set(&tcon->num_t2renames, 0);
42981- atomic_set(&tcon->num_ffirst, 0);
42982- atomic_set(&tcon->num_fnext, 0);
42983- atomic_set(&tcon->num_fclose, 0);
42984- atomic_set(&tcon->num_hardlinks, 0);
42985- atomic_set(&tcon->num_symlinks, 0);
42986- atomic_set(&tcon->num_locks, 0);
42987+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
42988+ atomic_set_unchecked(&tcon->num_writes, 0);
42989+ atomic_set_unchecked(&tcon->num_reads, 0);
42990+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
42991+ atomic_set_unchecked(&tcon->num_opens, 0);
42992+ atomic_set_unchecked(&tcon->num_posixopens, 0);
42993+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
42994+ atomic_set_unchecked(&tcon->num_closes, 0);
42995+ atomic_set_unchecked(&tcon->num_deletes, 0);
42996+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
42997+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
42998+ atomic_set_unchecked(&tcon->num_renames, 0);
42999+ atomic_set_unchecked(&tcon->num_t2renames, 0);
43000+ atomic_set_unchecked(&tcon->num_ffirst, 0);
43001+ atomic_set_unchecked(&tcon->num_fnext, 0);
43002+ atomic_set_unchecked(&tcon->num_fclose, 0);
43003+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
43004+ atomic_set_unchecked(&tcon->num_symlinks, 0);
43005+ atomic_set_unchecked(&tcon->num_locks, 0);
43006 }
43007 }
43008 }
43009@@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43010 smBufAllocCount.counter, cifs_min_small);
43011 #ifdef CONFIG_CIFS_STATS2
43012 seq_printf(m, "Total Large %d Small %d Allocations\n",
43013- atomic_read(&totBufAllocCount),
43014- atomic_read(&totSmBufAllocCount));
43015+ atomic_read_unchecked(&totBufAllocCount),
43016+ atomic_read_unchecked(&totSmBufAllocCount));
43017 #endif /* CONFIG_CIFS_STATS2 */
43018
43019 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
43020@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43021 if (tcon->need_reconnect)
43022 seq_puts(m, "\tDISCONNECTED ");
43023 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
43024- atomic_read(&tcon->num_smbs_sent),
43025- atomic_read(&tcon->num_oplock_brks));
43026+ atomic_read_unchecked(&tcon->num_smbs_sent),
43027+ atomic_read_unchecked(&tcon->num_oplock_brks));
43028 seq_printf(m, "\nReads: %d Bytes: %lld",
43029- atomic_read(&tcon->num_reads),
43030+ atomic_read_unchecked(&tcon->num_reads),
43031 (long long)(tcon->bytes_read));
43032 seq_printf(m, "\nWrites: %d Bytes: %lld",
43033- atomic_read(&tcon->num_writes),
43034+ atomic_read_unchecked(&tcon->num_writes),
43035 (long long)(tcon->bytes_written));
43036 seq_printf(m, "\nFlushes: %d",
43037- atomic_read(&tcon->num_flushes));
43038+ atomic_read_unchecked(&tcon->num_flushes));
43039 seq_printf(m, "\nLocks: %d HardLinks: %d "
43040 "Symlinks: %d",
43041- atomic_read(&tcon->num_locks),
43042- atomic_read(&tcon->num_hardlinks),
43043- atomic_read(&tcon->num_symlinks));
43044+ atomic_read_unchecked(&tcon->num_locks),
43045+ atomic_read_unchecked(&tcon->num_hardlinks),
43046+ atomic_read_unchecked(&tcon->num_symlinks));
43047 seq_printf(m, "\nOpens: %d Closes: %d "
43048 "Deletes: %d",
43049- atomic_read(&tcon->num_opens),
43050- atomic_read(&tcon->num_closes),
43051- atomic_read(&tcon->num_deletes));
43052+ atomic_read_unchecked(&tcon->num_opens),
43053+ atomic_read_unchecked(&tcon->num_closes),
43054+ atomic_read_unchecked(&tcon->num_deletes));
43055 seq_printf(m, "\nPosix Opens: %d "
43056 "Posix Mkdirs: %d",
43057- atomic_read(&tcon->num_posixopens),
43058- atomic_read(&tcon->num_posixmkdirs));
43059+ atomic_read_unchecked(&tcon->num_posixopens),
43060+ atomic_read_unchecked(&tcon->num_posixmkdirs));
43061 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
43062- atomic_read(&tcon->num_mkdirs),
43063- atomic_read(&tcon->num_rmdirs));
43064+ atomic_read_unchecked(&tcon->num_mkdirs),
43065+ atomic_read_unchecked(&tcon->num_rmdirs));
43066 seq_printf(m, "\nRenames: %d T2 Renames %d",
43067- atomic_read(&tcon->num_renames),
43068- atomic_read(&tcon->num_t2renames));
43069+ atomic_read_unchecked(&tcon->num_renames),
43070+ atomic_read_unchecked(&tcon->num_t2renames));
43071 seq_printf(m, "\nFindFirst: %d FNext %d "
43072 "FClose %d",
43073- atomic_read(&tcon->num_ffirst),
43074- atomic_read(&tcon->num_fnext),
43075- atomic_read(&tcon->num_fclose));
43076+ atomic_read_unchecked(&tcon->num_ffirst),
43077+ atomic_read_unchecked(&tcon->num_fnext),
43078+ atomic_read_unchecked(&tcon->num_fclose));
43079 }
43080 }
43081 }
43082diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
43083index 54b8f1e..f6a4c00 100644
43084--- a/fs/cifs/cifsfs.c
43085+++ b/fs/cifs/cifsfs.c
43086@@ -981,7 +981,7 @@ cifs_init_request_bufs(void)
43087 cifs_req_cachep = kmem_cache_create("cifs_request",
43088 CIFSMaxBufSize +
43089 MAX_CIFS_HDR_SIZE, 0,
43090- SLAB_HWCACHE_ALIGN, NULL);
43091+ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
43092 if (cifs_req_cachep == NULL)
43093 return -ENOMEM;
43094
43095@@ -1008,7 +1008,7 @@ cifs_init_request_bufs(void)
43096 efficient to alloc 1 per page off the slab compared to 17K (5page)
43097 alloc of large cifs buffers even when page debugging is on */
43098 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
43099- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
43100+ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
43101 NULL);
43102 if (cifs_sm_req_cachep == NULL) {
43103 mempool_destroy(cifs_req_poolp);
43104@@ -1093,8 +1093,8 @@ init_cifs(void)
43105 atomic_set(&bufAllocCount, 0);
43106 atomic_set(&smBufAllocCount, 0);
43107 #ifdef CONFIG_CIFS_STATS2
43108- atomic_set(&totBufAllocCount, 0);
43109- atomic_set(&totSmBufAllocCount, 0);
43110+ atomic_set_unchecked(&totBufAllocCount, 0);
43111+ atomic_set_unchecked(&totSmBufAllocCount, 0);
43112 #endif /* CONFIG_CIFS_STATS2 */
43113
43114 atomic_set(&midCount, 0);
43115diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
43116index 95dad9d..fe7af1a 100644
43117--- a/fs/cifs/cifsglob.h
43118+++ b/fs/cifs/cifsglob.h
43119@@ -381,28 +381,28 @@ struct cifs_tcon {
43120 __u16 Flags; /* optional support bits */
43121 enum statusEnum tidStatus;
43122 #ifdef CONFIG_CIFS_STATS
43123- atomic_t num_smbs_sent;
43124- atomic_t num_writes;
43125- atomic_t num_reads;
43126- atomic_t num_flushes;
43127- atomic_t num_oplock_brks;
43128- atomic_t num_opens;
43129- atomic_t num_closes;
43130- atomic_t num_deletes;
43131- atomic_t num_mkdirs;
43132- atomic_t num_posixopens;
43133- atomic_t num_posixmkdirs;
43134- atomic_t num_rmdirs;
43135- atomic_t num_renames;
43136- atomic_t num_t2renames;
43137- atomic_t num_ffirst;
43138- atomic_t num_fnext;
43139- atomic_t num_fclose;
43140- atomic_t num_hardlinks;
43141- atomic_t num_symlinks;
43142- atomic_t num_locks;
43143- atomic_t num_acl_get;
43144- atomic_t num_acl_set;
43145+ atomic_unchecked_t num_smbs_sent;
43146+ atomic_unchecked_t num_writes;
43147+ atomic_unchecked_t num_reads;
43148+ atomic_unchecked_t num_flushes;
43149+ atomic_unchecked_t num_oplock_brks;
43150+ atomic_unchecked_t num_opens;
43151+ atomic_unchecked_t num_closes;
43152+ atomic_unchecked_t num_deletes;
43153+ atomic_unchecked_t num_mkdirs;
43154+ atomic_unchecked_t num_posixopens;
43155+ atomic_unchecked_t num_posixmkdirs;
43156+ atomic_unchecked_t num_rmdirs;
43157+ atomic_unchecked_t num_renames;
43158+ atomic_unchecked_t num_t2renames;
43159+ atomic_unchecked_t num_ffirst;
43160+ atomic_unchecked_t num_fnext;
43161+ atomic_unchecked_t num_fclose;
43162+ atomic_unchecked_t num_hardlinks;
43163+ atomic_unchecked_t num_symlinks;
43164+ atomic_unchecked_t num_locks;
43165+ atomic_unchecked_t num_acl_get;
43166+ atomic_unchecked_t num_acl_set;
43167 #ifdef CONFIG_CIFS_STATS2
43168 unsigned long long time_writes;
43169 unsigned long long time_reads;
43170@@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim)
43171 }
43172
43173 #ifdef CONFIG_CIFS_STATS
43174-#define cifs_stats_inc atomic_inc
43175+#define cifs_stats_inc atomic_inc_unchecked
43176
43177 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
43178 unsigned int bytes)
43179@@ -953,8 +953,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
43180 /* Various Debug counters */
43181 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
43182 #ifdef CONFIG_CIFS_STATS2
43183-GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
43184-GLOBAL_EXTERN atomic_t totSmBufAllocCount;
43185+GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
43186+GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
43187 #endif
43188 GLOBAL_EXTERN atomic_t smBufAllocCount;
43189 GLOBAL_EXTERN atomic_t midCount;
43190diff --git a/fs/cifs/link.c b/fs/cifs/link.c
43191index db3f18c..1f5955e 100644
43192--- a/fs/cifs/link.c
43193+++ b/fs/cifs/link.c
43194@@ -593,7 +593,7 @@ symlink_exit:
43195
43196 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
43197 {
43198- char *p = nd_get_link(nd);
43199+ const char *p = nd_get_link(nd);
43200 if (!IS_ERR(p))
43201 kfree(p);
43202 }
43203diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
43204index 7c16933..c8212b5 100644
43205--- a/fs/cifs/misc.c
43206+++ b/fs/cifs/misc.c
43207@@ -156,7 +156,7 @@ cifs_buf_get(void)
43208 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
43209 atomic_inc(&bufAllocCount);
43210 #ifdef CONFIG_CIFS_STATS2
43211- atomic_inc(&totBufAllocCount);
43212+ atomic_inc_unchecked(&totBufAllocCount);
43213 #endif /* CONFIG_CIFS_STATS2 */
43214 }
43215
43216@@ -191,7 +191,7 @@ cifs_small_buf_get(void)
43217 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
43218 atomic_inc(&smBufAllocCount);
43219 #ifdef CONFIG_CIFS_STATS2
43220- atomic_inc(&totSmBufAllocCount);
43221+ atomic_inc_unchecked(&totSmBufAllocCount);
43222 #endif /* CONFIG_CIFS_STATS2 */
43223
43224 }
43225diff --git a/fs/coda/cache.c b/fs/coda/cache.c
43226index 6901578..d402eb5 100644
43227--- a/fs/coda/cache.c
43228+++ b/fs/coda/cache.c
43229@@ -24,7 +24,7 @@
43230 #include "coda_linux.h"
43231 #include "coda_cache.h"
43232
43233-static atomic_t permission_epoch = ATOMIC_INIT(0);
43234+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
43235
43236 /* replace or extend an acl cache hit */
43237 void coda_cache_enter(struct inode *inode, int mask)
43238@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inode, int mask)
43239 struct coda_inode_info *cii = ITOC(inode);
43240
43241 spin_lock(&cii->c_lock);
43242- cii->c_cached_epoch = atomic_read(&permission_epoch);
43243+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
43244 if (cii->c_uid != current_fsuid()) {
43245 cii->c_uid = current_fsuid();
43246 cii->c_cached_perm = mask;
43247@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode *inode)
43248 {
43249 struct coda_inode_info *cii = ITOC(inode);
43250 spin_lock(&cii->c_lock);
43251- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
43252+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
43253 spin_unlock(&cii->c_lock);
43254 }
43255
43256 /* remove all acl caches */
43257 void coda_cache_clear_all(struct super_block *sb)
43258 {
43259- atomic_inc(&permission_epoch);
43260+ atomic_inc_unchecked(&permission_epoch);
43261 }
43262
43263
43264@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode, int mask)
43265 spin_lock(&cii->c_lock);
43266 hit = (mask & cii->c_cached_perm) == mask &&
43267 cii->c_uid == current_fsuid() &&
43268- cii->c_cached_epoch == atomic_read(&permission_epoch);
43269+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
43270 spin_unlock(&cii->c_lock);
43271
43272 return hit;
43273diff --git a/fs/compat.c b/fs/compat.c
43274index 58b1da4..afcd9b8 100644
43275--- a/fs/compat.c
43276+++ b/fs/compat.c
43277@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
43278 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
43279 {
43280 compat_ino_t ino = stat->ino;
43281- typeof(ubuf->st_uid) uid = 0;
43282- typeof(ubuf->st_gid) gid = 0;
43283+ typeof(((struct compat_stat *)0)->st_uid) uid = 0;
43284+ typeof(((struct compat_stat *)0)->st_gid) gid = 0;
43285 int err;
43286
43287 SET_UID(uid, stat->uid);
43288@@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
43289
43290 set_fs(KERNEL_DS);
43291 /* The __user pointer cast is valid because of the set_fs() */
43292- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
43293+ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
43294 set_fs(oldfs);
43295 /* truncating is ok because it's a user address */
43296 if (!ret)
43297@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
43298 goto out;
43299
43300 ret = -EINVAL;
43301- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
43302+ if (nr_segs > UIO_MAXIOV)
43303 goto out;
43304 if (nr_segs > fast_segs) {
43305 ret = -ENOMEM;
43306@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
43307
43308 struct compat_readdir_callback {
43309 struct compat_old_linux_dirent __user *dirent;
43310+ struct file * file;
43311 int result;
43312 };
43313
43314@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
43315 buf->result = -EOVERFLOW;
43316 return -EOVERFLOW;
43317 }
43318+
43319+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43320+ return 0;
43321+
43322 buf->result++;
43323 dirent = buf->dirent;
43324 if (!access_ok(VERIFY_WRITE, dirent,
43325@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
43326
43327 buf.result = 0;
43328 buf.dirent = dirent;
43329+ buf.file = file;
43330
43331 error = vfs_readdir(file, compat_fillonedir, &buf);
43332 if (buf.result)
43333@@ -917,6 +923,7 @@ struct compat_linux_dirent {
43334 struct compat_getdents_callback {
43335 struct compat_linux_dirent __user *current_dir;
43336 struct compat_linux_dirent __user *previous;
43337+ struct file * file;
43338 int count;
43339 int error;
43340 };
43341@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
43342 buf->error = -EOVERFLOW;
43343 return -EOVERFLOW;
43344 }
43345+
43346+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43347+ return 0;
43348+
43349 dirent = buf->previous;
43350 if (dirent) {
43351 if (__put_user(offset, &dirent->d_off))
43352@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
43353 buf.previous = NULL;
43354 buf.count = count;
43355 buf.error = 0;
43356+ buf.file = file;
43357
43358 error = vfs_readdir(file, compat_filldir, &buf);
43359 if (error >= 0)
43360@@ -1006,6 +1018,7 @@ out:
43361 struct compat_getdents_callback64 {
43362 struct linux_dirent64 __user *current_dir;
43363 struct linux_dirent64 __user *previous;
43364+ struct file * file;
43365 int count;
43366 int error;
43367 };
43368@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
43369 buf->error = -EINVAL; /* only used if we fail.. */
43370 if (reclen > buf->count)
43371 return -EINVAL;
43372+
43373+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43374+ return 0;
43375+
43376 dirent = buf->previous;
43377
43378 if (dirent) {
43379@@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
43380 buf.previous = NULL;
43381 buf.count = count;
43382 buf.error = 0;
43383+ buf.file = file;
43384
43385 error = vfs_readdir(file, compat_filldir64, &buf);
43386 if (error >= 0)
43387 error = buf.error;
43388 lastdirent = buf.previous;
43389 if (lastdirent) {
43390- typeof(lastdirent->d_off) d_off = file->f_pos;
43391+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
43392 if (__put_user_unaligned(d_off, &lastdirent->d_off))
43393 error = -EFAULT;
43394 else
43395@@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
43396 struct fdtable *fdt;
43397 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
43398
43399+ pax_track_stack();
43400+
43401 if (n < 0)
43402 goto out_nofds;
43403
43404diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
43405index 112e45a..b59845b 100644
43406--- a/fs/compat_binfmt_elf.c
43407+++ b/fs/compat_binfmt_elf.c
43408@@ -30,11 +30,13 @@
43409 #undef elf_phdr
43410 #undef elf_shdr
43411 #undef elf_note
43412+#undef elf_dyn
43413 #undef elf_addr_t
43414 #define elfhdr elf32_hdr
43415 #define elf_phdr elf32_phdr
43416 #define elf_shdr elf32_shdr
43417 #define elf_note elf32_note
43418+#define elf_dyn Elf32_Dyn
43419 #define elf_addr_t Elf32_Addr
43420
43421 /*
43422diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
43423index 51352de..93292ff 100644
43424--- a/fs/compat_ioctl.c
43425+++ b/fs/compat_ioctl.c
43426@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
43427
43428 err = get_user(palp, &up->palette);
43429 err |= get_user(length, &up->length);
43430+ if (err)
43431+ return -EFAULT;
43432
43433 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
43434 err = put_user(compat_ptr(palp), &up_native->palette);
43435@@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
43436 return -EFAULT;
43437 if (__get_user(udata, &ss32->iomem_base))
43438 return -EFAULT;
43439- ss.iomem_base = compat_ptr(udata);
43440+ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
43441 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
43442 __get_user(ss.port_high, &ss32->port_high))
43443 return -EFAULT;
43444@@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
43445 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
43446 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
43447 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
43448- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43449+ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43450 return -EFAULT;
43451
43452 return ioctl_preallocate(file, p);
43453@@ -1644,8 +1646,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
43454 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
43455 {
43456 unsigned int a, b;
43457- a = *(unsigned int *)p;
43458- b = *(unsigned int *)q;
43459+ a = *(const unsigned int *)p;
43460+ b = *(const unsigned int *)q;
43461 if (a > b)
43462 return 1;
43463 if (a < b)
43464diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
43465index 9a37a9b..35792b6 100644
43466--- a/fs/configfs/dir.c
43467+++ b/fs/configfs/dir.c
43468@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43469 }
43470 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
43471 struct configfs_dirent *next;
43472- const char * name;
43473+ const unsigned char * name;
43474+ char d_name[sizeof(next->s_dentry->d_iname)];
43475 int len;
43476 struct inode *inode = NULL;
43477
43478@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43479 continue;
43480
43481 name = configfs_get_name(next);
43482- len = strlen(name);
43483+ if (next->s_dentry && name == next->s_dentry->d_iname) {
43484+ len = next->s_dentry->d_name.len;
43485+ memcpy(d_name, name, len);
43486+ name = d_name;
43487+ } else
43488+ len = strlen(name);
43489
43490 /*
43491 * We'll have a dentry and an inode for
43492diff --git a/fs/dcache.c b/fs/dcache.c
43493index 8b732a2..6db6c27 100644
43494--- a/fs/dcache.c
43495+++ b/fs/dcache.c
43496@@ -3015,7 +3015,7 @@ void __init vfs_caches_init(unsigned long mempages)
43497 mempages -= reserve;
43498
43499 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
43500- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
43501+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
43502
43503 dcache_init();
43504 inode_init();
43505diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
43506index 528da01..bd8c23d 100644
43507--- a/fs/ecryptfs/inode.c
43508+++ b/fs/ecryptfs/inode.c
43509@@ -691,7 +691,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
43510 old_fs = get_fs();
43511 set_fs(get_ds());
43512 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
43513- (char __user *)lower_buf,
43514+ (char __force_user *)lower_buf,
43515 lower_bufsiz);
43516 set_fs(old_fs);
43517 if (rc < 0)
43518@@ -737,7 +737,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
43519 }
43520 old_fs = get_fs();
43521 set_fs(get_ds());
43522- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
43523+ rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len);
43524 set_fs(old_fs);
43525 if (rc < 0) {
43526 kfree(buf);
43527@@ -752,7 +752,7 @@ out:
43528 static void
43529 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
43530 {
43531- char *buf = nd_get_link(nd);
43532+ const char *buf = nd_get_link(nd);
43533 if (!IS_ERR(buf)) {
43534 /* Free the char* */
43535 kfree(buf);
43536diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
43537index 940a82e..63af89e 100644
43538--- a/fs/ecryptfs/miscdev.c
43539+++ b/fs/ecryptfs/miscdev.c
43540@@ -328,7 +328,7 @@ check_list:
43541 goto out_unlock_msg_ctx;
43542 i = 5;
43543 if (msg_ctx->msg) {
43544- if (copy_to_user(&buf[i], packet_length, packet_length_size))
43545+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
43546 goto out_unlock_msg_ctx;
43547 i += packet_length_size;
43548 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
43549diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
43550index 3745f7c..89cc7a3 100644
43551--- a/fs/ecryptfs/read_write.c
43552+++ b/fs/ecryptfs/read_write.c
43553@@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
43554 return -EIO;
43555 fs_save = get_fs();
43556 set_fs(get_ds());
43557- rc = vfs_write(lower_file, data, size, &offset);
43558+ rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
43559 set_fs(fs_save);
43560 mark_inode_dirty_sync(ecryptfs_inode);
43561 return rc;
43562@@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
43563 return -EIO;
43564 fs_save = get_fs();
43565 set_fs(get_ds());
43566- rc = vfs_read(lower_file, data, size, &offset);
43567+ rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
43568 set_fs(fs_save);
43569 return rc;
43570 }
43571diff --git a/fs/exec.c b/fs/exec.c
43572index 25dcbe5..4ffaa78 100644
43573--- a/fs/exec.c
43574+++ b/fs/exec.c
43575@@ -55,12 +55,24 @@
43576 #include <linux/pipe_fs_i.h>
43577 #include <linux/oom.h>
43578 #include <linux/compat.h>
43579+#include <linux/random.h>
43580+#include <linux/seq_file.h>
43581+
43582+#ifdef CONFIG_PAX_REFCOUNT
43583+#include <linux/kallsyms.h>
43584+#include <linux/kdebug.h>
43585+#endif
43586
43587 #include <asm/uaccess.h>
43588 #include <asm/mmu_context.h>
43589 #include <asm/tlb.h>
43590 #include "internal.h"
43591
43592+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
43593+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
43594+EXPORT_SYMBOL(pax_set_initial_flags_func);
43595+#endif
43596+
43597 int core_uses_pid;
43598 char core_pattern[CORENAME_MAX_SIZE] = "core";
43599 unsigned int core_pipe_limit;
43600@@ -70,7 +82,7 @@ struct core_name {
43601 char *corename;
43602 int used, size;
43603 };
43604-static atomic_t call_count = ATOMIC_INIT(1);
43605+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
43606
43607 /* The maximal length of core_pattern is also specified in sysctl.c */
43608
43609@@ -188,18 +200,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
43610 int write)
43611 {
43612 struct page *page;
43613- int ret;
43614
43615-#ifdef CONFIG_STACK_GROWSUP
43616- if (write) {
43617- ret = expand_downwards(bprm->vma, pos);
43618- if (ret < 0)
43619- return NULL;
43620- }
43621-#endif
43622- ret = get_user_pages(current, bprm->mm, pos,
43623- 1, write, 1, &page, NULL);
43624- if (ret <= 0)
43625+ if (0 > expand_downwards(bprm->vma, pos))
43626+ return NULL;
43627+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
43628 return NULL;
43629
43630 if (write) {
43631@@ -274,6 +278,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
43632 vma->vm_end = STACK_TOP_MAX;
43633 vma->vm_start = vma->vm_end - PAGE_SIZE;
43634 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
43635+
43636+#ifdef CONFIG_PAX_SEGMEXEC
43637+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
43638+#endif
43639+
43640 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
43641 INIT_LIST_HEAD(&vma->anon_vma_chain);
43642
43643@@ -288,6 +297,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
43644 mm->stack_vm = mm->total_vm = 1;
43645 up_write(&mm->mmap_sem);
43646 bprm->p = vma->vm_end - sizeof(void *);
43647+
43648+#ifdef CONFIG_PAX_RANDUSTACK
43649+ if (randomize_va_space)
43650+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
43651+#endif
43652+
43653 return 0;
43654 err:
43655 up_write(&mm->mmap_sem);
43656@@ -396,19 +411,7 @@ err:
43657 return err;
43658 }
43659
43660-struct user_arg_ptr {
43661-#ifdef CONFIG_COMPAT
43662- bool is_compat;
43663-#endif
43664- union {
43665- const char __user *const __user *native;
43666-#ifdef CONFIG_COMPAT
43667- compat_uptr_t __user *compat;
43668-#endif
43669- } ptr;
43670-};
43671-
43672-static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43673+const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43674 {
43675 const char __user *native;
43676
43677@@ -417,14 +420,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43678 compat_uptr_t compat;
43679
43680 if (get_user(compat, argv.ptr.compat + nr))
43681- return ERR_PTR(-EFAULT);
43682+ return (const char __force_user *)ERR_PTR(-EFAULT);
43683
43684 return compat_ptr(compat);
43685 }
43686 #endif
43687
43688 if (get_user(native, argv.ptr.native + nr))
43689- return ERR_PTR(-EFAULT);
43690+ return (const char __force_user *)ERR_PTR(-EFAULT);
43691
43692 return native;
43693 }
43694@@ -443,7 +446,7 @@ static int count(struct user_arg_ptr argv, int max)
43695 if (!p)
43696 break;
43697
43698- if (IS_ERR(p))
43699+ if (IS_ERR((const char __force_kernel *)p))
43700 return -EFAULT;
43701
43702 if (i++ >= max)
43703@@ -477,7 +480,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
43704
43705 ret = -EFAULT;
43706 str = get_user_arg_ptr(argv, argc);
43707- if (IS_ERR(str))
43708+ if (IS_ERR((const char __force_kernel *)str))
43709 goto out;
43710
43711 len = strnlen_user(str, MAX_ARG_STRLEN);
43712@@ -559,7 +562,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
43713 int r;
43714 mm_segment_t oldfs = get_fs();
43715 struct user_arg_ptr argv = {
43716- .ptr.native = (const char __user *const __user *)__argv,
43717+ .ptr.native = (const char __force_user *const __force_user *)__argv,
43718 };
43719
43720 set_fs(KERNEL_DS);
43721@@ -594,7 +597,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
43722 unsigned long new_end = old_end - shift;
43723 struct mmu_gather tlb;
43724
43725- BUG_ON(new_start > new_end);
43726+ if (new_start >= new_end || new_start < mmap_min_addr)
43727+ return -ENOMEM;
43728
43729 /*
43730 * ensure there are no vmas between where we want to go
43731@@ -603,6 +607,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
43732 if (vma != find_vma(mm, new_start))
43733 return -EFAULT;
43734
43735+#ifdef CONFIG_PAX_SEGMEXEC
43736+ BUG_ON(pax_find_mirror_vma(vma));
43737+#endif
43738+
43739 /*
43740 * cover the whole range: [new_start, old_end)
43741 */
43742@@ -683,10 +691,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
43743 stack_top = arch_align_stack(stack_top);
43744 stack_top = PAGE_ALIGN(stack_top);
43745
43746- if (unlikely(stack_top < mmap_min_addr) ||
43747- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
43748- return -ENOMEM;
43749-
43750 stack_shift = vma->vm_end - stack_top;
43751
43752 bprm->p -= stack_shift;
43753@@ -698,8 +702,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
43754 bprm->exec -= stack_shift;
43755
43756 down_write(&mm->mmap_sem);
43757+
43758+ /* Move stack pages down in memory. */
43759+ if (stack_shift) {
43760+ ret = shift_arg_pages(vma, stack_shift);
43761+ if (ret)
43762+ goto out_unlock;
43763+ }
43764+
43765 vm_flags = VM_STACK_FLAGS;
43766
43767+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43768+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43769+ vm_flags &= ~VM_EXEC;
43770+
43771+#ifdef CONFIG_PAX_MPROTECT
43772+ if (mm->pax_flags & MF_PAX_MPROTECT)
43773+ vm_flags &= ~VM_MAYEXEC;
43774+#endif
43775+
43776+ }
43777+#endif
43778+
43779 /*
43780 * Adjust stack execute permissions; explicitly enable for
43781 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
43782@@ -718,13 +742,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
43783 goto out_unlock;
43784 BUG_ON(prev != vma);
43785
43786- /* Move stack pages down in memory. */
43787- if (stack_shift) {
43788- ret = shift_arg_pages(vma, stack_shift);
43789- if (ret)
43790- goto out_unlock;
43791- }
43792-
43793 /* mprotect_fixup is overkill to remove the temporary stack flags */
43794 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
43795
43796@@ -805,7 +822,7 @@ int kernel_read(struct file *file, loff_t offset,
43797 old_fs = get_fs();
43798 set_fs(get_ds());
43799 /* The cast to a user pointer is valid due to the set_fs() */
43800- result = vfs_read(file, (void __user *)addr, count, &pos);
43801+ result = vfs_read(file, (void __force_user *)addr, count, &pos);
43802 set_fs(old_fs);
43803 return result;
43804 }
43805@@ -1251,7 +1268,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
43806 }
43807 rcu_read_unlock();
43808
43809- if (p->fs->users > n_fs) {
43810+ if (atomic_read(&p->fs->users) > n_fs) {
43811 bprm->unsafe |= LSM_UNSAFE_SHARE;
43812 } else {
43813 res = -EAGAIN;
43814@@ -1454,6 +1471,11 @@ static int do_execve_common(const char *filename,
43815 struct user_arg_ptr envp,
43816 struct pt_regs *regs)
43817 {
43818+#ifdef CONFIG_GRKERNSEC
43819+ struct file *old_exec_file;
43820+ struct acl_subject_label *old_acl;
43821+ struct rlimit old_rlim[RLIM_NLIMITS];
43822+#endif
43823 struct linux_binprm *bprm;
43824 struct file *file;
43825 struct files_struct *displaced;
43826@@ -1461,6 +1483,8 @@ static int do_execve_common(const char *filename,
43827 int retval;
43828 const struct cred *cred = current_cred();
43829
43830+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
43831+
43832 /*
43833 * We move the actual failure in case of RLIMIT_NPROC excess from
43834 * set*uid() to execve() because too many poorly written programs
43835@@ -1507,6 +1531,16 @@ static int do_execve_common(const char *filename,
43836 bprm->filename = filename;
43837 bprm->interp = filename;
43838
43839+ if (gr_process_user_ban()) {
43840+ retval = -EPERM;
43841+ goto out_file;
43842+ }
43843+
43844+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
43845+ retval = -EACCES;
43846+ goto out_file;
43847+ }
43848+
43849 retval = bprm_mm_init(bprm);
43850 if (retval)
43851 goto out_file;
43852@@ -1536,9 +1570,40 @@ static int do_execve_common(const char *filename,
43853 if (retval < 0)
43854 goto out;
43855
43856+ if (!gr_tpe_allow(file)) {
43857+ retval = -EACCES;
43858+ goto out;
43859+ }
43860+
43861+ if (gr_check_crash_exec(file)) {
43862+ retval = -EACCES;
43863+ goto out;
43864+ }
43865+
43866+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
43867+
43868+ gr_handle_exec_args(bprm, argv);
43869+
43870+#ifdef CONFIG_GRKERNSEC
43871+ old_acl = current->acl;
43872+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
43873+ old_exec_file = current->exec_file;
43874+ get_file(file);
43875+ current->exec_file = file;
43876+#endif
43877+
43878+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
43879+ bprm->unsafe & LSM_UNSAFE_SHARE);
43880+ if (retval < 0)
43881+ goto out_fail;
43882+
43883 retval = search_binary_handler(bprm,regs);
43884 if (retval < 0)
43885- goto out;
43886+ goto out_fail;
43887+#ifdef CONFIG_GRKERNSEC
43888+ if (old_exec_file)
43889+ fput(old_exec_file);
43890+#endif
43891
43892 /* execve succeeded */
43893 current->fs->in_exec = 0;
43894@@ -1549,6 +1614,14 @@ static int do_execve_common(const char *filename,
43895 put_files_struct(displaced);
43896 return retval;
43897
43898+out_fail:
43899+#ifdef CONFIG_GRKERNSEC
43900+ current->acl = old_acl;
43901+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
43902+ fput(current->exec_file);
43903+ current->exec_file = old_exec_file;
43904+#endif
43905+
43906 out:
43907 if (bprm->mm) {
43908 acct_arg_size(bprm, 0);
43909@@ -1622,7 +1695,7 @@ static int expand_corename(struct core_name *cn)
43910 {
43911 char *old_corename = cn->corename;
43912
43913- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
43914+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
43915 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
43916
43917 if (!cn->corename) {
43918@@ -1719,7 +1792,7 @@ static int format_corename(struct core_name *cn, long signr)
43919 int pid_in_pattern = 0;
43920 int err = 0;
43921
43922- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
43923+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
43924 cn->corename = kmalloc(cn->size, GFP_KERNEL);
43925 cn->used = 0;
43926
43927@@ -1816,6 +1889,218 @@ out:
43928 return ispipe;
43929 }
43930
43931+int pax_check_flags(unsigned long *flags)
43932+{
43933+ int retval = 0;
43934+
43935+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
43936+ if (*flags & MF_PAX_SEGMEXEC)
43937+ {
43938+ *flags &= ~MF_PAX_SEGMEXEC;
43939+ retval = -EINVAL;
43940+ }
43941+#endif
43942+
43943+ if ((*flags & MF_PAX_PAGEEXEC)
43944+
43945+#ifdef CONFIG_PAX_PAGEEXEC
43946+ && (*flags & MF_PAX_SEGMEXEC)
43947+#endif
43948+
43949+ )
43950+ {
43951+ *flags &= ~MF_PAX_PAGEEXEC;
43952+ retval = -EINVAL;
43953+ }
43954+
43955+ if ((*flags & MF_PAX_MPROTECT)
43956+
43957+#ifdef CONFIG_PAX_MPROTECT
43958+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43959+#endif
43960+
43961+ )
43962+ {
43963+ *flags &= ~MF_PAX_MPROTECT;
43964+ retval = -EINVAL;
43965+ }
43966+
43967+ if ((*flags & MF_PAX_EMUTRAMP)
43968+
43969+#ifdef CONFIG_PAX_EMUTRAMP
43970+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43971+#endif
43972+
43973+ )
43974+ {
43975+ *flags &= ~MF_PAX_EMUTRAMP;
43976+ retval = -EINVAL;
43977+ }
43978+
43979+ return retval;
43980+}
43981+
43982+EXPORT_SYMBOL(pax_check_flags);
43983+
43984+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43985+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
43986+{
43987+ struct task_struct *tsk = current;
43988+ struct mm_struct *mm = current->mm;
43989+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
43990+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
43991+ char *path_exec = NULL;
43992+ char *path_fault = NULL;
43993+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
43994+
43995+ if (buffer_exec && buffer_fault) {
43996+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
43997+
43998+ down_read(&mm->mmap_sem);
43999+ vma = mm->mmap;
44000+ while (vma && (!vma_exec || !vma_fault)) {
44001+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
44002+ vma_exec = vma;
44003+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
44004+ vma_fault = vma;
44005+ vma = vma->vm_next;
44006+ }
44007+ if (vma_exec) {
44008+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
44009+ if (IS_ERR(path_exec))
44010+ path_exec = "<path too long>";
44011+ else {
44012+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
44013+ if (path_exec) {
44014+ *path_exec = 0;
44015+ path_exec = buffer_exec;
44016+ } else
44017+ path_exec = "<path too long>";
44018+ }
44019+ }
44020+ if (vma_fault) {
44021+ start = vma_fault->vm_start;
44022+ end = vma_fault->vm_end;
44023+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
44024+ if (vma_fault->vm_file) {
44025+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
44026+ if (IS_ERR(path_fault))
44027+ path_fault = "<path too long>";
44028+ else {
44029+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
44030+ if (path_fault) {
44031+ *path_fault = 0;
44032+ path_fault = buffer_fault;
44033+ } else
44034+ path_fault = "<path too long>";
44035+ }
44036+ } else
44037+ path_fault = "<anonymous mapping>";
44038+ }
44039+ up_read(&mm->mmap_sem);
44040+ }
44041+ if (tsk->signal->curr_ip)
44042+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
44043+ else
44044+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
44045+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
44046+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
44047+ task_uid(tsk), task_euid(tsk), pc, sp);
44048+ free_page((unsigned long)buffer_exec);
44049+ free_page((unsigned long)buffer_fault);
44050+ pax_report_insns(regs, pc, sp);
44051+ do_coredump(SIGKILL, SIGKILL, regs);
44052+}
44053+#endif
44054+
44055+#ifdef CONFIG_PAX_REFCOUNT
44056+void pax_report_refcount_overflow(struct pt_regs *regs)
44057+{
44058+ if (current->signal->curr_ip)
44059+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44060+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
44061+ else
44062+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44063+ current->comm, task_pid_nr(current), current_uid(), current_euid());
44064+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
44065+ show_regs(regs);
44066+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
44067+}
44068+#endif
44069+
44070+#ifdef CONFIG_PAX_USERCOPY
44071+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
44072+int object_is_on_stack(const void *obj, unsigned long len)
44073+{
44074+ const void * const stack = task_stack_page(current);
44075+ const void * const stackend = stack + THREAD_SIZE;
44076+
44077+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44078+ const void *frame = NULL;
44079+ const void *oldframe;
44080+#endif
44081+
44082+ if (obj + len < obj)
44083+ return -1;
44084+
44085+ if (obj + len <= stack || stackend <= obj)
44086+ return 0;
44087+
44088+ if (obj < stack || stackend < obj + len)
44089+ return -1;
44090+
44091+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44092+ oldframe = __builtin_frame_address(1);
44093+ if (oldframe)
44094+ frame = __builtin_frame_address(2);
44095+ /*
44096+ low ----------------------------------------------> high
44097+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
44098+ ^----------------^
44099+ allow copies only within here
44100+ */
44101+ while (stack <= frame && frame < stackend) {
44102+ /* if obj + len extends past the last frame, this
44103+ check won't pass and the next frame will be 0,
44104+ causing us to bail out and correctly report
44105+ the copy as invalid
44106+ */
44107+ if (obj + len <= frame)
44108+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
44109+ oldframe = frame;
44110+ frame = *(const void * const *)frame;
44111+ }
44112+ return -1;
44113+#else
44114+ return 1;
44115+#endif
44116+}
44117+
44118+NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
44119+{
44120+ if (current->signal->curr_ip)
44121+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44122+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44123+ else
44124+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44125+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44126+ dump_stack();
44127+ gr_handle_kernel_exploit();
44128+ do_group_exit(SIGKILL);
44129+}
44130+#endif
44131+
44132+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
44133+void pax_track_stack(void)
44134+{
44135+ unsigned long sp = (unsigned long)&sp;
44136+ if (sp < current_thread_info()->lowest_stack &&
44137+ sp > (unsigned long)task_stack_page(current))
44138+ current_thread_info()->lowest_stack = sp;
44139+}
44140+EXPORT_SYMBOL(pax_track_stack);
44141+#endif
44142+
44143 static int zap_process(struct task_struct *start, int exit_code)
44144 {
44145 struct task_struct *t;
44146@@ -2027,17 +2312,17 @@ static void wait_for_dump_helpers(struct file *file)
44147 pipe = file->f_path.dentry->d_inode->i_pipe;
44148
44149 pipe_lock(pipe);
44150- pipe->readers++;
44151- pipe->writers--;
44152+ atomic_inc(&pipe->readers);
44153+ atomic_dec(&pipe->writers);
44154
44155- while ((pipe->readers > 1) && (!signal_pending(current))) {
44156+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
44157 wake_up_interruptible_sync(&pipe->wait);
44158 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
44159 pipe_wait(pipe);
44160 }
44161
44162- pipe->readers--;
44163- pipe->writers++;
44164+ atomic_dec(&pipe->readers);
44165+ atomic_inc(&pipe->writers);
44166 pipe_unlock(pipe);
44167
44168 }
44169@@ -2098,7 +2383,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44170 int retval = 0;
44171 int flag = 0;
44172 int ispipe;
44173- static atomic_t core_dump_count = ATOMIC_INIT(0);
44174+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
44175 struct coredump_params cprm = {
44176 .signr = signr,
44177 .regs = regs,
44178@@ -2113,6 +2398,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44179
44180 audit_core_dumps(signr);
44181
44182+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
44183+ gr_handle_brute_attach(current, cprm.mm_flags);
44184+
44185 binfmt = mm->binfmt;
44186 if (!binfmt || !binfmt->core_dump)
44187 goto fail;
44188@@ -2180,7 +2468,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44189 }
44190 cprm.limit = RLIM_INFINITY;
44191
44192- dump_count = atomic_inc_return(&core_dump_count);
44193+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
44194 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
44195 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
44196 task_tgid_vnr(current), current->comm);
44197@@ -2207,6 +2495,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44198 } else {
44199 struct inode *inode;
44200
44201+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
44202+
44203 if (cprm.limit < binfmt->min_coredump)
44204 goto fail_unlock;
44205
44206@@ -2250,7 +2540,7 @@ close_fail:
44207 filp_close(cprm.file, NULL);
44208 fail_dropcount:
44209 if (ispipe)
44210- atomic_dec(&core_dump_count);
44211+ atomic_dec_unchecked(&core_dump_count);
44212 fail_unlock:
44213 kfree(cn.corename);
44214 fail_corename:
44215@@ -2269,7 +2559,7 @@ fail:
44216 */
44217 int dump_write(struct file *file, const void *addr, int nr)
44218 {
44219- return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
44220+ return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
44221 }
44222 EXPORT_SYMBOL(dump_write);
44223
44224diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
44225index 8f44cef..cb07120 100644
44226--- a/fs/ext2/balloc.c
44227+++ b/fs/ext2/balloc.c
44228@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
44229
44230 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44231 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44232- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44233+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44234 sbi->s_resuid != current_fsuid() &&
44235 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44236 return 0;
44237diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
44238index 6386d76..0a266b1 100644
44239--- a/fs/ext3/balloc.c
44240+++ b/fs/ext3/balloc.c
44241@@ -1446,7 +1446,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
44242
44243 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44244 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44245- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44246+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44247 sbi->s_resuid != current_fsuid() &&
44248 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44249 return 0;
44250diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
44251index f8224ad..fbef97c 100644
44252--- a/fs/ext4/balloc.c
44253+++ b/fs/ext4/balloc.c
44254@@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct ext4_sb_info *sbi,
44255 /* Hm, nope. Are (enough) root reserved blocks available? */
44256 if (sbi->s_resuid == current_fsuid() ||
44257 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
44258- capable(CAP_SYS_RESOURCE) ||
44259- (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
44260+ (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
44261+ capable_nolog(CAP_SYS_RESOURCE)) {
44262
44263 if (free_blocks >= (nblocks + dirty_blocks))
44264 return 1;
44265diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
44266index 5c38120..2291d18 100644
44267--- a/fs/ext4/ext4.h
44268+++ b/fs/ext4/ext4.h
44269@@ -1180,19 +1180,19 @@ struct ext4_sb_info {
44270 unsigned long s_mb_last_start;
44271
44272 /* stats for buddy allocator */
44273- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
44274- atomic_t s_bal_success; /* we found long enough chunks */
44275- atomic_t s_bal_allocated; /* in blocks */
44276- atomic_t s_bal_ex_scanned; /* total extents scanned */
44277- atomic_t s_bal_goals; /* goal hits */
44278- atomic_t s_bal_breaks; /* too long searches */
44279- atomic_t s_bal_2orders; /* 2^order hits */
44280+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
44281+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
44282+ atomic_unchecked_t s_bal_allocated; /* in blocks */
44283+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
44284+ atomic_unchecked_t s_bal_goals; /* goal hits */
44285+ atomic_unchecked_t s_bal_breaks; /* too long searches */
44286+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
44287 spinlock_t s_bal_lock;
44288 unsigned long s_mb_buddies_generated;
44289 unsigned long long s_mb_generation_time;
44290- atomic_t s_mb_lost_chunks;
44291- atomic_t s_mb_preallocated;
44292- atomic_t s_mb_discarded;
44293+ atomic_unchecked_t s_mb_lost_chunks;
44294+ atomic_unchecked_t s_mb_preallocated;
44295+ atomic_unchecked_t s_mb_discarded;
44296 atomic_t s_lock_busy;
44297
44298 /* locality groups */
44299diff --git a/fs/ext4/file.c b/fs/ext4/file.c
44300index e4095e9..1c006c5 100644
44301--- a/fs/ext4/file.c
44302+++ b/fs/ext4/file.c
44303@@ -181,8 +181,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
44304 path.dentry = mnt->mnt_root;
44305 cp = d_path(&path, buf, sizeof(buf));
44306 if (!IS_ERR(cp)) {
44307- memcpy(sbi->s_es->s_last_mounted, cp,
44308- sizeof(sbi->s_es->s_last_mounted));
44309+ strlcpy(sbi->s_es->s_last_mounted, cp,
44310+ sizeof(sbi->s_es->s_last_mounted));
44311 ext4_mark_super_dirty(sb);
44312 }
44313 }
44314diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
44315index f18bfe3..43759b1 100644
44316--- a/fs/ext4/ioctl.c
44317+++ b/fs/ext4/ioctl.c
44318@@ -348,7 +348,7 @@ mext_out:
44319 if (!blk_queue_discard(q))
44320 return -EOPNOTSUPP;
44321
44322- if (copy_from_user(&range, (struct fstrim_range *)arg,
44323+ if (copy_from_user(&range, (struct fstrim_range __user *)arg,
44324 sizeof(range)))
44325 return -EFAULT;
44326
44327@@ -358,7 +358,7 @@ mext_out:
44328 if (ret < 0)
44329 return ret;
44330
44331- if (copy_to_user((struct fstrim_range *)arg, &range,
44332+ if (copy_to_user((struct fstrim_range __user *)arg, &range,
44333 sizeof(range)))
44334 return -EFAULT;
44335
44336diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
44337index 17a5a57..b6be3c5 100644
44338--- a/fs/ext4/mballoc.c
44339+++ b/fs/ext4/mballoc.c
44340@@ -1795,7 +1795,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
44341 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
44342
44343 if (EXT4_SB(sb)->s_mb_stats)
44344- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
44345+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
44346
44347 break;
44348 }
44349@@ -2089,7 +2089,7 @@ repeat:
44350 ac->ac_status = AC_STATUS_CONTINUE;
44351 ac->ac_flags |= EXT4_MB_HINT_FIRST;
44352 cr = 3;
44353- atomic_inc(&sbi->s_mb_lost_chunks);
44354+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
44355 goto repeat;
44356 }
44357 }
44358@@ -2132,6 +2132,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
44359 ext4_grpblk_t counters[16];
44360 } sg;
44361
44362+ pax_track_stack();
44363+
44364 group--;
44365 if (group == 0)
44366 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
44367@@ -2573,25 +2575,25 @@ int ext4_mb_release(struct super_block *sb)
44368 if (sbi->s_mb_stats) {
44369 ext4_msg(sb, KERN_INFO,
44370 "mballoc: %u blocks %u reqs (%u success)",
44371- atomic_read(&sbi->s_bal_allocated),
44372- atomic_read(&sbi->s_bal_reqs),
44373- atomic_read(&sbi->s_bal_success));
44374+ atomic_read_unchecked(&sbi->s_bal_allocated),
44375+ atomic_read_unchecked(&sbi->s_bal_reqs),
44376+ atomic_read_unchecked(&sbi->s_bal_success));
44377 ext4_msg(sb, KERN_INFO,
44378 "mballoc: %u extents scanned, %u goal hits, "
44379 "%u 2^N hits, %u breaks, %u lost",
44380- atomic_read(&sbi->s_bal_ex_scanned),
44381- atomic_read(&sbi->s_bal_goals),
44382- atomic_read(&sbi->s_bal_2orders),
44383- atomic_read(&sbi->s_bal_breaks),
44384- atomic_read(&sbi->s_mb_lost_chunks));
44385+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
44386+ atomic_read_unchecked(&sbi->s_bal_goals),
44387+ atomic_read_unchecked(&sbi->s_bal_2orders),
44388+ atomic_read_unchecked(&sbi->s_bal_breaks),
44389+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
44390 ext4_msg(sb, KERN_INFO,
44391 "mballoc: %lu generated and it took %Lu",
44392 sbi->s_mb_buddies_generated,
44393 sbi->s_mb_generation_time);
44394 ext4_msg(sb, KERN_INFO,
44395 "mballoc: %u preallocated, %u discarded",
44396- atomic_read(&sbi->s_mb_preallocated),
44397- atomic_read(&sbi->s_mb_discarded));
44398+ atomic_read_unchecked(&sbi->s_mb_preallocated),
44399+ atomic_read_unchecked(&sbi->s_mb_discarded));
44400 }
44401
44402 free_percpu(sbi->s_locality_groups);
44403@@ -3070,16 +3072,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
44404 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
44405
44406 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
44407- atomic_inc(&sbi->s_bal_reqs);
44408- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44409+ atomic_inc_unchecked(&sbi->s_bal_reqs);
44410+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44411 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
44412- atomic_inc(&sbi->s_bal_success);
44413- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
44414+ atomic_inc_unchecked(&sbi->s_bal_success);
44415+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
44416 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
44417 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
44418- atomic_inc(&sbi->s_bal_goals);
44419+ atomic_inc_unchecked(&sbi->s_bal_goals);
44420 if (ac->ac_found > sbi->s_mb_max_to_scan)
44421- atomic_inc(&sbi->s_bal_breaks);
44422+ atomic_inc_unchecked(&sbi->s_bal_breaks);
44423 }
44424
44425 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
44426@@ -3477,7 +3479,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
44427 trace_ext4_mb_new_inode_pa(ac, pa);
44428
44429 ext4_mb_use_inode_pa(ac, pa);
44430- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44431+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44432
44433 ei = EXT4_I(ac->ac_inode);
44434 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44435@@ -3537,7 +3539,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
44436 trace_ext4_mb_new_group_pa(ac, pa);
44437
44438 ext4_mb_use_group_pa(ac, pa);
44439- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44440+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44441
44442 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44443 lg = ac->ac_lg;
44444@@ -3625,7 +3627,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
44445 * from the bitmap and continue.
44446 */
44447 }
44448- atomic_add(free, &sbi->s_mb_discarded);
44449+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
44450
44451 return err;
44452 }
44453@@ -3643,7 +3645,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
44454 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
44455 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
44456 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
44457- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44458+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44459 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
44460
44461 return 0;
44462diff --git a/fs/fcntl.c b/fs/fcntl.c
44463index 22764c7..86372c9 100644
44464--- a/fs/fcntl.c
44465+++ b/fs/fcntl.c
44466@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
44467 if (err)
44468 return err;
44469
44470+ if (gr_handle_chroot_fowner(pid, type))
44471+ return -ENOENT;
44472+ if (gr_check_protected_task_fowner(pid, type))
44473+ return -EACCES;
44474+
44475 f_modown(filp, pid, type, force);
44476 return 0;
44477 }
44478@@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
44479
44480 static int f_setown_ex(struct file *filp, unsigned long arg)
44481 {
44482- struct f_owner_ex * __user owner_p = (void * __user)arg;
44483+ struct f_owner_ex __user *owner_p = (void __user *)arg;
44484 struct f_owner_ex owner;
44485 struct pid *pid;
44486 int type;
44487@@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
44488
44489 static int f_getown_ex(struct file *filp, unsigned long arg)
44490 {
44491- struct f_owner_ex * __user owner_p = (void * __user)arg;
44492+ struct f_owner_ex __user *owner_p = (void __user *)arg;
44493 struct f_owner_ex owner;
44494 int ret = 0;
44495
44496@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
44497 switch (cmd) {
44498 case F_DUPFD:
44499 case F_DUPFD_CLOEXEC:
44500+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
44501 if (arg >= rlimit(RLIMIT_NOFILE))
44502 break;
44503 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
44504diff --git a/fs/fifo.c b/fs/fifo.c
44505index b1a524d..4ee270e 100644
44506--- a/fs/fifo.c
44507+++ b/fs/fifo.c
44508@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
44509 */
44510 filp->f_op = &read_pipefifo_fops;
44511 pipe->r_counter++;
44512- if (pipe->readers++ == 0)
44513+ if (atomic_inc_return(&pipe->readers) == 1)
44514 wake_up_partner(inode);
44515
44516- if (!pipe->writers) {
44517+ if (!atomic_read(&pipe->writers)) {
44518 if ((filp->f_flags & O_NONBLOCK)) {
44519 /* suppress POLLHUP until we have
44520 * seen a writer */
44521@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode, struct file *filp)
44522 * errno=ENXIO when there is no process reading the FIFO.
44523 */
44524 ret = -ENXIO;
44525- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
44526+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
44527 goto err;
44528
44529 filp->f_op = &write_pipefifo_fops;
44530 pipe->w_counter++;
44531- if (!pipe->writers++)
44532+ if (atomic_inc_return(&pipe->writers) == 1)
44533 wake_up_partner(inode);
44534
44535- if (!pipe->readers) {
44536+ if (!atomic_read(&pipe->readers)) {
44537 wait_for_partner(inode, &pipe->r_counter);
44538 if (signal_pending(current))
44539 goto err_wr;
44540@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
44541 */
44542 filp->f_op = &rdwr_pipefifo_fops;
44543
44544- pipe->readers++;
44545- pipe->writers++;
44546+ atomic_inc(&pipe->readers);
44547+ atomic_inc(&pipe->writers);
44548 pipe->r_counter++;
44549 pipe->w_counter++;
44550- if (pipe->readers == 1 || pipe->writers == 1)
44551+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
44552 wake_up_partner(inode);
44553 break;
44554
44555@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
44556 return 0;
44557
44558 err_rd:
44559- if (!--pipe->readers)
44560+ if (atomic_dec_and_test(&pipe->readers))
44561 wake_up_interruptible(&pipe->wait);
44562 ret = -ERESTARTSYS;
44563 goto err;
44564
44565 err_wr:
44566- if (!--pipe->writers)
44567+ if (atomic_dec_and_test(&pipe->writers))
44568 wake_up_interruptible(&pipe->wait);
44569 ret = -ERESTARTSYS;
44570 goto err;
44571
44572 err:
44573- if (!pipe->readers && !pipe->writers)
44574+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
44575 free_pipe_info(inode);
44576
44577 err_nocleanup:
44578diff --git a/fs/file.c b/fs/file.c
44579index 4c6992d..104cdea 100644
44580--- a/fs/file.c
44581+++ b/fs/file.c
44582@@ -15,6 +15,7 @@
44583 #include <linux/slab.h>
44584 #include <linux/vmalloc.h>
44585 #include <linux/file.h>
44586+#include <linux/security.h>
44587 #include <linux/fdtable.h>
44588 #include <linux/bitops.h>
44589 #include <linux/interrupt.h>
44590@@ -254,6 +255,7 @@ int expand_files(struct files_struct *files, int nr)
44591 * N.B. For clone tasks sharing a files structure, this test
44592 * will limit the total number of files that can be opened.
44593 */
44594+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
44595 if (nr >= rlimit(RLIMIT_NOFILE))
44596 return -EMFILE;
44597
44598diff --git a/fs/filesystems.c b/fs/filesystems.c
44599index 0845f84..7b4ebef 100644
44600--- a/fs/filesystems.c
44601+++ b/fs/filesystems.c
44602@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(const char *name)
44603 int len = dot ? dot - name : strlen(name);
44604
44605 fs = __get_fs_type(name, len);
44606+
44607+#ifdef CONFIG_GRKERNSEC_MODHARDEN
44608+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
44609+#else
44610 if (!fs && (request_module("%.*s", len, name) == 0))
44611+#endif
44612 fs = __get_fs_type(name, len);
44613
44614 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
44615diff --git a/fs/fs_struct.c b/fs/fs_struct.c
44616index 78b519c..212c0d0 100644
44617--- a/fs/fs_struct.c
44618+++ b/fs/fs_struct.c
44619@@ -4,6 +4,7 @@
44620 #include <linux/path.h>
44621 #include <linux/slab.h>
44622 #include <linux/fs_struct.h>
44623+#include <linux/grsecurity.h>
44624 #include "internal.h"
44625
44626 static inline void path_get_longterm(struct path *path)
44627@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
44628 old_root = fs->root;
44629 fs->root = *path;
44630 path_get_longterm(path);
44631+ gr_set_chroot_entries(current, path);
44632 write_seqcount_end(&fs->seq);
44633 spin_unlock(&fs->lock);
44634 if (old_root.dentry)
44635@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
44636 && fs->root.mnt == old_root->mnt) {
44637 path_get_longterm(new_root);
44638 fs->root = *new_root;
44639+ gr_set_chroot_entries(p, new_root);
44640 count++;
44641 }
44642 if (fs->pwd.dentry == old_root->dentry
44643@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
44644 spin_lock(&fs->lock);
44645 write_seqcount_begin(&fs->seq);
44646 tsk->fs = NULL;
44647- kill = !--fs->users;
44648+ gr_clear_chroot_entries(tsk);
44649+ kill = !atomic_dec_return(&fs->users);
44650 write_seqcount_end(&fs->seq);
44651 spin_unlock(&fs->lock);
44652 task_unlock(tsk);
44653@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
44654 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
44655 /* We don't need to lock fs - think why ;-) */
44656 if (fs) {
44657- fs->users = 1;
44658+ atomic_set(&fs->users, 1);
44659 fs->in_exec = 0;
44660 spin_lock_init(&fs->lock);
44661 seqcount_init(&fs->seq);
44662@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
44663 spin_lock(&old->lock);
44664 fs->root = old->root;
44665 path_get_longterm(&fs->root);
44666+ /* instead of calling gr_set_chroot_entries here,
44667+ we call it from every caller of this function
44668+ */
44669 fs->pwd = old->pwd;
44670 path_get_longterm(&fs->pwd);
44671 spin_unlock(&old->lock);
44672@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
44673
44674 task_lock(current);
44675 spin_lock(&fs->lock);
44676- kill = !--fs->users;
44677+ kill = !atomic_dec_return(&fs->users);
44678 current->fs = new_fs;
44679+ gr_set_chroot_entries(current, &new_fs->root);
44680 spin_unlock(&fs->lock);
44681 task_unlock(current);
44682
44683@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
44684
44685 /* to be mentioned only in INIT_TASK */
44686 struct fs_struct init_fs = {
44687- .users = 1,
44688+ .users = ATOMIC_INIT(1),
44689 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
44690 .seq = SEQCNT_ZERO,
44691 .umask = 0022,
44692@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
44693 task_lock(current);
44694
44695 spin_lock(&init_fs.lock);
44696- init_fs.users++;
44697+ atomic_inc(&init_fs.users);
44698 spin_unlock(&init_fs.lock);
44699
44700 spin_lock(&fs->lock);
44701 current->fs = &init_fs;
44702- kill = !--fs->users;
44703+ gr_set_chroot_entries(current, &current->fs->root);
44704+ kill = !atomic_dec_return(&fs->users);
44705 spin_unlock(&fs->lock);
44706
44707 task_unlock(current);
44708diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
44709index 9905350..02eaec4 100644
44710--- a/fs/fscache/cookie.c
44711+++ b/fs/fscache/cookie.c
44712@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
44713 parent ? (char *) parent->def->name : "<no-parent>",
44714 def->name, netfs_data);
44715
44716- fscache_stat(&fscache_n_acquires);
44717+ fscache_stat_unchecked(&fscache_n_acquires);
44718
44719 /* if there's no parent cookie, then we don't create one here either */
44720 if (!parent) {
44721- fscache_stat(&fscache_n_acquires_null);
44722+ fscache_stat_unchecked(&fscache_n_acquires_null);
44723 _leave(" [no parent]");
44724 return NULL;
44725 }
44726@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
44727 /* allocate and initialise a cookie */
44728 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
44729 if (!cookie) {
44730- fscache_stat(&fscache_n_acquires_oom);
44731+ fscache_stat_unchecked(&fscache_n_acquires_oom);
44732 _leave(" [ENOMEM]");
44733 return NULL;
44734 }
44735@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
44736
44737 switch (cookie->def->type) {
44738 case FSCACHE_COOKIE_TYPE_INDEX:
44739- fscache_stat(&fscache_n_cookie_index);
44740+ fscache_stat_unchecked(&fscache_n_cookie_index);
44741 break;
44742 case FSCACHE_COOKIE_TYPE_DATAFILE:
44743- fscache_stat(&fscache_n_cookie_data);
44744+ fscache_stat_unchecked(&fscache_n_cookie_data);
44745 break;
44746 default:
44747- fscache_stat(&fscache_n_cookie_special);
44748+ fscache_stat_unchecked(&fscache_n_cookie_special);
44749 break;
44750 }
44751
44752@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
44753 if (fscache_acquire_non_index_cookie(cookie) < 0) {
44754 atomic_dec(&parent->n_children);
44755 __fscache_cookie_put(cookie);
44756- fscache_stat(&fscache_n_acquires_nobufs);
44757+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
44758 _leave(" = NULL");
44759 return NULL;
44760 }
44761 }
44762
44763- fscache_stat(&fscache_n_acquires_ok);
44764+ fscache_stat_unchecked(&fscache_n_acquires_ok);
44765 _leave(" = %p", cookie);
44766 return cookie;
44767 }
44768@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
44769 cache = fscache_select_cache_for_object(cookie->parent);
44770 if (!cache) {
44771 up_read(&fscache_addremove_sem);
44772- fscache_stat(&fscache_n_acquires_no_cache);
44773+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
44774 _leave(" = -ENOMEDIUM [no cache]");
44775 return -ENOMEDIUM;
44776 }
44777@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
44778 object = cache->ops->alloc_object(cache, cookie);
44779 fscache_stat_d(&fscache_n_cop_alloc_object);
44780 if (IS_ERR(object)) {
44781- fscache_stat(&fscache_n_object_no_alloc);
44782+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
44783 ret = PTR_ERR(object);
44784 goto error;
44785 }
44786
44787- fscache_stat(&fscache_n_object_alloc);
44788+ fscache_stat_unchecked(&fscache_n_object_alloc);
44789
44790 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
44791
44792@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
44793 struct fscache_object *object;
44794 struct hlist_node *_p;
44795
44796- fscache_stat(&fscache_n_updates);
44797+ fscache_stat_unchecked(&fscache_n_updates);
44798
44799 if (!cookie) {
44800- fscache_stat(&fscache_n_updates_null);
44801+ fscache_stat_unchecked(&fscache_n_updates_null);
44802 _leave(" [no cookie]");
44803 return;
44804 }
44805@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
44806 struct fscache_object *object;
44807 unsigned long event;
44808
44809- fscache_stat(&fscache_n_relinquishes);
44810+ fscache_stat_unchecked(&fscache_n_relinquishes);
44811 if (retire)
44812- fscache_stat(&fscache_n_relinquishes_retire);
44813+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
44814
44815 if (!cookie) {
44816- fscache_stat(&fscache_n_relinquishes_null);
44817+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
44818 _leave(" [no cookie]");
44819 return;
44820 }
44821@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
44822
44823 /* wait for the cookie to finish being instantiated (or to fail) */
44824 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
44825- fscache_stat(&fscache_n_relinquishes_waitcrt);
44826+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
44827 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
44828 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
44829 }
44830diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
44831index f6aad48..88dcf26 100644
44832--- a/fs/fscache/internal.h
44833+++ b/fs/fscache/internal.h
44834@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
44835 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
44836 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
44837
44838-extern atomic_t fscache_n_op_pend;
44839-extern atomic_t fscache_n_op_run;
44840-extern atomic_t fscache_n_op_enqueue;
44841-extern atomic_t fscache_n_op_deferred_release;
44842-extern atomic_t fscache_n_op_release;
44843-extern atomic_t fscache_n_op_gc;
44844-extern atomic_t fscache_n_op_cancelled;
44845-extern atomic_t fscache_n_op_rejected;
44846+extern atomic_unchecked_t fscache_n_op_pend;
44847+extern atomic_unchecked_t fscache_n_op_run;
44848+extern atomic_unchecked_t fscache_n_op_enqueue;
44849+extern atomic_unchecked_t fscache_n_op_deferred_release;
44850+extern atomic_unchecked_t fscache_n_op_release;
44851+extern atomic_unchecked_t fscache_n_op_gc;
44852+extern atomic_unchecked_t fscache_n_op_cancelled;
44853+extern atomic_unchecked_t fscache_n_op_rejected;
44854
44855-extern atomic_t fscache_n_attr_changed;
44856-extern atomic_t fscache_n_attr_changed_ok;
44857-extern atomic_t fscache_n_attr_changed_nobufs;
44858-extern atomic_t fscache_n_attr_changed_nomem;
44859-extern atomic_t fscache_n_attr_changed_calls;
44860+extern atomic_unchecked_t fscache_n_attr_changed;
44861+extern atomic_unchecked_t fscache_n_attr_changed_ok;
44862+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
44863+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
44864+extern atomic_unchecked_t fscache_n_attr_changed_calls;
44865
44866-extern atomic_t fscache_n_allocs;
44867-extern atomic_t fscache_n_allocs_ok;
44868-extern atomic_t fscache_n_allocs_wait;
44869-extern atomic_t fscache_n_allocs_nobufs;
44870-extern atomic_t fscache_n_allocs_intr;
44871-extern atomic_t fscache_n_allocs_object_dead;
44872-extern atomic_t fscache_n_alloc_ops;
44873-extern atomic_t fscache_n_alloc_op_waits;
44874+extern atomic_unchecked_t fscache_n_allocs;
44875+extern atomic_unchecked_t fscache_n_allocs_ok;
44876+extern atomic_unchecked_t fscache_n_allocs_wait;
44877+extern atomic_unchecked_t fscache_n_allocs_nobufs;
44878+extern atomic_unchecked_t fscache_n_allocs_intr;
44879+extern atomic_unchecked_t fscache_n_allocs_object_dead;
44880+extern atomic_unchecked_t fscache_n_alloc_ops;
44881+extern atomic_unchecked_t fscache_n_alloc_op_waits;
44882
44883-extern atomic_t fscache_n_retrievals;
44884-extern atomic_t fscache_n_retrievals_ok;
44885-extern atomic_t fscache_n_retrievals_wait;
44886-extern atomic_t fscache_n_retrievals_nodata;
44887-extern atomic_t fscache_n_retrievals_nobufs;
44888-extern atomic_t fscache_n_retrievals_intr;
44889-extern atomic_t fscache_n_retrievals_nomem;
44890-extern atomic_t fscache_n_retrievals_object_dead;
44891-extern atomic_t fscache_n_retrieval_ops;
44892-extern atomic_t fscache_n_retrieval_op_waits;
44893+extern atomic_unchecked_t fscache_n_retrievals;
44894+extern atomic_unchecked_t fscache_n_retrievals_ok;
44895+extern atomic_unchecked_t fscache_n_retrievals_wait;
44896+extern atomic_unchecked_t fscache_n_retrievals_nodata;
44897+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
44898+extern atomic_unchecked_t fscache_n_retrievals_intr;
44899+extern atomic_unchecked_t fscache_n_retrievals_nomem;
44900+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
44901+extern atomic_unchecked_t fscache_n_retrieval_ops;
44902+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
44903
44904-extern atomic_t fscache_n_stores;
44905-extern atomic_t fscache_n_stores_ok;
44906-extern atomic_t fscache_n_stores_again;
44907-extern atomic_t fscache_n_stores_nobufs;
44908-extern atomic_t fscache_n_stores_oom;
44909-extern atomic_t fscache_n_store_ops;
44910-extern atomic_t fscache_n_store_calls;
44911-extern atomic_t fscache_n_store_pages;
44912-extern atomic_t fscache_n_store_radix_deletes;
44913-extern atomic_t fscache_n_store_pages_over_limit;
44914+extern atomic_unchecked_t fscache_n_stores;
44915+extern atomic_unchecked_t fscache_n_stores_ok;
44916+extern atomic_unchecked_t fscache_n_stores_again;
44917+extern atomic_unchecked_t fscache_n_stores_nobufs;
44918+extern atomic_unchecked_t fscache_n_stores_oom;
44919+extern atomic_unchecked_t fscache_n_store_ops;
44920+extern atomic_unchecked_t fscache_n_store_calls;
44921+extern atomic_unchecked_t fscache_n_store_pages;
44922+extern atomic_unchecked_t fscache_n_store_radix_deletes;
44923+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
44924
44925-extern atomic_t fscache_n_store_vmscan_not_storing;
44926-extern atomic_t fscache_n_store_vmscan_gone;
44927-extern atomic_t fscache_n_store_vmscan_busy;
44928-extern atomic_t fscache_n_store_vmscan_cancelled;
44929+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
44930+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
44931+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
44932+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
44933
44934-extern atomic_t fscache_n_marks;
44935-extern atomic_t fscache_n_uncaches;
44936+extern atomic_unchecked_t fscache_n_marks;
44937+extern atomic_unchecked_t fscache_n_uncaches;
44938
44939-extern atomic_t fscache_n_acquires;
44940-extern atomic_t fscache_n_acquires_null;
44941-extern atomic_t fscache_n_acquires_no_cache;
44942-extern atomic_t fscache_n_acquires_ok;
44943-extern atomic_t fscache_n_acquires_nobufs;
44944-extern atomic_t fscache_n_acquires_oom;
44945+extern atomic_unchecked_t fscache_n_acquires;
44946+extern atomic_unchecked_t fscache_n_acquires_null;
44947+extern atomic_unchecked_t fscache_n_acquires_no_cache;
44948+extern atomic_unchecked_t fscache_n_acquires_ok;
44949+extern atomic_unchecked_t fscache_n_acquires_nobufs;
44950+extern atomic_unchecked_t fscache_n_acquires_oom;
44951
44952-extern atomic_t fscache_n_updates;
44953-extern atomic_t fscache_n_updates_null;
44954-extern atomic_t fscache_n_updates_run;
44955+extern atomic_unchecked_t fscache_n_updates;
44956+extern atomic_unchecked_t fscache_n_updates_null;
44957+extern atomic_unchecked_t fscache_n_updates_run;
44958
44959-extern atomic_t fscache_n_relinquishes;
44960-extern atomic_t fscache_n_relinquishes_null;
44961-extern atomic_t fscache_n_relinquishes_waitcrt;
44962-extern atomic_t fscache_n_relinquishes_retire;
44963+extern atomic_unchecked_t fscache_n_relinquishes;
44964+extern atomic_unchecked_t fscache_n_relinquishes_null;
44965+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
44966+extern atomic_unchecked_t fscache_n_relinquishes_retire;
44967
44968-extern atomic_t fscache_n_cookie_index;
44969-extern atomic_t fscache_n_cookie_data;
44970-extern atomic_t fscache_n_cookie_special;
44971+extern atomic_unchecked_t fscache_n_cookie_index;
44972+extern atomic_unchecked_t fscache_n_cookie_data;
44973+extern atomic_unchecked_t fscache_n_cookie_special;
44974
44975-extern atomic_t fscache_n_object_alloc;
44976-extern atomic_t fscache_n_object_no_alloc;
44977-extern atomic_t fscache_n_object_lookups;
44978-extern atomic_t fscache_n_object_lookups_negative;
44979-extern atomic_t fscache_n_object_lookups_positive;
44980-extern atomic_t fscache_n_object_lookups_timed_out;
44981-extern atomic_t fscache_n_object_created;
44982-extern atomic_t fscache_n_object_avail;
44983-extern atomic_t fscache_n_object_dead;
44984+extern atomic_unchecked_t fscache_n_object_alloc;
44985+extern atomic_unchecked_t fscache_n_object_no_alloc;
44986+extern atomic_unchecked_t fscache_n_object_lookups;
44987+extern atomic_unchecked_t fscache_n_object_lookups_negative;
44988+extern atomic_unchecked_t fscache_n_object_lookups_positive;
44989+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
44990+extern atomic_unchecked_t fscache_n_object_created;
44991+extern atomic_unchecked_t fscache_n_object_avail;
44992+extern atomic_unchecked_t fscache_n_object_dead;
44993
44994-extern atomic_t fscache_n_checkaux_none;
44995-extern atomic_t fscache_n_checkaux_okay;
44996-extern atomic_t fscache_n_checkaux_update;
44997-extern atomic_t fscache_n_checkaux_obsolete;
44998+extern atomic_unchecked_t fscache_n_checkaux_none;
44999+extern atomic_unchecked_t fscache_n_checkaux_okay;
45000+extern atomic_unchecked_t fscache_n_checkaux_update;
45001+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
45002
45003 extern atomic_t fscache_n_cop_alloc_object;
45004 extern atomic_t fscache_n_cop_lookup_object;
45005@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t *stat)
45006 atomic_inc(stat);
45007 }
45008
45009+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
45010+{
45011+ atomic_inc_unchecked(stat);
45012+}
45013+
45014 static inline void fscache_stat_d(atomic_t *stat)
45015 {
45016 atomic_dec(stat);
45017@@ -267,6 +272,7 @@ extern const struct file_operations fscache_stats_fops;
45018
45019 #define __fscache_stat(stat) (NULL)
45020 #define fscache_stat(stat) do {} while (0)
45021+#define fscache_stat_unchecked(stat) do {} while (0)
45022 #define fscache_stat_d(stat) do {} while (0)
45023 #endif
45024
45025diff --git a/fs/fscache/object.c b/fs/fscache/object.c
45026index b6b897c..0ffff9c 100644
45027--- a/fs/fscache/object.c
45028+++ b/fs/fscache/object.c
45029@@ -128,7 +128,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45030 /* update the object metadata on disk */
45031 case FSCACHE_OBJECT_UPDATING:
45032 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
45033- fscache_stat(&fscache_n_updates_run);
45034+ fscache_stat_unchecked(&fscache_n_updates_run);
45035 fscache_stat(&fscache_n_cop_update_object);
45036 object->cache->ops->update_object(object);
45037 fscache_stat_d(&fscache_n_cop_update_object);
45038@@ -217,7 +217,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45039 spin_lock(&object->lock);
45040 object->state = FSCACHE_OBJECT_DEAD;
45041 spin_unlock(&object->lock);
45042- fscache_stat(&fscache_n_object_dead);
45043+ fscache_stat_unchecked(&fscache_n_object_dead);
45044 goto terminal_transit;
45045
45046 /* handle the parent cache of this object being withdrawn from
45047@@ -232,7 +232,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45048 spin_lock(&object->lock);
45049 object->state = FSCACHE_OBJECT_DEAD;
45050 spin_unlock(&object->lock);
45051- fscache_stat(&fscache_n_object_dead);
45052+ fscache_stat_unchecked(&fscache_n_object_dead);
45053 goto terminal_transit;
45054
45055 /* complain about the object being woken up once it is
45056@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45057 parent->cookie->def->name, cookie->def->name,
45058 object->cache->tag->name);
45059
45060- fscache_stat(&fscache_n_object_lookups);
45061+ fscache_stat_unchecked(&fscache_n_object_lookups);
45062 fscache_stat(&fscache_n_cop_lookup_object);
45063 ret = object->cache->ops->lookup_object(object);
45064 fscache_stat_d(&fscache_n_cop_lookup_object);
45065@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45066 if (ret == -ETIMEDOUT) {
45067 /* probably stuck behind another object, so move this one to
45068 * the back of the queue */
45069- fscache_stat(&fscache_n_object_lookups_timed_out);
45070+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
45071 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45072 }
45073
45074@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
45075
45076 spin_lock(&object->lock);
45077 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45078- fscache_stat(&fscache_n_object_lookups_negative);
45079+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
45080
45081 /* transit here to allow write requests to begin stacking up
45082 * and read requests to begin returning ENODATA */
45083@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fscache_object *object)
45084 * result, in which case there may be data available */
45085 spin_lock(&object->lock);
45086 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45087- fscache_stat(&fscache_n_object_lookups_positive);
45088+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
45089
45090 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
45091
45092@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fscache_object *object)
45093 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45094 } else {
45095 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
45096- fscache_stat(&fscache_n_object_created);
45097+ fscache_stat_unchecked(&fscache_n_object_created);
45098
45099 object->state = FSCACHE_OBJECT_AVAILABLE;
45100 spin_unlock(&object->lock);
45101@@ -602,7 +602,7 @@ static void fscache_object_available(struct fscache_object *object)
45102 fscache_enqueue_dependents(object);
45103
45104 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
45105- fscache_stat(&fscache_n_object_avail);
45106+ fscache_stat_unchecked(&fscache_n_object_avail);
45107
45108 _leave("");
45109 }
45110@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45111 enum fscache_checkaux result;
45112
45113 if (!object->cookie->def->check_aux) {
45114- fscache_stat(&fscache_n_checkaux_none);
45115+ fscache_stat_unchecked(&fscache_n_checkaux_none);
45116 return FSCACHE_CHECKAUX_OKAY;
45117 }
45118
45119@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45120 switch (result) {
45121 /* entry okay as is */
45122 case FSCACHE_CHECKAUX_OKAY:
45123- fscache_stat(&fscache_n_checkaux_okay);
45124+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
45125 break;
45126
45127 /* entry requires update */
45128 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
45129- fscache_stat(&fscache_n_checkaux_update);
45130+ fscache_stat_unchecked(&fscache_n_checkaux_update);
45131 break;
45132
45133 /* entry requires deletion */
45134 case FSCACHE_CHECKAUX_OBSOLETE:
45135- fscache_stat(&fscache_n_checkaux_obsolete);
45136+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
45137 break;
45138
45139 default:
45140diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
45141index 30afdfa..2256596 100644
45142--- a/fs/fscache/operation.c
45143+++ b/fs/fscache/operation.c
45144@@ -17,7 +17,7 @@
45145 #include <linux/slab.h>
45146 #include "internal.h"
45147
45148-atomic_t fscache_op_debug_id;
45149+atomic_unchecked_t fscache_op_debug_id;
45150 EXPORT_SYMBOL(fscache_op_debug_id);
45151
45152 /**
45153@@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
45154 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
45155 ASSERTCMP(atomic_read(&op->usage), >, 0);
45156
45157- fscache_stat(&fscache_n_op_enqueue);
45158+ fscache_stat_unchecked(&fscache_n_op_enqueue);
45159 switch (op->flags & FSCACHE_OP_TYPE) {
45160 case FSCACHE_OP_ASYNC:
45161 _debug("queue async");
45162@@ -69,7 +69,7 @@ static void fscache_run_op(struct fscache_object *object,
45163 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
45164 if (op->processor)
45165 fscache_enqueue_operation(op);
45166- fscache_stat(&fscache_n_op_run);
45167+ fscache_stat_unchecked(&fscache_n_op_run);
45168 }
45169
45170 /*
45171@@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45172 if (object->n_ops > 1) {
45173 atomic_inc(&op->usage);
45174 list_add_tail(&op->pend_link, &object->pending_ops);
45175- fscache_stat(&fscache_n_op_pend);
45176+ fscache_stat_unchecked(&fscache_n_op_pend);
45177 } else if (!list_empty(&object->pending_ops)) {
45178 atomic_inc(&op->usage);
45179 list_add_tail(&op->pend_link, &object->pending_ops);
45180- fscache_stat(&fscache_n_op_pend);
45181+ fscache_stat_unchecked(&fscache_n_op_pend);
45182 fscache_start_operations(object);
45183 } else {
45184 ASSERTCMP(object->n_in_progress, ==, 0);
45185@@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45186 object->n_exclusive++; /* reads and writes must wait */
45187 atomic_inc(&op->usage);
45188 list_add_tail(&op->pend_link, &object->pending_ops);
45189- fscache_stat(&fscache_n_op_pend);
45190+ fscache_stat_unchecked(&fscache_n_op_pend);
45191 ret = 0;
45192 } else {
45193 /* not allowed to submit ops in any other state */
45194@@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_object *object,
45195 if (object->n_exclusive > 0) {
45196 atomic_inc(&op->usage);
45197 list_add_tail(&op->pend_link, &object->pending_ops);
45198- fscache_stat(&fscache_n_op_pend);
45199+ fscache_stat_unchecked(&fscache_n_op_pend);
45200 } else if (!list_empty(&object->pending_ops)) {
45201 atomic_inc(&op->usage);
45202 list_add_tail(&op->pend_link, &object->pending_ops);
45203- fscache_stat(&fscache_n_op_pend);
45204+ fscache_stat_unchecked(&fscache_n_op_pend);
45205 fscache_start_operations(object);
45206 } else {
45207 ASSERTCMP(object->n_exclusive, ==, 0);
45208@@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_object *object,
45209 object->n_ops++;
45210 atomic_inc(&op->usage);
45211 list_add_tail(&op->pend_link, &object->pending_ops);
45212- fscache_stat(&fscache_n_op_pend);
45213+ fscache_stat_unchecked(&fscache_n_op_pend);
45214 ret = 0;
45215 } else if (object->state == FSCACHE_OBJECT_DYING ||
45216 object->state == FSCACHE_OBJECT_LC_DYING ||
45217 object->state == FSCACHE_OBJECT_WITHDRAWING) {
45218- fscache_stat(&fscache_n_op_rejected);
45219+ fscache_stat_unchecked(&fscache_n_op_rejected);
45220 ret = -ENOBUFS;
45221 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
45222 fscache_report_unexpected_submission(object, op, ostate);
45223@@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_operation *op)
45224
45225 ret = -EBUSY;
45226 if (!list_empty(&op->pend_link)) {
45227- fscache_stat(&fscache_n_op_cancelled);
45228+ fscache_stat_unchecked(&fscache_n_op_cancelled);
45229 list_del_init(&op->pend_link);
45230 object->n_ops--;
45231 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
45232@@ -331,7 +331,7 @@ void fscache_put_operation(struct fscache_operation *op)
45233 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
45234 BUG();
45235
45236- fscache_stat(&fscache_n_op_release);
45237+ fscache_stat_unchecked(&fscache_n_op_release);
45238
45239 if (op->release) {
45240 op->release(op);
45241@@ -348,7 +348,7 @@ void fscache_put_operation(struct fscache_operation *op)
45242 * lock, and defer it otherwise */
45243 if (!spin_trylock(&object->lock)) {
45244 _debug("defer put");
45245- fscache_stat(&fscache_n_op_deferred_release);
45246+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
45247
45248 cache = object->cache;
45249 spin_lock(&cache->op_gc_list_lock);
45250@@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_struct *work)
45251
45252 _debug("GC DEFERRED REL OBJ%x OP%x",
45253 object->debug_id, op->debug_id);
45254- fscache_stat(&fscache_n_op_gc);
45255+ fscache_stat_unchecked(&fscache_n_op_gc);
45256
45257 ASSERTCMP(atomic_read(&op->usage), ==, 0);
45258
45259diff --git a/fs/fscache/page.c b/fs/fscache/page.c
45260index 3f7a59b..cf196cc 100644
45261--- a/fs/fscache/page.c
45262+++ b/fs/fscache/page.c
45263@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45264 val = radix_tree_lookup(&cookie->stores, page->index);
45265 if (!val) {
45266 rcu_read_unlock();
45267- fscache_stat(&fscache_n_store_vmscan_not_storing);
45268+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
45269 __fscache_uncache_page(cookie, page);
45270 return true;
45271 }
45272@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45273 spin_unlock(&cookie->stores_lock);
45274
45275 if (xpage) {
45276- fscache_stat(&fscache_n_store_vmscan_cancelled);
45277- fscache_stat(&fscache_n_store_radix_deletes);
45278+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
45279+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45280 ASSERTCMP(xpage, ==, page);
45281 } else {
45282- fscache_stat(&fscache_n_store_vmscan_gone);
45283+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
45284 }
45285
45286 wake_up_bit(&cookie->flags, 0);
45287@@ -107,7 +107,7 @@ page_busy:
45288 /* we might want to wait here, but that could deadlock the allocator as
45289 * the work threads writing to the cache may all end up sleeping
45290 * on memory allocation */
45291- fscache_stat(&fscache_n_store_vmscan_busy);
45292+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
45293 return false;
45294 }
45295 EXPORT_SYMBOL(__fscache_maybe_release_page);
45296@@ -131,7 +131,7 @@ static void fscache_end_page_write(struct fscache_object *object,
45297 FSCACHE_COOKIE_STORING_TAG);
45298 if (!radix_tree_tag_get(&cookie->stores, page->index,
45299 FSCACHE_COOKIE_PENDING_TAG)) {
45300- fscache_stat(&fscache_n_store_radix_deletes);
45301+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45302 xpage = radix_tree_delete(&cookie->stores, page->index);
45303 }
45304 spin_unlock(&cookie->stores_lock);
45305@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
45306
45307 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
45308
45309- fscache_stat(&fscache_n_attr_changed_calls);
45310+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
45311
45312 if (fscache_object_is_active(object)) {
45313 fscache_stat(&fscache_n_cop_attr_changed);
45314@@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45315
45316 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45317
45318- fscache_stat(&fscache_n_attr_changed);
45319+ fscache_stat_unchecked(&fscache_n_attr_changed);
45320
45321 op = kzalloc(sizeof(*op), GFP_KERNEL);
45322 if (!op) {
45323- fscache_stat(&fscache_n_attr_changed_nomem);
45324+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
45325 _leave(" = -ENOMEM");
45326 return -ENOMEM;
45327 }
45328@@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45329 if (fscache_submit_exclusive_op(object, op) < 0)
45330 goto nobufs;
45331 spin_unlock(&cookie->lock);
45332- fscache_stat(&fscache_n_attr_changed_ok);
45333+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
45334 fscache_put_operation(op);
45335 _leave(" = 0");
45336 return 0;
45337@@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45338 nobufs:
45339 spin_unlock(&cookie->lock);
45340 kfree(op);
45341- fscache_stat(&fscache_n_attr_changed_nobufs);
45342+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
45343 _leave(" = %d", -ENOBUFS);
45344 return -ENOBUFS;
45345 }
45346@@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
45347 /* allocate a retrieval operation and attempt to submit it */
45348 op = kzalloc(sizeof(*op), GFP_NOIO);
45349 if (!op) {
45350- fscache_stat(&fscache_n_retrievals_nomem);
45351+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45352 return NULL;
45353 }
45354
45355@@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45356 return 0;
45357 }
45358
45359- fscache_stat(&fscache_n_retrievals_wait);
45360+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
45361
45362 jif = jiffies;
45363 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
45364 fscache_wait_bit_interruptible,
45365 TASK_INTERRUPTIBLE) != 0) {
45366- fscache_stat(&fscache_n_retrievals_intr);
45367+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45368 _leave(" = -ERESTARTSYS");
45369 return -ERESTARTSYS;
45370 }
45371@@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45372 */
45373 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45374 struct fscache_retrieval *op,
45375- atomic_t *stat_op_waits,
45376- atomic_t *stat_object_dead)
45377+ atomic_unchecked_t *stat_op_waits,
45378+ atomic_unchecked_t *stat_object_dead)
45379 {
45380 int ret;
45381
45382@@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45383 goto check_if_dead;
45384
45385 _debug(">>> WT");
45386- fscache_stat(stat_op_waits);
45387+ fscache_stat_unchecked(stat_op_waits);
45388 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
45389 fscache_wait_bit_interruptible,
45390 TASK_INTERRUPTIBLE) < 0) {
45391@@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45392
45393 check_if_dead:
45394 if (unlikely(fscache_object_is_dead(object))) {
45395- fscache_stat(stat_object_dead);
45396+ fscache_stat_unchecked(stat_object_dead);
45397 return -ENOBUFS;
45398 }
45399 return 0;
45400@@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45401
45402 _enter("%p,%p,,,", cookie, page);
45403
45404- fscache_stat(&fscache_n_retrievals);
45405+ fscache_stat_unchecked(&fscache_n_retrievals);
45406
45407 if (hlist_empty(&cookie->backing_objects))
45408 goto nobufs;
45409@@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45410 goto nobufs_unlock;
45411 spin_unlock(&cookie->lock);
45412
45413- fscache_stat(&fscache_n_retrieval_ops);
45414+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45415
45416 /* pin the netfs read context in case we need to do the actual netfs
45417 * read because we've encountered a cache read failure */
45418@@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45419
45420 error:
45421 if (ret == -ENOMEM)
45422- fscache_stat(&fscache_n_retrievals_nomem);
45423+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45424 else if (ret == -ERESTARTSYS)
45425- fscache_stat(&fscache_n_retrievals_intr);
45426+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45427 else if (ret == -ENODATA)
45428- fscache_stat(&fscache_n_retrievals_nodata);
45429+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45430 else if (ret < 0)
45431- fscache_stat(&fscache_n_retrievals_nobufs);
45432+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45433 else
45434- fscache_stat(&fscache_n_retrievals_ok);
45435+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45436
45437 fscache_put_retrieval(op);
45438 _leave(" = %d", ret);
45439@@ -429,7 +429,7 @@ nobufs_unlock:
45440 spin_unlock(&cookie->lock);
45441 kfree(op);
45442 nobufs:
45443- fscache_stat(&fscache_n_retrievals_nobufs);
45444+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45445 _leave(" = -ENOBUFS");
45446 return -ENOBUFS;
45447 }
45448@@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45449
45450 _enter("%p,,%d,,,", cookie, *nr_pages);
45451
45452- fscache_stat(&fscache_n_retrievals);
45453+ fscache_stat_unchecked(&fscache_n_retrievals);
45454
45455 if (hlist_empty(&cookie->backing_objects))
45456 goto nobufs;
45457@@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45458 goto nobufs_unlock;
45459 spin_unlock(&cookie->lock);
45460
45461- fscache_stat(&fscache_n_retrieval_ops);
45462+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45463
45464 /* pin the netfs read context in case we need to do the actual netfs
45465 * read because we've encountered a cache read failure */
45466@@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45467
45468 error:
45469 if (ret == -ENOMEM)
45470- fscache_stat(&fscache_n_retrievals_nomem);
45471+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45472 else if (ret == -ERESTARTSYS)
45473- fscache_stat(&fscache_n_retrievals_intr);
45474+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45475 else if (ret == -ENODATA)
45476- fscache_stat(&fscache_n_retrievals_nodata);
45477+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45478 else if (ret < 0)
45479- fscache_stat(&fscache_n_retrievals_nobufs);
45480+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45481 else
45482- fscache_stat(&fscache_n_retrievals_ok);
45483+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45484
45485 fscache_put_retrieval(op);
45486 _leave(" = %d", ret);
45487@@ -545,7 +545,7 @@ nobufs_unlock:
45488 spin_unlock(&cookie->lock);
45489 kfree(op);
45490 nobufs:
45491- fscache_stat(&fscache_n_retrievals_nobufs);
45492+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45493 _leave(" = -ENOBUFS");
45494 return -ENOBUFS;
45495 }
45496@@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45497
45498 _enter("%p,%p,,,", cookie, page);
45499
45500- fscache_stat(&fscache_n_allocs);
45501+ fscache_stat_unchecked(&fscache_n_allocs);
45502
45503 if (hlist_empty(&cookie->backing_objects))
45504 goto nobufs;
45505@@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45506 goto nobufs_unlock;
45507 spin_unlock(&cookie->lock);
45508
45509- fscache_stat(&fscache_n_alloc_ops);
45510+ fscache_stat_unchecked(&fscache_n_alloc_ops);
45511
45512 ret = fscache_wait_for_retrieval_activation(
45513 object, op,
45514@@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45515
45516 error:
45517 if (ret == -ERESTARTSYS)
45518- fscache_stat(&fscache_n_allocs_intr);
45519+ fscache_stat_unchecked(&fscache_n_allocs_intr);
45520 else if (ret < 0)
45521- fscache_stat(&fscache_n_allocs_nobufs);
45522+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45523 else
45524- fscache_stat(&fscache_n_allocs_ok);
45525+ fscache_stat_unchecked(&fscache_n_allocs_ok);
45526
45527 fscache_put_retrieval(op);
45528 _leave(" = %d", ret);
45529@@ -625,7 +625,7 @@ nobufs_unlock:
45530 spin_unlock(&cookie->lock);
45531 kfree(op);
45532 nobufs:
45533- fscache_stat(&fscache_n_allocs_nobufs);
45534+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45535 _leave(" = -ENOBUFS");
45536 return -ENOBUFS;
45537 }
45538@@ -666,7 +666,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45539
45540 spin_lock(&cookie->stores_lock);
45541
45542- fscache_stat(&fscache_n_store_calls);
45543+ fscache_stat_unchecked(&fscache_n_store_calls);
45544
45545 /* find a page to store */
45546 page = NULL;
45547@@ -677,7 +677,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45548 page = results[0];
45549 _debug("gang %d [%lx]", n, page->index);
45550 if (page->index > op->store_limit) {
45551- fscache_stat(&fscache_n_store_pages_over_limit);
45552+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
45553 goto superseded;
45554 }
45555
45556@@ -689,7 +689,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45557 spin_unlock(&cookie->stores_lock);
45558 spin_unlock(&object->lock);
45559
45560- fscache_stat(&fscache_n_store_pages);
45561+ fscache_stat_unchecked(&fscache_n_store_pages);
45562 fscache_stat(&fscache_n_cop_write_page);
45563 ret = object->cache->ops->write_page(op, page);
45564 fscache_stat_d(&fscache_n_cop_write_page);
45565@@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45566 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45567 ASSERT(PageFsCache(page));
45568
45569- fscache_stat(&fscache_n_stores);
45570+ fscache_stat_unchecked(&fscache_n_stores);
45571
45572 op = kzalloc(sizeof(*op), GFP_NOIO);
45573 if (!op)
45574@@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45575 spin_unlock(&cookie->stores_lock);
45576 spin_unlock(&object->lock);
45577
45578- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
45579+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
45580 op->store_limit = object->store_limit;
45581
45582 if (fscache_submit_op(object, &op->op) < 0)
45583@@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45584
45585 spin_unlock(&cookie->lock);
45586 radix_tree_preload_end();
45587- fscache_stat(&fscache_n_store_ops);
45588- fscache_stat(&fscache_n_stores_ok);
45589+ fscache_stat_unchecked(&fscache_n_store_ops);
45590+ fscache_stat_unchecked(&fscache_n_stores_ok);
45591
45592 /* the work queue now carries its own ref on the object */
45593 fscache_put_operation(&op->op);
45594@@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45595 return 0;
45596
45597 already_queued:
45598- fscache_stat(&fscache_n_stores_again);
45599+ fscache_stat_unchecked(&fscache_n_stores_again);
45600 already_pending:
45601 spin_unlock(&cookie->stores_lock);
45602 spin_unlock(&object->lock);
45603 spin_unlock(&cookie->lock);
45604 radix_tree_preload_end();
45605 kfree(op);
45606- fscache_stat(&fscache_n_stores_ok);
45607+ fscache_stat_unchecked(&fscache_n_stores_ok);
45608 _leave(" = 0");
45609 return 0;
45610
45611@@ -851,14 +851,14 @@ nobufs:
45612 spin_unlock(&cookie->lock);
45613 radix_tree_preload_end();
45614 kfree(op);
45615- fscache_stat(&fscache_n_stores_nobufs);
45616+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
45617 _leave(" = -ENOBUFS");
45618 return -ENOBUFS;
45619
45620 nomem_free:
45621 kfree(op);
45622 nomem:
45623- fscache_stat(&fscache_n_stores_oom);
45624+ fscache_stat_unchecked(&fscache_n_stores_oom);
45625 _leave(" = -ENOMEM");
45626 return -ENOMEM;
45627 }
45628@@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
45629 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45630 ASSERTCMP(page, !=, NULL);
45631
45632- fscache_stat(&fscache_n_uncaches);
45633+ fscache_stat_unchecked(&fscache_n_uncaches);
45634
45635 /* cache withdrawal may beat us to it */
45636 if (!PageFsCache(page))
45637@@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
45638 unsigned long loop;
45639
45640 #ifdef CONFIG_FSCACHE_STATS
45641- atomic_add(pagevec->nr, &fscache_n_marks);
45642+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
45643 #endif
45644
45645 for (loop = 0; loop < pagevec->nr; loop++) {
45646diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
45647index 4765190..2a067f2 100644
45648--- a/fs/fscache/stats.c
45649+++ b/fs/fscache/stats.c
45650@@ -18,95 +18,95 @@
45651 /*
45652 * operation counters
45653 */
45654-atomic_t fscache_n_op_pend;
45655-atomic_t fscache_n_op_run;
45656-atomic_t fscache_n_op_enqueue;
45657-atomic_t fscache_n_op_requeue;
45658-atomic_t fscache_n_op_deferred_release;
45659-atomic_t fscache_n_op_release;
45660-atomic_t fscache_n_op_gc;
45661-atomic_t fscache_n_op_cancelled;
45662-atomic_t fscache_n_op_rejected;
45663+atomic_unchecked_t fscache_n_op_pend;
45664+atomic_unchecked_t fscache_n_op_run;
45665+atomic_unchecked_t fscache_n_op_enqueue;
45666+atomic_unchecked_t fscache_n_op_requeue;
45667+atomic_unchecked_t fscache_n_op_deferred_release;
45668+atomic_unchecked_t fscache_n_op_release;
45669+atomic_unchecked_t fscache_n_op_gc;
45670+atomic_unchecked_t fscache_n_op_cancelled;
45671+atomic_unchecked_t fscache_n_op_rejected;
45672
45673-atomic_t fscache_n_attr_changed;
45674-atomic_t fscache_n_attr_changed_ok;
45675-atomic_t fscache_n_attr_changed_nobufs;
45676-atomic_t fscache_n_attr_changed_nomem;
45677-atomic_t fscache_n_attr_changed_calls;
45678+atomic_unchecked_t fscache_n_attr_changed;
45679+atomic_unchecked_t fscache_n_attr_changed_ok;
45680+atomic_unchecked_t fscache_n_attr_changed_nobufs;
45681+atomic_unchecked_t fscache_n_attr_changed_nomem;
45682+atomic_unchecked_t fscache_n_attr_changed_calls;
45683
45684-atomic_t fscache_n_allocs;
45685-atomic_t fscache_n_allocs_ok;
45686-atomic_t fscache_n_allocs_wait;
45687-atomic_t fscache_n_allocs_nobufs;
45688-atomic_t fscache_n_allocs_intr;
45689-atomic_t fscache_n_allocs_object_dead;
45690-atomic_t fscache_n_alloc_ops;
45691-atomic_t fscache_n_alloc_op_waits;
45692+atomic_unchecked_t fscache_n_allocs;
45693+atomic_unchecked_t fscache_n_allocs_ok;
45694+atomic_unchecked_t fscache_n_allocs_wait;
45695+atomic_unchecked_t fscache_n_allocs_nobufs;
45696+atomic_unchecked_t fscache_n_allocs_intr;
45697+atomic_unchecked_t fscache_n_allocs_object_dead;
45698+atomic_unchecked_t fscache_n_alloc_ops;
45699+atomic_unchecked_t fscache_n_alloc_op_waits;
45700
45701-atomic_t fscache_n_retrievals;
45702-atomic_t fscache_n_retrievals_ok;
45703-atomic_t fscache_n_retrievals_wait;
45704-atomic_t fscache_n_retrievals_nodata;
45705-atomic_t fscache_n_retrievals_nobufs;
45706-atomic_t fscache_n_retrievals_intr;
45707-atomic_t fscache_n_retrievals_nomem;
45708-atomic_t fscache_n_retrievals_object_dead;
45709-atomic_t fscache_n_retrieval_ops;
45710-atomic_t fscache_n_retrieval_op_waits;
45711+atomic_unchecked_t fscache_n_retrievals;
45712+atomic_unchecked_t fscache_n_retrievals_ok;
45713+atomic_unchecked_t fscache_n_retrievals_wait;
45714+atomic_unchecked_t fscache_n_retrievals_nodata;
45715+atomic_unchecked_t fscache_n_retrievals_nobufs;
45716+atomic_unchecked_t fscache_n_retrievals_intr;
45717+atomic_unchecked_t fscache_n_retrievals_nomem;
45718+atomic_unchecked_t fscache_n_retrievals_object_dead;
45719+atomic_unchecked_t fscache_n_retrieval_ops;
45720+atomic_unchecked_t fscache_n_retrieval_op_waits;
45721
45722-atomic_t fscache_n_stores;
45723-atomic_t fscache_n_stores_ok;
45724-atomic_t fscache_n_stores_again;
45725-atomic_t fscache_n_stores_nobufs;
45726-atomic_t fscache_n_stores_oom;
45727-atomic_t fscache_n_store_ops;
45728-atomic_t fscache_n_store_calls;
45729-atomic_t fscache_n_store_pages;
45730-atomic_t fscache_n_store_radix_deletes;
45731-atomic_t fscache_n_store_pages_over_limit;
45732+atomic_unchecked_t fscache_n_stores;
45733+atomic_unchecked_t fscache_n_stores_ok;
45734+atomic_unchecked_t fscache_n_stores_again;
45735+atomic_unchecked_t fscache_n_stores_nobufs;
45736+atomic_unchecked_t fscache_n_stores_oom;
45737+atomic_unchecked_t fscache_n_store_ops;
45738+atomic_unchecked_t fscache_n_store_calls;
45739+atomic_unchecked_t fscache_n_store_pages;
45740+atomic_unchecked_t fscache_n_store_radix_deletes;
45741+atomic_unchecked_t fscache_n_store_pages_over_limit;
45742
45743-atomic_t fscache_n_store_vmscan_not_storing;
45744-atomic_t fscache_n_store_vmscan_gone;
45745-atomic_t fscache_n_store_vmscan_busy;
45746-atomic_t fscache_n_store_vmscan_cancelled;
45747+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45748+atomic_unchecked_t fscache_n_store_vmscan_gone;
45749+atomic_unchecked_t fscache_n_store_vmscan_busy;
45750+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45751
45752-atomic_t fscache_n_marks;
45753-atomic_t fscache_n_uncaches;
45754+atomic_unchecked_t fscache_n_marks;
45755+atomic_unchecked_t fscache_n_uncaches;
45756
45757-atomic_t fscache_n_acquires;
45758-atomic_t fscache_n_acquires_null;
45759-atomic_t fscache_n_acquires_no_cache;
45760-atomic_t fscache_n_acquires_ok;
45761-atomic_t fscache_n_acquires_nobufs;
45762-atomic_t fscache_n_acquires_oom;
45763+atomic_unchecked_t fscache_n_acquires;
45764+atomic_unchecked_t fscache_n_acquires_null;
45765+atomic_unchecked_t fscache_n_acquires_no_cache;
45766+atomic_unchecked_t fscache_n_acquires_ok;
45767+atomic_unchecked_t fscache_n_acquires_nobufs;
45768+atomic_unchecked_t fscache_n_acquires_oom;
45769
45770-atomic_t fscache_n_updates;
45771-atomic_t fscache_n_updates_null;
45772-atomic_t fscache_n_updates_run;
45773+atomic_unchecked_t fscache_n_updates;
45774+atomic_unchecked_t fscache_n_updates_null;
45775+atomic_unchecked_t fscache_n_updates_run;
45776
45777-atomic_t fscache_n_relinquishes;
45778-atomic_t fscache_n_relinquishes_null;
45779-atomic_t fscache_n_relinquishes_waitcrt;
45780-atomic_t fscache_n_relinquishes_retire;
45781+atomic_unchecked_t fscache_n_relinquishes;
45782+atomic_unchecked_t fscache_n_relinquishes_null;
45783+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45784+atomic_unchecked_t fscache_n_relinquishes_retire;
45785
45786-atomic_t fscache_n_cookie_index;
45787-atomic_t fscache_n_cookie_data;
45788-atomic_t fscache_n_cookie_special;
45789+atomic_unchecked_t fscache_n_cookie_index;
45790+atomic_unchecked_t fscache_n_cookie_data;
45791+atomic_unchecked_t fscache_n_cookie_special;
45792
45793-atomic_t fscache_n_object_alloc;
45794-atomic_t fscache_n_object_no_alloc;
45795-atomic_t fscache_n_object_lookups;
45796-atomic_t fscache_n_object_lookups_negative;
45797-atomic_t fscache_n_object_lookups_positive;
45798-atomic_t fscache_n_object_lookups_timed_out;
45799-atomic_t fscache_n_object_created;
45800-atomic_t fscache_n_object_avail;
45801-atomic_t fscache_n_object_dead;
45802+atomic_unchecked_t fscache_n_object_alloc;
45803+atomic_unchecked_t fscache_n_object_no_alloc;
45804+atomic_unchecked_t fscache_n_object_lookups;
45805+atomic_unchecked_t fscache_n_object_lookups_negative;
45806+atomic_unchecked_t fscache_n_object_lookups_positive;
45807+atomic_unchecked_t fscache_n_object_lookups_timed_out;
45808+atomic_unchecked_t fscache_n_object_created;
45809+atomic_unchecked_t fscache_n_object_avail;
45810+atomic_unchecked_t fscache_n_object_dead;
45811
45812-atomic_t fscache_n_checkaux_none;
45813-atomic_t fscache_n_checkaux_okay;
45814-atomic_t fscache_n_checkaux_update;
45815-atomic_t fscache_n_checkaux_obsolete;
45816+atomic_unchecked_t fscache_n_checkaux_none;
45817+atomic_unchecked_t fscache_n_checkaux_okay;
45818+atomic_unchecked_t fscache_n_checkaux_update;
45819+atomic_unchecked_t fscache_n_checkaux_obsolete;
45820
45821 atomic_t fscache_n_cop_alloc_object;
45822 atomic_t fscache_n_cop_lookup_object;
45823@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
45824 seq_puts(m, "FS-Cache statistics\n");
45825
45826 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
45827- atomic_read(&fscache_n_cookie_index),
45828- atomic_read(&fscache_n_cookie_data),
45829- atomic_read(&fscache_n_cookie_special));
45830+ atomic_read_unchecked(&fscache_n_cookie_index),
45831+ atomic_read_unchecked(&fscache_n_cookie_data),
45832+ atomic_read_unchecked(&fscache_n_cookie_special));
45833
45834 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
45835- atomic_read(&fscache_n_object_alloc),
45836- atomic_read(&fscache_n_object_no_alloc),
45837- atomic_read(&fscache_n_object_avail),
45838- atomic_read(&fscache_n_object_dead));
45839+ atomic_read_unchecked(&fscache_n_object_alloc),
45840+ atomic_read_unchecked(&fscache_n_object_no_alloc),
45841+ atomic_read_unchecked(&fscache_n_object_avail),
45842+ atomic_read_unchecked(&fscache_n_object_dead));
45843 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
45844- atomic_read(&fscache_n_checkaux_none),
45845- atomic_read(&fscache_n_checkaux_okay),
45846- atomic_read(&fscache_n_checkaux_update),
45847- atomic_read(&fscache_n_checkaux_obsolete));
45848+ atomic_read_unchecked(&fscache_n_checkaux_none),
45849+ atomic_read_unchecked(&fscache_n_checkaux_okay),
45850+ atomic_read_unchecked(&fscache_n_checkaux_update),
45851+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
45852
45853 seq_printf(m, "Pages : mrk=%u unc=%u\n",
45854- atomic_read(&fscache_n_marks),
45855- atomic_read(&fscache_n_uncaches));
45856+ atomic_read_unchecked(&fscache_n_marks),
45857+ atomic_read_unchecked(&fscache_n_uncaches));
45858
45859 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
45860 " oom=%u\n",
45861- atomic_read(&fscache_n_acquires),
45862- atomic_read(&fscache_n_acquires_null),
45863- atomic_read(&fscache_n_acquires_no_cache),
45864- atomic_read(&fscache_n_acquires_ok),
45865- atomic_read(&fscache_n_acquires_nobufs),
45866- atomic_read(&fscache_n_acquires_oom));
45867+ atomic_read_unchecked(&fscache_n_acquires),
45868+ atomic_read_unchecked(&fscache_n_acquires_null),
45869+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
45870+ atomic_read_unchecked(&fscache_n_acquires_ok),
45871+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
45872+ atomic_read_unchecked(&fscache_n_acquires_oom));
45873
45874 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
45875- atomic_read(&fscache_n_object_lookups),
45876- atomic_read(&fscache_n_object_lookups_negative),
45877- atomic_read(&fscache_n_object_lookups_positive),
45878- atomic_read(&fscache_n_object_created),
45879- atomic_read(&fscache_n_object_lookups_timed_out));
45880+ atomic_read_unchecked(&fscache_n_object_lookups),
45881+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
45882+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
45883+ atomic_read_unchecked(&fscache_n_object_created),
45884+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
45885
45886 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
45887- atomic_read(&fscache_n_updates),
45888- atomic_read(&fscache_n_updates_null),
45889- atomic_read(&fscache_n_updates_run));
45890+ atomic_read_unchecked(&fscache_n_updates),
45891+ atomic_read_unchecked(&fscache_n_updates_null),
45892+ atomic_read_unchecked(&fscache_n_updates_run));
45893
45894 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
45895- atomic_read(&fscache_n_relinquishes),
45896- atomic_read(&fscache_n_relinquishes_null),
45897- atomic_read(&fscache_n_relinquishes_waitcrt),
45898- atomic_read(&fscache_n_relinquishes_retire));
45899+ atomic_read_unchecked(&fscache_n_relinquishes),
45900+ atomic_read_unchecked(&fscache_n_relinquishes_null),
45901+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
45902+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
45903
45904 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
45905- atomic_read(&fscache_n_attr_changed),
45906- atomic_read(&fscache_n_attr_changed_ok),
45907- atomic_read(&fscache_n_attr_changed_nobufs),
45908- atomic_read(&fscache_n_attr_changed_nomem),
45909- atomic_read(&fscache_n_attr_changed_calls));
45910+ atomic_read_unchecked(&fscache_n_attr_changed),
45911+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
45912+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
45913+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
45914+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
45915
45916 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
45917- atomic_read(&fscache_n_allocs),
45918- atomic_read(&fscache_n_allocs_ok),
45919- atomic_read(&fscache_n_allocs_wait),
45920- atomic_read(&fscache_n_allocs_nobufs),
45921- atomic_read(&fscache_n_allocs_intr));
45922+ atomic_read_unchecked(&fscache_n_allocs),
45923+ atomic_read_unchecked(&fscache_n_allocs_ok),
45924+ atomic_read_unchecked(&fscache_n_allocs_wait),
45925+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
45926+ atomic_read_unchecked(&fscache_n_allocs_intr));
45927 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
45928- atomic_read(&fscache_n_alloc_ops),
45929- atomic_read(&fscache_n_alloc_op_waits),
45930- atomic_read(&fscache_n_allocs_object_dead));
45931+ atomic_read_unchecked(&fscache_n_alloc_ops),
45932+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
45933+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
45934
45935 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
45936 " int=%u oom=%u\n",
45937- atomic_read(&fscache_n_retrievals),
45938- atomic_read(&fscache_n_retrievals_ok),
45939- atomic_read(&fscache_n_retrievals_wait),
45940- atomic_read(&fscache_n_retrievals_nodata),
45941- atomic_read(&fscache_n_retrievals_nobufs),
45942- atomic_read(&fscache_n_retrievals_intr),
45943- atomic_read(&fscache_n_retrievals_nomem));
45944+ atomic_read_unchecked(&fscache_n_retrievals),
45945+ atomic_read_unchecked(&fscache_n_retrievals_ok),
45946+ atomic_read_unchecked(&fscache_n_retrievals_wait),
45947+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
45948+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
45949+ atomic_read_unchecked(&fscache_n_retrievals_intr),
45950+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
45951 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
45952- atomic_read(&fscache_n_retrieval_ops),
45953- atomic_read(&fscache_n_retrieval_op_waits),
45954- atomic_read(&fscache_n_retrievals_object_dead));
45955+ atomic_read_unchecked(&fscache_n_retrieval_ops),
45956+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
45957+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
45958
45959 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
45960- atomic_read(&fscache_n_stores),
45961- atomic_read(&fscache_n_stores_ok),
45962- atomic_read(&fscache_n_stores_again),
45963- atomic_read(&fscache_n_stores_nobufs),
45964- atomic_read(&fscache_n_stores_oom));
45965+ atomic_read_unchecked(&fscache_n_stores),
45966+ atomic_read_unchecked(&fscache_n_stores_ok),
45967+ atomic_read_unchecked(&fscache_n_stores_again),
45968+ atomic_read_unchecked(&fscache_n_stores_nobufs),
45969+ atomic_read_unchecked(&fscache_n_stores_oom));
45970 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
45971- atomic_read(&fscache_n_store_ops),
45972- atomic_read(&fscache_n_store_calls),
45973- atomic_read(&fscache_n_store_pages),
45974- atomic_read(&fscache_n_store_radix_deletes),
45975- atomic_read(&fscache_n_store_pages_over_limit));
45976+ atomic_read_unchecked(&fscache_n_store_ops),
45977+ atomic_read_unchecked(&fscache_n_store_calls),
45978+ atomic_read_unchecked(&fscache_n_store_pages),
45979+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
45980+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
45981
45982 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
45983- atomic_read(&fscache_n_store_vmscan_not_storing),
45984- atomic_read(&fscache_n_store_vmscan_gone),
45985- atomic_read(&fscache_n_store_vmscan_busy),
45986- atomic_read(&fscache_n_store_vmscan_cancelled));
45987+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
45988+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
45989+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
45990+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
45991
45992 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
45993- atomic_read(&fscache_n_op_pend),
45994- atomic_read(&fscache_n_op_run),
45995- atomic_read(&fscache_n_op_enqueue),
45996- atomic_read(&fscache_n_op_cancelled),
45997- atomic_read(&fscache_n_op_rejected));
45998+ atomic_read_unchecked(&fscache_n_op_pend),
45999+ atomic_read_unchecked(&fscache_n_op_run),
46000+ atomic_read_unchecked(&fscache_n_op_enqueue),
46001+ atomic_read_unchecked(&fscache_n_op_cancelled),
46002+ atomic_read_unchecked(&fscache_n_op_rejected));
46003 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
46004- atomic_read(&fscache_n_op_deferred_release),
46005- atomic_read(&fscache_n_op_release),
46006- atomic_read(&fscache_n_op_gc));
46007+ atomic_read_unchecked(&fscache_n_op_deferred_release),
46008+ atomic_read_unchecked(&fscache_n_op_release),
46009+ atomic_read_unchecked(&fscache_n_op_gc));
46010
46011 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
46012 atomic_read(&fscache_n_cop_alloc_object),
46013diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
46014index b6cca47..ec782c3 100644
46015--- a/fs/fuse/cuse.c
46016+++ b/fs/fuse/cuse.c
46017@@ -586,10 +586,12 @@ static int __init cuse_init(void)
46018 INIT_LIST_HEAD(&cuse_conntbl[i]);
46019
46020 /* inherit and extend fuse_dev_operations */
46021- cuse_channel_fops = fuse_dev_operations;
46022- cuse_channel_fops.owner = THIS_MODULE;
46023- cuse_channel_fops.open = cuse_channel_open;
46024- cuse_channel_fops.release = cuse_channel_release;
46025+ pax_open_kernel();
46026+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
46027+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
46028+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
46029+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
46030+ pax_close_kernel();
46031
46032 cuse_class = class_create(THIS_MODULE, "cuse");
46033 if (IS_ERR(cuse_class))
46034diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
46035index 2aaf3ea..8e50863 100644
46036--- a/fs/fuse/dev.c
46037+++ b/fs/fuse/dev.c
46038@@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
46039 ret = 0;
46040 pipe_lock(pipe);
46041
46042- if (!pipe->readers) {
46043+ if (!atomic_read(&pipe->readers)) {
46044 send_sig(SIGPIPE, current, 0);
46045 if (!ret)
46046 ret = -EPIPE;
46047diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
46048index 9f63e49..d8a64c0 100644
46049--- a/fs/fuse/dir.c
46050+++ b/fs/fuse/dir.c
46051@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *dentry)
46052 return link;
46053 }
46054
46055-static void free_link(char *link)
46056+static void free_link(const char *link)
46057 {
46058 if (!IS_ERR(link))
46059 free_page((unsigned long) link);
46060diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
46061index 900cf98..3896726 100644
46062--- a/fs/gfs2/inode.c
46063+++ b/fs/gfs2/inode.c
46064@@ -1517,7 +1517,7 @@ out:
46065
46066 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
46067 {
46068- char *s = nd_get_link(nd);
46069+ const char *s = nd_get_link(nd);
46070 if (!IS_ERR(s))
46071 kfree(s);
46072 }
46073diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
46074index 4dfbfec..947c9c2 100644
46075--- a/fs/hfsplus/catalog.c
46076+++ b/fs/hfsplus/catalog.c
46077@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
46078 int err;
46079 u16 type;
46080
46081+ pax_track_stack();
46082+
46083 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
46084 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
46085 if (err)
46086@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
46087 int entry_size;
46088 int err;
46089
46090+ pax_track_stack();
46091+
46092 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
46093 str->name, cnid, inode->i_nlink);
46094 err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
46095@@ -353,6 +357,8 @@ int hfsplus_rename_cat(u32 cnid,
46096 int entry_size, type;
46097 int err;
46098
46099+ pax_track_stack();
46100+
46101 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
46102 cnid, src_dir->i_ino, src_name->name,
46103 dst_dir->i_ino, dst_name->name);
46104diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
46105index 25b2443..09a3341 100644
46106--- a/fs/hfsplus/dir.c
46107+++ b/fs/hfsplus/dir.c
46108@@ -131,6 +131,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
46109 struct hfsplus_readdir_data *rd;
46110 u16 type;
46111
46112+ pax_track_stack();
46113+
46114 if (filp->f_pos >= inode->i_size)
46115 return 0;
46116
46117diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
46118index 4cc1e3a..ad0f70b 100644
46119--- a/fs/hfsplus/inode.c
46120+++ b/fs/hfsplus/inode.c
46121@@ -501,6 +501,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
46122 int res = 0;
46123 u16 type;
46124
46125+ pax_track_stack();
46126+
46127 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
46128
46129 HFSPLUS_I(inode)->linkid = 0;
46130@@ -564,6 +566,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
46131 struct hfs_find_data fd;
46132 hfsplus_cat_entry entry;
46133
46134+ pax_track_stack();
46135+
46136 if (HFSPLUS_IS_RSRC(inode))
46137 main_inode = HFSPLUS_I(inode)->rsrc_inode;
46138
46139diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
46140index fbaa669..c548cd0 100644
46141--- a/fs/hfsplus/ioctl.c
46142+++ b/fs/hfsplus/ioctl.c
46143@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
46144 struct hfsplus_cat_file *file;
46145 int res;
46146
46147+ pax_track_stack();
46148+
46149 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46150 return -EOPNOTSUPP;
46151
46152@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
46153 struct hfsplus_cat_file *file;
46154 ssize_t res = 0;
46155
46156+ pax_track_stack();
46157+
46158 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46159 return -EOPNOTSUPP;
46160
46161diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
46162index d24a9b6..dd9b3dd 100644
46163--- a/fs/hfsplus/super.c
46164+++ b/fs/hfsplus/super.c
46165@@ -347,6 +347,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
46166 u64 last_fs_block, last_fs_page;
46167 int err;
46168
46169+ pax_track_stack();
46170+
46171 err = -EINVAL;
46172 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
46173 if (!sbi)
46174diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
46175index ec88953..cb5e98e 100644
46176--- a/fs/hugetlbfs/inode.c
46177+++ b/fs/hugetlbfs/inode.c
46178@@ -915,7 +915,7 @@ static struct file_system_type hugetlbfs_fs_type = {
46179 .kill_sb = kill_litter_super,
46180 };
46181
46182-static struct vfsmount *hugetlbfs_vfsmount;
46183+struct vfsmount *hugetlbfs_vfsmount;
46184
46185 static int can_do_hugetlb_shm(void)
46186 {
46187diff --git a/fs/inode.c b/fs/inode.c
46188index ec79246..054c36a 100644
46189--- a/fs/inode.c
46190+++ b/fs/inode.c
46191@@ -787,8 +787,8 @@ unsigned int get_next_ino(void)
46192
46193 #ifdef CONFIG_SMP
46194 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
46195- static atomic_t shared_last_ino;
46196- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
46197+ static atomic_unchecked_t shared_last_ino;
46198+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
46199
46200 res = next - LAST_INO_BATCH;
46201 }
46202diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
46203index f94fc48..3bb8d30 100644
46204--- a/fs/jbd/checkpoint.c
46205+++ b/fs/jbd/checkpoint.c
46206@@ -358,6 +358,8 @@ int log_do_checkpoint(journal_t *journal)
46207 tid_t this_tid;
46208 int result;
46209
46210+ pax_track_stack();
46211+
46212 jbd_debug(1, "Start checkpoint\n");
46213
46214 /*
46215diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
46216index 16a5047..88ff6ca 100644
46217--- a/fs/jffs2/compr_rtime.c
46218+++ b/fs/jffs2/compr_rtime.c
46219@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
46220 int outpos = 0;
46221 int pos=0;
46222
46223+ pax_track_stack();
46224+
46225 memset(positions,0,sizeof(positions));
46226
46227 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
46228@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
46229 int outpos = 0;
46230 int pos=0;
46231
46232+ pax_track_stack();
46233+
46234 memset(positions,0,sizeof(positions));
46235
46236 while (outpos<destlen) {
46237diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
46238index 9e7cec8..4713089 100644
46239--- a/fs/jffs2/compr_rubin.c
46240+++ b/fs/jffs2/compr_rubin.c
46241@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
46242 int ret;
46243 uint32_t mysrclen, mydstlen;
46244
46245+ pax_track_stack();
46246+
46247 mysrclen = *sourcelen;
46248 mydstlen = *dstlen - 8;
46249
46250diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
46251index e513f19..2ab1351 100644
46252--- a/fs/jffs2/erase.c
46253+++ b/fs/jffs2/erase.c
46254@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
46255 struct jffs2_unknown_node marker = {
46256 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
46257 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46258- .totlen = cpu_to_je32(c->cleanmarker_size)
46259+ .totlen = cpu_to_je32(c->cleanmarker_size),
46260+ .hdr_crc = cpu_to_je32(0)
46261 };
46262
46263 jffs2_prealloc_raw_node_refs(c, jeb, 1);
46264diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
46265index 4515bea..178f2d6 100644
46266--- a/fs/jffs2/wbuf.c
46267+++ b/fs/jffs2/wbuf.c
46268@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
46269 {
46270 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
46271 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46272- .totlen = constant_cpu_to_je32(8)
46273+ .totlen = constant_cpu_to_je32(8),
46274+ .hdr_crc = constant_cpu_to_je32(0)
46275 };
46276
46277 /*
46278diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
46279index 3e93cdd..c8a80e1 100644
46280--- a/fs/jffs2/xattr.c
46281+++ b/fs/jffs2/xattr.c
46282@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
46283
46284 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
46285
46286+ pax_track_stack();
46287+
46288 /* Phase.1 : Merge same xref */
46289 for (i=0; i < XREF_TMPHASH_SIZE; i++)
46290 xref_tmphash[i] = NULL;
46291diff --git a/fs/jfs/super.c b/fs/jfs/super.c
46292index 06c8a67..589dbbd 100644
46293--- a/fs/jfs/super.c
46294+++ b/fs/jfs/super.c
46295@@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
46296
46297 jfs_inode_cachep =
46298 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
46299- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
46300+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
46301 init_once);
46302 if (jfs_inode_cachep == NULL)
46303 return -ENOMEM;
46304diff --git a/fs/libfs.c b/fs/libfs.c
46305index c18e9a1..0b04e2c 100644
46306--- a/fs/libfs.c
46307+++ b/fs/libfs.c
46308@@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46309
46310 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
46311 struct dentry *next;
46312+ char d_name[sizeof(next->d_iname)];
46313+ const unsigned char *name;
46314+
46315 next = list_entry(p, struct dentry, d_u.d_child);
46316 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
46317 if (!simple_positive(next)) {
46318@@ -174,7 +177,12 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46319
46320 spin_unlock(&next->d_lock);
46321 spin_unlock(&dentry->d_lock);
46322- if (filldir(dirent, next->d_name.name,
46323+ name = next->d_name.name;
46324+ if (name == next->d_iname) {
46325+ memcpy(d_name, name, next->d_name.len);
46326+ name = d_name;
46327+ }
46328+ if (filldir(dirent, name,
46329 next->d_name.len, filp->f_pos,
46330 next->d_inode->i_ino,
46331 dt_type(next->d_inode)) < 0)
46332diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
46333index 8392cb8..ae8ed40 100644
46334--- a/fs/lockd/clntproc.c
46335+++ b/fs/lockd/clntproc.c
46336@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
46337 /*
46338 * Cookie counter for NLM requests
46339 */
46340-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
46341+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
46342
46343 void nlmclnt_next_cookie(struct nlm_cookie *c)
46344 {
46345- u32 cookie = atomic_inc_return(&nlm_cookie);
46346+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
46347
46348 memcpy(c->data, &cookie, 4);
46349 c->len=4;
46350@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
46351 struct nlm_rqst reqst, *req;
46352 int status;
46353
46354+ pax_track_stack();
46355+
46356 req = &reqst;
46357 memset(req, 0, sizeof(*req));
46358 locks_init_lock(&req->a_args.lock.fl);
46359diff --git a/fs/locks.c b/fs/locks.c
46360index 703f545..150a552 100644
46361--- a/fs/locks.c
46362+++ b/fs/locks.c
46363@@ -2022,16 +2022,16 @@ void locks_remove_flock(struct file *filp)
46364 return;
46365
46366 if (filp->f_op && filp->f_op->flock) {
46367- struct file_lock fl = {
46368+ struct file_lock flock = {
46369 .fl_pid = current->tgid,
46370 .fl_file = filp,
46371 .fl_flags = FL_FLOCK,
46372 .fl_type = F_UNLCK,
46373 .fl_end = OFFSET_MAX,
46374 };
46375- filp->f_op->flock(filp, F_SETLKW, &fl);
46376- if (fl.fl_ops && fl.fl_ops->fl_release_private)
46377- fl.fl_ops->fl_release_private(&fl);
46378+ filp->f_op->flock(filp, F_SETLKW, &flock);
46379+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
46380+ flock.fl_ops->fl_release_private(&flock);
46381 }
46382
46383 lock_flocks();
46384diff --git a/fs/logfs/super.c b/fs/logfs/super.c
46385index ce03a18..ac8c14f 100644
46386--- a/fs/logfs/super.c
46387+++ b/fs/logfs/super.c
46388@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super_block *sb)
46389 struct logfs_disk_super _ds1, *ds1 = &_ds1;
46390 int err, valid0, valid1;
46391
46392+ pax_track_stack();
46393+
46394 /* read first superblock */
46395 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
46396 if (err)
46397diff --git a/fs/minix/bitmap.c b/fs/minix/bitmap.c
46398index 3f32bcb..7c82c29 100644
46399--- a/fs/minix/bitmap.c
46400+++ b/fs/minix/bitmap.c
46401@@ -20,10 +20,11 @@ static const int nibblemap[] = { 4,3,3,2,3,2,2,1,3,2,2,1,2,1,1,0 };
46402
46403 static DEFINE_SPINLOCK(bitmap_lock);
46404
46405-static unsigned long count_free(struct buffer_head *map[], unsigned numblocks, __u32 numbits)
46406+static unsigned long count_free(struct buffer_head *map[], unsigned blocksize, __u32 numbits)
46407 {
46408 unsigned i, j, sum = 0;
46409 struct buffer_head *bh;
46410+ unsigned numblocks = minix_blocks_needed(numbits, blocksize);
46411
46412 for (i=0; i<numblocks-1; i++) {
46413 if (!(bh=map[i]))
46414@@ -105,10 +106,12 @@ int minix_new_block(struct inode * inode)
46415 return 0;
46416 }
46417
46418-unsigned long minix_count_free_blocks(struct minix_sb_info *sbi)
46419+unsigned long minix_count_free_blocks(struct super_block *sb)
46420 {
46421- return (count_free(sbi->s_zmap, sbi->s_zmap_blocks,
46422- sbi->s_nzones - sbi->s_firstdatazone + 1)
46423+ struct minix_sb_info *sbi = minix_sb(sb);
46424+ u32 bits = sbi->s_nzones - (sbi->s_firstdatazone + 1);
46425+
46426+ return (count_free(sbi->s_zmap, sb->s_blocksize, bits)
46427 << sbi->s_log_zone_size);
46428 }
46429
46430@@ -273,7 +276,10 @@ struct inode *minix_new_inode(const struct inode *dir, int mode, int *error)
46431 return inode;
46432 }
46433
46434-unsigned long minix_count_free_inodes(struct minix_sb_info *sbi)
46435+unsigned long minix_count_free_inodes(struct super_block *sb)
46436 {
46437- return count_free(sbi->s_imap, sbi->s_imap_blocks, sbi->s_ninodes + 1);
46438+ struct minix_sb_info *sbi = minix_sb(sb);
46439+ u32 bits = sbi->s_ninodes + 1;
46440+
46441+ return count_free(sbi->s_imap, sb->s_blocksize, bits);
46442 }
46443diff --git a/fs/minix/inode.c b/fs/minix/inode.c
46444index e7d23e2..1ed1351 100644
46445--- a/fs/minix/inode.c
46446+++ b/fs/minix/inode.c
46447@@ -279,6 +279,27 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
46448 else if (sbi->s_mount_state & MINIX_ERROR_FS)
46449 printk("MINIX-fs: mounting file system with errors, "
46450 "running fsck is recommended\n");
46451+
46452+ /* Apparently minix can create filesystems that allocate more blocks for
46453+ * the bitmaps than needed. We simply ignore that, but verify it didn't
46454+ * create one with not enough blocks and bail out if so.
46455+ */
46456+ block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
46457+ if (sbi->s_imap_blocks < block) {
46458+ printk("MINIX-fs: file system does not have enough "
46459+ "imap blocks allocated. Refusing to mount\n");
46460+ goto out_iput;
46461+ }
46462+
46463+ block = minix_blocks_needed(
46464+ (sbi->s_nzones - (sbi->s_firstdatazone + 1)),
46465+ s->s_blocksize);
46466+ if (sbi->s_zmap_blocks < block) {
46467+ printk("MINIX-fs: file system does not have enough "
46468+ "zmap blocks allocated. Refusing to mount.\n");
46469+ goto out_iput;
46470+ }
46471+
46472 return 0;
46473
46474 out_iput:
46475@@ -339,10 +360,10 @@ static int minix_statfs(struct dentry *dentry, struct kstatfs *buf)
46476 buf->f_type = sb->s_magic;
46477 buf->f_bsize = sb->s_blocksize;
46478 buf->f_blocks = (sbi->s_nzones - sbi->s_firstdatazone) << sbi->s_log_zone_size;
46479- buf->f_bfree = minix_count_free_blocks(sbi);
46480+ buf->f_bfree = minix_count_free_blocks(sb);
46481 buf->f_bavail = buf->f_bfree;
46482 buf->f_files = sbi->s_ninodes;
46483- buf->f_ffree = minix_count_free_inodes(sbi);
46484+ buf->f_ffree = minix_count_free_inodes(sb);
46485 buf->f_namelen = sbi->s_namelen;
46486 buf->f_fsid.val[0] = (u32)id;
46487 buf->f_fsid.val[1] = (u32)(id >> 32);
46488diff --git a/fs/minix/minix.h b/fs/minix/minix.h
46489index 341e212..6415fe0 100644
46490--- a/fs/minix/minix.h
46491+++ b/fs/minix/minix.h
46492@@ -48,10 +48,10 @@ extern struct minix_inode * minix_V1_raw_inode(struct super_block *, ino_t, stru
46493 extern struct minix2_inode * minix_V2_raw_inode(struct super_block *, ino_t, struct buffer_head **);
46494 extern struct inode * minix_new_inode(const struct inode *, int, int *);
46495 extern void minix_free_inode(struct inode * inode);
46496-extern unsigned long minix_count_free_inodes(struct minix_sb_info *sbi);
46497+extern unsigned long minix_count_free_inodes(struct super_block *sb);
46498 extern int minix_new_block(struct inode * inode);
46499 extern void minix_free_block(struct inode *inode, unsigned long block);
46500-extern unsigned long minix_count_free_blocks(struct minix_sb_info *sbi);
46501+extern unsigned long minix_count_free_blocks(struct super_block *sb);
46502 extern int minix_getattr(struct vfsmount *, struct dentry *, struct kstat *);
46503 extern int minix_prepare_chunk(struct page *page, loff_t pos, unsigned len);
46504
46505@@ -88,6 +88,11 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)
46506 return list_entry(inode, struct minix_inode_info, vfs_inode);
46507 }
46508
46509+static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
46510+{
46511+ return DIV_ROUND_UP(bits, blocksize * 8);
46512+}
46513+
46514 #if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
46515 defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
46516
46517diff --git a/fs/namei.c b/fs/namei.c
46518index 3d15072..c1ddf9c 100644
46519--- a/fs/namei.c
46520+++ b/fs/namei.c
46521@@ -281,16 +281,32 @@ int generic_permission(struct inode *inode, int mask)
46522 if (ret != -EACCES)
46523 return ret;
46524
46525+#ifdef CONFIG_GRKERNSEC
46526+ /* we'll block if we have to log due to a denied capability use */
46527+ if (mask & MAY_NOT_BLOCK)
46528+ return -ECHILD;
46529+#endif
46530+
46531 if (S_ISDIR(inode->i_mode)) {
46532 /* DACs are overridable for directories */
46533- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46534- return 0;
46535 if (!(mask & MAY_WRITE))
46536- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46537+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46538+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46539 return 0;
46540+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46541+ return 0;
46542 return -EACCES;
46543 }
46544 /*
46545+ * Searching includes executable on directories, else just read.
46546+ */
46547+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46548+ if (mask == MAY_READ)
46549+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46550+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46551+ return 0;
46552+
46553+ /*
46554 * Read/write DACs are always overridable.
46555 * Executable DACs are overridable when there is
46556 * at least one exec bit set.
46557@@ -299,14 +315,6 @@ int generic_permission(struct inode *inode, int mask)
46558 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46559 return 0;
46560
46561- /*
46562- * Searching includes executable on directories, else just read.
46563- */
46564- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46565- if (mask == MAY_READ)
46566- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46567- return 0;
46568-
46569 return -EACCES;
46570 }
46571
46572@@ -653,11 +661,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
46573 return error;
46574 }
46575
46576+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
46577+ dentry->d_inode, dentry, nd->path.mnt)) {
46578+ error = -EACCES;
46579+ *p = ERR_PTR(error); /* no ->put_link(), please */
46580+ path_put(&nd->path);
46581+ return error;
46582+ }
46583+
46584 nd->last_type = LAST_BIND;
46585 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
46586 error = PTR_ERR(*p);
46587 if (!IS_ERR(*p)) {
46588- char *s = nd_get_link(nd);
46589+ const char *s = nd_get_link(nd);
46590 error = 0;
46591 if (s)
46592 error = __vfs_follow_link(nd, s);
46593@@ -1622,6 +1638,21 @@ static int path_lookupat(int dfd, const char *name,
46594 if (!err)
46595 err = complete_walk(nd);
46596
46597+ if (!(nd->flags & LOOKUP_PARENT)) {
46598+#ifdef CONFIG_GRKERNSEC
46599+ if (flags & LOOKUP_RCU) {
46600+ if (!err)
46601+ path_put(&nd->path);
46602+ err = -ECHILD;
46603+ } else
46604+#endif
46605+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46606+ if (!err)
46607+ path_put(&nd->path);
46608+ err = -ENOENT;
46609+ }
46610+ }
46611+
46612 if (!err && nd->flags & LOOKUP_DIRECTORY) {
46613 if (!nd->inode->i_op->lookup) {
46614 path_put(&nd->path);
46615@@ -1649,6 +1680,15 @@ static int do_path_lookup(int dfd, const char *name,
46616 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
46617
46618 if (likely(!retval)) {
46619+ if (*name != '/' && nd->path.dentry && nd->inode) {
46620+#ifdef CONFIG_GRKERNSEC
46621+ if (flags & LOOKUP_RCU)
46622+ return -ECHILD;
46623+#endif
46624+ if (!gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
46625+ return -ENOENT;
46626+ }
46627+
46628 if (unlikely(!audit_dummy_context())) {
46629 if (nd->path.dentry && nd->inode)
46630 audit_inode(name, nd->path.dentry);
46631@@ -2049,7 +2089,27 @@ static int may_open(struct path *path, int acc_mode, int flag)
46632 /*
46633 * Ensure there are no outstanding leases on the file.
46634 */
46635- return break_lease(inode, flag);
46636+ error = break_lease(inode, flag);
46637+
46638+ if (error)
46639+ return error;
46640+
46641+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
46642+ error = -EPERM;
46643+ goto exit;
46644+ }
46645+
46646+ if (gr_handle_rawio(inode)) {
46647+ error = -EPERM;
46648+ goto exit;
46649+ }
46650+
46651+ if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
46652+ error = -EACCES;
46653+ goto exit;
46654+ }
46655+exit:
46656+ return error;
46657 }
46658
46659 static int handle_truncate(struct file *filp)
46660@@ -2110,6 +2170,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46661 error = complete_walk(nd);
46662 if (error)
46663 return ERR_PTR(error);
46664+#ifdef CONFIG_GRKERNSEC
46665+ if (nd->flags & LOOKUP_RCU) {
46666+ error = -ECHILD;
46667+ goto exit;
46668+ }
46669+#endif
46670+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46671+ error = -ENOENT;
46672+ goto exit;
46673+ }
46674 audit_inode(pathname, nd->path.dentry);
46675 if (open_flag & O_CREAT) {
46676 error = -EISDIR;
46677@@ -2120,6 +2190,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46678 error = complete_walk(nd);
46679 if (error)
46680 return ERR_PTR(error);
46681+#ifdef CONFIG_GRKERNSEC
46682+ if (nd->flags & LOOKUP_RCU) {
46683+ error = -ECHILD;
46684+ goto exit;
46685+ }
46686+#endif
46687+ if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
46688+ error = -ENOENT;
46689+ goto exit;
46690+ }
46691 audit_inode(pathname, dir);
46692 goto ok;
46693 }
46694@@ -2141,6 +2221,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46695 error = complete_walk(nd);
46696 if (error)
46697 return ERR_PTR(-ECHILD);
46698+#ifdef CONFIG_GRKERNSEC
46699+ if (nd->flags & LOOKUP_RCU) {
46700+ error = -ECHILD;
46701+ goto exit;
46702+ }
46703+#endif
46704+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46705+ error = -ENOENT;
46706+ goto exit;
46707+ }
46708
46709 error = -ENOTDIR;
46710 if (nd->flags & LOOKUP_DIRECTORY) {
46711@@ -2181,6 +2271,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46712 /* Negative dentry, just create the file */
46713 if (!dentry->d_inode) {
46714 int mode = op->mode;
46715+
46716+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, open_flag, acc_mode, mode)) {
46717+ error = -EACCES;
46718+ goto exit_mutex_unlock;
46719+ }
46720+
46721 if (!IS_POSIXACL(dir->d_inode))
46722 mode &= ~current_umask();
46723 /*
46724@@ -2204,6 +2300,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46725 error = vfs_create(dir->d_inode, dentry, mode, nd);
46726 if (error)
46727 goto exit_mutex_unlock;
46728+ else
46729+ gr_handle_create(path->dentry, path->mnt);
46730 mutex_unlock(&dir->d_inode->i_mutex);
46731 dput(nd->path.dentry);
46732 nd->path.dentry = dentry;
46733@@ -2213,6 +2311,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46734 /*
46735 * It already exists.
46736 */
46737+
46738+ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
46739+ error = -ENOENT;
46740+ goto exit_mutex_unlock;
46741+ }
46742+
46743+ /* only check if O_CREAT is specified, all other checks need to go
46744+ into may_open */
46745+ if (gr_handle_fifo(path->dentry, path->mnt, dir, open_flag, acc_mode)) {
46746+ error = -EACCES;
46747+ goto exit_mutex_unlock;
46748+ }
46749+
46750 mutex_unlock(&dir->d_inode->i_mutex);
46751 audit_inode(pathname, path->dentry);
46752
46753@@ -2425,6 +2536,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
46754 *path = nd.path;
46755 return dentry;
46756 eexist:
46757+ if (!gr_acl_handle_hidden_file(dentry, nd.path.mnt)) {
46758+ dput(dentry);
46759+ dentry = ERR_PTR(-ENOENT);
46760+ goto fail;
46761+ }
46762 dput(dentry);
46763 dentry = ERR_PTR(-EEXIST);
46764 fail:
46765@@ -2447,6 +2563,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
46766 }
46767 EXPORT_SYMBOL(user_path_create);
46768
46769+static struct dentry *user_path_create_with_name(int dfd, const char __user *pathname, struct path *path, char **to, int is_dir)
46770+{
46771+ char *tmp = getname(pathname);
46772+ struct dentry *res;
46773+ if (IS_ERR(tmp))
46774+ return ERR_CAST(tmp);
46775+ res = kern_path_create(dfd, tmp, path, is_dir);
46776+ if (IS_ERR(res))
46777+ putname(tmp);
46778+ else
46779+ *to = tmp;
46780+ return res;
46781+}
46782+
46783 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
46784 {
46785 int error = may_create(dir, dentry);
46786@@ -2514,6 +2644,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
46787 error = mnt_want_write(path.mnt);
46788 if (error)
46789 goto out_dput;
46790+
46791+ if (gr_handle_chroot_mknod(dentry, path.mnt, mode)) {
46792+ error = -EPERM;
46793+ goto out_drop_write;
46794+ }
46795+
46796+ if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
46797+ error = -EACCES;
46798+ goto out_drop_write;
46799+ }
46800+
46801 error = security_path_mknod(&path, dentry, mode, dev);
46802 if (error)
46803 goto out_drop_write;
46804@@ -2531,6 +2672,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
46805 }
46806 out_drop_write:
46807 mnt_drop_write(path.mnt);
46808+
46809+ if (!error)
46810+ gr_handle_create(dentry, path.mnt);
46811 out_dput:
46812 dput(dentry);
46813 mutex_unlock(&path.dentry->d_inode->i_mutex);
46814@@ -2580,12 +2724,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
46815 error = mnt_want_write(path.mnt);
46816 if (error)
46817 goto out_dput;
46818+
46819+ if (!gr_acl_handle_mkdir(dentry, path.dentry, path.mnt)) {
46820+ error = -EACCES;
46821+ goto out_drop_write;
46822+ }
46823+
46824 error = security_path_mkdir(&path, dentry, mode);
46825 if (error)
46826 goto out_drop_write;
46827 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
46828 out_drop_write:
46829 mnt_drop_write(path.mnt);
46830+
46831+ if (!error)
46832+ gr_handle_create(dentry, path.mnt);
46833 out_dput:
46834 dput(dentry);
46835 mutex_unlock(&path.dentry->d_inode->i_mutex);
46836@@ -2665,6 +2818,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
46837 char * name;
46838 struct dentry *dentry;
46839 struct nameidata nd;
46840+ ino_t saved_ino = 0;
46841+ dev_t saved_dev = 0;
46842
46843 error = user_path_parent(dfd, pathname, &nd, &name);
46844 if (error)
46845@@ -2693,6 +2848,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
46846 error = -ENOENT;
46847 goto exit3;
46848 }
46849+
46850+ saved_ino = dentry->d_inode->i_ino;
46851+ saved_dev = gr_get_dev_from_dentry(dentry);
46852+
46853+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
46854+ error = -EACCES;
46855+ goto exit3;
46856+ }
46857+
46858 error = mnt_want_write(nd.path.mnt);
46859 if (error)
46860 goto exit3;
46861@@ -2700,6 +2864,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
46862 if (error)
46863 goto exit4;
46864 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
46865+ if (!error && (saved_dev || saved_ino))
46866+ gr_handle_delete(saved_ino, saved_dev);
46867 exit4:
46868 mnt_drop_write(nd.path.mnt);
46869 exit3:
46870@@ -2762,6 +2928,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46871 struct dentry *dentry;
46872 struct nameidata nd;
46873 struct inode *inode = NULL;
46874+ ino_t saved_ino = 0;
46875+ dev_t saved_dev = 0;
46876
46877 error = user_path_parent(dfd, pathname, &nd, &name);
46878 if (error)
46879@@ -2784,6 +2952,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46880 if (!inode)
46881 goto slashes;
46882 ihold(inode);
46883+
46884+ if (inode->i_nlink <= 1) {
46885+ saved_ino = inode->i_ino;
46886+ saved_dev = gr_get_dev_from_dentry(dentry);
46887+ }
46888+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
46889+ error = -EACCES;
46890+ goto exit2;
46891+ }
46892+
46893 error = mnt_want_write(nd.path.mnt);
46894 if (error)
46895 goto exit2;
46896@@ -2791,6 +2969,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46897 if (error)
46898 goto exit3;
46899 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
46900+ if (!error && (saved_ino || saved_dev))
46901+ gr_handle_delete(saved_ino, saved_dev);
46902 exit3:
46903 mnt_drop_write(nd.path.mnt);
46904 exit2:
46905@@ -2866,10 +3046,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
46906 error = mnt_want_write(path.mnt);
46907 if (error)
46908 goto out_dput;
46909+
46910+ if (!gr_acl_handle_symlink(dentry, path.dentry, path.mnt, from)) {
46911+ error = -EACCES;
46912+ goto out_drop_write;
46913+ }
46914+
46915 error = security_path_symlink(&path, dentry, from);
46916 if (error)
46917 goto out_drop_write;
46918 error = vfs_symlink(path.dentry->d_inode, dentry, from);
46919+ if (!error)
46920+ gr_handle_create(dentry, path.mnt);
46921 out_drop_write:
46922 mnt_drop_write(path.mnt);
46923 out_dput:
46924@@ -2941,6 +3129,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46925 {
46926 struct dentry *new_dentry;
46927 struct path old_path, new_path;
46928+ char *to = NULL;
46929 int how = 0;
46930 int error;
46931
46932@@ -2964,7 +3153,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46933 if (error)
46934 return error;
46935
46936- new_dentry = user_path_create(newdfd, newname, &new_path, 0);
46937+ new_dentry = user_path_create_with_name(newdfd, newname, &new_path, &to, 0);
46938 error = PTR_ERR(new_dentry);
46939 if (IS_ERR(new_dentry))
46940 goto out;
46941@@ -2975,13 +3164,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46942 error = mnt_want_write(new_path.mnt);
46943 if (error)
46944 goto out_dput;
46945+
46946+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
46947+ old_path.dentry->d_inode,
46948+ old_path.dentry->d_inode->i_mode, to)) {
46949+ error = -EACCES;
46950+ goto out_drop_write;
46951+ }
46952+
46953+ if (!gr_acl_handle_link(new_dentry, new_path.dentry, new_path.mnt,
46954+ old_path.dentry, old_path.mnt, to)) {
46955+ error = -EACCES;
46956+ goto out_drop_write;
46957+ }
46958+
46959 error = security_path_link(old_path.dentry, &new_path, new_dentry);
46960 if (error)
46961 goto out_drop_write;
46962 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
46963+ if (!error)
46964+ gr_handle_create(new_dentry, new_path.mnt);
46965 out_drop_write:
46966 mnt_drop_write(new_path.mnt);
46967 out_dput:
46968+ putname(to);
46969 dput(new_dentry);
46970 mutex_unlock(&new_path.dentry->d_inode->i_mutex);
46971 path_put(&new_path);
46972@@ -3153,6 +3359,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46973 char *to;
46974 int error;
46975
46976+ pax_track_stack();
46977+
46978 error = user_path_parent(olddfd, oldname, &oldnd, &from);
46979 if (error)
46980 goto exit;
46981@@ -3209,6 +3417,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46982 if (new_dentry == trap)
46983 goto exit5;
46984
46985+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
46986+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
46987+ to);
46988+ if (error)
46989+ goto exit5;
46990+
46991 error = mnt_want_write(oldnd.path.mnt);
46992 if (error)
46993 goto exit5;
46994@@ -3218,6 +3432,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46995 goto exit6;
46996 error = vfs_rename(old_dir->d_inode, old_dentry,
46997 new_dir->d_inode, new_dentry);
46998+ if (!error)
46999+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
47000+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
47001 exit6:
47002 mnt_drop_write(oldnd.path.mnt);
47003 exit5:
47004@@ -3243,6 +3460,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
47005
47006 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
47007 {
47008+ char tmpbuf[64];
47009+ const char *newlink;
47010 int len;
47011
47012 len = PTR_ERR(link);
47013@@ -3252,7 +3471,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
47014 len = strlen(link);
47015 if (len > (unsigned) buflen)
47016 len = buflen;
47017- if (copy_to_user(buffer, link, len))
47018+
47019+ if (len < sizeof(tmpbuf)) {
47020+ memcpy(tmpbuf, link, len);
47021+ newlink = tmpbuf;
47022+ } else
47023+ newlink = link;
47024+
47025+ if (copy_to_user(buffer, newlink, len))
47026 len = -EFAULT;
47027 out:
47028 return len;
47029diff --git a/fs/namespace.c b/fs/namespace.c
47030index 5e7f2e9..cd13685 100644
47031--- a/fs/namespace.c
47032+++ b/fs/namespace.c
47033@@ -1326,6 +1326,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
47034 if (!(sb->s_flags & MS_RDONLY))
47035 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
47036 up_write(&sb->s_umount);
47037+
47038+ gr_log_remount(mnt->mnt_devname, retval);
47039+
47040 return retval;
47041 }
47042
47043@@ -1345,6 +1348,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
47044 br_write_unlock(vfsmount_lock);
47045 up_write(&namespace_sem);
47046 release_mounts(&umount_list);
47047+
47048+ gr_log_unmount(mnt->mnt_devname, retval);
47049+
47050 return retval;
47051 }
47052
47053@@ -2336,6 +2342,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47054 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
47055 MS_STRICTATIME);
47056
47057+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
47058+ retval = -EPERM;
47059+ goto dput_out;
47060+ }
47061+
47062+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
47063+ retval = -EPERM;
47064+ goto dput_out;
47065+ }
47066+
47067 if (flags & MS_REMOUNT)
47068 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
47069 data_page);
47070@@ -2350,6 +2366,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47071 dev_name, data_page);
47072 dput_out:
47073 path_put(&path);
47074+
47075+ gr_log_mount(dev_name, dir_name, retval);
47076+
47077 return retval;
47078 }
47079
47080@@ -2573,6 +2592,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
47081 if (error)
47082 goto out2;
47083
47084+ if (gr_handle_chroot_pivot()) {
47085+ error = -EPERM;
47086+ goto out2;
47087+ }
47088+
47089 get_fs_root(current->fs, &root);
47090 error = lock_mount(&old);
47091 if (error)
47092diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
47093index 9c51f62..503b252 100644
47094--- a/fs/ncpfs/dir.c
47095+++ b/fs/ncpfs/dir.c
47096@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentry, struct nameidata *nd)
47097 int res, val = 0, len;
47098 __u8 __name[NCP_MAXPATHLEN + 1];
47099
47100+ pax_track_stack();
47101+
47102 if (dentry == dentry->d_sb->s_root)
47103 return 1;
47104
47105@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
47106 int error, res, len;
47107 __u8 __name[NCP_MAXPATHLEN + 1];
47108
47109+ pax_track_stack();
47110+
47111 error = -EIO;
47112 if (!ncp_conn_valid(server))
47113 goto finished;
47114@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
47115 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
47116 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
47117
47118+ pax_track_stack();
47119+
47120 ncp_age_dentry(server, dentry);
47121 len = sizeof(__name);
47122 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
47123@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
47124 int error, len;
47125 __u8 __name[NCP_MAXPATHLEN + 1];
47126
47127+ pax_track_stack();
47128+
47129 DPRINTK("ncp_mkdir: making %s/%s\n",
47130 dentry->d_parent->d_name.name, dentry->d_name.name);
47131
47132@@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
47133 int old_len, new_len;
47134 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
47135
47136+ pax_track_stack();
47137+
47138 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
47139 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
47140 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
47141diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
47142index 202f370..9d4565e 100644
47143--- a/fs/ncpfs/inode.c
47144+++ b/fs/ncpfs/inode.c
47145@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
47146 #endif
47147 struct ncp_entry_info finfo;
47148
47149+ pax_track_stack();
47150+
47151 memset(&data, 0, sizeof(data));
47152 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
47153 if (!server)
47154diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
47155index 281ae95..dd895b9 100644
47156--- a/fs/nfs/blocklayout/blocklayout.c
47157+++ b/fs/nfs/blocklayout/blocklayout.c
47158@@ -90,7 +90,7 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
47159 */
47160 struct parallel_io {
47161 struct kref refcnt;
47162- struct rpc_call_ops call_ops;
47163+ rpc_call_ops_no_const call_ops;
47164 void (*pnfs_callback) (void *data);
47165 void *data;
47166 };
47167diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
47168index 679d2f5..ef1ffec 100644
47169--- a/fs/nfs/inode.c
47170+++ b/fs/nfs/inode.c
47171@@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
47172 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
47173 nfsi->attrtimeo_timestamp = jiffies;
47174
47175- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
47176+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
47177 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
47178 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
47179 else
47180@@ -1002,16 +1002,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
47181 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
47182 }
47183
47184-static atomic_long_t nfs_attr_generation_counter;
47185+static atomic_long_unchecked_t nfs_attr_generation_counter;
47186
47187 static unsigned long nfs_read_attr_generation_counter(void)
47188 {
47189- return atomic_long_read(&nfs_attr_generation_counter);
47190+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
47191 }
47192
47193 unsigned long nfs_inc_attr_generation_counter(void)
47194 {
47195- return atomic_long_inc_return(&nfs_attr_generation_counter);
47196+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
47197 }
47198
47199 void nfs_fattr_init(struct nfs_fattr *fattr)
47200diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
47201index 6f8bcc7..8f823c5 100644
47202--- a/fs/nfsd/nfs4state.c
47203+++ b/fs/nfsd/nfs4state.c
47204@@ -3999,6 +3999,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
47205 unsigned int strhashval;
47206 int err;
47207
47208+ pax_track_stack();
47209+
47210 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
47211 (long long) lock->lk_offset,
47212 (long long) lock->lk_length);
47213diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
47214index f810996..cec8977 100644
47215--- a/fs/nfsd/nfs4xdr.c
47216+++ b/fs/nfsd/nfs4xdr.c
47217@@ -1875,6 +1875,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
47218 .dentry = dentry,
47219 };
47220
47221+ pax_track_stack();
47222+
47223 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
47224 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
47225 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
47226diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
47227index acf88ae..4fd6245 100644
47228--- a/fs/nfsd/vfs.c
47229+++ b/fs/nfsd/vfs.c
47230@@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47231 } else {
47232 oldfs = get_fs();
47233 set_fs(KERNEL_DS);
47234- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
47235+ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
47236 set_fs(oldfs);
47237 }
47238
47239@@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47240
47241 /* Write the data. */
47242 oldfs = get_fs(); set_fs(KERNEL_DS);
47243- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
47244+ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
47245 set_fs(oldfs);
47246 if (host_err < 0)
47247 goto out_nfserr;
47248@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
47249 */
47250
47251 oldfs = get_fs(); set_fs(KERNEL_DS);
47252- host_err = inode->i_op->readlink(dentry, buf, *lenp);
47253+ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
47254 set_fs(oldfs);
47255
47256 if (host_err < 0)
47257diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
47258index 41d6743..b805df9 100644
47259--- a/fs/nilfs2/ioctl.c
47260+++ b/fs/nilfs2/ioctl.c
47261@@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
47262 if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
47263 goto out_free;
47264
47265+ if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
47266+ goto out_free;
47267+
47268 len = argv[n].v_size * argv[n].v_nmembs;
47269 base = (void __user *)(unsigned long)argv[n].v_base;
47270 if (len == 0) {
47271diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
47272index 9fde1c0..14e8827 100644
47273--- a/fs/notify/fanotify/fanotify_user.c
47274+++ b/fs/notify/fanotify/fanotify_user.c
47275@@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
47276 goto out_close_fd;
47277
47278 ret = -EFAULT;
47279- if (copy_to_user(buf, &fanotify_event_metadata,
47280+ if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
47281+ copy_to_user(buf, &fanotify_event_metadata,
47282 fanotify_event_metadata.event_len))
47283 goto out_kill_access_response;
47284
47285diff --git a/fs/notify/notification.c b/fs/notify/notification.c
47286index ee18815..7aa5d01 100644
47287--- a/fs/notify/notification.c
47288+++ b/fs/notify/notification.c
47289@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
47290 * get set to 0 so it will never get 'freed'
47291 */
47292 static struct fsnotify_event *q_overflow_event;
47293-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47294+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47295
47296 /**
47297 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
47298@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47299 */
47300 u32 fsnotify_get_cookie(void)
47301 {
47302- return atomic_inc_return(&fsnotify_sync_cookie);
47303+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
47304 }
47305 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
47306
47307diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
47308index 99e3610..02c1068 100644
47309--- a/fs/ntfs/dir.c
47310+++ b/fs/ntfs/dir.c
47311@@ -1329,7 +1329,7 @@ find_next_index_buffer:
47312 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
47313 ~(s64)(ndir->itype.index.block_size - 1)));
47314 /* Bounds checks. */
47315- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47316+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47317 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
47318 "inode 0x%lx or driver bug.", vdir->i_ino);
47319 goto err_out;
47320diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
47321index c587e2d..3641eaa 100644
47322--- a/fs/ntfs/file.c
47323+++ b/fs/ntfs/file.c
47324@@ -2229,6 +2229,6 @@ const struct inode_operations ntfs_file_inode_ops = {
47325 #endif /* NTFS_RW */
47326 };
47327
47328-const struct file_operations ntfs_empty_file_ops = {};
47329+const struct file_operations ntfs_empty_file_ops __read_only;
47330
47331-const struct inode_operations ntfs_empty_inode_ops = {};
47332+const struct inode_operations ntfs_empty_inode_ops __read_only;
47333diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
47334index 210c352..a174f83 100644
47335--- a/fs/ocfs2/localalloc.c
47336+++ b/fs/ocfs2/localalloc.c
47337@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
47338 goto bail;
47339 }
47340
47341- atomic_inc(&osb->alloc_stats.moves);
47342+ atomic_inc_unchecked(&osb->alloc_stats.moves);
47343
47344 bail:
47345 if (handle)
47346diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
47347index 53aa41e..d7df9f1 100644
47348--- a/fs/ocfs2/namei.c
47349+++ b/fs/ocfs2/namei.c
47350@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *old_dir,
47351 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
47352 struct ocfs2_dir_lookup_result target_insert = { NULL, };
47353
47354+ pax_track_stack();
47355+
47356 /* At some point it might be nice to break this function up a
47357 * bit. */
47358
47359diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
47360index 4092858..51c70ff 100644
47361--- a/fs/ocfs2/ocfs2.h
47362+++ b/fs/ocfs2/ocfs2.h
47363@@ -235,11 +235,11 @@ enum ocfs2_vol_state
47364
47365 struct ocfs2_alloc_stats
47366 {
47367- atomic_t moves;
47368- atomic_t local_data;
47369- atomic_t bitmap_data;
47370- atomic_t bg_allocs;
47371- atomic_t bg_extends;
47372+ atomic_unchecked_t moves;
47373+ atomic_unchecked_t local_data;
47374+ atomic_unchecked_t bitmap_data;
47375+ atomic_unchecked_t bg_allocs;
47376+ atomic_unchecked_t bg_extends;
47377 };
47378
47379 enum ocfs2_local_alloc_state
47380diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
47381index ba5d97e..c77db25 100644
47382--- a/fs/ocfs2/suballoc.c
47383+++ b/fs/ocfs2/suballoc.c
47384@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
47385 mlog_errno(status);
47386 goto bail;
47387 }
47388- atomic_inc(&osb->alloc_stats.bg_extends);
47389+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
47390
47391 /* You should never ask for this much metadata */
47392 BUG_ON(bits_wanted >
47393@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handle,
47394 mlog_errno(status);
47395 goto bail;
47396 }
47397- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47398+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47399
47400 *suballoc_loc = res.sr_bg_blkno;
47401 *suballoc_bit_start = res.sr_bit_offset;
47402@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_t *handle,
47403 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
47404 res->sr_bits);
47405
47406- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47407+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47408
47409 BUG_ON(res->sr_bits != 1);
47410
47411@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *handle,
47412 mlog_errno(status);
47413 goto bail;
47414 }
47415- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47416+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47417
47418 BUG_ON(res.sr_bits != 1);
47419
47420@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47421 cluster_start,
47422 num_clusters);
47423 if (!status)
47424- atomic_inc(&osb->alloc_stats.local_data);
47425+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
47426 } else {
47427 if (min_clusters > (osb->bitmap_cpg - 1)) {
47428 /* The only paths asking for contiguousness
47429@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47430 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
47431 res.sr_bg_blkno,
47432 res.sr_bit_offset);
47433- atomic_inc(&osb->alloc_stats.bitmap_data);
47434+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
47435 *num_clusters = res.sr_bits;
47436 }
47437 }
47438diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
47439index 56f6102..1433c29 100644
47440--- a/fs/ocfs2/super.c
47441+++ b/fs/ocfs2/super.c
47442@@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
47443 "%10s => GlobalAllocs: %d LocalAllocs: %d "
47444 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
47445 "Stats",
47446- atomic_read(&osb->alloc_stats.bitmap_data),
47447- atomic_read(&osb->alloc_stats.local_data),
47448- atomic_read(&osb->alloc_stats.bg_allocs),
47449- atomic_read(&osb->alloc_stats.moves),
47450- atomic_read(&osb->alloc_stats.bg_extends));
47451+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
47452+ atomic_read_unchecked(&osb->alloc_stats.local_data),
47453+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
47454+ atomic_read_unchecked(&osb->alloc_stats.moves),
47455+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
47456
47457 out += snprintf(buf + out, len - out,
47458 "%10s => State: %u Descriptor: %llu Size: %u bits "
47459@@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
47460 spin_lock_init(&osb->osb_xattr_lock);
47461 ocfs2_init_steal_slots(osb);
47462
47463- atomic_set(&osb->alloc_stats.moves, 0);
47464- atomic_set(&osb->alloc_stats.local_data, 0);
47465- atomic_set(&osb->alloc_stats.bitmap_data, 0);
47466- atomic_set(&osb->alloc_stats.bg_allocs, 0);
47467- atomic_set(&osb->alloc_stats.bg_extends, 0);
47468+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
47469+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
47470+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
47471+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
47472+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
47473
47474 /* Copy the blockcheck stats from the superblock probe */
47475 osb->osb_ecc_stats = *stats;
47476diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
47477index 5d22872..523db20 100644
47478--- a/fs/ocfs2/symlink.c
47479+++ b/fs/ocfs2/symlink.c
47480@@ -142,7 +142,7 @@ bail:
47481
47482 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
47483 {
47484- char *link = nd_get_link(nd);
47485+ const char *link = nd_get_link(nd);
47486 if (!IS_ERR(link))
47487 kfree(link);
47488 }
47489diff --git a/fs/open.c b/fs/open.c
47490index f711921..28d5958 100644
47491--- a/fs/open.c
47492+++ b/fs/open.c
47493@@ -112,6 +112,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
47494 error = locks_verify_truncate(inode, NULL, length);
47495 if (!error)
47496 error = security_path_truncate(&path);
47497+
47498+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
47499+ error = -EACCES;
47500+
47501 if (!error)
47502 error = do_truncate(path.dentry, length, 0, NULL);
47503
47504@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
47505 if (__mnt_is_readonly(path.mnt))
47506 res = -EROFS;
47507
47508+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
47509+ res = -EACCES;
47510+
47511 out_path_release:
47512 path_put(&path);
47513 out:
47514@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
47515 if (error)
47516 goto dput_and_out;
47517
47518+ gr_log_chdir(path.dentry, path.mnt);
47519+
47520 set_fs_pwd(current->fs, &path);
47521
47522 dput_and_out:
47523@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
47524 goto out_putf;
47525
47526 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
47527+
47528+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
47529+ error = -EPERM;
47530+
47531+ if (!error)
47532+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
47533+
47534 if (!error)
47535 set_fs_pwd(current->fs, &file->f_path);
47536 out_putf:
47537@@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
47538 if (error)
47539 goto dput_and_out;
47540
47541+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
47542+ goto dput_and_out;
47543+
47544 set_fs_root(current->fs, &path);
47545+
47546+ gr_handle_chroot_chdir(&path);
47547+
47548 error = 0;
47549 dput_and_out:
47550 path_put(&path);
47551@@ -456,6 +478,16 @@ static int chmod_common(struct path *path, umode_t mode)
47552 if (error)
47553 return error;
47554 mutex_lock(&inode->i_mutex);
47555+
47556+ if (!gr_acl_handle_fchmod(path->dentry, path->mnt, mode)) {
47557+ error = -EACCES;
47558+ goto out_unlock;
47559+ }
47560+ if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
47561+ error = -EACCES;
47562+ goto out_unlock;
47563+ }
47564+
47565 error = security_path_chmod(path->dentry, path->mnt, mode);
47566 if (error)
47567 goto out_unlock;
47568@@ -506,6 +538,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
47569 int error;
47570 struct iattr newattrs;
47571
47572+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
47573+ return -EACCES;
47574+
47575 newattrs.ia_valid = ATTR_CTIME;
47576 if (user != (uid_t) -1) {
47577 newattrs.ia_valid |= ATTR_UID;
47578diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
47579index 6296b40..417c00f 100644
47580--- a/fs/partitions/efi.c
47581+++ b/fs/partitions/efi.c
47582@@ -234,14 +234,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
47583 if (!gpt)
47584 return NULL;
47585
47586+ if (!le32_to_cpu(gpt->num_partition_entries))
47587+ return NULL;
47588+ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
47589+ if (!pte)
47590+ return NULL;
47591+
47592 count = le32_to_cpu(gpt->num_partition_entries) *
47593 le32_to_cpu(gpt->sizeof_partition_entry);
47594- if (!count)
47595- return NULL;
47596- pte = kzalloc(count, GFP_KERNEL);
47597- if (!pte)
47598- return NULL;
47599-
47600 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
47601 (u8 *) pte,
47602 count) < count) {
47603diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
47604index af9fdf0..75b15c3 100644
47605--- a/fs/partitions/ldm.c
47606+++ b/fs/partitions/ldm.c
47607@@ -1322,7 +1322,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
47608 goto found;
47609 }
47610
47611- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
47612+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
47613 if (!f) {
47614 ldm_crit ("Out of memory.");
47615 return false;
47616diff --git a/fs/pipe.c b/fs/pipe.c
47617index 0e0be1d..f62a72d 100644
47618--- a/fs/pipe.c
47619+++ b/fs/pipe.c
47620@@ -420,9 +420,9 @@ redo:
47621 }
47622 if (bufs) /* More to do? */
47623 continue;
47624- if (!pipe->writers)
47625+ if (!atomic_read(&pipe->writers))
47626 break;
47627- if (!pipe->waiting_writers) {
47628+ if (!atomic_read(&pipe->waiting_writers)) {
47629 /* syscall merging: Usually we must not sleep
47630 * if O_NONBLOCK is set, or if we got some data.
47631 * But if a writer sleeps in kernel space, then
47632@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
47633 mutex_lock(&inode->i_mutex);
47634 pipe = inode->i_pipe;
47635
47636- if (!pipe->readers) {
47637+ if (!atomic_read(&pipe->readers)) {
47638 send_sig(SIGPIPE, current, 0);
47639 ret = -EPIPE;
47640 goto out;
47641@@ -530,7 +530,7 @@ redo1:
47642 for (;;) {
47643 int bufs;
47644
47645- if (!pipe->readers) {
47646+ if (!atomic_read(&pipe->readers)) {
47647 send_sig(SIGPIPE, current, 0);
47648 if (!ret)
47649 ret = -EPIPE;
47650@@ -616,9 +616,9 @@ redo2:
47651 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
47652 do_wakeup = 0;
47653 }
47654- pipe->waiting_writers++;
47655+ atomic_inc(&pipe->waiting_writers);
47656 pipe_wait(pipe);
47657- pipe->waiting_writers--;
47658+ atomic_dec(&pipe->waiting_writers);
47659 }
47660 out:
47661 mutex_unlock(&inode->i_mutex);
47662@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table *wait)
47663 mask = 0;
47664 if (filp->f_mode & FMODE_READ) {
47665 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
47666- if (!pipe->writers && filp->f_version != pipe->w_counter)
47667+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
47668 mask |= POLLHUP;
47669 }
47670
47671@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table *wait)
47672 * Most Unices do not set POLLERR for FIFOs but on Linux they
47673 * behave exactly like pipes for poll().
47674 */
47675- if (!pipe->readers)
47676+ if (!atomic_read(&pipe->readers))
47677 mask |= POLLERR;
47678 }
47679
47680@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int decr, int decw)
47681
47682 mutex_lock(&inode->i_mutex);
47683 pipe = inode->i_pipe;
47684- pipe->readers -= decr;
47685- pipe->writers -= decw;
47686+ atomic_sub(decr, &pipe->readers);
47687+ atomic_sub(decw, &pipe->writers);
47688
47689- if (!pipe->readers && !pipe->writers) {
47690+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
47691 free_pipe_info(inode);
47692 } else {
47693 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
47694@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
47695
47696 if (inode->i_pipe) {
47697 ret = 0;
47698- inode->i_pipe->readers++;
47699+ atomic_inc(&inode->i_pipe->readers);
47700 }
47701
47702 mutex_unlock(&inode->i_mutex);
47703@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
47704
47705 if (inode->i_pipe) {
47706 ret = 0;
47707- inode->i_pipe->writers++;
47708+ atomic_inc(&inode->i_pipe->writers);
47709 }
47710
47711 mutex_unlock(&inode->i_mutex);
47712@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
47713 if (inode->i_pipe) {
47714 ret = 0;
47715 if (filp->f_mode & FMODE_READ)
47716- inode->i_pipe->readers++;
47717+ atomic_inc(&inode->i_pipe->readers);
47718 if (filp->f_mode & FMODE_WRITE)
47719- inode->i_pipe->writers++;
47720+ atomic_inc(&inode->i_pipe->writers);
47721 }
47722
47723 mutex_unlock(&inode->i_mutex);
47724@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
47725 inode->i_pipe = NULL;
47726 }
47727
47728-static struct vfsmount *pipe_mnt __read_mostly;
47729+struct vfsmount *pipe_mnt __read_mostly;
47730
47731 /*
47732 * pipefs_dname() is called from d_path().
47733@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(void)
47734 goto fail_iput;
47735 inode->i_pipe = pipe;
47736
47737- pipe->readers = pipe->writers = 1;
47738+ atomic_set(&pipe->readers, 1);
47739+ atomic_set(&pipe->writers, 1);
47740 inode->i_fop = &rdwr_pipefifo_fops;
47741
47742 /*
47743diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
47744index 15af622..0e9f4467 100644
47745--- a/fs/proc/Kconfig
47746+++ b/fs/proc/Kconfig
47747@@ -30,12 +30,12 @@ config PROC_FS
47748
47749 config PROC_KCORE
47750 bool "/proc/kcore support" if !ARM
47751- depends on PROC_FS && MMU
47752+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
47753
47754 config PROC_VMCORE
47755 bool "/proc/vmcore support"
47756- depends on PROC_FS && CRASH_DUMP
47757- default y
47758+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
47759+ default n
47760 help
47761 Exports the dump image of crashed kernel in ELF format.
47762
47763@@ -59,8 +59,8 @@ config PROC_SYSCTL
47764 limited in memory.
47765
47766 config PROC_PAGE_MONITOR
47767- default y
47768- depends on PROC_FS && MMU
47769+ default n
47770+ depends on PROC_FS && MMU && !GRKERNSEC
47771 bool "Enable /proc page monitoring" if EXPERT
47772 help
47773 Various /proc files exist to monitor process memory utilization:
47774diff --git a/fs/proc/array.c b/fs/proc/array.c
47775index 3a1dafd..c7fed72 100644
47776--- a/fs/proc/array.c
47777+++ b/fs/proc/array.c
47778@@ -60,6 +60,7 @@
47779 #include <linux/tty.h>
47780 #include <linux/string.h>
47781 #include <linux/mman.h>
47782+#include <linux/grsecurity.h>
47783 #include <linux/proc_fs.h>
47784 #include <linux/ioport.h>
47785 #include <linux/uaccess.h>
47786@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
47787 seq_putc(m, '\n');
47788 }
47789
47790+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47791+static inline void task_pax(struct seq_file *m, struct task_struct *p)
47792+{
47793+ if (p->mm)
47794+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
47795+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
47796+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
47797+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
47798+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
47799+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
47800+ else
47801+ seq_printf(m, "PaX:\t-----\n");
47802+}
47803+#endif
47804+
47805 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47806 struct pid *pid, struct task_struct *task)
47807 {
47808@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47809 task_cpus_allowed(m, task);
47810 cpuset_task_status_allowed(m, task);
47811 task_context_switch_counts(m, task);
47812+
47813+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47814+ task_pax(m, task);
47815+#endif
47816+
47817+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
47818+ task_grsec_rbac(m, task);
47819+#endif
47820+
47821 return 0;
47822 }
47823
47824+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47825+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47826+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
47827+ _mm->pax_flags & MF_PAX_SEGMEXEC))
47828+#endif
47829+
47830 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47831 struct pid *pid, struct task_struct *task, int whole)
47832 {
47833@@ -378,6 +409,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47834 char tcomm[sizeof(task->comm)];
47835 unsigned long flags;
47836
47837+ pax_track_stack();
47838+
47839 state = *get_task_state(task);
47840 vsize = eip = esp = 0;
47841 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
47842@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47843 gtime = task->gtime;
47844 }
47845
47846+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47847+ if (PAX_RAND_FLAGS(mm)) {
47848+ eip = 0;
47849+ esp = 0;
47850+ wchan = 0;
47851+ }
47852+#endif
47853+#ifdef CONFIG_GRKERNSEC_HIDESYM
47854+ wchan = 0;
47855+ eip =0;
47856+ esp =0;
47857+#endif
47858+
47859 /* scale priority and nice values from timeslices to -20..20 */
47860 /* to make it look like a "normal" Unix priority/nice value */
47861 priority = task_prio(task);
47862@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47863 vsize,
47864 mm ? get_mm_rss(mm) : 0,
47865 rsslim,
47866+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47867+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
47868+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
47869+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
47870+#else
47871 mm ? (permitted ? mm->start_code : 1) : 0,
47872 mm ? (permitted ? mm->end_code : 1) : 0,
47873 (permitted && mm) ? mm->start_stack : 0,
47874+#endif
47875 esp,
47876 eip,
47877 /* The signal information here is obsolete.
47878@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
47879
47880 return 0;
47881 }
47882+
47883+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
47884+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
47885+{
47886+ u32 curr_ip = 0;
47887+ unsigned long flags;
47888+
47889+ if (lock_task_sighand(task, &flags)) {
47890+ curr_ip = task->signal->curr_ip;
47891+ unlock_task_sighand(task, &flags);
47892+ }
47893+
47894+ return sprintf(buffer, "%pI4\n", &curr_ip);
47895+}
47896+#endif
47897diff --git a/fs/proc/base.c b/fs/proc/base.c
47898index 5eb0206..fe01db4 100644
47899--- a/fs/proc/base.c
47900+++ b/fs/proc/base.c
47901@@ -107,6 +107,22 @@ struct pid_entry {
47902 union proc_op op;
47903 };
47904
47905+struct getdents_callback {
47906+ struct linux_dirent __user * current_dir;
47907+ struct linux_dirent __user * previous;
47908+ struct file * file;
47909+ int count;
47910+ int error;
47911+};
47912+
47913+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
47914+ loff_t offset, u64 ino, unsigned int d_type)
47915+{
47916+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
47917+ buf->error = -EINVAL;
47918+ return 0;
47919+}
47920+
47921 #define NOD(NAME, MODE, IOP, FOP, OP) { \
47922 .name = (NAME), \
47923 .len = sizeof(NAME) - 1, \
47924@@ -209,6 +225,9 @@ static struct mm_struct *__check_mem_permission(struct task_struct *task)
47925 if (task == current)
47926 return mm;
47927
47928+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
47929+ return ERR_PTR(-EPERM);
47930+
47931 /*
47932 * If current is actively ptrace'ing, and would also be
47933 * permitted to freshly attach with ptrace now, permit it.
47934@@ -282,6 +301,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
47935 if (!mm->arg_end)
47936 goto out_mm; /* Shh! No looking before we're done */
47937
47938+ if (gr_acl_handle_procpidmem(task))
47939+ goto out_mm;
47940+
47941 len = mm->arg_end - mm->arg_start;
47942
47943 if (len > PAGE_SIZE)
47944@@ -309,12 +331,28 @@ out:
47945 return res;
47946 }
47947
47948+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47949+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47950+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
47951+ _mm->pax_flags & MF_PAX_SEGMEXEC))
47952+#endif
47953+
47954 static int proc_pid_auxv(struct task_struct *task, char *buffer)
47955 {
47956 struct mm_struct *mm = mm_for_maps(task);
47957 int res = PTR_ERR(mm);
47958 if (mm && !IS_ERR(mm)) {
47959 unsigned int nwords = 0;
47960+
47961+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47962+ /* allow if we're currently ptracing this task */
47963+ if (PAX_RAND_FLAGS(mm) &&
47964+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
47965+ mmput(mm);
47966+ return 0;
47967+ }
47968+#endif
47969+
47970 do {
47971 nwords += 2;
47972 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
47973@@ -328,7 +366,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
47974 }
47975
47976
47977-#ifdef CONFIG_KALLSYMS
47978+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47979 /*
47980 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
47981 * Returns the resolved symbol. If that fails, simply return the address.
47982@@ -367,7 +405,7 @@ static void unlock_trace(struct task_struct *task)
47983 mutex_unlock(&task->signal->cred_guard_mutex);
47984 }
47985
47986-#ifdef CONFIG_STACKTRACE
47987+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47988
47989 #define MAX_STACK_TRACE_DEPTH 64
47990
47991@@ -558,7 +596,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
47992 return count;
47993 }
47994
47995-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
47996+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
47997 static int proc_pid_syscall(struct task_struct *task, char *buffer)
47998 {
47999 long nr;
48000@@ -587,7 +625,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
48001 /************************************************************************/
48002
48003 /* permission checks */
48004-static int proc_fd_access_allowed(struct inode *inode)
48005+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
48006 {
48007 struct task_struct *task;
48008 int allowed = 0;
48009@@ -597,7 +635,10 @@ static int proc_fd_access_allowed(struct inode *inode)
48010 */
48011 task = get_proc_task(inode);
48012 if (task) {
48013- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48014+ if (log)
48015+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
48016+ else
48017+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48018 put_task_struct(task);
48019 }
48020 return allowed;
48021@@ -978,6 +1019,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
48022 if (!task)
48023 goto out_no_task;
48024
48025+ if (gr_acl_handle_procpidmem(task))
48026+ goto out;
48027+
48028 ret = -ENOMEM;
48029 page = (char *)__get_free_page(GFP_TEMPORARY);
48030 if (!page)
48031@@ -1613,7 +1657,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
48032 path_put(&nd->path);
48033
48034 /* Are we allowed to snoop on the tasks file descriptors? */
48035- if (!proc_fd_access_allowed(inode))
48036+ if (!proc_fd_access_allowed(inode,0))
48037 goto out;
48038
48039 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
48040@@ -1652,8 +1696,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
48041 struct path path;
48042
48043 /* Are we allowed to snoop on the tasks file descriptors? */
48044- if (!proc_fd_access_allowed(inode))
48045- goto out;
48046+ /* logging this is needed for learning on chromium to work properly,
48047+ but we don't want to flood the logs from 'ps' which does a readlink
48048+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
48049+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
48050+ */
48051+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
48052+ if (!proc_fd_access_allowed(inode,0))
48053+ goto out;
48054+ } else {
48055+ if (!proc_fd_access_allowed(inode,1))
48056+ goto out;
48057+ }
48058
48059 error = PROC_I(inode)->op.proc_get_link(inode, &path);
48060 if (error)
48061@@ -1718,7 +1772,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
48062 rcu_read_lock();
48063 cred = __task_cred(task);
48064 inode->i_uid = cred->euid;
48065+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48066+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48067+#else
48068 inode->i_gid = cred->egid;
48069+#endif
48070 rcu_read_unlock();
48071 }
48072 security_task_to_inode(task, inode);
48073@@ -1736,6 +1794,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48074 struct inode *inode = dentry->d_inode;
48075 struct task_struct *task;
48076 const struct cred *cred;
48077+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48078+ const struct cred *tmpcred = current_cred();
48079+#endif
48080
48081 generic_fillattr(inode, stat);
48082
48083@@ -1743,13 +1804,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48084 stat->uid = 0;
48085 stat->gid = 0;
48086 task = pid_task(proc_pid(inode), PIDTYPE_PID);
48087+
48088+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
48089+ rcu_read_unlock();
48090+ return -ENOENT;
48091+ }
48092+
48093 if (task) {
48094+ cred = __task_cred(task);
48095+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48096+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
48097+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48098+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48099+#endif
48100+ ) {
48101+#endif
48102 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48103+#ifdef CONFIG_GRKERNSEC_PROC_USER
48104+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48105+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48106+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48107+#endif
48108 task_dumpable(task)) {
48109- cred = __task_cred(task);
48110 stat->uid = cred->euid;
48111+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48112+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
48113+#else
48114 stat->gid = cred->egid;
48115+#endif
48116 }
48117+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48118+ } else {
48119+ rcu_read_unlock();
48120+ return -ENOENT;
48121+ }
48122+#endif
48123 }
48124 rcu_read_unlock();
48125 return 0;
48126@@ -1786,11 +1875,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
48127
48128 if (task) {
48129 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48130+#ifdef CONFIG_GRKERNSEC_PROC_USER
48131+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48132+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48133+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48134+#endif
48135 task_dumpable(task)) {
48136 rcu_read_lock();
48137 cred = __task_cred(task);
48138 inode->i_uid = cred->euid;
48139+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48140+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48141+#else
48142 inode->i_gid = cred->egid;
48143+#endif
48144 rcu_read_unlock();
48145 } else {
48146 inode->i_uid = 0;
48147@@ -1908,7 +2006,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
48148 int fd = proc_fd(inode);
48149
48150 if (task) {
48151- files = get_files_struct(task);
48152+ if (!gr_acl_handle_procpidmem(task))
48153+ files = get_files_struct(task);
48154 put_task_struct(task);
48155 }
48156 if (files) {
48157@@ -2176,11 +2275,21 @@ static const struct file_operations proc_fd_operations = {
48158 */
48159 static int proc_fd_permission(struct inode *inode, int mask)
48160 {
48161+ struct task_struct *task;
48162 int rv = generic_permission(inode, mask);
48163- if (rv == 0)
48164- return 0;
48165+
48166 if (task_pid(current) == proc_pid(inode))
48167 rv = 0;
48168+
48169+ task = get_proc_task(inode);
48170+ if (task == NULL)
48171+ return rv;
48172+
48173+ if (gr_acl_handle_procpidmem(task))
48174+ rv = -EACCES;
48175+
48176+ put_task_struct(task);
48177+
48178 return rv;
48179 }
48180
48181@@ -2290,6 +2399,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
48182 if (!task)
48183 goto out_no_task;
48184
48185+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48186+ goto out;
48187+
48188 /*
48189 * Yes, it does not scale. And it should not. Don't add
48190 * new entries into /proc/<tgid>/ without very good reasons.
48191@@ -2334,6 +2446,9 @@ static int proc_pident_readdir(struct file *filp,
48192 if (!task)
48193 goto out_no_task;
48194
48195+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48196+ goto out;
48197+
48198 ret = 0;
48199 i = filp->f_pos;
48200 switch (i) {
48201@@ -2604,7 +2719,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
48202 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
48203 void *cookie)
48204 {
48205- char *s = nd_get_link(nd);
48206+ const char *s = nd_get_link(nd);
48207 if (!IS_ERR(s))
48208 __putname(s);
48209 }
48210@@ -2802,7 +2917,7 @@ static const struct pid_entry tgid_base_stuff[] = {
48211 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
48212 #endif
48213 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48214-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48215+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48216 INF("syscall", S_IRUGO, proc_pid_syscall),
48217 #endif
48218 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48219@@ -2827,10 +2942,10 @@ static const struct pid_entry tgid_base_stuff[] = {
48220 #ifdef CONFIG_SECURITY
48221 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48222 #endif
48223-#ifdef CONFIG_KALLSYMS
48224+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48225 INF("wchan", S_IRUGO, proc_pid_wchan),
48226 #endif
48227-#ifdef CONFIG_STACKTRACE
48228+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48229 ONE("stack", S_IRUGO, proc_pid_stack),
48230 #endif
48231 #ifdef CONFIG_SCHEDSTATS
48232@@ -2864,6 +2979,9 @@ static const struct pid_entry tgid_base_stuff[] = {
48233 #ifdef CONFIG_HARDWALL
48234 INF("hardwall", S_IRUGO, proc_pid_hardwall),
48235 #endif
48236+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48237+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
48238+#endif
48239 };
48240
48241 static int proc_tgid_base_readdir(struct file * filp,
48242@@ -2989,7 +3107,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
48243 if (!inode)
48244 goto out;
48245
48246+#ifdef CONFIG_GRKERNSEC_PROC_USER
48247+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
48248+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48249+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48250+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
48251+#else
48252 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
48253+#endif
48254 inode->i_op = &proc_tgid_base_inode_operations;
48255 inode->i_fop = &proc_tgid_base_operations;
48256 inode->i_flags|=S_IMMUTABLE;
48257@@ -3031,7 +3156,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
48258 if (!task)
48259 goto out;
48260
48261+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48262+ goto out_put_task;
48263+
48264 result = proc_pid_instantiate(dir, dentry, task, NULL);
48265+out_put_task:
48266 put_task_struct(task);
48267 out:
48268 return result;
48269@@ -3096,6 +3225,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48270 {
48271 unsigned int nr;
48272 struct task_struct *reaper;
48273+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48274+ const struct cred *tmpcred = current_cred();
48275+ const struct cred *itercred;
48276+#endif
48277+ filldir_t __filldir = filldir;
48278 struct tgid_iter iter;
48279 struct pid_namespace *ns;
48280
48281@@ -3119,8 +3253,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48282 for (iter = next_tgid(ns, iter);
48283 iter.task;
48284 iter.tgid += 1, iter = next_tgid(ns, iter)) {
48285+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48286+ rcu_read_lock();
48287+ itercred = __task_cred(iter.task);
48288+#endif
48289+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
48290+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48291+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
48292+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48293+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48294+#endif
48295+ )
48296+#endif
48297+ )
48298+ __filldir = &gr_fake_filldir;
48299+ else
48300+ __filldir = filldir;
48301+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48302+ rcu_read_unlock();
48303+#endif
48304 filp->f_pos = iter.tgid + TGID_OFFSET;
48305- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
48306+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
48307 put_task_struct(iter.task);
48308 goto out;
48309 }
48310@@ -3148,7 +3301,7 @@ static const struct pid_entry tid_base_stuff[] = {
48311 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
48312 #endif
48313 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48314-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48315+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48316 INF("syscall", S_IRUGO, proc_pid_syscall),
48317 #endif
48318 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48319@@ -3172,10 +3325,10 @@ static const struct pid_entry tid_base_stuff[] = {
48320 #ifdef CONFIG_SECURITY
48321 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48322 #endif
48323-#ifdef CONFIG_KALLSYMS
48324+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48325 INF("wchan", S_IRUGO, proc_pid_wchan),
48326 #endif
48327-#ifdef CONFIG_STACKTRACE
48328+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48329 ONE("stack", S_IRUGO, proc_pid_stack),
48330 #endif
48331 #ifdef CONFIG_SCHEDSTATS
48332diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
48333index 82676e3..5f8518a 100644
48334--- a/fs/proc/cmdline.c
48335+++ b/fs/proc/cmdline.c
48336@@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
48337
48338 static int __init proc_cmdline_init(void)
48339 {
48340+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48341+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
48342+#else
48343 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
48344+#endif
48345 return 0;
48346 }
48347 module_init(proc_cmdline_init);
48348diff --git a/fs/proc/devices.c b/fs/proc/devices.c
48349index b143471..bb105e5 100644
48350--- a/fs/proc/devices.c
48351+++ b/fs/proc/devices.c
48352@@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
48353
48354 static int __init proc_devices_init(void)
48355 {
48356+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48357+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
48358+#else
48359 proc_create("devices", 0, NULL, &proc_devinfo_operations);
48360+#endif
48361 return 0;
48362 }
48363 module_init(proc_devices_init);
48364diff --git a/fs/proc/inode.c b/fs/proc/inode.c
48365index 7ed72d6..d5f061a 100644
48366--- a/fs/proc/inode.c
48367+++ b/fs/proc/inode.c
48368@@ -18,12 +18,18 @@
48369 #include <linux/module.h>
48370 #include <linux/sysctl.h>
48371 #include <linux/slab.h>
48372+#include <linux/grsecurity.h>
48373
48374 #include <asm/system.h>
48375 #include <asm/uaccess.h>
48376
48377 #include "internal.h"
48378
48379+#ifdef CONFIG_PROC_SYSCTL
48380+extern const struct inode_operations proc_sys_inode_operations;
48381+extern const struct inode_operations proc_sys_dir_operations;
48382+#endif
48383+
48384 static void proc_evict_inode(struct inode *inode)
48385 {
48386 struct proc_dir_entry *de;
48387@@ -49,6 +55,13 @@ static void proc_evict_inode(struct inode *inode)
48388 ns_ops = PROC_I(inode)->ns_ops;
48389 if (ns_ops && ns_ops->put)
48390 ns_ops->put(PROC_I(inode)->ns);
48391+
48392+#ifdef CONFIG_PROC_SYSCTL
48393+ if (inode->i_op == &proc_sys_inode_operations ||
48394+ inode->i_op == &proc_sys_dir_operations)
48395+ gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
48396+#endif
48397+
48398 }
48399
48400 static struct kmem_cache * proc_inode_cachep;
48401@@ -440,7 +453,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
48402 if (de->mode) {
48403 inode->i_mode = de->mode;
48404 inode->i_uid = de->uid;
48405+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48406+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48407+#else
48408 inode->i_gid = de->gid;
48409+#endif
48410 }
48411 if (de->size)
48412 inode->i_size = de->size;
48413diff --git a/fs/proc/internal.h b/fs/proc/internal.h
48414index 7838e5c..ff92cbc 100644
48415--- a/fs/proc/internal.h
48416+++ b/fs/proc/internal.h
48417@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48418 struct pid *pid, struct task_struct *task);
48419 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48420 struct pid *pid, struct task_struct *task);
48421+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48422+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
48423+#endif
48424 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
48425
48426 extern const struct file_operations proc_maps_operations;
48427diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
48428index d245cb2..7e645bd 100644
48429--- a/fs/proc/kcore.c
48430+++ b/fs/proc/kcore.c
48431@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
48432 off_t offset = 0;
48433 struct kcore_list *m;
48434
48435+ pax_track_stack();
48436+
48437 /* setup ELF header */
48438 elf = (struct elfhdr *) bufp;
48439 bufp += sizeof(struct elfhdr);
48440@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48441 * the addresses in the elf_phdr on our list.
48442 */
48443 start = kc_offset_to_vaddr(*fpos - elf_buflen);
48444- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
48445+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
48446+ if (tsz > buflen)
48447 tsz = buflen;
48448-
48449+
48450 while (buflen) {
48451 struct kcore_list *m;
48452
48453@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48454 kfree(elf_buf);
48455 } else {
48456 if (kern_addr_valid(start)) {
48457- unsigned long n;
48458+ char *elf_buf;
48459+ mm_segment_t oldfs;
48460
48461- n = copy_to_user(buffer, (char *)start, tsz);
48462- /*
48463- * We cannot distingush between fault on source
48464- * and fault on destination. When this happens
48465- * we clear too and hope it will trigger the
48466- * EFAULT again.
48467- */
48468- if (n) {
48469- if (clear_user(buffer + tsz - n,
48470- n))
48471+ elf_buf = kmalloc(tsz, GFP_KERNEL);
48472+ if (!elf_buf)
48473+ return -ENOMEM;
48474+ oldfs = get_fs();
48475+ set_fs(KERNEL_DS);
48476+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
48477+ set_fs(oldfs);
48478+ if (copy_to_user(buffer, elf_buf, tsz)) {
48479+ kfree(elf_buf);
48480 return -EFAULT;
48481+ }
48482 }
48483+ set_fs(oldfs);
48484+ kfree(elf_buf);
48485 } else {
48486 if (clear_user(buffer, tsz))
48487 return -EFAULT;
48488@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48489
48490 static int open_kcore(struct inode *inode, struct file *filp)
48491 {
48492+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
48493+ return -EPERM;
48494+#endif
48495 if (!capable(CAP_SYS_RAWIO))
48496 return -EPERM;
48497 if (kcore_need_update)
48498diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
48499index 80e4645..d2689e9 100644
48500--- a/fs/proc/meminfo.c
48501+++ b/fs/proc/meminfo.c
48502@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
48503 unsigned long pages[NR_LRU_LISTS];
48504 int lru;
48505
48506+ pax_track_stack();
48507+
48508 /*
48509 * display in kilobytes.
48510 */
48511@@ -158,7 +160,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
48512 vmi.used >> 10,
48513 vmi.largest_chunk >> 10
48514 #ifdef CONFIG_MEMORY_FAILURE
48515- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
48516+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
48517 #endif
48518 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
48519 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
48520diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
48521index b1822dd..df622cb 100644
48522--- a/fs/proc/nommu.c
48523+++ b/fs/proc/nommu.c
48524@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
48525 if (len < 1)
48526 len = 1;
48527 seq_printf(m, "%*c", len, ' ');
48528- seq_path(m, &file->f_path, "");
48529+ seq_path(m, &file->f_path, "\n\\");
48530 }
48531
48532 seq_putc(m, '\n');
48533diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
48534index f738024..876984a 100644
48535--- a/fs/proc/proc_net.c
48536+++ b/fs/proc/proc_net.c
48537@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
48538 struct task_struct *task;
48539 struct nsproxy *ns;
48540 struct net *net = NULL;
48541+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48542+ const struct cred *cred = current_cred();
48543+#endif
48544+
48545+#ifdef CONFIG_GRKERNSEC_PROC_USER
48546+ if (cred->fsuid)
48547+ return net;
48548+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48549+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
48550+ return net;
48551+#endif
48552
48553 rcu_read_lock();
48554 task = pid_task(proc_pid(dir), PIDTYPE_PID);
48555diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
48556index 1a77dbe..56ec911 100644
48557--- a/fs/proc/proc_sysctl.c
48558+++ b/fs/proc/proc_sysctl.c
48559@@ -8,11 +8,13 @@
48560 #include <linux/namei.h>
48561 #include "internal.h"
48562
48563+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
48564+
48565 static const struct dentry_operations proc_sys_dentry_operations;
48566 static const struct file_operations proc_sys_file_operations;
48567-static const struct inode_operations proc_sys_inode_operations;
48568+const struct inode_operations proc_sys_inode_operations;
48569 static const struct file_operations proc_sys_dir_file_operations;
48570-static const struct inode_operations proc_sys_dir_operations;
48571+const struct inode_operations proc_sys_dir_operations;
48572
48573 static struct inode *proc_sys_make_inode(struct super_block *sb,
48574 struct ctl_table_header *head, struct ctl_table *table)
48575@@ -121,8 +123,14 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
48576
48577 err = NULL;
48578 d_set_d_op(dentry, &proc_sys_dentry_operations);
48579+
48580+ gr_handle_proc_create(dentry, inode);
48581+
48582 d_add(dentry, inode);
48583
48584+ if (gr_handle_sysctl(p, MAY_EXEC))
48585+ err = ERR_PTR(-ENOENT);
48586+
48587 out:
48588 sysctl_head_finish(head);
48589 return err;
48590@@ -202,6 +210,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
48591 return -ENOMEM;
48592 } else {
48593 d_set_d_op(child, &proc_sys_dentry_operations);
48594+
48595+ gr_handle_proc_create(child, inode);
48596+
48597 d_add(child, inode);
48598 }
48599 } else {
48600@@ -230,6 +241,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
48601 if (*pos < file->f_pos)
48602 continue;
48603
48604+ if (gr_handle_sysctl(table, 0))
48605+ continue;
48606+
48607 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
48608 if (res)
48609 return res;
48610@@ -355,6 +369,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
48611 if (IS_ERR(head))
48612 return PTR_ERR(head);
48613
48614+ if (table && gr_handle_sysctl(table, MAY_EXEC))
48615+ return -ENOENT;
48616+
48617 generic_fillattr(inode, stat);
48618 if (table)
48619 stat->mode = (stat->mode & S_IFMT) | table->mode;
48620@@ -370,17 +387,18 @@ static const struct file_operations proc_sys_file_operations = {
48621 };
48622
48623 static const struct file_operations proc_sys_dir_file_operations = {
48624+ .read = generic_read_dir,
48625 .readdir = proc_sys_readdir,
48626 .llseek = generic_file_llseek,
48627 };
48628
48629-static const struct inode_operations proc_sys_inode_operations = {
48630+const struct inode_operations proc_sys_inode_operations = {
48631 .permission = proc_sys_permission,
48632 .setattr = proc_sys_setattr,
48633 .getattr = proc_sys_getattr,
48634 };
48635
48636-static const struct inode_operations proc_sys_dir_operations = {
48637+const struct inode_operations proc_sys_dir_operations = {
48638 .lookup = proc_sys_lookup,
48639 .permission = proc_sys_permission,
48640 .setattr = proc_sys_setattr,
48641diff --git a/fs/proc/root.c b/fs/proc/root.c
48642index 9a8a2b7..3018df6 100644
48643--- a/fs/proc/root.c
48644+++ b/fs/proc/root.c
48645@@ -123,7 +123,15 @@ void __init proc_root_init(void)
48646 #ifdef CONFIG_PROC_DEVICETREE
48647 proc_device_tree_init();
48648 #endif
48649+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48650+#ifdef CONFIG_GRKERNSEC_PROC_USER
48651+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
48652+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48653+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
48654+#endif
48655+#else
48656 proc_mkdir("bus", NULL);
48657+#endif
48658 proc_sys_init();
48659 }
48660
48661diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
48662index c7d4ee6..41c5564 100644
48663--- a/fs/proc/task_mmu.c
48664+++ b/fs/proc/task_mmu.c
48665@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48666 "VmExe:\t%8lu kB\n"
48667 "VmLib:\t%8lu kB\n"
48668 "VmPTE:\t%8lu kB\n"
48669- "VmSwap:\t%8lu kB\n",
48670- hiwater_vm << (PAGE_SHIFT-10),
48671+ "VmSwap:\t%8lu kB\n"
48672+
48673+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48674+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
48675+#endif
48676+
48677+ ,hiwater_vm << (PAGE_SHIFT-10),
48678 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
48679 mm->locked_vm << (PAGE_SHIFT-10),
48680 hiwater_rss << (PAGE_SHIFT-10),
48681@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48682 data << (PAGE_SHIFT-10),
48683 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
48684 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
48685- swap << (PAGE_SHIFT-10));
48686+ swap << (PAGE_SHIFT-10)
48687+
48688+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48689+ , mm->context.user_cs_base, mm->context.user_cs_limit
48690+#endif
48691+
48692+ );
48693 }
48694
48695 unsigned long task_vsize(struct mm_struct *mm)
48696@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *inode, struct file *file,
48697 return ret;
48698 }
48699
48700+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48701+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48702+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
48703+ _mm->pax_flags & MF_PAX_SEGMEXEC))
48704+#endif
48705+
48706 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48707 {
48708 struct mm_struct *mm = vma->vm_mm;
48709@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48710 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
48711 }
48712
48713- /* We don't show the stack guard page in /proc/maps */
48714+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48715+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
48716+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
48717+#else
48718 start = vma->vm_start;
48719- if (stack_guard_page_start(vma, start))
48720- start += PAGE_SIZE;
48721 end = vma->vm_end;
48722- if (stack_guard_page_end(vma, end))
48723- end -= PAGE_SIZE;
48724+#endif
48725
48726 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
48727 start,
48728@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48729 flags & VM_WRITE ? 'w' : '-',
48730 flags & VM_EXEC ? 'x' : '-',
48731 flags & VM_MAYSHARE ? 's' : 'p',
48732+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48733+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
48734+#else
48735 pgoff,
48736+#endif
48737 MAJOR(dev), MINOR(dev), ino, &len);
48738
48739 /*
48740@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48741 */
48742 if (file) {
48743 pad_len_spaces(m, len);
48744- seq_path(m, &file->f_path, "\n");
48745+ seq_path(m, &file->f_path, "\n\\");
48746 } else {
48747 const char *name = arch_vma_name(vma);
48748 if (!name) {
48749@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48750 if (vma->vm_start <= mm->brk &&
48751 vma->vm_end >= mm->start_brk) {
48752 name = "[heap]";
48753- } else if (vma->vm_start <= mm->start_stack &&
48754- vma->vm_end >= mm->start_stack) {
48755+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
48756+ (vma->vm_start <= mm->start_stack &&
48757+ vma->vm_end >= mm->start_stack)) {
48758 name = "[stack]";
48759 }
48760 } else {
48761@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m, void *v)
48762 };
48763
48764 memset(&mss, 0, sizeof mss);
48765- mss.vma = vma;
48766- /* mmap_sem is held in m_start */
48767- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48768- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48769-
48770+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48771+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
48772+#endif
48773+ mss.vma = vma;
48774+ /* mmap_sem is held in m_start */
48775+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48776+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48777+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48778+ }
48779+#endif
48780 show_map_vma(m, vma);
48781
48782 seq_printf(m,
48783@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m, void *v)
48784 "KernelPageSize: %8lu kB\n"
48785 "MMUPageSize: %8lu kB\n"
48786 "Locked: %8lu kB\n",
48787+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48788+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
48789+#else
48790 (vma->vm_end - vma->vm_start) >> 10,
48791+#endif
48792 mss.resident >> 10,
48793 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
48794 mss.shared_clean >> 10,
48795@@ -1031,7 +1062,7 @@ static int show_numa_map(struct seq_file *m, void *v)
48796
48797 if (file) {
48798 seq_printf(m, " file=");
48799- seq_path(m, &file->f_path, "\n\t= ");
48800+ seq_path(m, &file->f_path, "\n\t\\= ");
48801 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
48802 seq_printf(m, " heap");
48803 } else if (vma->vm_start <= mm->start_stack &&
48804diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
48805index 980de54..2a4db5f 100644
48806--- a/fs/proc/task_nommu.c
48807+++ b/fs/proc/task_nommu.c
48808@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48809 else
48810 bytes += kobjsize(mm);
48811
48812- if (current->fs && current->fs->users > 1)
48813+ if (current->fs && atomic_read(&current->fs->users) > 1)
48814 sbytes += kobjsize(current->fs);
48815 else
48816 bytes += kobjsize(current->fs);
48817@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
48818
48819 if (file) {
48820 pad_len_spaces(m, len);
48821- seq_path(m, &file->f_path, "");
48822+ seq_path(m, &file->f_path, "\n\\");
48823 } else if (mm) {
48824 if (vma->vm_start <= mm->start_stack &&
48825 vma->vm_end >= mm->start_stack) {
48826diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
48827index d67908b..d13f6a6 100644
48828--- a/fs/quota/netlink.c
48829+++ b/fs/quota/netlink.c
48830@@ -33,7 +33,7 @@ static struct genl_family quota_genl_family = {
48831 void quota_send_warning(short type, unsigned int id, dev_t dev,
48832 const char warntype)
48833 {
48834- static atomic_t seq;
48835+ static atomic_unchecked_t seq;
48836 struct sk_buff *skb;
48837 void *msg_head;
48838 int ret;
48839@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsigned int id, dev_t dev,
48840 "VFS: Not enough memory to send quota warning.\n");
48841 return;
48842 }
48843- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
48844+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
48845 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
48846 if (!msg_head) {
48847 printk(KERN_ERR
48848diff --git a/fs/readdir.c b/fs/readdir.c
48849index 356f715..c918d38 100644
48850--- a/fs/readdir.c
48851+++ b/fs/readdir.c
48852@@ -17,6 +17,7 @@
48853 #include <linux/security.h>
48854 #include <linux/syscalls.h>
48855 #include <linux/unistd.h>
48856+#include <linux/namei.h>
48857
48858 #include <asm/uaccess.h>
48859
48860@@ -67,6 +68,7 @@ struct old_linux_dirent {
48861
48862 struct readdir_callback {
48863 struct old_linux_dirent __user * dirent;
48864+ struct file * file;
48865 int result;
48866 };
48867
48868@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
48869 buf->result = -EOVERFLOW;
48870 return -EOVERFLOW;
48871 }
48872+
48873+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48874+ return 0;
48875+
48876 buf->result++;
48877 dirent = buf->dirent;
48878 if (!access_ok(VERIFY_WRITE, dirent,
48879@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
48880
48881 buf.result = 0;
48882 buf.dirent = dirent;
48883+ buf.file = file;
48884
48885 error = vfs_readdir(file, fillonedir, &buf);
48886 if (buf.result)
48887@@ -142,6 +149,7 @@ struct linux_dirent {
48888 struct getdents_callback {
48889 struct linux_dirent __user * current_dir;
48890 struct linux_dirent __user * previous;
48891+ struct file * file;
48892 int count;
48893 int error;
48894 };
48895@@ -163,6 +171,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
48896 buf->error = -EOVERFLOW;
48897 return -EOVERFLOW;
48898 }
48899+
48900+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48901+ return 0;
48902+
48903 dirent = buf->previous;
48904 if (dirent) {
48905 if (__put_user(offset, &dirent->d_off))
48906@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
48907 buf.previous = NULL;
48908 buf.count = count;
48909 buf.error = 0;
48910+ buf.file = file;
48911
48912 error = vfs_readdir(file, filldir, &buf);
48913 if (error >= 0)
48914@@ -229,6 +242,7 @@ out:
48915 struct getdents_callback64 {
48916 struct linux_dirent64 __user * current_dir;
48917 struct linux_dirent64 __user * previous;
48918+ struct file *file;
48919 int count;
48920 int error;
48921 };
48922@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
48923 buf->error = -EINVAL; /* only used if we fail.. */
48924 if (reclen > buf->count)
48925 return -EINVAL;
48926+
48927+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48928+ return 0;
48929+
48930 dirent = buf->previous;
48931 if (dirent) {
48932 if (__put_user(offset, &dirent->d_off))
48933@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
48934
48935 buf.current_dir = dirent;
48936 buf.previous = NULL;
48937+ buf.file = file;
48938 buf.count = count;
48939 buf.error = 0;
48940
48941@@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
48942 error = buf.error;
48943 lastdirent = buf.previous;
48944 if (lastdirent) {
48945- typeof(lastdirent->d_off) d_off = file->f_pos;
48946+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
48947 if (__put_user(d_off, &lastdirent->d_off))
48948 error = -EFAULT;
48949 else
48950diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
48951index 133e935..349ef18 100644
48952--- a/fs/reiserfs/dir.c
48953+++ b/fs/reiserfs/dir.c
48954@@ -75,6 +75,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
48955 struct reiserfs_dir_entry de;
48956 int ret = 0;
48957
48958+ pax_track_stack();
48959+
48960 reiserfs_write_lock(inode->i_sb);
48961
48962 reiserfs_check_lock_depth(inode->i_sb, "readdir");
48963diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
48964index 60c0804..d814f98 100644
48965--- a/fs/reiserfs/do_balan.c
48966+++ b/fs/reiserfs/do_balan.c
48967@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
48968 return;
48969 }
48970
48971- atomic_inc(&(fs_generation(tb->tb_sb)));
48972+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
48973 do_balance_starts(tb);
48974
48975 /* balance leaf returns 0 except if combining L R and S into
48976diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
48977index a159ba5..0396a76 100644
48978--- a/fs/reiserfs/journal.c
48979+++ b/fs/reiserfs/journal.c
48980@@ -2289,6 +2289,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
48981 struct buffer_head *bh;
48982 int i, j;
48983
48984+ pax_track_stack();
48985+
48986 bh = __getblk(dev, block, bufsize);
48987 if (buffer_uptodate(bh))
48988 return (bh);
48989diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
48990index ef39232..0fa91ba 100644
48991--- a/fs/reiserfs/namei.c
48992+++ b/fs/reiserfs/namei.c
48993@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
48994 unsigned long savelink = 1;
48995 struct timespec ctime;
48996
48997+ pax_track_stack();
48998+
48999 /* three balancings: (1) old name removal, (2) new name insertion
49000 and (3) maybe "save" link insertion
49001 stat data updates: (1) old directory,
49002diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
49003index 7a99811..2c9286f 100644
49004--- a/fs/reiserfs/procfs.c
49005+++ b/fs/reiserfs/procfs.c
49006@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
49007 "SMALL_TAILS " : "NO_TAILS ",
49008 replay_only(sb) ? "REPLAY_ONLY " : "",
49009 convert_reiserfs(sb) ? "CONV " : "",
49010- atomic_read(&r->s_generation_counter),
49011+ atomic_read_unchecked(&r->s_generation_counter),
49012 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
49013 SF(s_do_balance), SF(s_unneeded_left_neighbor),
49014 SF(s_good_search_by_key_reada), SF(s_bmaps),
49015@@ -299,6 +299,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
49016 struct journal_params *jp = &rs->s_v1.s_journal;
49017 char b[BDEVNAME_SIZE];
49018
49019+ pax_track_stack();
49020+
49021 seq_printf(m, /* on-disk fields */
49022 "jp_journal_1st_block: \t%i\n"
49023 "jp_journal_dev: \t%s[%x]\n"
49024diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
49025index 313d39d..3a5811b 100644
49026--- a/fs/reiserfs/stree.c
49027+++ b/fs/reiserfs/stree.c
49028@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
49029 int iter = 0;
49030 #endif
49031
49032+ pax_track_stack();
49033+
49034 BUG_ON(!th->t_trans_id);
49035
49036 init_tb_struct(th, &s_del_balance, sb, path,
49037@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
49038 int retval;
49039 int quota_cut_bytes = 0;
49040
49041+ pax_track_stack();
49042+
49043 BUG_ON(!th->t_trans_id);
49044
49045 le_key2cpu_key(&cpu_key, key);
49046@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
49047 int quota_cut_bytes;
49048 loff_t tail_pos = 0;
49049
49050+ pax_track_stack();
49051+
49052 BUG_ON(!th->t_trans_id);
49053
49054 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
49055@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
49056 int retval;
49057 int fs_gen;
49058
49059+ pax_track_stack();
49060+
49061 BUG_ON(!th->t_trans_id);
49062
49063 fs_gen = get_generation(inode->i_sb);
49064@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
49065 int fs_gen = 0;
49066 int quota_bytes = 0;
49067
49068+ pax_track_stack();
49069+
49070 BUG_ON(!th->t_trans_id);
49071
49072 if (inode) { /* Do we count quotas for item? */
49073diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
49074index 14363b9..dd95a04 100644
49075--- a/fs/reiserfs/super.c
49076+++ b/fs/reiserfs/super.c
49077@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
49078 {.option_name = NULL}
49079 };
49080
49081+ pax_track_stack();
49082+
49083 *blocks = 0;
49084 if (!options || !*options)
49085 /* use default configuration: create tails, journaling on, no
49086diff --git a/fs/select.c b/fs/select.c
49087index d33418f..f8e06bc 100644
49088--- a/fs/select.c
49089+++ b/fs/select.c
49090@@ -20,6 +20,7 @@
49091 #include <linux/module.h>
49092 #include <linux/slab.h>
49093 #include <linux/poll.h>
49094+#include <linux/security.h>
49095 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
49096 #include <linux/file.h>
49097 #include <linux/fdtable.h>
49098@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
49099 int retval, i, timed_out = 0;
49100 unsigned long slack = 0;
49101
49102+ pax_track_stack();
49103+
49104 rcu_read_lock();
49105 retval = max_select_fd(n, fds);
49106 rcu_read_unlock();
49107@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
49108 /* Allocate small arguments on the stack to save memory and be faster */
49109 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
49110
49111+ pax_track_stack();
49112+
49113 ret = -EINVAL;
49114 if (n < 0)
49115 goto out_nofds;
49116@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
49117 struct poll_list *walk = head;
49118 unsigned long todo = nfds;
49119
49120+ pax_track_stack();
49121+
49122+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
49123 if (nfds > rlimit(RLIMIT_NOFILE))
49124 return -EINVAL;
49125
49126diff --git a/fs/seq_file.c b/fs/seq_file.c
49127index dba43c3..a99fb63 100644
49128--- a/fs/seq_file.c
49129+++ b/fs/seq_file.c
49130@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49131 return 0;
49132 }
49133 if (!m->buf) {
49134- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49135+ m->size = PAGE_SIZE;
49136+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49137 if (!m->buf)
49138 return -ENOMEM;
49139 }
49140@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49141 Eoverflow:
49142 m->op->stop(m, p);
49143 kfree(m->buf);
49144- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49145+ m->size <<= 1;
49146+ m->buf = kmalloc(m->size, GFP_KERNEL);
49147 return !m->buf ? -ENOMEM : -EAGAIN;
49148 }
49149
49150@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49151 m->version = file->f_version;
49152 /* grab buffer if we didn't have one */
49153 if (!m->buf) {
49154- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49155+ m->size = PAGE_SIZE;
49156+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49157 if (!m->buf)
49158 goto Enomem;
49159 }
49160@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49161 goto Fill;
49162 m->op->stop(m, p);
49163 kfree(m->buf);
49164- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49165+ m->size <<= 1;
49166+ m->buf = kmalloc(m->size, GFP_KERNEL);
49167 if (!m->buf)
49168 goto Enomem;
49169 m->count = 0;
49170@@ -549,7 +553,7 @@ static void single_stop(struct seq_file *p, void *v)
49171 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
49172 void *data)
49173 {
49174- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
49175+ seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
49176 int res = -ENOMEM;
49177
49178 if (op) {
49179diff --git a/fs/splice.c b/fs/splice.c
49180index fa2defa..9a697a5 100644
49181--- a/fs/splice.c
49182+++ b/fs/splice.c
49183@@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49184 pipe_lock(pipe);
49185
49186 for (;;) {
49187- if (!pipe->readers) {
49188+ if (!atomic_read(&pipe->readers)) {
49189 send_sig(SIGPIPE, current, 0);
49190 if (!ret)
49191 ret = -EPIPE;
49192@@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49193 do_wakeup = 0;
49194 }
49195
49196- pipe->waiting_writers++;
49197+ atomic_inc(&pipe->waiting_writers);
49198 pipe_wait(pipe);
49199- pipe->waiting_writers--;
49200+ atomic_dec(&pipe->waiting_writers);
49201 }
49202
49203 pipe_unlock(pipe);
49204@@ -320,6 +320,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
49205 .spd_release = spd_release_page,
49206 };
49207
49208+ pax_track_stack();
49209+
49210 if (splice_grow_spd(pipe, &spd))
49211 return -ENOMEM;
49212
49213@@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
49214 old_fs = get_fs();
49215 set_fs(get_ds());
49216 /* The cast to a user pointer is valid due to the set_fs() */
49217- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
49218+ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
49219 set_fs(old_fs);
49220
49221 return res;
49222@@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
49223 old_fs = get_fs();
49224 set_fs(get_ds());
49225 /* The cast to a user pointer is valid due to the set_fs() */
49226- res = vfs_write(file, (const char __user *)buf, count, &pos);
49227+ res = vfs_write(file, (const char __force_user *)buf, count, &pos);
49228 set_fs(old_fs);
49229
49230 return res;
49231@@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49232 .spd_release = spd_release_page,
49233 };
49234
49235+ pax_track_stack();
49236+
49237 if (splice_grow_spd(pipe, &spd))
49238 return -ENOMEM;
49239
49240@@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49241 goto err;
49242
49243 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
49244- vec[i].iov_base = (void __user *) page_address(page);
49245+ vec[i].iov_base = (void __force_user *) page_address(page);
49246 vec[i].iov_len = this_len;
49247 spd.pages[i] = page;
49248 spd.nr_pages++;
49249@@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
49250 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
49251 {
49252 while (!pipe->nrbufs) {
49253- if (!pipe->writers)
49254+ if (!atomic_read(&pipe->writers))
49255 return 0;
49256
49257- if (!pipe->waiting_writers && sd->num_spliced)
49258+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
49259 return 0;
49260
49261 if (sd->flags & SPLICE_F_NONBLOCK)
49262@@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
49263 * out of the pipe right after the splice_to_pipe(). So set
49264 * PIPE_READERS appropriately.
49265 */
49266- pipe->readers = 1;
49267+ atomic_set(&pipe->readers, 1);
49268
49269 current->splice_pipe = pipe;
49270 }
49271@@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
49272 };
49273 long ret;
49274
49275+ pax_track_stack();
49276+
49277 pipe = get_pipe_info(file);
49278 if (!pipe)
49279 return -EBADF;
49280@@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49281 ret = -ERESTARTSYS;
49282 break;
49283 }
49284- if (!pipe->writers)
49285+ if (!atomic_read(&pipe->writers))
49286 break;
49287- if (!pipe->waiting_writers) {
49288+ if (!atomic_read(&pipe->waiting_writers)) {
49289 if (flags & SPLICE_F_NONBLOCK) {
49290 ret = -EAGAIN;
49291 break;
49292@@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49293 pipe_lock(pipe);
49294
49295 while (pipe->nrbufs >= pipe->buffers) {
49296- if (!pipe->readers) {
49297+ if (!atomic_read(&pipe->readers)) {
49298 send_sig(SIGPIPE, current, 0);
49299 ret = -EPIPE;
49300 break;
49301@@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49302 ret = -ERESTARTSYS;
49303 break;
49304 }
49305- pipe->waiting_writers++;
49306+ atomic_inc(&pipe->waiting_writers);
49307 pipe_wait(pipe);
49308- pipe->waiting_writers--;
49309+ atomic_dec(&pipe->waiting_writers);
49310 }
49311
49312 pipe_unlock(pipe);
49313@@ -1819,14 +1825,14 @@ retry:
49314 pipe_double_lock(ipipe, opipe);
49315
49316 do {
49317- if (!opipe->readers) {
49318+ if (!atomic_read(&opipe->readers)) {
49319 send_sig(SIGPIPE, current, 0);
49320 if (!ret)
49321 ret = -EPIPE;
49322 break;
49323 }
49324
49325- if (!ipipe->nrbufs && !ipipe->writers)
49326+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
49327 break;
49328
49329 /*
49330@@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49331 pipe_double_lock(ipipe, opipe);
49332
49333 do {
49334- if (!opipe->readers) {
49335+ if (!atomic_read(&opipe->readers)) {
49336 send_sig(SIGPIPE, current, 0);
49337 if (!ret)
49338 ret = -EPIPE;
49339@@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49340 * return EAGAIN if we have the potential of some data in the
49341 * future, otherwise just return 0
49342 */
49343- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
49344+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
49345 ret = -EAGAIN;
49346
49347 pipe_unlock(ipipe);
49348diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
49349index 1ad8c93..6633545 100644
49350--- a/fs/sysfs/file.c
49351+++ b/fs/sysfs/file.c
49352@@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
49353
49354 struct sysfs_open_dirent {
49355 atomic_t refcnt;
49356- atomic_t event;
49357+ atomic_unchecked_t event;
49358 wait_queue_head_t poll;
49359 struct list_head buffers; /* goes through sysfs_buffer.list */
49360 };
49361@@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
49362 if (!sysfs_get_active(attr_sd))
49363 return -ENODEV;
49364
49365- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
49366+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
49367 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
49368
49369 sysfs_put_active(attr_sd);
49370@@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
49371 return -ENOMEM;
49372
49373 atomic_set(&new_od->refcnt, 0);
49374- atomic_set(&new_od->event, 1);
49375+ atomic_set_unchecked(&new_od->event, 1);
49376 init_waitqueue_head(&new_od->poll);
49377 INIT_LIST_HEAD(&new_od->buffers);
49378 goto retry;
49379@@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
49380
49381 sysfs_put_active(attr_sd);
49382
49383- if (buffer->event != atomic_read(&od->event))
49384+ if (buffer->event != atomic_read_unchecked(&od->event))
49385 goto trigger;
49386
49387 return DEFAULT_POLLMASK;
49388@@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
49389
49390 od = sd->s_attr.open;
49391 if (od) {
49392- atomic_inc(&od->event);
49393+ atomic_inc_unchecked(&od->event);
49394 wake_up_interruptible(&od->poll);
49395 }
49396
49397diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
49398index e34f0d9..740ea7b 100644
49399--- a/fs/sysfs/mount.c
49400+++ b/fs/sysfs/mount.c
49401@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
49402 .s_name = "",
49403 .s_count = ATOMIC_INIT(1),
49404 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
49405+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
49406+ .s_mode = S_IFDIR | S_IRWXU,
49407+#else
49408 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
49409+#endif
49410 .s_ino = 1,
49411 };
49412
49413diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
49414index a7ac78f..02158e1 100644
49415--- a/fs/sysfs/symlink.c
49416+++ b/fs/sysfs/symlink.c
49417@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
49418
49419 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49420 {
49421- char *page = nd_get_link(nd);
49422+ const char *page = nd_get_link(nd);
49423 if (!IS_ERR(page))
49424 free_page((unsigned long)page);
49425 }
49426diff --git a/fs/udf/inode.c b/fs/udf/inode.c
49427index 1d1358e..408bedb 100644
49428--- a/fs/udf/inode.c
49429+++ b/fs/udf/inode.c
49430@@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
49431 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
49432 int lastblock = 0;
49433
49434+ pax_track_stack();
49435+
49436 prev_epos.offset = udf_file_entry_alloc_offset(inode);
49437 prev_epos.block = iinfo->i_location;
49438 prev_epos.bh = NULL;
49439diff --git a/fs/udf/misc.c b/fs/udf/misc.c
49440index 9215700..bf1f68e 100644
49441--- a/fs/udf/misc.c
49442+++ b/fs/udf/misc.c
49443@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
49444
49445 u8 udf_tag_checksum(const struct tag *t)
49446 {
49447- u8 *data = (u8 *)t;
49448+ const u8 *data = (const u8 *)t;
49449 u8 checksum = 0;
49450 int i;
49451 for (i = 0; i < sizeof(struct tag); ++i)
49452diff --git a/fs/utimes.c b/fs/utimes.c
49453index ba653f3..06ea4b1 100644
49454--- a/fs/utimes.c
49455+++ b/fs/utimes.c
49456@@ -1,6 +1,7 @@
49457 #include <linux/compiler.h>
49458 #include <linux/file.h>
49459 #include <linux/fs.h>
49460+#include <linux/security.h>
49461 #include <linux/linkage.h>
49462 #include <linux/mount.h>
49463 #include <linux/namei.h>
49464@@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
49465 goto mnt_drop_write_and_out;
49466 }
49467 }
49468+
49469+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
49470+ error = -EACCES;
49471+ goto mnt_drop_write_and_out;
49472+ }
49473+
49474 mutex_lock(&inode->i_mutex);
49475 error = notify_change(path->dentry, &newattrs);
49476 mutex_unlock(&inode->i_mutex);
49477diff --git a/fs/xattr.c b/fs/xattr.c
49478index f060663..def7007 100644
49479--- a/fs/xattr.c
49480+++ b/fs/xattr.c
49481@@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
49482 * Extended attribute SET operations
49483 */
49484 static long
49485-setxattr(struct dentry *d, const char __user *name, const void __user *value,
49486+setxattr(struct path *path, const char __user *name, const void __user *value,
49487 size_t size, int flags)
49488 {
49489 int error;
49490@@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
49491 return PTR_ERR(kvalue);
49492 }
49493
49494- error = vfs_setxattr(d, kname, kvalue, size, flags);
49495+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
49496+ error = -EACCES;
49497+ goto out;
49498+ }
49499+
49500+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
49501+out:
49502 kfree(kvalue);
49503 return error;
49504 }
49505@@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
49506 return error;
49507 error = mnt_want_write(path.mnt);
49508 if (!error) {
49509- error = setxattr(path.dentry, name, value, size, flags);
49510+ error = setxattr(&path, name, value, size, flags);
49511 mnt_drop_write(path.mnt);
49512 }
49513 path_put(&path);
49514@@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
49515 return error;
49516 error = mnt_want_write(path.mnt);
49517 if (!error) {
49518- error = setxattr(path.dentry, name, value, size, flags);
49519+ error = setxattr(&path, name, value, size, flags);
49520 mnt_drop_write(path.mnt);
49521 }
49522 path_put(&path);
49523@@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
49524 const void __user *,value, size_t, size, int, flags)
49525 {
49526 struct file *f;
49527- struct dentry *dentry;
49528 int error = -EBADF;
49529
49530 f = fget(fd);
49531 if (!f)
49532 return error;
49533- dentry = f->f_path.dentry;
49534- audit_inode(NULL, dentry);
49535+ audit_inode(NULL, f->f_path.dentry);
49536 error = mnt_want_write_file(f);
49537 if (!error) {
49538- error = setxattr(dentry, name, value, size, flags);
49539+ error = setxattr(&f->f_path, name, value, size, flags);
49540 mnt_drop_write(f->f_path.mnt);
49541 }
49542 fput(f);
49543diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
49544index 8d5a506..7f62712 100644
49545--- a/fs/xattr_acl.c
49546+++ b/fs/xattr_acl.c
49547@@ -17,8 +17,8 @@
49548 struct posix_acl *
49549 posix_acl_from_xattr(const void *value, size_t size)
49550 {
49551- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
49552- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
49553+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
49554+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
49555 int count;
49556 struct posix_acl *acl;
49557 struct posix_acl_entry *acl_e;
49558diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
49559index 452a291..91a95f3b 100644
49560--- a/fs/xfs/xfs_bmap.c
49561+++ b/fs/xfs/xfs_bmap.c
49562@@ -250,7 +250,7 @@ xfs_bmap_validate_ret(
49563 int nmap,
49564 int ret_nmap);
49565 #else
49566-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
49567+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
49568 #endif /* DEBUG */
49569
49570 STATIC int
49571diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
49572index 79d05e8..e3e5861 100644
49573--- a/fs/xfs/xfs_dir2_sf.c
49574+++ b/fs/xfs/xfs_dir2_sf.c
49575@@ -852,7 +852,15 @@ xfs_dir2_sf_getdents(
49576 }
49577
49578 ino = xfs_dir2_sfe_get_ino(sfp, sfep);
49579- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
49580+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
49581+ char name[sfep->namelen];
49582+ memcpy(name, sfep->name, sfep->namelen);
49583+ if (filldir(dirent, name, sfep->namelen,
49584+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
49585+ *offset = off & 0x7fffffff;
49586+ return 0;
49587+ }
49588+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
49589 off & 0x7fffffff, ino, DT_UNKNOWN)) {
49590 *offset = off & 0x7fffffff;
49591 return 0;
49592diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
49593index f7ce7de..e1a5db0 100644
49594--- a/fs/xfs/xfs_ioctl.c
49595+++ b/fs/xfs/xfs_ioctl.c
49596@@ -128,7 +128,7 @@ xfs_find_handle(
49597 }
49598
49599 error = -EFAULT;
49600- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
49601+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
49602 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
49603 goto out_put;
49604
49605diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
49606index 474920b..97169a9 100644
49607--- a/fs/xfs/xfs_iops.c
49608+++ b/fs/xfs/xfs_iops.c
49609@@ -446,7 +446,7 @@ xfs_vn_put_link(
49610 struct nameidata *nd,
49611 void *p)
49612 {
49613- char *s = nd_get_link(nd);
49614+ const char *s = nd_get_link(nd);
49615
49616 if (!IS_ERR(s))
49617 kfree(s);
49618diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
49619new file mode 100644
49620index 0000000..4639511
49621--- /dev/null
49622+++ b/grsecurity/Kconfig
49623@@ -0,0 +1,1051 @@
49624+#
49625+# grecurity configuration
49626+#
49627+
49628+menu "Grsecurity"
49629+
49630+config GRKERNSEC
49631+ bool "Grsecurity"
49632+ select CRYPTO
49633+ select CRYPTO_SHA256
49634+ help
49635+ If you say Y here, you will be able to configure many features
49636+ that will enhance the security of your system. It is highly
49637+ recommended that you say Y here and read through the help
49638+ for each option so that you fully understand the features and
49639+ can evaluate their usefulness for your machine.
49640+
49641+choice
49642+ prompt "Security Level"
49643+ depends on GRKERNSEC
49644+ default GRKERNSEC_CUSTOM
49645+
49646+config GRKERNSEC_LOW
49647+ bool "Low"
49648+ select GRKERNSEC_LINK
49649+ select GRKERNSEC_FIFO
49650+ select GRKERNSEC_RANDNET
49651+ select GRKERNSEC_DMESG
49652+ select GRKERNSEC_CHROOT
49653+ select GRKERNSEC_CHROOT_CHDIR
49654+
49655+ help
49656+ If you choose this option, several of the grsecurity options will
49657+ be enabled that will give you greater protection against a number
49658+ of attacks, while assuring that none of your software will have any
49659+ conflicts with the additional security measures. If you run a lot
49660+ of unusual software, or you are having problems with the higher
49661+ security levels, you should say Y here. With this option, the
49662+ following features are enabled:
49663+
49664+ - Linking restrictions
49665+ - FIFO restrictions
49666+ - Restricted dmesg
49667+ - Enforced chdir("/") on chroot
49668+ - Runtime module disabling
49669+
49670+config GRKERNSEC_MEDIUM
49671+ bool "Medium"
49672+ select PAX
49673+ select PAX_EI_PAX
49674+ select PAX_PT_PAX_FLAGS
49675+ select PAX_HAVE_ACL_FLAGS
49676+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
49677+ select GRKERNSEC_CHROOT
49678+ select GRKERNSEC_CHROOT_SYSCTL
49679+ select GRKERNSEC_LINK
49680+ select GRKERNSEC_FIFO
49681+ select GRKERNSEC_DMESG
49682+ select GRKERNSEC_RANDNET
49683+ select GRKERNSEC_FORKFAIL
49684+ select GRKERNSEC_TIME
49685+ select GRKERNSEC_SIGNAL
49686+ select GRKERNSEC_CHROOT
49687+ select GRKERNSEC_CHROOT_UNIX
49688+ select GRKERNSEC_CHROOT_MOUNT
49689+ select GRKERNSEC_CHROOT_PIVOT
49690+ select GRKERNSEC_CHROOT_DOUBLE
49691+ select GRKERNSEC_CHROOT_CHDIR
49692+ select GRKERNSEC_CHROOT_MKNOD
49693+ select GRKERNSEC_PROC
49694+ select GRKERNSEC_PROC_USERGROUP
49695+ select PAX_RANDUSTACK
49696+ select PAX_ASLR
49697+ select PAX_RANDMMAP
49698+ select PAX_REFCOUNT if (X86 || SPARC64)
49699+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
49700+
49701+ help
49702+ If you say Y here, several features in addition to those included
49703+ in the low additional security level will be enabled. These
49704+ features provide even more security to your system, though in rare
49705+ cases they may be incompatible with very old or poorly written
49706+ software. If you enable this option, make sure that your auth
49707+ service (identd) is running as gid 1001. With this option,
49708+ the following features (in addition to those provided in the
49709+ low additional security level) will be enabled:
49710+
49711+ - Failed fork logging
49712+ - Time change logging
49713+ - Signal logging
49714+ - Deny mounts in chroot
49715+ - Deny double chrooting
49716+ - Deny sysctl writes in chroot
49717+ - Deny mknod in chroot
49718+ - Deny access to abstract AF_UNIX sockets out of chroot
49719+ - Deny pivot_root in chroot
49720+ - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
49721+ - /proc restrictions with special GID set to 10 (usually wheel)
49722+ - Address Space Layout Randomization (ASLR)
49723+ - Prevent exploitation of most refcount overflows
49724+ - Bounds checking of copying between the kernel and userland
49725+
49726+config GRKERNSEC_HIGH
49727+ bool "High"
49728+ select GRKERNSEC_LINK
49729+ select GRKERNSEC_FIFO
49730+ select GRKERNSEC_DMESG
49731+ select GRKERNSEC_FORKFAIL
49732+ select GRKERNSEC_TIME
49733+ select GRKERNSEC_SIGNAL
49734+ select GRKERNSEC_CHROOT
49735+ select GRKERNSEC_CHROOT_SHMAT
49736+ select GRKERNSEC_CHROOT_UNIX
49737+ select GRKERNSEC_CHROOT_MOUNT
49738+ select GRKERNSEC_CHROOT_FCHDIR
49739+ select GRKERNSEC_CHROOT_PIVOT
49740+ select GRKERNSEC_CHROOT_DOUBLE
49741+ select GRKERNSEC_CHROOT_CHDIR
49742+ select GRKERNSEC_CHROOT_MKNOD
49743+ select GRKERNSEC_CHROOT_CAPS
49744+ select GRKERNSEC_CHROOT_SYSCTL
49745+ select GRKERNSEC_CHROOT_FINDTASK
49746+ select GRKERNSEC_SYSFS_RESTRICT
49747+ select GRKERNSEC_PROC
49748+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
49749+ select GRKERNSEC_HIDESYM
49750+ select GRKERNSEC_BRUTE
49751+ select GRKERNSEC_PROC_USERGROUP
49752+ select GRKERNSEC_KMEM
49753+ select GRKERNSEC_RESLOG
49754+ select GRKERNSEC_RANDNET
49755+ select GRKERNSEC_PROC_ADD
49756+ select GRKERNSEC_CHROOT_CHMOD
49757+ select GRKERNSEC_CHROOT_NICE
49758+ select GRKERNSEC_SETXID
49759+ select GRKERNSEC_AUDIT_MOUNT
49760+ select GRKERNSEC_MODHARDEN if (MODULES)
49761+ select GRKERNSEC_HARDEN_PTRACE
49762+ select GRKERNSEC_VM86 if (X86_32)
49763+ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
49764+ select PAX
49765+ select PAX_RANDUSTACK
49766+ select PAX_ASLR
49767+ select PAX_RANDMMAP
49768+ select PAX_NOEXEC
49769+ select PAX_MPROTECT
49770+ select PAX_EI_PAX
49771+ select PAX_PT_PAX_FLAGS
49772+ select PAX_HAVE_ACL_FLAGS
49773+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
49774+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
49775+ select PAX_RANDKSTACK if (X86_TSC && X86)
49776+ select PAX_SEGMEXEC if (X86_32)
49777+ select PAX_PAGEEXEC
49778+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
49779+ select PAX_EMUTRAMP if (PARISC)
49780+ select PAX_EMUSIGRT if (PARISC)
49781+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
49782+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
49783+ select PAX_REFCOUNT if (X86 || SPARC64)
49784+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
49785+ help
49786+ If you say Y here, many of the features of grsecurity will be
49787+ enabled, which will protect you against many kinds of attacks
49788+ against your system. The heightened security comes at a cost
49789+ of an increased chance of incompatibilities with rare software
49790+ on your machine. Since this security level enables PaX, you should
49791+ view <http://pax.grsecurity.net> and read about the PaX
49792+ project. While you are there, download chpax and run it on
49793+ binaries that cause problems with PaX. Also remember that
49794+ since the /proc restrictions are enabled, you must run your
49795+ identd as gid 1001. This security level enables the following
49796+ features in addition to those listed in the low and medium
49797+ security levels:
49798+
49799+ - Additional /proc restrictions
49800+ - Chmod restrictions in chroot
49801+ - No signals, ptrace, or viewing of processes outside of chroot
49802+ - Capability restrictions in chroot
49803+ - Deny fchdir out of chroot
49804+ - Priority restrictions in chroot
49805+ - Segmentation-based implementation of PaX
49806+ - Mprotect restrictions
49807+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
49808+ - Kernel stack randomization
49809+ - Mount/unmount/remount logging
49810+ - Kernel symbol hiding
49811+ - Hardening of module auto-loading
49812+ - Ptrace restrictions
49813+ - Restricted vm86 mode
49814+ - Restricted sysfs/debugfs
49815+ - Active kernel exploit response
49816+
49817+config GRKERNSEC_CUSTOM
49818+ bool "Custom"
49819+ help
49820+ If you say Y here, you will be able to configure every grsecurity
49821+ option, which allows you to enable many more features that aren't
49822+ covered in the basic security levels. These additional features
49823+ include TPE, socket restrictions, and the sysctl system for
49824+ grsecurity. It is advised that you read through the help for
49825+ each option to determine its usefulness in your situation.
49826+
49827+endchoice
49828+
49829+menu "Address Space Protection"
49830+depends on GRKERNSEC
49831+
49832+config GRKERNSEC_KMEM
49833+ bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
49834+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
49835+ help
49836+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
49837+ be written to or read from to modify or leak the contents of the running
49838+ kernel. /dev/port will also not be allowed to be opened. If you have module
49839+ support disabled, enabling this will close up four ways that are
49840+ currently used to insert malicious code into the running kernel.
49841+ Even with all these features enabled, we still highly recommend that
49842+ you use the RBAC system, as it is still possible for an attacker to
49843+ modify the running kernel through privileged I/O granted by ioperm/iopl.
49844+ If you are not using XFree86, you may be able to stop this additional
49845+ case by enabling the 'Disable privileged I/O' option. Though nothing
49846+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
49847+ but only to video memory, which is the only writing we allow in this
49848+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
49849+ not be allowed to mprotect it with PROT_WRITE later.
49850+ It is highly recommended that you say Y here if you meet all the
49851+ conditions above.
49852+
49853+config GRKERNSEC_VM86
49854+ bool "Restrict VM86 mode"
49855+ depends on X86_32
49856+
49857+ help
49858+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
49859+ make use of a special execution mode on 32bit x86 processors called
49860+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
49861+ video cards and will still work with this option enabled. The purpose
49862+ of the option is to prevent exploitation of emulation errors in
49863+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
49864+ Nearly all users should be able to enable this option.
49865+
49866+config GRKERNSEC_IO
49867+ bool "Disable privileged I/O"
49868+ depends on X86
49869+ select RTC_CLASS
49870+ select RTC_INTF_DEV
49871+ select RTC_DRV_CMOS
49872+
49873+ help
49874+ If you say Y here, all ioperm and iopl calls will return an error.
49875+ Ioperm and iopl can be used to modify the running kernel.
49876+ Unfortunately, some programs need this access to operate properly,
49877+ the most notable of which are XFree86 and hwclock. hwclock can be
49878+ remedied by having RTC support in the kernel, so real-time
49879+ clock support is enabled if this option is enabled, to ensure
49880+ that hwclock operates correctly. XFree86 still will not
49881+ operate correctly with this option enabled, so DO NOT CHOOSE Y
49882+ IF YOU USE XFree86. If you use XFree86 and you still want to
49883+ protect your kernel against modification, use the RBAC system.
49884+
49885+config GRKERNSEC_PROC_MEMMAP
49886+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
49887+ default y if (PAX_NOEXEC || PAX_ASLR)
49888+ depends on PAX_NOEXEC || PAX_ASLR
49889+ help
49890+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
49891+ give no information about the addresses of its mappings if
49892+ PaX features that rely on random addresses are enabled on the task.
49893+ If you use PaX it is greatly recommended that you say Y here as it
49894+ closes up a hole that makes the full ASLR useless for suid
49895+ binaries.
49896+
49897+config GRKERNSEC_BRUTE
49898+ bool "Deter exploit bruteforcing"
49899+ help
49900+ If you say Y here, attempts to bruteforce exploits against forking
49901+ daemons such as apache or sshd, as well as against suid/sgid binaries
49902+ will be deterred. When a child of a forking daemon is killed by PaX
49903+ or crashes due to an illegal instruction or other suspicious signal,
49904+ the parent process will be delayed 30 seconds upon every subsequent
49905+ fork until the administrator is able to assess the situation and
49906+ restart the daemon.
49907+ In the suid/sgid case, the attempt is logged, the user has all their
49908+ processes terminated, and they are prevented from executing any further
49909+ processes for 15 minutes.
49910+ It is recommended that you also enable signal logging in the auditing
49911+ section so that logs are generated when a process triggers a suspicious
49912+ signal.
49913+ If the sysctl option is enabled, a sysctl option with name
49914+ "deter_bruteforce" is created.
49915+
49916+
49917+config GRKERNSEC_MODHARDEN
49918+ bool "Harden module auto-loading"
49919+ depends on MODULES
49920+ help
49921+ If you say Y here, module auto-loading in response to use of some
49922+ feature implemented by an unloaded module will be restricted to
49923+ root users. Enabling this option helps defend against attacks
49924+ by unprivileged users who abuse the auto-loading behavior to
49925+ cause a vulnerable module to load that is then exploited.
49926+
49927+ If this option prevents a legitimate use of auto-loading for a
49928+ non-root user, the administrator can execute modprobe manually
49929+ with the exact name of the module mentioned in the alert log.
49930+ Alternatively, the administrator can add the module to the list
49931+ of modules loaded at boot by modifying init scripts.
49932+
49933+ Modification of init scripts will most likely be needed on
49934+ Ubuntu servers with encrypted home directory support enabled,
49935+ as the first non-root user logging in will cause the ecb(aes),
49936+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
49937+
49938+config GRKERNSEC_HIDESYM
49939+ bool "Hide kernel symbols"
49940+ help
49941+ If you say Y here, getting information on loaded modules, and
49942+ displaying all kernel symbols through a syscall will be restricted
49943+ to users with CAP_SYS_MODULE. For software compatibility reasons,
49944+ /proc/kallsyms will be restricted to the root user. The RBAC
49945+ system can hide that entry even from root.
49946+
49947+ This option also prevents leaking of kernel addresses through
49948+ several /proc entries.
49949+
49950+ Note that this option is only effective provided the following
49951+ conditions are met:
49952+ 1) The kernel using grsecurity is not precompiled by some distribution
49953+ 2) You have also enabled GRKERNSEC_DMESG
49954+ 3) You are using the RBAC system and hiding other files such as your
49955+ kernel image and System.map. Alternatively, enabling this option
49956+ causes the permissions on /boot, /lib/modules, and the kernel
49957+ source directory to change at compile time to prevent
49958+ reading by non-root users.
49959+ If the above conditions are met, this option will aid in providing a
49960+ useful protection against local kernel exploitation of overflows
49961+ and arbitrary read/write vulnerabilities.
49962+
49963+config GRKERNSEC_KERN_LOCKOUT
49964+ bool "Active kernel exploit response"
49965+ depends on X86 || ARM || PPC || SPARC
49966+ help
49967+ If you say Y here, when a PaX alert is triggered due to suspicious
49968+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
49969+ or an OOPs occurs due to bad memory accesses, instead of just
49970+ terminating the offending process (and potentially allowing
49971+ a subsequent exploit from the same user), we will take one of two
49972+ actions:
49973+ If the user was root, we will panic the system
49974+ If the user was non-root, we will log the attempt, terminate
49975+ all processes owned by the user, then prevent them from creating
49976+ any new processes until the system is restarted
49977+ This deters repeated kernel exploitation/bruteforcing attempts
49978+ and is useful for later forensics.
49979+
49980+endmenu
49981+menu "Role Based Access Control Options"
49982+depends on GRKERNSEC
49983+
49984+config GRKERNSEC_RBAC_DEBUG
49985+ bool
49986+
49987+config GRKERNSEC_NO_RBAC
49988+ bool "Disable RBAC system"
49989+ help
49990+ If you say Y here, the /dev/grsec device will be removed from the kernel,
49991+ preventing the RBAC system from being enabled. You should only say Y
49992+ here if you have no intention of using the RBAC system, so as to prevent
49993+ an attacker with root access from misusing the RBAC system to hide files
49994+ and processes when loadable module support and /dev/[k]mem have been
49995+ locked down.
49996+
49997+config GRKERNSEC_ACL_HIDEKERN
49998+ bool "Hide kernel processes"
49999+ help
50000+ If you say Y here, all kernel threads will be hidden to all
50001+ processes but those whose subject has the "view hidden processes"
50002+ flag.
50003+
50004+config GRKERNSEC_ACL_MAXTRIES
50005+ int "Maximum tries before password lockout"
50006+ default 3
50007+ help
50008+ This option enforces the maximum number of times a user can attempt
50009+ to authorize themselves with the grsecurity RBAC system before being
50010+ denied the ability to attempt authorization again for a specified time.
50011+ The lower the number, the harder it will be to brute-force a password.
50012+
50013+config GRKERNSEC_ACL_TIMEOUT
50014+ int "Time to wait after max password tries, in seconds"
50015+ default 30
50016+ help
50017+ This option specifies the time the user must wait after attempting to
50018+ authorize to the RBAC system with the maximum number of invalid
50019+ passwords. The higher the number, the harder it will be to brute-force
50020+ a password.
50021+
50022+endmenu
50023+menu "Filesystem Protections"
50024+depends on GRKERNSEC
50025+
50026+config GRKERNSEC_PROC
50027+ bool "Proc restrictions"
50028+ help
50029+ If you say Y here, the permissions of the /proc filesystem
50030+ will be altered to enhance system security and privacy. You MUST
50031+ choose either a user only restriction or a user and group restriction.
50032+ Depending upon the option you choose, you can either restrict users to
50033+ see only the processes they themselves run, or choose a group that can
50034+ view all processes and files normally restricted to root if you choose
50035+ the "restrict to user only" option. NOTE: If you're running identd as
50036+ a non-root user, you will have to run it as the group you specify here.
50037+
50038+config GRKERNSEC_PROC_USER
50039+ bool "Restrict /proc to user only"
50040+ depends on GRKERNSEC_PROC
50041+ help
50042+ If you say Y here, non-root users will only be able to view their own
50043+ processes, and restricts them from viewing network-related information,
50044+ and viewing kernel symbol and module information.
50045+
50046+config GRKERNSEC_PROC_USERGROUP
50047+ bool "Allow special group"
50048+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
50049+ help
50050+ If you say Y here, you will be able to select a group that will be
50051+ able to view all processes and network-related information. If you've
50052+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
50053+ remain hidden. This option is useful if you want to run identd as
50054+ a non-root user.
50055+
50056+config GRKERNSEC_PROC_GID
50057+ int "GID for special group"
50058+ depends on GRKERNSEC_PROC_USERGROUP
50059+ default 1001
50060+
50061+config GRKERNSEC_PROC_ADD
50062+ bool "Additional restrictions"
50063+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
50064+ help
50065+ If you say Y here, additional restrictions will be placed on
50066+ /proc that keep normal users from viewing device information and
50067+ slabinfo information that could be useful for exploits.
50068+
50069+config GRKERNSEC_LINK
50070+ bool "Linking restrictions"
50071+ help
50072+ If you say Y here, /tmp race exploits will be prevented, since users
50073+ will no longer be able to follow symlinks owned by other users in
50074+ world-writable +t directories (e.g. /tmp), unless the owner of the
50075+ symlink is the owner of the directory. users will also not be
50076+ able to hardlink to files they do not own. If the sysctl option is
50077+ enabled, a sysctl option with name "linking_restrictions" is created.
50078+
50079+config GRKERNSEC_FIFO
50080+ bool "FIFO restrictions"
50081+ help
50082+ If you say Y here, users will not be able to write to FIFOs they don't
50083+ own in world-writable +t directories (e.g. /tmp), unless the owner of
50084+ the FIFO is the same owner of the directory it's held in. If the sysctl
50085+ option is enabled, a sysctl option with name "fifo_restrictions" is
50086+ created.
50087+
50088+config GRKERNSEC_SYSFS_RESTRICT
50089+ bool "Sysfs/debugfs restriction"
50090+ depends on SYSFS
50091+ help
50092+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
50093+ any filesystem normally mounted under it (e.g. debugfs) will only
50094+ be accessible by root. These filesystems generally provide access
50095+ to hardware and debug information that isn't appropriate for unprivileged
50096+ users of the system. Sysfs and debugfs have also become a large source
50097+ of new vulnerabilities, ranging from infoleaks to local compromise.
50098+ There has been very little oversight with an eye toward security involved
50099+ in adding new exporters of information to these filesystems, so their
50100+ use is discouraged.
50101+ This option is equivalent to a chmod 0700 of the mount paths.
50102+
50103+config GRKERNSEC_ROFS
50104+ bool "Runtime read-only mount protection"
50105+ help
50106+ If you say Y here, a sysctl option with name "romount_protect" will
50107+ be created. By setting this option to 1 at runtime, filesystems
50108+ will be protected in the following ways:
50109+ * No new writable mounts will be allowed
50110+ * Existing read-only mounts won't be able to be remounted read/write
50111+ * Write operations will be denied on all block devices
50112+ This option acts independently of grsec_lock: once it is set to 1,
50113+ it cannot be turned off. Therefore, please be mindful of the resulting
50114+ behavior if this option is enabled in an init script on a read-only
50115+ filesystem. This feature is mainly intended for secure embedded systems.
50116+
50117+config GRKERNSEC_CHROOT
50118+ bool "Chroot jail restrictions"
50119+ help
50120+ If you say Y here, you will be able to choose several options that will
50121+ make breaking out of a chrooted jail much more difficult. If you
50122+ encounter no software incompatibilities with the following options, it
50123+ is recommended that you enable each one.
50124+
50125+config GRKERNSEC_CHROOT_MOUNT
50126+ bool "Deny mounts"
50127+ depends on GRKERNSEC_CHROOT
50128+ help
50129+ If you say Y here, processes inside a chroot will not be able to
50130+ mount or remount filesystems. If the sysctl option is enabled, a
50131+ sysctl option with name "chroot_deny_mount" is created.
50132+
50133+config GRKERNSEC_CHROOT_DOUBLE
50134+ bool "Deny double-chroots"
50135+ depends on GRKERNSEC_CHROOT
50136+ help
50137+ If you say Y here, processes inside a chroot will not be able to chroot
50138+ again outside the chroot. This is a widely used method of breaking
50139+ out of a chroot jail and should not be allowed. If the sysctl
50140+ option is enabled, a sysctl option with name
50141+ "chroot_deny_chroot" is created.
50142+
50143+config GRKERNSEC_CHROOT_PIVOT
50144+ bool "Deny pivot_root in chroot"
50145+ depends on GRKERNSEC_CHROOT
50146+ help
50147+ If you say Y here, processes inside a chroot will not be able to use
50148+ a function called pivot_root() that was introduced in Linux 2.3.41. It
50149+ works similar to chroot in that it changes the root filesystem. This
50150+ function could be misused in a chrooted process to attempt to break out
50151+ of the chroot, and therefore should not be allowed. If the sysctl
50152+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
50153+ created.
50154+
50155+config GRKERNSEC_CHROOT_CHDIR
50156+ bool "Enforce chdir(\"/\") on all chroots"
50157+ depends on GRKERNSEC_CHROOT
50158+ help
50159+ If you say Y here, the current working directory of all newly-chrooted
50160+ applications will be set to the the root directory of the chroot.
50161+ The man page on chroot(2) states:
50162+ Note that this call does not change the current working
50163+ directory, so that `.' can be outside the tree rooted at
50164+ `/'. In particular, the super-user can escape from a
50165+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
50166+
50167+ It is recommended that you say Y here, since it's not known to break
50168+ any software. If the sysctl option is enabled, a sysctl option with
50169+ name "chroot_enforce_chdir" is created.
50170+
50171+config GRKERNSEC_CHROOT_CHMOD
50172+ bool "Deny (f)chmod +s"
50173+ depends on GRKERNSEC_CHROOT
50174+ help
50175+ If you say Y here, processes inside a chroot will not be able to chmod
50176+ or fchmod files to make them have suid or sgid bits. This protects
50177+ against another published method of breaking a chroot. If the sysctl
50178+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
50179+ created.
50180+
50181+config GRKERNSEC_CHROOT_FCHDIR
50182+ bool "Deny fchdir out of chroot"
50183+ depends on GRKERNSEC_CHROOT
50184+ help
50185+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
50186+ to a file descriptor of the chrooting process that points to a directory
50187+ outside the filesystem will be stopped. If the sysctl option
50188+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
50189+
50190+config GRKERNSEC_CHROOT_MKNOD
50191+ bool "Deny mknod"
50192+ depends on GRKERNSEC_CHROOT
50193+ help
50194+ If you say Y here, processes inside a chroot will not be allowed to
50195+ mknod. The problem with using mknod inside a chroot is that it
50196+ would allow an attacker to create a device entry that is the same
50197+ as one on the physical root of your system, which could range from
50198+ anything from the console device to a device for your harddrive (which
50199+ they could then use to wipe the drive or steal data). It is recommended
50200+ that you say Y here, unless you run into software incompatibilities.
50201+ If the sysctl option is enabled, a sysctl option with name
50202+ "chroot_deny_mknod" is created.
50203+
50204+config GRKERNSEC_CHROOT_SHMAT
50205+ bool "Deny shmat() out of chroot"
50206+ depends on GRKERNSEC_CHROOT
50207+ help
50208+ If you say Y here, processes inside a chroot will not be able to attach
50209+ to shared memory segments that were created outside of the chroot jail.
50210+ It is recommended that you say Y here. If the sysctl option is enabled,
50211+ a sysctl option with name "chroot_deny_shmat" is created.
50212+
50213+config GRKERNSEC_CHROOT_UNIX
50214+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
50215+ depends on GRKERNSEC_CHROOT
50216+ help
50217+ If you say Y here, processes inside a chroot will not be able to
50218+ connect to abstract (meaning not belonging to a filesystem) Unix
50219+ domain sockets that were bound outside of a chroot. It is recommended
50220+ that you say Y here. If the sysctl option is enabled, a sysctl option
50221+ with name "chroot_deny_unix" is created.
50222+
50223+config GRKERNSEC_CHROOT_FINDTASK
50224+ bool "Protect outside processes"
50225+ depends on GRKERNSEC_CHROOT
50226+ help
50227+ If you say Y here, processes inside a chroot will not be able to
50228+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
50229+ getsid, or view any process outside of the chroot. If the sysctl
50230+ option is enabled, a sysctl option with name "chroot_findtask" is
50231+ created.
50232+
50233+config GRKERNSEC_CHROOT_NICE
50234+ bool "Restrict priority changes"
50235+ depends on GRKERNSEC_CHROOT
50236+ help
50237+ If you say Y here, processes inside a chroot will not be able to raise
50238+ the priority of processes in the chroot, or alter the priority of
50239+ processes outside the chroot. This provides more security than simply
50240+ removing CAP_SYS_NICE from the process' capability set. If the
50241+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
50242+ is created.
50243+
50244+config GRKERNSEC_CHROOT_SYSCTL
50245+ bool "Deny sysctl writes"
50246+ depends on GRKERNSEC_CHROOT
50247+ help
50248+ If you say Y here, an attacker in a chroot will not be able to
50249+ write to sysctl entries, either by sysctl(2) or through a /proc
50250+ interface. It is strongly recommended that you say Y here. If the
50251+ sysctl option is enabled, a sysctl option with name
50252+ "chroot_deny_sysctl" is created.
50253+
50254+config GRKERNSEC_CHROOT_CAPS
50255+ bool "Capability restrictions"
50256+ depends on GRKERNSEC_CHROOT
50257+ help
50258+ If you say Y here, the capabilities on all processes within a
50259+ chroot jail will be lowered to stop module insertion, raw i/o,
50260+ system and net admin tasks, rebooting the system, modifying immutable
50261+ files, modifying IPC owned by another, and changing the system time.
50262+ This is left an option because it can break some apps. Disable this
50263+ if your chrooted apps are having problems performing those kinds of
50264+ tasks. If the sysctl option is enabled, a sysctl option with
50265+ name "chroot_caps" is created.
50266+
50267+endmenu
50268+menu "Kernel Auditing"
50269+depends on GRKERNSEC
50270+
50271+config GRKERNSEC_AUDIT_GROUP
50272+ bool "Single group for auditing"
50273+ help
50274+ If you say Y here, the exec, chdir, and (un)mount logging features
50275+ will only operate on a group you specify. This option is recommended
50276+ if you only want to watch certain users instead of having a large
50277+ amount of logs from the entire system. If the sysctl option is enabled,
50278+ a sysctl option with name "audit_group" is created.
50279+
50280+config GRKERNSEC_AUDIT_GID
50281+ int "GID for auditing"
50282+ depends on GRKERNSEC_AUDIT_GROUP
50283+ default 1007
50284+
50285+config GRKERNSEC_EXECLOG
50286+ bool "Exec logging"
50287+ help
50288+ If you say Y here, all execve() calls will be logged (since the
50289+ other exec*() calls are frontends to execve(), all execution
50290+ will be logged). Useful for shell-servers that like to keep track
50291+ of their users. If the sysctl option is enabled, a sysctl option with
50292+ name "exec_logging" is created.
50293+ WARNING: This option when enabled will produce a LOT of logs, especially
50294+ on an active system.
50295+
50296+config GRKERNSEC_RESLOG
50297+ bool "Resource logging"
50298+ help
50299+ If you say Y here, all attempts to overstep resource limits will
50300+ be logged with the resource name, the requested size, and the current
50301+ limit. It is highly recommended that you say Y here. If the sysctl
50302+ option is enabled, a sysctl option with name "resource_logging" is
50303+ created. If the RBAC system is enabled, the sysctl value is ignored.
50304+
50305+config GRKERNSEC_CHROOT_EXECLOG
50306+ bool "Log execs within chroot"
50307+ help
50308+ If you say Y here, all executions inside a chroot jail will be logged
50309+ to syslog. This can cause a large amount of logs if certain
50310+ applications (eg. djb's daemontools) are installed on the system, and
50311+ is therefore left as an option. If the sysctl option is enabled, a
50312+ sysctl option with name "chroot_execlog" is created.
50313+
50314+config GRKERNSEC_AUDIT_PTRACE
50315+ bool "Ptrace logging"
50316+ help
50317+ If you say Y here, all attempts to attach to a process via ptrace
50318+ will be logged. If the sysctl option is enabled, a sysctl option
50319+ with name "audit_ptrace" is created.
50320+
50321+config GRKERNSEC_AUDIT_CHDIR
50322+ bool "Chdir logging"
50323+ help
50324+ If you say Y here, all chdir() calls will be logged. If the sysctl
50325+ option is enabled, a sysctl option with name "audit_chdir" is created.
50326+
50327+config GRKERNSEC_AUDIT_MOUNT
50328+ bool "(Un)Mount logging"
50329+ help
50330+ If you say Y here, all mounts and unmounts will be logged. If the
50331+ sysctl option is enabled, a sysctl option with name "audit_mount" is
50332+ created.
50333+
50334+config GRKERNSEC_SIGNAL
50335+ bool "Signal logging"
50336+ help
50337+ If you say Y here, certain important signals will be logged, such as
50338+ SIGSEGV, which will as a result inform you of when a error in a program
50339+ occurred, which in some cases could mean a possible exploit attempt.
50340+ If the sysctl option is enabled, a sysctl option with name
50341+ "signal_logging" is created.
50342+
50343+config GRKERNSEC_FORKFAIL
50344+ bool "Fork failure logging"
50345+ help
50346+ If you say Y here, all failed fork() attempts will be logged.
50347+ This could suggest a fork bomb, or someone attempting to overstep
50348+ their process limit. If the sysctl option is enabled, a sysctl option
50349+ with name "forkfail_logging" is created.
50350+
50351+config GRKERNSEC_TIME
50352+ bool "Time change logging"
50353+ help
50354+ If you say Y here, any changes of the system clock will be logged.
50355+ If the sysctl option is enabled, a sysctl option with name
50356+ "timechange_logging" is created.
50357+
50358+config GRKERNSEC_PROC_IPADDR
50359+ bool "/proc/<pid>/ipaddr support"
50360+ help
50361+ If you say Y here, a new entry will be added to each /proc/<pid>
50362+ directory that contains the IP address of the person using the task.
50363+ The IP is carried across local TCP and AF_UNIX stream sockets.
50364+ This information can be useful for IDS/IPSes to perform remote response
50365+ to a local attack. The entry is readable by only the owner of the
50366+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
50367+ the RBAC system), and thus does not create privacy concerns.
50368+
50369+config GRKERNSEC_RWXMAP_LOG
50370+ bool 'Denied RWX mmap/mprotect logging'
50371+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
50372+ help
50373+ If you say Y here, calls to mmap() and mprotect() with explicit
50374+ usage of PROT_WRITE and PROT_EXEC together will be logged when
50375+ denied by the PAX_MPROTECT feature. If the sysctl option is
50376+ enabled, a sysctl option with name "rwxmap_logging" is created.
50377+
50378+config GRKERNSEC_AUDIT_TEXTREL
50379+ bool 'ELF text relocations logging (READ HELP)'
50380+ depends on PAX_MPROTECT
50381+ help
50382+ If you say Y here, text relocations will be logged with the filename
50383+ of the offending library or binary. The purpose of the feature is
50384+ to help Linux distribution developers get rid of libraries and
50385+ binaries that need text relocations which hinder the future progress
50386+ of PaX. Only Linux distribution developers should say Y here, and
50387+ never on a production machine, as this option creates an information
50388+ leak that could aid an attacker in defeating the randomization of
50389+ a single memory region. If the sysctl option is enabled, a sysctl
50390+ option with name "audit_textrel" is created.
50391+
50392+endmenu
50393+
50394+menu "Executable Protections"
50395+depends on GRKERNSEC
50396+
50397+config GRKERNSEC_DMESG
50398+ bool "Dmesg(8) restriction"
50399+ help
50400+ If you say Y here, non-root users will not be able to use dmesg(8)
50401+ to view up to the last 4kb of messages in the kernel's log buffer.
50402+ The kernel's log buffer often contains kernel addresses and other
50403+ identifying information useful to an attacker in fingerprinting a
50404+ system for a targeted exploit.
50405+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
50406+ created.
50407+
50408+config GRKERNSEC_HARDEN_PTRACE
50409+ bool "Deter ptrace-based process snooping"
50410+ help
50411+ If you say Y here, TTY sniffers and other malicious monitoring
50412+ programs implemented through ptrace will be defeated. If you
50413+ have been using the RBAC system, this option has already been
50414+ enabled for several years for all users, with the ability to make
50415+ fine-grained exceptions.
50416+
50417+ This option only affects the ability of non-root users to ptrace
50418+ processes that are not a descendent of the ptracing process.
50419+ This means that strace ./binary and gdb ./binary will still work,
50420+ but attaching to arbitrary processes will not. If the sysctl
50421+ option is enabled, a sysctl option with name "harden_ptrace" is
50422+ created.
50423+
50424+config GRKERNSEC_SETXID
50425+ bool "Enforce consistent multithreaded privileges"
50426+ help
50427+ If you say Y here, a change from a root uid to a non-root uid
50428+ in a multithreaded application will cause the resulting uids,
50429+ gids, supplementary groups, and capabilities in that thread
50430+ to be propagated to the other threads of the process. In most
50431+ cases this is unnecessary, as glibc will emulate this behavior
50432+ on behalf of the application. Other libcs do not act in the
50433+ same way, allowing the other threads of the process to continue
50434+ running with root privileges. If the sysctl option is enabled,
50435+ a sysctl option with name "consistent_setxid" is created.
50436+
50437+config GRKERNSEC_TPE
50438+ bool "Trusted Path Execution (TPE)"
50439+ help
50440+ If you say Y here, you will be able to choose a gid to add to the
50441+ supplementary groups of users you want to mark as "untrusted."
50442+ These users will not be able to execute any files that are not in
50443+ root-owned directories writable only by root. If the sysctl option
50444+ is enabled, a sysctl option with name "tpe" is created.
50445+
50446+config GRKERNSEC_TPE_ALL
50447+ bool "Partially restrict all non-root users"
50448+ depends on GRKERNSEC_TPE
50449+ help
50450+ If you say Y here, all non-root users will be covered under
50451+ a weaker TPE restriction. This is separate from, and in addition to,
50452+ the main TPE options that you have selected elsewhere. Thus, if a
50453+ "trusted" GID is chosen, this restriction applies to even that GID.
50454+ Under this restriction, all non-root users will only be allowed to
50455+ execute files in directories they own that are not group or
50456+ world-writable, or in directories owned by root and writable only by
50457+ root. If the sysctl option is enabled, a sysctl option with name
50458+ "tpe_restrict_all" is created.
50459+
50460+config GRKERNSEC_TPE_INVERT
50461+ bool "Invert GID option"
50462+ depends on GRKERNSEC_TPE
50463+ help
50464+ If you say Y here, the group you specify in the TPE configuration will
50465+ decide what group TPE restrictions will be *disabled* for. This
50466+ option is useful if you want TPE restrictions to be applied to most
50467+ users on the system. If the sysctl option is enabled, a sysctl option
50468+ with name "tpe_invert" is created. Unlike other sysctl options, this
50469+ entry will default to on for backward-compatibility.
50470+
50471+config GRKERNSEC_TPE_GID
50472+ int "GID for untrusted users"
50473+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
50474+ default 1005
50475+ help
50476+ Setting this GID determines what group TPE restrictions will be
50477+ *enabled* for. If the sysctl option is enabled, a sysctl option
50478+ with name "tpe_gid" is created.
50479+
50480+config GRKERNSEC_TPE_GID
50481+ int "GID for trusted users"
50482+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
50483+ default 1005
50484+ help
50485+ Setting this GID determines what group TPE restrictions will be
50486+ *disabled* for. If the sysctl option is enabled, a sysctl option
50487+ with name "tpe_gid" is created.
50488+
50489+endmenu
50490+menu "Network Protections"
50491+depends on GRKERNSEC
50492+
50493+config GRKERNSEC_RANDNET
50494+ bool "Larger entropy pools"
50495+ help
50496+ If you say Y here, the entropy pools used for many features of Linux
50497+ and grsecurity will be doubled in size. Since several grsecurity
50498+ features use additional randomness, it is recommended that you say Y
50499+ here. Saying Y here has a similar effect as modifying
50500+ /proc/sys/kernel/random/poolsize.
50501+
50502+config GRKERNSEC_BLACKHOLE
50503+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
50504+ depends on NET
50505+ help
50506+ If you say Y here, neither TCP resets nor ICMP
50507+ destination-unreachable packets will be sent in response to packets
50508+ sent to ports for which no associated listening process exists.
50509+ This feature supports both IPV4 and IPV6 and exempts the
50510+ loopback interface from blackholing. Enabling this feature
50511+ makes a host more resilient to DoS attacks and reduces network
50512+ visibility against scanners.
50513+
50514+ The blackhole feature as-implemented is equivalent to the FreeBSD
50515+ blackhole feature, as it prevents RST responses to all packets, not
50516+ just SYNs. Under most application behavior this causes no
50517+ problems, but applications (like haproxy) may not close certain
50518+ connections in a way that cleanly terminates them on the remote
50519+ end, leaving the remote host in LAST_ACK state. Because of this
50520+ side-effect and to prevent intentional LAST_ACK DoSes, this
50521+ feature also adds automatic mitigation against such attacks.
50522+ The mitigation drastically reduces the amount of time a socket
50523+ can spend in LAST_ACK state. If you're using haproxy and not
50524+ all servers it connects to have this option enabled, consider
50525+ disabling this feature on the haproxy host.
50526+
50527+ If the sysctl option is enabled, two sysctl options with names
50528+ "ip_blackhole" and "lastack_retries" will be created.
50529+ While "ip_blackhole" takes the standard zero/non-zero on/off
50530+ toggle, "lastack_retries" uses the same kinds of values as
50531+ "tcp_retries1" and "tcp_retries2". The default value of 4
50532+ prevents a socket from lasting more than 45 seconds in LAST_ACK
50533+ state.
50534+
50535+config GRKERNSEC_SOCKET
50536+ bool "Socket restrictions"
50537+ depends on NET
50538+ help
50539+ If you say Y here, you will be able to choose from several options.
50540+ If you assign a GID on your system and add it to the supplementary
50541+ groups of users you want to restrict socket access to, this patch
50542+ will perform up to three things, based on the option(s) you choose.
50543+
50544+config GRKERNSEC_SOCKET_ALL
50545+ bool "Deny any sockets to group"
50546+ depends on GRKERNSEC_SOCKET
50547+ help
50548+ If you say Y here, you will be able to choose a GID of whose users will
50549+ be unable to connect to other hosts from your machine or run server
50550+ applications from your machine. If the sysctl option is enabled, a
50551+ sysctl option with name "socket_all" is created.
50552+
50553+config GRKERNSEC_SOCKET_ALL_GID
50554+ int "GID to deny all sockets for"
50555+ depends on GRKERNSEC_SOCKET_ALL
50556+ default 1004
50557+ help
50558+ Here you can choose the GID to disable socket access for. Remember to
50559+ add the users you want socket access disabled for to the GID
50560+ specified here. If the sysctl option is enabled, a sysctl option
50561+ with name "socket_all_gid" is created.
50562+
50563+config GRKERNSEC_SOCKET_CLIENT
50564+ bool "Deny client sockets to group"
50565+ depends on GRKERNSEC_SOCKET
50566+ help
50567+ If you say Y here, you will be able to choose a GID of whose users will
50568+ be unable to connect to other hosts from your machine, but will be
50569+ able to run servers. If this option is enabled, all users in the group
50570+ you specify will have to use passive mode when initiating ftp transfers
50571+ from the shell on your machine. If the sysctl option is enabled, a
50572+ sysctl option with name "socket_client" is created.
50573+
50574+config GRKERNSEC_SOCKET_CLIENT_GID
50575+ int "GID to deny client sockets for"
50576+ depends on GRKERNSEC_SOCKET_CLIENT
50577+ default 1003
50578+ help
50579+ Here you can choose the GID to disable client socket access for.
50580+ Remember to add the users you want client socket access disabled for to
50581+ the GID specified here. If the sysctl option is enabled, a sysctl
50582+ option with name "socket_client_gid" is created.
50583+
50584+config GRKERNSEC_SOCKET_SERVER
50585+ bool "Deny server sockets to group"
50586+ depends on GRKERNSEC_SOCKET
50587+ help
50588+ If you say Y here, you will be able to choose a GID of whose users will
50589+ be unable to run server applications from your machine. If the sysctl
50590+ option is enabled, a sysctl option with name "socket_server" is created.
50591+
50592+config GRKERNSEC_SOCKET_SERVER_GID
50593+ int "GID to deny server sockets for"
50594+ depends on GRKERNSEC_SOCKET_SERVER
50595+ default 1002
50596+ help
50597+ Here you can choose the GID to disable server socket access for.
50598+ Remember to add the users you want server socket access disabled for to
50599+ the GID specified here. If the sysctl option is enabled, a sysctl
50600+ option with name "socket_server_gid" is created.
50601+
50602+endmenu
50603+menu "Sysctl support"
50604+depends on GRKERNSEC && SYSCTL
50605+
50606+config GRKERNSEC_SYSCTL
50607+ bool "Sysctl support"
50608+ help
50609+ If you say Y here, you will be able to change the options that
50610+ grsecurity runs with at bootup, without having to recompile your
50611+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
50612+ to enable (1) or disable (0) various features. All the sysctl entries
50613+ are mutable until the "grsec_lock" entry is set to a non-zero value.
50614+ All features enabled in the kernel configuration are disabled at boot
50615+ if you do not say Y to the "Turn on features by default" option.
50616+ All options should be set at startup, and the grsec_lock entry should
50617+ be set to a non-zero value after all the options are set.
50618+ *THIS IS EXTREMELY IMPORTANT*
50619+
50620+config GRKERNSEC_SYSCTL_DISTRO
50621+ bool "Extra sysctl support for distro makers (READ HELP)"
50622+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
50623+ help
50624+ If you say Y here, additional sysctl options will be created
50625+ for features that affect processes running as root. Therefore,
50626+ it is critical when using this option that the grsec_lock entry be
50627+ enabled after boot. Only distros with prebuilt kernel packages
50628+ with this option enabled that can ensure grsec_lock is enabled
50629+ after boot should use this option.
50630+ *Failure to set grsec_lock after boot makes all grsec features
50631+ this option covers useless*
50632+
50633+ Currently this option creates the following sysctl entries:
50634+ "Disable Privileged I/O": "disable_priv_io"
50635+
50636+config GRKERNSEC_SYSCTL_ON
50637+ bool "Turn on features by default"
50638+ depends on GRKERNSEC_SYSCTL
50639+ help
50640+ If you say Y here, instead of having all features enabled in the
50641+ kernel configuration disabled at boot time, the features will be
50642+ enabled at boot time. It is recommended you say Y here unless
50643+ there is some reason you would want all sysctl-tunable features to
50644+ be disabled by default. As mentioned elsewhere, it is important
50645+ to enable the grsec_lock entry once you have finished modifying
50646+ the sysctl entries.
50647+
50648+endmenu
50649+menu "Logging Options"
50650+depends on GRKERNSEC
50651+
50652+config GRKERNSEC_FLOODTIME
50653+ int "Seconds in between log messages (minimum)"
50654+ default 10
50655+ help
50656+ This option allows you to enforce the number of seconds between
50657+ grsecurity log messages. The default should be suitable for most
50658+ people, however, if you choose to change it, choose a value small enough
50659+ to allow informative logs to be produced, but large enough to
50660+ prevent flooding.
50661+
50662+config GRKERNSEC_FLOODBURST
50663+ int "Number of messages in a burst (maximum)"
50664+ default 6
50665+ help
50666+ This option allows you to choose the maximum number of messages allowed
50667+ within the flood time interval you chose in a separate option. The
50668+ default should be suitable for most people, however if you find that
50669+ many of your logs are being interpreted as flooding, you may want to
50670+ raise this value.
50671+
50672+endmenu
50673+
50674+endmenu
50675diff --git a/grsecurity/Makefile b/grsecurity/Makefile
50676new file mode 100644
50677index 0000000..be9ae3a
50678--- /dev/null
50679+++ b/grsecurity/Makefile
50680@@ -0,0 +1,36 @@
50681+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
50682+# during 2001-2009 it has been completely redesigned by Brad Spengler
50683+# into an RBAC system
50684+#
50685+# All code in this directory and various hooks inserted throughout the kernel
50686+# are copyright Brad Spengler - Open Source Security, Inc., and released
50687+# under the GPL v2 or higher
50688+
50689+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
50690+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
50691+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
50692+
50693+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
50694+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
50695+ gracl_learn.o grsec_log.o
50696+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
50697+
50698+ifdef CONFIG_NET
50699+obj-y += grsec_sock.o
50700+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
50701+endif
50702+
50703+ifndef CONFIG_GRKERNSEC
50704+obj-y += grsec_disabled.o
50705+endif
50706+
50707+ifdef CONFIG_GRKERNSEC_HIDESYM
50708+extra-y := grsec_hidesym.o
50709+$(obj)/grsec_hidesym.o:
50710+ @-chmod -f 500 /boot
50711+ @-chmod -f 500 /lib/modules
50712+ @-chmod -f 500 /lib64/modules
50713+ @-chmod -f 500 /lib32/modules
50714+ @-chmod -f 700 .
50715+ @echo ' grsec: protected kernel image paths'
50716+endif
50717diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
50718new file mode 100644
50719index 0000000..09258e0
50720--- /dev/null
50721+++ b/grsecurity/gracl.c
50722@@ -0,0 +1,4156 @@
50723+#include <linux/kernel.h>
50724+#include <linux/module.h>
50725+#include <linux/sched.h>
50726+#include <linux/mm.h>
50727+#include <linux/file.h>
50728+#include <linux/fs.h>
50729+#include <linux/namei.h>
50730+#include <linux/mount.h>
50731+#include <linux/tty.h>
50732+#include <linux/proc_fs.h>
50733+#include <linux/lglock.h>
50734+#include <linux/slab.h>
50735+#include <linux/vmalloc.h>
50736+#include <linux/types.h>
50737+#include <linux/sysctl.h>
50738+#include <linux/netdevice.h>
50739+#include <linux/ptrace.h>
50740+#include <linux/gracl.h>
50741+#include <linux/gralloc.h>
50742+#include <linux/grsecurity.h>
50743+#include <linux/grinternal.h>
50744+#include <linux/pid_namespace.h>
50745+#include <linux/fdtable.h>
50746+#include <linux/percpu.h>
50747+
50748+#include <asm/uaccess.h>
50749+#include <asm/errno.h>
50750+#include <asm/mman.h>
50751+
50752+static struct acl_role_db acl_role_set;
50753+static struct name_db name_set;
50754+static struct inodev_db inodev_set;
50755+
50756+/* for keeping track of userspace pointers used for subjects, so we
50757+ can share references in the kernel as well
50758+*/
50759+
50760+static struct path real_root;
50761+
50762+static struct acl_subj_map_db subj_map_set;
50763+
50764+static struct acl_role_label *default_role;
50765+
50766+static struct acl_role_label *role_list;
50767+
50768+static u16 acl_sp_role_value;
50769+
50770+extern char *gr_shared_page[4];
50771+static DEFINE_MUTEX(gr_dev_mutex);
50772+DEFINE_RWLOCK(gr_inode_lock);
50773+
50774+struct gr_arg *gr_usermode;
50775+
50776+static unsigned int gr_status __read_only = GR_STATUS_INIT;
50777+
50778+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
50779+extern void gr_clear_learn_entries(void);
50780+
50781+#ifdef CONFIG_GRKERNSEC_RESLOG
50782+extern void gr_log_resource(const struct task_struct *task,
50783+ const int res, const unsigned long wanted, const int gt);
50784+#endif
50785+
50786+unsigned char *gr_system_salt;
50787+unsigned char *gr_system_sum;
50788+
50789+static struct sprole_pw **acl_special_roles = NULL;
50790+static __u16 num_sprole_pws = 0;
50791+
50792+static struct acl_role_label *kernel_role = NULL;
50793+
50794+static unsigned int gr_auth_attempts = 0;
50795+static unsigned long gr_auth_expires = 0UL;
50796+
50797+#ifdef CONFIG_NET
50798+extern struct vfsmount *sock_mnt;
50799+#endif
50800+
50801+extern struct vfsmount *pipe_mnt;
50802+extern struct vfsmount *shm_mnt;
50803+#ifdef CONFIG_HUGETLBFS
50804+extern struct vfsmount *hugetlbfs_vfsmount;
50805+#endif
50806+
50807+static struct acl_object_label *fakefs_obj_rw;
50808+static struct acl_object_label *fakefs_obj_rwx;
50809+
50810+extern int gr_init_uidset(void);
50811+extern void gr_free_uidset(void);
50812+extern void gr_remove_uid(uid_t uid);
50813+extern int gr_find_uid(uid_t uid);
50814+
50815+DECLARE_BRLOCK(vfsmount_lock);
50816+
50817+__inline__ int
50818+gr_acl_is_enabled(void)
50819+{
50820+ return (gr_status & GR_READY);
50821+}
50822+
50823+#ifdef CONFIG_BTRFS_FS
50824+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
50825+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
50826+#endif
50827+
50828+static inline dev_t __get_dev(const struct dentry *dentry)
50829+{
50830+#ifdef CONFIG_BTRFS_FS
50831+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
50832+ return get_btrfs_dev_from_inode(dentry->d_inode);
50833+ else
50834+#endif
50835+ return dentry->d_inode->i_sb->s_dev;
50836+}
50837+
50838+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
50839+{
50840+ return __get_dev(dentry);
50841+}
50842+
50843+static char gr_task_roletype_to_char(struct task_struct *task)
50844+{
50845+ switch (task->role->roletype &
50846+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
50847+ GR_ROLE_SPECIAL)) {
50848+ case GR_ROLE_DEFAULT:
50849+ return 'D';
50850+ case GR_ROLE_USER:
50851+ return 'U';
50852+ case GR_ROLE_GROUP:
50853+ return 'G';
50854+ case GR_ROLE_SPECIAL:
50855+ return 'S';
50856+ }
50857+
50858+ return 'X';
50859+}
50860+
50861+char gr_roletype_to_char(void)
50862+{
50863+ return gr_task_roletype_to_char(current);
50864+}
50865+
50866+__inline__ int
50867+gr_acl_tpe_check(void)
50868+{
50869+ if (unlikely(!(gr_status & GR_READY)))
50870+ return 0;
50871+ if (current->role->roletype & GR_ROLE_TPE)
50872+ return 1;
50873+ else
50874+ return 0;
50875+}
50876+
50877+int
50878+gr_handle_rawio(const struct inode *inode)
50879+{
50880+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
50881+ if (inode && S_ISBLK(inode->i_mode) &&
50882+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
50883+ !capable(CAP_SYS_RAWIO))
50884+ return 1;
50885+#endif
50886+ return 0;
50887+}
50888+
50889+static int
50890+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
50891+{
50892+ if (likely(lena != lenb))
50893+ return 0;
50894+
50895+ return !memcmp(a, b, lena);
50896+}
50897+
50898+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
50899+{
50900+ *buflen -= namelen;
50901+ if (*buflen < 0)
50902+ return -ENAMETOOLONG;
50903+ *buffer -= namelen;
50904+ memcpy(*buffer, str, namelen);
50905+ return 0;
50906+}
50907+
50908+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
50909+{
50910+ return prepend(buffer, buflen, name->name, name->len);
50911+}
50912+
50913+static int prepend_path(const struct path *path, struct path *root,
50914+ char **buffer, int *buflen)
50915+{
50916+ struct dentry *dentry = path->dentry;
50917+ struct vfsmount *vfsmnt = path->mnt;
50918+ bool slash = false;
50919+ int error = 0;
50920+
50921+ while (dentry != root->dentry || vfsmnt != root->mnt) {
50922+ struct dentry * parent;
50923+
50924+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
50925+ /* Global root? */
50926+ if (vfsmnt->mnt_parent == vfsmnt) {
50927+ goto out;
50928+ }
50929+ dentry = vfsmnt->mnt_mountpoint;
50930+ vfsmnt = vfsmnt->mnt_parent;
50931+ continue;
50932+ }
50933+ parent = dentry->d_parent;
50934+ prefetch(parent);
50935+ spin_lock(&dentry->d_lock);
50936+ error = prepend_name(buffer, buflen, &dentry->d_name);
50937+ spin_unlock(&dentry->d_lock);
50938+ if (!error)
50939+ error = prepend(buffer, buflen, "/", 1);
50940+ if (error)
50941+ break;
50942+
50943+ slash = true;
50944+ dentry = parent;
50945+ }
50946+
50947+out:
50948+ if (!error && !slash)
50949+ error = prepend(buffer, buflen, "/", 1);
50950+
50951+ return error;
50952+}
50953+
50954+/* this must be called with vfsmount_lock and rename_lock held */
50955+
50956+static char *__our_d_path(const struct path *path, struct path *root,
50957+ char *buf, int buflen)
50958+{
50959+ char *res = buf + buflen;
50960+ int error;
50961+
50962+ prepend(&res, &buflen, "\0", 1);
50963+ error = prepend_path(path, root, &res, &buflen);
50964+ if (error)
50965+ return ERR_PTR(error);
50966+
50967+ return res;
50968+}
50969+
50970+static char *
50971+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
50972+{
50973+ char *retval;
50974+
50975+ retval = __our_d_path(path, root, buf, buflen);
50976+ if (unlikely(IS_ERR(retval)))
50977+ retval = strcpy(buf, "<path too long>");
50978+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
50979+ retval[1] = '\0';
50980+
50981+ return retval;
50982+}
50983+
50984+static char *
50985+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
50986+ char *buf, int buflen)
50987+{
50988+ struct path path;
50989+ char *res;
50990+
50991+ path.dentry = (struct dentry *)dentry;
50992+ path.mnt = (struct vfsmount *)vfsmnt;
50993+
50994+ /* we can use real_root.dentry, real_root.mnt, because this is only called
50995+ by the RBAC system */
50996+ res = gen_full_path(&path, &real_root, buf, buflen);
50997+
50998+ return res;
50999+}
51000+
51001+static char *
51002+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51003+ char *buf, int buflen)
51004+{
51005+ char *res;
51006+ struct path path;
51007+ struct path root;
51008+ struct task_struct *reaper = &init_task;
51009+
51010+ path.dentry = (struct dentry *)dentry;
51011+ path.mnt = (struct vfsmount *)vfsmnt;
51012+
51013+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51014+ get_fs_root(reaper->fs, &root);
51015+
51016+ write_seqlock(&rename_lock);
51017+ br_read_lock(vfsmount_lock);
51018+ res = gen_full_path(&path, &root, buf, buflen);
51019+ br_read_unlock(vfsmount_lock);
51020+ write_sequnlock(&rename_lock);
51021+
51022+ path_put(&root);
51023+ return res;
51024+}
51025+
51026+static char *
51027+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51028+{
51029+ char *ret;
51030+ write_seqlock(&rename_lock);
51031+ br_read_lock(vfsmount_lock);
51032+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51033+ PAGE_SIZE);
51034+ br_read_unlock(vfsmount_lock);
51035+ write_sequnlock(&rename_lock);
51036+ return ret;
51037+}
51038+
51039+static char *
51040+gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51041+{
51042+ char *ret;
51043+ char *buf;
51044+ int buflen;
51045+
51046+ write_seqlock(&rename_lock);
51047+ br_read_lock(vfsmount_lock);
51048+ buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
51049+ ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
51050+ buflen = (int)(ret - buf);
51051+ if (buflen >= 5)
51052+ prepend(&ret, &buflen, "/proc", 5);
51053+ else
51054+ ret = strcpy(buf, "<path too long>");
51055+ br_read_unlock(vfsmount_lock);
51056+ write_sequnlock(&rename_lock);
51057+ return ret;
51058+}
51059+
51060+char *
51061+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51062+{
51063+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51064+ PAGE_SIZE);
51065+}
51066+
51067+char *
51068+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51069+{
51070+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51071+ PAGE_SIZE);
51072+}
51073+
51074+char *
51075+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51076+{
51077+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51078+ PAGE_SIZE);
51079+}
51080+
51081+char *
51082+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51083+{
51084+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51085+ PAGE_SIZE);
51086+}
51087+
51088+char *
51089+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51090+{
51091+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51092+ PAGE_SIZE);
51093+}
51094+
51095+__inline__ __u32
51096+to_gr_audit(const __u32 reqmode)
51097+{
51098+ /* masks off auditable permission flags, then shifts them to create
51099+ auditing flags, and adds the special case of append auditing if
51100+ we're requesting write */
51101+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51102+}
51103+
51104+struct acl_subject_label *
51105+lookup_subject_map(const struct acl_subject_label *userp)
51106+{
51107+ unsigned int index = shash(userp, subj_map_set.s_size);
51108+ struct subject_map *match;
51109+
51110+ match = subj_map_set.s_hash[index];
51111+
51112+ while (match && match->user != userp)
51113+ match = match->next;
51114+
51115+ if (match != NULL)
51116+ return match->kernel;
51117+ else
51118+ return NULL;
51119+}
51120+
51121+static void
51122+insert_subj_map_entry(struct subject_map *subjmap)
51123+{
51124+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51125+ struct subject_map **curr;
51126+
51127+ subjmap->prev = NULL;
51128+
51129+ curr = &subj_map_set.s_hash[index];
51130+ if (*curr != NULL)
51131+ (*curr)->prev = subjmap;
51132+
51133+ subjmap->next = *curr;
51134+ *curr = subjmap;
51135+
51136+ return;
51137+}
51138+
51139+static struct acl_role_label *
51140+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51141+ const gid_t gid)
51142+{
51143+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51144+ struct acl_role_label *match;
51145+ struct role_allowed_ip *ipp;
51146+ unsigned int x;
51147+ u32 curr_ip = task->signal->curr_ip;
51148+
51149+ task->signal->saved_ip = curr_ip;
51150+
51151+ match = acl_role_set.r_hash[index];
51152+
51153+ while (match) {
51154+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51155+ for (x = 0; x < match->domain_child_num; x++) {
51156+ if (match->domain_children[x] == uid)
51157+ goto found;
51158+ }
51159+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51160+ break;
51161+ match = match->next;
51162+ }
51163+found:
51164+ if (match == NULL) {
51165+ try_group:
51166+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51167+ match = acl_role_set.r_hash[index];
51168+
51169+ while (match) {
51170+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51171+ for (x = 0; x < match->domain_child_num; x++) {
51172+ if (match->domain_children[x] == gid)
51173+ goto found2;
51174+ }
51175+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51176+ break;
51177+ match = match->next;
51178+ }
51179+found2:
51180+ if (match == NULL)
51181+ match = default_role;
51182+ if (match->allowed_ips == NULL)
51183+ return match;
51184+ else {
51185+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51186+ if (likely
51187+ ((ntohl(curr_ip) & ipp->netmask) ==
51188+ (ntohl(ipp->addr) & ipp->netmask)))
51189+ return match;
51190+ }
51191+ match = default_role;
51192+ }
51193+ } else if (match->allowed_ips == NULL) {
51194+ return match;
51195+ } else {
51196+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51197+ if (likely
51198+ ((ntohl(curr_ip) & ipp->netmask) ==
51199+ (ntohl(ipp->addr) & ipp->netmask)))
51200+ return match;
51201+ }
51202+ goto try_group;
51203+ }
51204+
51205+ return match;
51206+}
51207+
51208+struct acl_subject_label *
51209+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51210+ const struct acl_role_label *role)
51211+{
51212+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51213+ struct acl_subject_label *match;
51214+
51215+ match = role->subj_hash[index];
51216+
51217+ while (match && (match->inode != ino || match->device != dev ||
51218+ (match->mode & GR_DELETED))) {
51219+ match = match->next;
51220+ }
51221+
51222+ if (match && !(match->mode & GR_DELETED))
51223+ return match;
51224+ else
51225+ return NULL;
51226+}
51227+
51228+struct acl_subject_label *
51229+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51230+ const struct acl_role_label *role)
51231+{
51232+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51233+ struct acl_subject_label *match;
51234+
51235+ match = role->subj_hash[index];
51236+
51237+ while (match && (match->inode != ino || match->device != dev ||
51238+ !(match->mode & GR_DELETED))) {
51239+ match = match->next;
51240+ }
51241+
51242+ if (match && (match->mode & GR_DELETED))
51243+ return match;
51244+ else
51245+ return NULL;
51246+}
51247+
51248+static struct acl_object_label *
51249+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51250+ const struct acl_subject_label *subj)
51251+{
51252+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51253+ struct acl_object_label *match;
51254+
51255+ match = subj->obj_hash[index];
51256+
51257+ while (match && (match->inode != ino || match->device != dev ||
51258+ (match->mode & GR_DELETED))) {
51259+ match = match->next;
51260+ }
51261+
51262+ if (match && !(match->mode & GR_DELETED))
51263+ return match;
51264+ else
51265+ return NULL;
51266+}
51267+
51268+static struct acl_object_label *
51269+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51270+ const struct acl_subject_label *subj)
51271+{
51272+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51273+ struct acl_object_label *match;
51274+
51275+ match = subj->obj_hash[index];
51276+
51277+ while (match && (match->inode != ino || match->device != dev ||
51278+ !(match->mode & GR_DELETED))) {
51279+ match = match->next;
51280+ }
51281+
51282+ if (match && (match->mode & GR_DELETED))
51283+ return match;
51284+
51285+ match = subj->obj_hash[index];
51286+
51287+ while (match && (match->inode != ino || match->device != dev ||
51288+ (match->mode & GR_DELETED))) {
51289+ match = match->next;
51290+ }
51291+
51292+ if (match && !(match->mode & GR_DELETED))
51293+ return match;
51294+ else
51295+ return NULL;
51296+}
51297+
51298+static struct name_entry *
51299+lookup_name_entry(const char *name)
51300+{
51301+ unsigned int len = strlen(name);
51302+ unsigned int key = full_name_hash(name, len);
51303+ unsigned int index = key % name_set.n_size;
51304+ struct name_entry *match;
51305+
51306+ match = name_set.n_hash[index];
51307+
51308+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51309+ match = match->next;
51310+
51311+ return match;
51312+}
51313+
51314+static struct name_entry *
51315+lookup_name_entry_create(const char *name)
51316+{
51317+ unsigned int len = strlen(name);
51318+ unsigned int key = full_name_hash(name, len);
51319+ unsigned int index = key % name_set.n_size;
51320+ struct name_entry *match;
51321+
51322+ match = name_set.n_hash[index];
51323+
51324+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51325+ !match->deleted))
51326+ match = match->next;
51327+
51328+ if (match && match->deleted)
51329+ return match;
51330+
51331+ match = name_set.n_hash[index];
51332+
51333+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51334+ match->deleted))
51335+ match = match->next;
51336+
51337+ if (match && !match->deleted)
51338+ return match;
51339+ else
51340+ return NULL;
51341+}
51342+
51343+static struct inodev_entry *
51344+lookup_inodev_entry(const ino_t ino, const dev_t dev)
51345+{
51346+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
51347+ struct inodev_entry *match;
51348+
51349+ match = inodev_set.i_hash[index];
51350+
51351+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51352+ match = match->next;
51353+
51354+ return match;
51355+}
51356+
51357+static void
51358+insert_inodev_entry(struct inodev_entry *entry)
51359+{
51360+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51361+ inodev_set.i_size);
51362+ struct inodev_entry **curr;
51363+
51364+ entry->prev = NULL;
51365+
51366+ curr = &inodev_set.i_hash[index];
51367+ if (*curr != NULL)
51368+ (*curr)->prev = entry;
51369+
51370+ entry->next = *curr;
51371+ *curr = entry;
51372+
51373+ return;
51374+}
51375+
51376+static void
51377+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51378+{
51379+ unsigned int index =
51380+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51381+ struct acl_role_label **curr;
51382+ struct acl_role_label *tmp;
51383+
51384+ curr = &acl_role_set.r_hash[index];
51385+
51386+ /* if role was already inserted due to domains and already has
51387+ a role in the same bucket as it attached, then we need to
51388+ combine these two buckets
51389+ */
51390+ if (role->next) {
51391+ tmp = role->next;
51392+ while (tmp->next)
51393+ tmp = tmp->next;
51394+ tmp->next = *curr;
51395+ } else
51396+ role->next = *curr;
51397+ *curr = role;
51398+
51399+ return;
51400+}
51401+
51402+static void
51403+insert_acl_role_label(struct acl_role_label *role)
51404+{
51405+ int i;
51406+
51407+ if (role_list == NULL) {
51408+ role_list = role;
51409+ role->prev = NULL;
51410+ } else {
51411+ role->prev = role_list;
51412+ role_list = role;
51413+ }
51414+
51415+ /* used for hash chains */
51416+ role->next = NULL;
51417+
51418+ if (role->roletype & GR_ROLE_DOMAIN) {
51419+ for (i = 0; i < role->domain_child_num; i++)
51420+ __insert_acl_role_label(role, role->domain_children[i]);
51421+ } else
51422+ __insert_acl_role_label(role, role->uidgid);
51423+}
51424+
51425+static int
51426+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
51427+{
51428+ struct name_entry **curr, *nentry;
51429+ struct inodev_entry *ientry;
51430+ unsigned int len = strlen(name);
51431+ unsigned int key = full_name_hash(name, len);
51432+ unsigned int index = key % name_set.n_size;
51433+
51434+ curr = &name_set.n_hash[index];
51435+
51436+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
51437+ curr = &((*curr)->next);
51438+
51439+ if (*curr != NULL)
51440+ return 1;
51441+
51442+ nentry = acl_alloc(sizeof (struct name_entry));
51443+ if (nentry == NULL)
51444+ return 0;
51445+ ientry = acl_alloc(sizeof (struct inodev_entry));
51446+ if (ientry == NULL)
51447+ return 0;
51448+ ientry->nentry = nentry;
51449+
51450+ nentry->key = key;
51451+ nentry->name = name;
51452+ nentry->inode = inode;
51453+ nentry->device = device;
51454+ nentry->len = len;
51455+ nentry->deleted = deleted;
51456+
51457+ nentry->prev = NULL;
51458+ curr = &name_set.n_hash[index];
51459+ if (*curr != NULL)
51460+ (*curr)->prev = nentry;
51461+ nentry->next = *curr;
51462+ *curr = nentry;
51463+
51464+ /* insert us into the table searchable by inode/dev */
51465+ insert_inodev_entry(ientry);
51466+
51467+ return 1;
51468+}
51469+
51470+static void
51471+insert_acl_obj_label(struct acl_object_label *obj,
51472+ struct acl_subject_label *subj)
51473+{
51474+ unsigned int index =
51475+ fhash(obj->inode, obj->device, subj->obj_hash_size);
51476+ struct acl_object_label **curr;
51477+
51478+
51479+ obj->prev = NULL;
51480+
51481+ curr = &subj->obj_hash[index];
51482+ if (*curr != NULL)
51483+ (*curr)->prev = obj;
51484+
51485+ obj->next = *curr;
51486+ *curr = obj;
51487+
51488+ return;
51489+}
51490+
51491+static void
51492+insert_acl_subj_label(struct acl_subject_label *obj,
51493+ struct acl_role_label *role)
51494+{
51495+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
51496+ struct acl_subject_label **curr;
51497+
51498+ obj->prev = NULL;
51499+
51500+ curr = &role->subj_hash[index];
51501+ if (*curr != NULL)
51502+ (*curr)->prev = obj;
51503+
51504+ obj->next = *curr;
51505+ *curr = obj;
51506+
51507+ return;
51508+}
51509+
51510+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
51511+
51512+static void *
51513+create_table(__u32 * len, int elementsize)
51514+{
51515+ unsigned int table_sizes[] = {
51516+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
51517+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
51518+ 4194301, 8388593, 16777213, 33554393, 67108859
51519+ };
51520+ void *newtable = NULL;
51521+ unsigned int pwr = 0;
51522+
51523+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
51524+ table_sizes[pwr] <= *len)
51525+ pwr++;
51526+
51527+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
51528+ return newtable;
51529+
51530+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
51531+ newtable =
51532+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
51533+ else
51534+ newtable = vmalloc(table_sizes[pwr] * elementsize);
51535+
51536+ *len = table_sizes[pwr];
51537+
51538+ return newtable;
51539+}
51540+
51541+static int
51542+init_variables(const struct gr_arg *arg)
51543+{
51544+ struct task_struct *reaper = &init_task;
51545+ unsigned int stacksize;
51546+
51547+ subj_map_set.s_size = arg->role_db.num_subjects;
51548+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
51549+ name_set.n_size = arg->role_db.num_objects;
51550+ inodev_set.i_size = arg->role_db.num_objects;
51551+
51552+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
51553+ !name_set.n_size || !inodev_set.i_size)
51554+ return 1;
51555+
51556+ if (!gr_init_uidset())
51557+ return 1;
51558+
51559+ /* set up the stack that holds allocation info */
51560+
51561+ stacksize = arg->role_db.num_pointers + 5;
51562+
51563+ if (!acl_alloc_stack_init(stacksize))
51564+ return 1;
51565+
51566+ /* grab reference for the real root dentry and vfsmount */
51567+ get_fs_root(reaper->fs, &real_root);
51568+
51569+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
51570+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
51571+#endif
51572+
51573+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
51574+ if (fakefs_obj_rw == NULL)
51575+ return 1;
51576+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
51577+
51578+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
51579+ if (fakefs_obj_rwx == NULL)
51580+ return 1;
51581+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
51582+
51583+ subj_map_set.s_hash =
51584+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
51585+ acl_role_set.r_hash =
51586+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
51587+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
51588+ inodev_set.i_hash =
51589+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
51590+
51591+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
51592+ !name_set.n_hash || !inodev_set.i_hash)
51593+ return 1;
51594+
51595+ memset(subj_map_set.s_hash, 0,
51596+ sizeof(struct subject_map *) * subj_map_set.s_size);
51597+ memset(acl_role_set.r_hash, 0,
51598+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
51599+ memset(name_set.n_hash, 0,
51600+ sizeof (struct name_entry *) * name_set.n_size);
51601+ memset(inodev_set.i_hash, 0,
51602+ sizeof (struct inodev_entry *) * inodev_set.i_size);
51603+
51604+ return 0;
51605+}
51606+
51607+/* free information not needed after startup
51608+ currently contains user->kernel pointer mappings for subjects
51609+*/
51610+
51611+static void
51612+free_init_variables(void)
51613+{
51614+ __u32 i;
51615+
51616+ if (subj_map_set.s_hash) {
51617+ for (i = 0; i < subj_map_set.s_size; i++) {
51618+ if (subj_map_set.s_hash[i]) {
51619+ kfree(subj_map_set.s_hash[i]);
51620+ subj_map_set.s_hash[i] = NULL;
51621+ }
51622+ }
51623+
51624+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
51625+ PAGE_SIZE)
51626+ kfree(subj_map_set.s_hash);
51627+ else
51628+ vfree(subj_map_set.s_hash);
51629+ }
51630+
51631+ return;
51632+}
51633+
51634+static void
51635+free_variables(void)
51636+{
51637+ struct acl_subject_label *s;
51638+ struct acl_role_label *r;
51639+ struct task_struct *task, *task2;
51640+ unsigned int x;
51641+
51642+ gr_clear_learn_entries();
51643+
51644+ read_lock(&tasklist_lock);
51645+ do_each_thread(task2, task) {
51646+ task->acl_sp_role = 0;
51647+ task->acl_role_id = 0;
51648+ task->acl = NULL;
51649+ task->role = NULL;
51650+ } while_each_thread(task2, task);
51651+ read_unlock(&tasklist_lock);
51652+
51653+ /* release the reference to the real root dentry and vfsmount */
51654+ path_put(&real_root);
51655+
51656+ /* free all object hash tables */
51657+
51658+ FOR_EACH_ROLE_START(r)
51659+ if (r->subj_hash == NULL)
51660+ goto next_role;
51661+ FOR_EACH_SUBJECT_START(r, s, x)
51662+ if (s->obj_hash == NULL)
51663+ break;
51664+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51665+ kfree(s->obj_hash);
51666+ else
51667+ vfree(s->obj_hash);
51668+ FOR_EACH_SUBJECT_END(s, x)
51669+ FOR_EACH_NESTED_SUBJECT_START(r, s)
51670+ if (s->obj_hash == NULL)
51671+ break;
51672+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51673+ kfree(s->obj_hash);
51674+ else
51675+ vfree(s->obj_hash);
51676+ FOR_EACH_NESTED_SUBJECT_END(s)
51677+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
51678+ kfree(r->subj_hash);
51679+ else
51680+ vfree(r->subj_hash);
51681+ r->subj_hash = NULL;
51682+next_role:
51683+ FOR_EACH_ROLE_END(r)
51684+
51685+ acl_free_all();
51686+
51687+ if (acl_role_set.r_hash) {
51688+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
51689+ PAGE_SIZE)
51690+ kfree(acl_role_set.r_hash);
51691+ else
51692+ vfree(acl_role_set.r_hash);
51693+ }
51694+ if (name_set.n_hash) {
51695+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
51696+ PAGE_SIZE)
51697+ kfree(name_set.n_hash);
51698+ else
51699+ vfree(name_set.n_hash);
51700+ }
51701+
51702+ if (inodev_set.i_hash) {
51703+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
51704+ PAGE_SIZE)
51705+ kfree(inodev_set.i_hash);
51706+ else
51707+ vfree(inodev_set.i_hash);
51708+ }
51709+
51710+ gr_free_uidset();
51711+
51712+ memset(&name_set, 0, sizeof (struct name_db));
51713+ memset(&inodev_set, 0, sizeof (struct inodev_db));
51714+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
51715+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
51716+
51717+ default_role = NULL;
51718+ role_list = NULL;
51719+
51720+ return;
51721+}
51722+
51723+static __u32
51724+count_user_objs(struct acl_object_label *userp)
51725+{
51726+ struct acl_object_label o_tmp;
51727+ __u32 num = 0;
51728+
51729+ while (userp) {
51730+ if (copy_from_user(&o_tmp, userp,
51731+ sizeof (struct acl_object_label)))
51732+ break;
51733+
51734+ userp = o_tmp.prev;
51735+ num++;
51736+ }
51737+
51738+ return num;
51739+}
51740+
51741+static struct acl_subject_label *
51742+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
51743+
51744+static int
51745+copy_user_glob(struct acl_object_label *obj)
51746+{
51747+ struct acl_object_label *g_tmp, **guser;
51748+ unsigned int len;
51749+ char *tmp;
51750+
51751+ if (obj->globbed == NULL)
51752+ return 0;
51753+
51754+ guser = &obj->globbed;
51755+ while (*guser) {
51756+ g_tmp = (struct acl_object_label *)
51757+ acl_alloc(sizeof (struct acl_object_label));
51758+ if (g_tmp == NULL)
51759+ return -ENOMEM;
51760+
51761+ if (copy_from_user(g_tmp, *guser,
51762+ sizeof (struct acl_object_label)))
51763+ return -EFAULT;
51764+
51765+ len = strnlen_user(g_tmp->filename, PATH_MAX);
51766+
51767+ if (!len || len >= PATH_MAX)
51768+ return -EINVAL;
51769+
51770+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51771+ return -ENOMEM;
51772+
51773+ if (copy_from_user(tmp, g_tmp->filename, len))
51774+ return -EFAULT;
51775+ tmp[len-1] = '\0';
51776+ g_tmp->filename = tmp;
51777+
51778+ *guser = g_tmp;
51779+ guser = &(g_tmp->next);
51780+ }
51781+
51782+ return 0;
51783+}
51784+
51785+static int
51786+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
51787+ struct acl_role_label *role)
51788+{
51789+ struct acl_object_label *o_tmp;
51790+ unsigned int len;
51791+ int ret;
51792+ char *tmp;
51793+
51794+ while (userp) {
51795+ if ((o_tmp = (struct acl_object_label *)
51796+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
51797+ return -ENOMEM;
51798+
51799+ if (copy_from_user(o_tmp, userp,
51800+ sizeof (struct acl_object_label)))
51801+ return -EFAULT;
51802+
51803+ userp = o_tmp->prev;
51804+
51805+ len = strnlen_user(o_tmp->filename, PATH_MAX);
51806+
51807+ if (!len || len >= PATH_MAX)
51808+ return -EINVAL;
51809+
51810+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51811+ return -ENOMEM;
51812+
51813+ if (copy_from_user(tmp, o_tmp->filename, len))
51814+ return -EFAULT;
51815+ tmp[len-1] = '\0';
51816+ o_tmp->filename = tmp;
51817+
51818+ insert_acl_obj_label(o_tmp, subj);
51819+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
51820+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
51821+ return -ENOMEM;
51822+
51823+ ret = copy_user_glob(o_tmp);
51824+ if (ret)
51825+ return ret;
51826+
51827+ if (o_tmp->nested) {
51828+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
51829+ if (IS_ERR(o_tmp->nested))
51830+ return PTR_ERR(o_tmp->nested);
51831+
51832+ /* insert into nested subject list */
51833+ o_tmp->nested->next = role->hash->first;
51834+ role->hash->first = o_tmp->nested;
51835+ }
51836+ }
51837+
51838+ return 0;
51839+}
51840+
51841+static __u32
51842+count_user_subjs(struct acl_subject_label *userp)
51843+{
51844+ struct acl_subject_label s_tmp;
51845+ __u32 num = 0;
51846+
51847+ while (userp) {
51848+ if (copy_from_user(&s_tmp, userp,
51849+ sizeof (struct acl_subject_label)))
51850+ break;
51851+
51852+ userp = s_tmp.prev;
51853+ /* do not count nested subjects against this count, since
51854+ they are not included in the hash table, but are
51855+ attached to objects. We have already counted
51856+ the subjects in userspace for the allocation
51857+ stack
51858+ */
51859+ if (!(s_tmp.mode & GR_NESTED))
51860+ num++;
51861+ }
51862+
51863+ return num;
51864+}
51865+
51866+static int
51867+copy_user_allowedips(struct acl_role_label *rolep)
51868+{
51869+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
51870+
51871+ ruserip = rolep->allowed_ips;
51872+
51873+ while (ruserip) {
51874+ rlast = rtmp;
51875+
51876+ if ((rtmp = (struct role_allowed_ip *)
51877+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
51878+ return -ENOMEM;
51879+
51880+ if (copy_from_user(rtmp, ruserip,
51881+ sizeof (struct role_allowed_ip)))
51882+ return -EFAULT;
51883+
51884+ ruserip = rtmp->prev;
51885+
51886+ if (!rlast) {
51887+ rtmp->prev = NULL;
51888+ rolep->allowed_ips = rtmp;
51889+ } else {
51890+ rlast->next = rtmp;
51891+ rtmp->prev = rlast;
51892+ }
51893+
51894+ if (!ruserip)
51895+ rtmp->next = NULL;
51896+ }
51897+
51898+ return 0;
51899+}
51900+
51901+static int
51902+copy_user_transitions(struct acl_role_label *rolep)
51903+{
51904+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
51905+
51906+ unsigned int len;
51907+ char *tmp;
51908+
51909+ rusertp = rolep->transitions;
51910+
51911+ while (rusertp) {
51912+ rlast = rtmp;
51913+
51914+ if ((rtmp = (struct role_transition *)
51915+ acl_alloc(sizeof (struct role_transition))) == NULL)
51916+ return -ENOMEM;
51917+
51918+ if (copy_from_user(rtmp, rusertp,
51919+ sizeof (struct role_transition)))
51920+ return -EFAULT;
51921+
51922+ rusertp = rtmp->prev;
51923+
51924+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
51925+
51926+ if (!len || len >= GR_SPROLE_LEN)
51927+ return -EINVAL;
51928+
51929+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51930+ return -ENOMEM;
51931+
51932+ if (copy_from_user(tmp, rtmp->rolename, len))
51933+ return -EFAULT;
51934+ tmp[len-1] = '\0';
51935+ rtmp->rolename = tmp;
51936+
51937+ if (!rlast) {
51938+ rtmp->prev = NULL;
51939+ rolep->transitions = rtmp;
51940+ } else {
51941+ rlast->next = rtmp;
51942+ rtmp->prev = rlast;
51943+ }
51944+
51945+ if (!rusertp)
51946+ rtmp->next = NULL;
51947+ }
51948+
51949+ return 0;
51950+}
51951+
51952+static struct acl_subject_label *
51953+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
51954+{
51955+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
51956+ unsigned int len;
51957+ char *tmp;
51958+ __u32 num_objs;
51959+ struct acl_ip_label **i_tmp, *i_utmp2;
51960+ struct gr_hash_struct ghash;
51961+ struct subject_map *subjmap;
51962+ unsigned int i_num;
51963+ int err;
51964+
51965+ s_tmp = lookup_subject_map(userp);
51966+
51967+ /* we've already copied this subject into the kernel, just return
51968+ the reference to it, and don't copy it over again
51969+ */
51970+ if (s_tmp)
51971+ return(s_tmp);
51972+
51973+ if ((s_tmp = (struct acl_subject_label *)
51974+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
51975+ return ERR_PTR(-ENOMEM);
51976+
51977+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
51978+ if (subjmap == NULL)
51979+ return ERR_PTR(-ENOMEM);
51980+
51981+ subjmap->user = userp;
51982+ subjmap->kernel = s_tmp;
51983+ insert_subj_map_entry(subjmap);
51984+
51985+ if (copy_from_user(s_tmp, userp,
51986+ sizeof (struct acl_subject_label)))
51987+ return ERR_PTR(-EFAULT);
51988+
51989+ len = strnlen_user(s_tmp->filename, PATH_MAX);
51990+
51991+ if (!len || len >= PATH_MAX)
51992+ return ERR_PTR(-EINVAL);
51993+
51994+ if ((tmp = (char *) acl_alloc(len)) == NULL)
51995+ return ERR_PTR(-ENOMEM);
51996+
51997+ if (copy_from_user(tmp, s_tmp->filename, len))
51998+ return ERR_PTR(-EFAULT);
51999+ tmp[len-1] = '\0';
52000+ s_tmp->filename = tmp;
52001+
52002+ if (!strcmp(s_tmp->filename, "/"))
52003+ role->root_label = s_tmp;
52004+
52005+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52006+ return ERR_PTR(-EFAULT);
52007+
52008+ /* copy user and group transition tables */
52009+
52010+ if (s_tmp->user_trans_num) {
52011+ uid_t *uidlist;
52012+
52013+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52014+ if (uidlist == NULL)
52015+ return ERR_PTR(-ENOMEM);
52016+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52017+ return ERR_PTR(-EFAULT);
52018+
52019+ s_tmp->user_transitions = uidlist;
52020+ }
52021+
52022+ if (s_tmp->group_trans_num) {
52023+ gid_t *gidlist;
52024+
52025+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52026+ if (gidlist == NULL)
52027+ return ERR_PTR(-ENOMEM);
52028+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52029+ return ERR_PTR(-EFAULT);
52030+
52031+ s_tmp->group_transitions = gidlist;
52032+ }
52033+
52034+ /* set up object hash table */
52035+ num_objs = count_user_objs(ghash.first);
52036+
52037+ s_tmp->obj_hash_size = num_objs;
52038+ s_tmp->obj_hash =
52039+ (struct acl_object_label **)
52040+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52041+
52042+ if (!s_tmp->obj_hash)
52043+ return ERR_PTR(-ENOMEM);
52044+
52045+ memset(s_tmp->obj_hash, 0,
52046+ s_tmp->obj_hash_size *
52047+ sizeof (struct acl_object_label *));
52048+
52049+ /* add in objects */
52050+ err = copy_user_objs(ghash.first, s_tmp, role);
52051+
52052+ if (err)
52053+ return ERR_PTR(err);
52054+
52055+ /* set pointer for parent subject */
52056+ if (s_tmp->parent_subject) {
52057+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52058+
52059+ if (IS_ERR(s_tmp2))
52060+ return s_tmp2;
52061+
52062+ s_tmp->parent_subject = s_tmp2;
52063+ }
52064+
52065+ /* add in ip acls */
52066+
52067+ if (!s_tmp->ip_num) {
52068+ s_tmp->ips = NULL;
52069+ goto insert;
52070+ }
52071+
52072+ i_tmp =
52073+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52074+ sizeof (struct acl_ip_label *));
52075+
52076+ if (!i_tmp)
52077+ return ERR_PTR(-ENOMEM);
52078+
52079+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52080+ *(i_tmp + i_num) =
52081+ (struct acl_ip_label *)
52082+ acl_alloc(sizeof (struct acl_ip_label));
52083+ if (!*(i_tmp + i_num))
52084+ return ERR_PTR(-ENOMEM);
52085+
52086+ if (copy_from_user
52087+ (&i_utmp2, s_tmp->ips + i_num,
52088+ sizeof (struct acl_ip_label *)))
52089+ return ERR_PTR(-EFAULT);
52090+
52091+ if (copy_from_user
52092+ (*(i_tmp + i_num), i_utmp2,
52093+ sizeof (struct acl_ip_label)))
52094+ return ERR_PTR(-EFAULT);
52095+
52096+ if ((*(i_tmp + i_num))->iface == NULL)
52097+ continue;
52098+
52099+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52100+ if (!len || len >= IFNAMSIZ)
52101+ return ERR_PTR(-EINVAL);
52102+ tmp = acl_alloc(len);
52103+ if (tmp == NULL)
52104+ return ERR_PTR(-ENOMEM);
52105+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52106+ return ERR_PTR(-EFAULT);
52107+ (*(i_tmp + i_num))->iface = tmp;
52108+ }
52109+
52110+ s_tmp->ips = i_tmp;
52111+
52112+insert:
52113+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52114+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52115+ return ERR_PTR(-ENOMEM);
52116+
52117+ return s_tmp;
52118+}
52119+
52120+static int
52121+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52122+{
52123+ struct acl_subject_label s_pre;
52124+ struct acl_subject_label * ret;
52125+ int err;
52126+
52127+ while (userp) {
52128+ if (copy_from_user(&s_pre, userp,
52129+ sizeof (struct acl_subject_label)))
52130+ return -EFAULT;
52131+
52132+ /* do not add nested subjects here, add
52133+ while parsing objects
52134+ */
52135+
52136+ if (s_pre.mode & GR_NESTED) {
52137+ userp = s_pre.prev;
52138+ continue;
52139+ }
52140+
52141+ ret = do_copy_user_subj(userp, role);
52142+
52143+ err = PTR_ERR(ret);
52144+ if (IS_ERR(ret))
52145+ return err;
52146+
52147+ insert_acl_subj_label(ret, role);
52148+
52149+ userp = s_pre.prev;
52150+ }
52151+
52152+ return 0;
52153+}
52154+
52155+static int
52156+copy_user_acl(struct gr_arg *arg)
52157+{
52158+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52159+ struct sprole_pw *sptmp;
52160+ struct gr_hash_struct *ghash;
52161+ uid_t *domainlist;
52162+ unsigned int r_num;
52163+ unsigned int len;
52164+ char *tmp;
52165+ int err = 0;
52166+ __u16 i;
52167+ __u32 num_subjs;
52168+
52169+ /* we need a default and kernel role */
52170+ if (arg->role_db.num_roles < 2)
52171+ return -EINVAL;
52172+
52173+ /* copy special role authentication info from userspace */
52174+
52175+ num_sprole_pws = arg->num_sprole_pws;
52176+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52177+
52178+ if (!acl_special_roles) {
52179+ err = -ENOMEM;
52180+ goto cleanup;
52181+ }
52182+
52183+ for (i = 0; i < num_sprole_pws; i++) {
52184+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52185+ if (!sptmp) {
52186+ err = -ENOMEM;
52187+ goto cleanup;
52188+ }
52189+ if (copy_from_user(sptmp, arg->sprole_pws + i,
52190+ sizeof (struct sprole_pw))) {
52191+ err = -EFAULT;
52192+ goto cleanup;
52193+ }
52194+
52195+ len =
52196+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52197+
52198+ if (!len || len >= GR_SPROLE_LEN) {
52199+ err = -EINVAL;
52200+ goto cleanup;
52201+ }
52202+
52203+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52204+ err = -ENOMEM;
52205+ goto cleanup;
52206+ }
52207+
52208+ if (copy_from_user(tmp, sptmp->rolename, len)) {
52209+ err = -EFAULT;
52210+ goto cleanup;
52211+ }
52212+ tmp[len-1] = '\0';
52213+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52214+ printk(KERN_ALERT "Copying special role %s\n", tmp);
52215+#endif
52216+ sptmp->rolename = tmp;
52217+ acl_special_roles[i] = sptmp;
52218+ }
52219+
52220+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52221+
52222+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52223+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
52224+
52225+ if (!r_tmp) {
52226+ err = -ENOMEM;
52227+ goto cleanup;
52228+ }
52229+
52230+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
52231+ sizeof (struct acl_role_label *))) {
52232+ err = -EFAULT;
52233+ goto cleanup;
52234+ }
52235+
52236+ if (copy_from_user(r_tmp, r_utmp2,
52237+ sizeof (struct acl_role_label))) {
52238+ err = -EFAULT;
52239+ goto cleanup;
52240+ }
52241+
52242+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52243+
52244+ if (!len || len >= PATH_MAX) {
52245+ err = -EINVAL;
52246+ goto cleanup;
52247+ }
52248+
52249+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52250+ err = -ENOMEM;
52251+ goto cleanup;
52252+ }
52253+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
52254+ err = -EFAULT;
52255+ goto cleanup;
52256+ }
52257+ tmp[len-1] = '\0';
52258+ r_tmp->rolename = tmp;
52259+
52260+ if (!strcmp(r_tmp->rolename, "default")
52261+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52262+ default_role = r_tmp;
52263+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52264+ kernel_role = r_tmp;
52265+ }
52266+
52267+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52268+ err = -ENOMEM;
52269+ goto cleanup;
52270+ }
52271+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52272+ err = -EFAULT;
52273+ goto cleanup;
52274+ }
52275+
52276+ r_tmp->hash = ghash;
52277+
52278+ num_subjs = count_user_subjs(r_tmp->hash->first);
52279+
52280+ r_tmp->subj_hash_size = num_subjs;
52281+ r_tmp->subj_hash =
52282+ (struct acl_subject_label **)
52283+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52284+
52285+ if (!r_tmp->subj_hash) {
52286+ err = -ENOMEM;
52287+ goto cleanup;
52288+ }
52289+
52290+ err = copy_user_allowedips(r_tmp);
52291+ if (err)
52292+ goto cleanup;
52293+
52294+ /* copy domain info */
52295+ if (r_tmp->domain_children != NULL) {
52296+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52297+ if (domainlist == NULL) {
52298+ err = -ENOMEM;
52299+ goto cleanup;
52300+ }
52301+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52302+ err = -EFAULT;
52303+ goto cleanup;
52304+ }
52305+ r_tmp->domain_children = domainlist;
52306+ }
52307+
52308+ err = copy_user_transitions(r_tmp);
52309+ if (err)
52310+ goto cleanup;
52311+
52312+ memset(r_tmp->subj_hash, 0,
52313+ r_tmp->subj_hash_size *
52314+ sizeof (struct acl_subject_label *));
52315+
52316+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52317+
52318+ if (err)
52319+ goto cleanup;
52320+
52321+ /* set nested subject list to null */
52322+ r_tmp->hash->first = NULL;
52323+
52324+ insert_acl_role_label(r_tmp);
52325+ }
52326+
52327+ goto return_err;
52328+ cleanup:
52329+ free_variables();
52330+ return_err:
52331+ return err;
52332+
52333+}
52334+
52335+static int
52336+gracl_init(struct gr_arg *args)
52337+{
52338+ int error = 0;
52339+
52340+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52341+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52342+
52343+ if (init_variables(args)) {
52344+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52345+ error = -ENOMEM;
52346+ free_variables();
52347+ goto out;
52348+ }
52349+
52350+ error = copy_user_acl(args);
52351+ free_init_variables();
52352+ if (error) {
52353+ free_variables();
52354+ goto out;
52355+ }
52356+
52357+ if ((error = gr_set_acls(0))) {
52358+ free_variables();
52359+ goto out;
52360+ }
52361+
52362+ pax_open_kernel();
52363+ gr_status |= GR_READY;
52364+ pax_close_kernel();
52365+
52366+ out:
52367+ return error;
52368+}
52369+
52370+/* derived from glibc fnmatch() 0: match, 1: no match*/
52371+
52372+static int
52373+glob_match(const char *p, const char *n)
52374+{
52375+ char c;
52376+
52377+ while ((c = *p++) != '\0') {
52378+ switch (c) {
52379+ case '?':
52380+ if (*n == '\0')
52381+ return 1;
52382+ else if (*n == '/')
52383+ return 1;
52384+ break;
52385+ case '\\':
52386+ if (*n != c)
52387+ return 1;
52388+ break;
52389+ case '*':
52390+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
52391+ if (*n == '/')
52392+ return 1;
52393+ else if (c == '?') {
52394+ if (*n == '\0')
52395+ return 1;
52396+ else
52397+ ++n;
52398+ }
52399+ }
52400+ if (c == '\0') {
52401+ return 0;
52402+ } else {
52403+ const char *endp;
52404+
52405+ if ((endp = strchr(n, '/')) == NULL)
52406+ endp = n + strlen(n);
52407+
52408+ if (c == '[') {
52409+ for (--p; n < endp; ++n)
52410+ if (!glob_match(p, n))
52411+ return 0;
52412+ } else if (c == '/') {
52413+ while (*n != '\0' && *n != '/')
52414+ ++n;
52415+ if (*n == '/' && !glob_match(p, n + 1))
52416+ return 0;
52417+ } else {
52418+ for (--p; n < endp; ++n)
52419+ if (*n == c && !glob_match(p, n))
52420+ return 0;
52421+ }
52422+
52423+ return 1;
52424+ }
52425+ case '[':
52426+ {
52427+ int not;
52428+ char cold;
52429+
52430+ if (*n == '\0' || *n == '/')
52431+ return 1;
52432+
52433+ not = (*p == '!' || *p == '^');
52434+ if (not)
52435+ ++p;
52436+
52437+ c = *p++;
52438+ for (;;) {
52439+ unsigned char fn = (unsigned char)*n;
52440+
52441+ if (c == '\0')
52442+ return 1;
52443+ else {
52444+ if (c == fn)
52445+ goto matched;
52446+ cold = c;
52447+ c = *p++;
52448+
52449+ if (c == '-' && *p != ']') {
52450+ unsigned char cend = *p++;
52451+
52452+ if (cend == '\0')
52453+ return 1;
52454+
52455+ if (cold <= fn && fn <= cend)
52456+ goto matched;
52457+
52458+ c = *p++;
52459+ }
52460+ }
52461+
52462+ if (c == ']')
52463+ break;
52464+ }
52465+ if (!not)
52466+ return 1;
52467+ break;
52468+ matched:
52469+ while (c != ']') {
52470+ if (c == '\0')
52471+ return 1;
52472+
52473+ c = *p++;
52474+ }
52475+ if (not)
52476+ return 1;
52477+ }
52478+ break;
52479+ default:
52480+ if (c != *n)
52481+ return 1;
52482+ }
52483+
52484+ ++n;
52485+ }
52486+
52487+ if (*n == '\0')
52488+ return 0;
52489+
52490+ if (*n == '/')
52491+ return 0;
52492+
52493+ return 1;
52494+}
52495+
52496+static struct acl_object_label *
52497+chk_glob_label(struct acl_object_label *globbed,
52498+ struct dentry *dentry, struct vfsmount *mnt, char **path)
52499+{
52500+ struct acl_object_label *tmp;
52501+
52502+ if (*path == NULL)
52503+ *path = gr_to_filename_nolock(dentry, mnt);
52504+
52505+ tmp = globbed;
52506+
52507+ while (tmp) {
52508+ if (!glob_match(tmp->filename, *path))
52509+ return tmp;
52510+ tmp = tmp->next;
52511+ }
52512+
52513+ return NULL;
52514+}
52515+
52516+static struct acl_object_label *
52517+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52518+ const ino_t curr_ino, const dev_t curr_dev,
52519+ const struct acl_subject_label *subj, char **path, const int checkglob)
52520+{
52521+ struct acl_subject_label *tmpsubj;
52522+ struct acl_object_label *retval;
52523+ struct acl_object_label *retval2;
52524+
52525+ tmpsubj = (struct acl_subject_label *) subj;
52526+ read_lock(&gr_inode_lock);
52527+ do {
52528+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
52529+ if (retval) {
52530+ if (checkglob && retval->globbed) {
52531+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
52532+ (struct vfsmount *)orig_mnt, path);
52533+ if (retval2)
52534+ retval = retval2;
52535+ }
52536+ break;
52537+ }
52538+ } while ((tmpsubj = tmpsubj->parent_subject));
52539+ read_unlock(&gr_inode_lock);
52540+
52541+ return retval;
52542+}
52543+
52544+static __inline__ struct acl_object_label *
52545+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52546+ struct dentry *curr_dentry,
52547+ const struct acl_subject_label *subj, char **path, const int checkglob)
52548+{
52549+ int newglob = checkglob;
52550+ ino_t inode;
52551+ dev_t device;
52552+
52553+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
52554+ as we don't want a / * rule to match instead of the / object
52555+ don't do this for create lookups that call this function though, since they're looking up
52556+ on the parent and thus need globbing checks on all paths
52557+ */
52558+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
52559+ newglob = GR_NO_GLOB;
52560+
52561+ spin_lock(&curr_dentry->d_lock);
52562+ inode = curr_dentry->d_inode->i_ino;
52563+ device = __get_dev(curr_dentry);
52564+ spin_unlock(&curr_dentry->d_lock);
52565+
52566+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
52567+}
52568+
52569+static struct acl_object_label *
52570+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52571+ const struct acl_subject_label *subj, char *path, const int checkglob)
52572+{
52573+ struct dentry *dentry = (struct dentry *) l_dentry;
52574+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52575+ struct acl_object_label *retval;
52576+ struct dentry *parent;
52577+
52578+ write_seqlock(&rename_lock);
52579+ br_read_lock(vfsmount_lock);
52580+
52581+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
52582+#ifdef CONFIG_NET
52583+ mnt == sock_mnt ||
52584+#endif
52585+#ifdef CONFIG_HUGETLBFS
52586+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
52587+#endif
52588+ /* ignore Eric Biederman */
52589+ IS_PRIVATE(l_dentry->d_inode))) {
52590+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
52591+ goto out;
52592+ }
52593+
52594+ for (;;) {
52595+ if (dentry == real_root.dentry && mnt == real_root.mnt)
52596+ break;
52597+
52598+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52599+ if (mnt->mnt_parent == mnt)
52600+ break;
52601+
52602+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52603+ if (retval != NULL)
52604+ goto out;
52605+
52606+ dentry = mnt->mnt_mountpoint;
52607+ mnt = mnt->mnt_parent;
52608+ continue;
52609+ }
52610+
52611+ parent = dentry->d_parent;
52612+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52613+ if (retval != NULL)
52614+ goto out;
52615+
52616+ dentry = parent;
52617+ }
52618+
52619+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52620+
52621+ /* real_root is pinned so we don't have to hold a reference */
52622+ if (retval == NULL)
52623+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
52624+out:
52625+ br_read_unlock(vfsmount_lock);
52626+ write_sequnlock(&rename_lock);
52627+
52628+ BUG_ON(retval == NULL);
52629+
52630+ return retval;
52631+}
52632+
52633+static __inline__ struct acl_object_label *
52634+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52635+ const struct acl_subject_label *subj)
52636+{
52637+ char *path = NULL;
52638+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
52639+}
52640+
52641+static __inline__ struct acl_object_label *
52642+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52643+ const struct acl_subject_label *subj)
52644+{
52645+ char *path = NULL;
52646+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
52647+}
52648+
52649+static __inline__ struct acl_object_label *
52650+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52651+ const struct acl_subject_label *subj, char *path)
52652+{
52653+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
52654+}
52655+
52656+static struct acl_subject_label *
52657+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52658+ const struct acl_role_label *role)
52659+{
52660+ struct dentry *dentry = (struct dentry *) l_dentry;
52661+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52662+ struct acl_subject_label *retval;
52663+ struct dentry *parent;
52664+
52665+ write_seqlock(&rename_lock);
52666+ br_read_lock(vfsmount_lock);
52667+
52668+ for (;;) {
52669+ if (dentry == real_root.dentry && mnt == real_root.mnt)
52670+ break;
52671+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52672+ if (mnt->mnt_parent == mnt)
52673+ break;
52674+
52675+ spin_lock(&dentry->d_lock);
52676+ read_lock(&gr_inode_lock);
52677+ retval =
52678+ lookup_acl_subj_label(dentry->d_inode->i_ino,
52679+ __get_dev(dentry), role);
52680+ read_unlock(&gr_inode_lock);
52681+ spin_unlock(&dentry->d_lock);
52682+ if (retval != NULL)
52683+ goto out;
52684+
52685+ dentry = mnt->mnt_mountpoint;
52686+ mnt = mnt->mnt_parent;
52687+ continue;
52688+ }
52689+
52690+ spin_lock(&dentry->d_lock);
52691+ read_lock(&gr_inode_lock);
52692+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52693+ __get_dev(dentry), role);
52694+ read_unlock(&gr_inode_lock);
52695+ parent = dentry->d_parent;
52696+ spin_unlock(&dentry->d_lock);
52697+
52698+ if (retval != NULL)
52699+ goto out;
52700+
52701+ dentry = parent;
52702+ }
52703+
52704+ spin_lock(&dentry->d_lock);
52705+ read_lock(&gr_inode_lock);
52706+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52707+ __get_dev(dentry), role);
52708+ read_unlock(&gr_inode_lock);
52709+ spin_unlock(&dentry->d_lock);
52710+
52711+ if (unlikely(retval == NULL)) {
52712+ /* real_root is pinned, we don't need to hold a reference */
52713+ read_lock(&gr_inode_lock);
52714+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
52715+ __get_dev(real_root.dentry), role);
52716+ read_unlock(&gr_inode_lock);
52717+ }
52718+out:
52719+ br_read_unlock(vfsmount_lock);
52720+ write_sequnlock(&rename_lock);
52721+
52722+ BUG_ON(retval == NULL);
52723+
52724+ return retval;
52725+}
52726+
52727+static void
52728+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
52729+{
52730+ struct task_struct *task = current;
52731+ const struct cred *cred = current_cred();
52732+
52733+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52734+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52735+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52736+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
52737+
52738+ return;
52739+}
52740+
52741+static void
52742+gr_log_learn_sysctl(const char *path, const __u32 mode)
52743+{
52744+ struct task_struct *task = current;
52745+ const struct cred *cred = current_cred();
52746+
52747+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52748+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52749+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52750+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
52751+
52752+ return;
52753+}
52754+
52755+static void
52756+gr_log_learn_id_change(const char type, const unsigned int real,
52757+ const unsigned int effective, const unsigned int fs)
52758+{
52759+ struct task_struct *task = current;
52760+ const struct cred *cred = current_cred();
52761+
52762+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
52763+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52764+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52765+ type, real, effective, fs, &task->signal->saved_ip);
52766+
52767+ return;
52768+}
52769+
52770+__u32
52771+gr_search_file(const struct dentry * dentry, const __u32 mode,
52772+ const struct vfsmount * mnt)
52773+{
52774+ __u32 retval = mode;
52775+ struct acl_subject_label *curracl;
52776+ struct acl_object_label *currobj;
52777+
52778+ if (unlikely(!(gr_status & GR_READY)))
52779+ return (mode & ~GR_AUDITS);
52780+
52781+ curracl = current->acl;
52782+
52783+ currobj = chk_obj_label(dentry, mnt, curracl);
52784+ retval = currobj->mode & mode;
52785+
52786+ /* if we're opening a specified transfer file for writing
52787+ (e.g. /dev/initctl), then transfer our role to init
52788+ */
52789+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
52790+ current->role->roletype & GR_ROLE_PERSIST)) {
52791+ struct task_struct *task = init_pid_ns.child_reaper;
52792+
52793+ if (task->role != current->role) {
52794+ task->acl_sp_role = 0;
52795+ task->acl_role_id = current->acl_role_id;
52796+ task->role = current->role;
52797+ rcu_read_lock();
52798+ read_lock(&grsec_exec_file_lock);
52799+ gr_apply_subject_to_task(task);
52800+ read_unlock(&grsec_exec_file_lock);
52801+ rcu_read_unlock();
52802+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
52803+ }
52804+ }
52805+
52806+ if (unlikely
52807+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
52808+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
52809+ __u32 new_mode = mode;
52810+
52811+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52812+
52813+ retval = new_mode;
52814+
52815+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
52816+ new_mode |= GR_INHERIT;
52817+
52818+ if (!(mode & GR_NOLEARN))
52819+ gr_log_learn(dentry, mnt, new_mode);
52820+ }
52821+
52822+ return retval;
52823+}
52824+
52825+struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
52826+ const struct dentry *parent,
52827+ const struct vfsmount *mnt)
52828+{
52829+ struct name_entry *match;
52830+ struct acl_object_label *matchpo;
52831+ struct acl_subject_label *curracl;
52832+ char *path;
52833+
52834+ if (unlikely(!(gr_status & GR_READY)))
52835+ return NULL;
52836+
52837+ preempt_disable();
52838+ path = gr_to_filename_rbac(new_dentry, mnt);
52839+ match = lookup_name_entry_create(path);
52840+
52841+ curracl = current->acl;
52842+
52843+ if (match) {
52844+ read_lock(&gr_inode_lock);
52845+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
52846+ read_unlock(&gr_inode_lock);
52847+
52848+ if (matchpo) {
52849+ preempt_enable();
52850+ return matchpo;
52851+ }
52852+ }
52853+
52854+ // lookup parent
52855+
52856+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
52857+
52858+ preempt_enable();
52859+ return matchpo;
52860+}
52861+
52862+__u32
52863+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
52864+ const struct vfsmount * mnt, const __u32 mode)
52865+{
52866+ struct acl_object_label *matchpo;
52867+ __u32 retval;
52868+
52869+ if (unlikely(!(gr_status & GR_READY)))
52870+ return (mode & ~GR_AUDITS);
52871+
52872+ matchpo = gr_get_create_object(new_dentry, parent, mnt);
52873+
52874+ retval = matchpo->mode & mode;
52875+
52876+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
52877+ && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
52878+ __u32 new_mode = mode;
52879+
52880+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52881+
52882+ gr_log_learn(new_dentry, mnt, new_mode);
52883+ return new_mode;
52884+ }
52885+
52886+ return retval;
52887+}
52888+
52889+__u32
52890+gr_check_link(const struct dentry * new_dentry,
52891+ const struct dentry * parent_dentry,
52892+ const struct vfsmount * parent_mnt,
52893+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
52894+{
52895+ struct acl_object_label *obj;
52896+ __u32 oldmode, newmode;
52897+ __u32 needmode;
52898+ __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
52899+ GR_DELETE | GR_INHERIT;
52900+
52901+ if (unlikely(!(gr_status & GR_READY)))
52902+ return (GR_CREATE | GR_LINK);
52903+
52904+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
52905+ oldmode = obj->mode;
52906+
52907+ obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
52908+ newmode = obj->mode;
52909+
52910+ needmode = newmode & checkmodes;
52911+
52912+ // old name for hardlink must have at least the permissions of the new name
52913+ if ((oldmode & needmode) != needmode)
52914+ goto bad;
52915+
52916+ // if old name had restrictions/auditing, make sure the new name does as well
52917+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
52918+
52919+ // don't allow hardlinking of suid/sgid files without permission
52920+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52921+ needmode |= GR_SETID;
52922+
52923+ if ((newmode & needmode) != needmode)
52924+ goto bad;
52925+
52926+ // enforce minimum permissions
52927+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
52928+ return newmode;
52929+bad:
52930+ needmode = oldmode;
52931+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52932+ needmode |= GR_SETID;
52933+
52934+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
52935+ gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
52936+ return (GR_CREATE | GR_LINK);
52937+ } else if (newmode & GR_SUPPRESS)
52938+ return GR_SUPPRESS;
52939+ else
52940+ return 0;
52941+}
52942+
52943+int
52944+gr_check_hidden_task(const struct task_struct *task)
52945+{
52946+ if (unlikely(!(gr_status & GR_READY)))
52947+ return 0;
52948+
52949+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
52950+ return 1;
52951+
52952+ return 0;
52953+}
52954+
52955+int
52956+gr_check_protected_task(const struct task_struct *task)
52957+{
52958+ if (unlikely(!(gr_status & GR_READY) || !task))
52959+ return 0;
52960+
52961+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52962+ task->acl != current->acl)
52963+ return 1;
52964+
52965+ return 0;
52966+}
52967+
52968+int
52969+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
52970+{
52971+ struct task_struct *p;
52972+ int ret = 0;
52973+
52974+ if (unlikely(!(gr_status & GR_READY) || !pid))
52975+ return ret;
52976+
52977+ read_lock(&tasklist_lock);
52978+ do_each_pid_task(pid, type, p) {
52979+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52980+ p->acl != current->acl) {
52981+ ret = 1;
52982+ goto out;
52983+ }
52984+ } while_each_pid_task(pid, type, p);
52985+out:
52986+ read_unlock(&tasklist_lock);
52987+
52988+ return ret;
52989+}
52990+
52991+void
52992+gr_copy_label(struct task_struct *tsk)
52993+{
52994+ tsk->signal->used_accept = 0;
52995+ tsk->acl_sp_role = 0;
52996+ tsk->acl_role_id = current->acl_role_id;
52997+ tsk->acl = current->acl;
52998+ tsk->role = current->role;
52999+ tsk->signal->curr_ip = current->signal->curr_ip;
53000+ tsk->signal->saved_ip = current->signal->saved_ip;
53001+ if (current->exec_file)
53002+ get_file(current->exec_file);
53003+ tsk->exec_file = current->exec_file;
53004+ tsk->is_writable = current->is_writable;
53005+ if (unlikely(current->signal->used_accept)) {
53006+ current->signal->curr_ip = 0;
53007+ current->signal->saved_ip = 0;
53008+ }
53009+
53010+ return;
53011+}
53012+
53013+static void
53014+gr_set_proc_res(struct task_struct *task)
53015+{
53016+ struct acl_subject_label *proc;
53017+ unsigned short i;
53018+
53019+ proc = task->acl;
53020+
53021+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53022+ return;
53023+
53024+ for (i = 0; i < RLIM_NLIMITS; i++) {
53025+ if (!(proc->resmask & (1 << i)))
53026+ continue;
53027+
53028+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53029+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53030+ }
53031+
53032+ return;
53033+}
53034+
53035+extern int __gr_process_user_ban(struct user_struct *user);
53036+
53037+int
53038+gr_check_user_change(int real, int effective, int fs)
53039+{
53040+ unsigned int i;
53041+ __u16 num;
53042+ uid_t *uidlist;
53043+ int curuid;
53044+ int realok = 0;
53045+ int effectiveok = 0;
53046+ int fsok = 0;
53047+
53048+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53049+ struct user_struct *user;
53050+
53051+ if (real == -1)
53052+ goto skipit;
53053+
53054+ user = find_user(real);
53055+ if (user == NULL)
53056+ goto skipit;
53057+
53058+ if (__gr_process_user_ban(user)) {
53059+ /* for find_user */
53060+ free_uid(user);
53061+ return 1;
53062+ }
53063+
53064+ /* for find_user */
53065+ free_uid(user);
53066+
53067+skipit:
53068+#endif
53069+
53070+ if (unlikely(!(gr_status & GR_READY)))
53071+ return 0;
53072+
53073+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53074+ gr_log_learn_id_change('u', real, effective, fs);
53075+
53076+ num = current->acl->user_trans_num;
53077+ uidlist = current->acl->user_transitions;
53078+
53079+ if (uidlist == NULL)
53080+ return 0;
53081+
53082+ if (real == -1)
53083+ realok = 1;
53084+ if (effective == -1)
53085+ effectiveok = 1;
53086+ if (fs == -1)
53087+ fsok = 1;
53088+
53089+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53090+ for (i = 0; i < num; i++) {
53091+ curuid = (int)uidlist[i];
53092+ if (real == curuid)
53093+ realok = 1;
53094+ if (effective == curuid)
53095+ effectiveok = 1;
53096+ if (fs == curuid)
53097+ fsok = 1;
53098+ }
53099+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53100+ for (i = 0; i < num; i++) {
53101+ curuid = (int)uidlist[i];
53102+ if (real == curuid)
53103+ break;
53104+ if (effective == curuid)
53105+ break;
53106+ if (fs == curuid)
53107+ break;
53108+ }
53109+ /* not in deny list */
53110+ if (i == num) {
53111+ realok = 1;
53112+ effectiveok = 1;
53113+ fsok = 1;
53114+ }
53115+ }
53116+
53117+ if (realok && effectiveok && fsok)
53118+ return 0;
53119+ else {
53120+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53121+ return 1;
53122+ }
53123+}
53124+
53125+int
53126+gr_check_group_change(int real, int effective, int fs)
53127+{
53128+ unsigned int i;
53129+ __u16 num;
53130+ gid_t *gidlist;
53131+ int curgid;
53132+ int realok = 0;
53133+ int effectiveok = 0;
53134+ int fsok = 0;
53135+
53136+ if (unlikely(!(gr_status & GR_READY)))
53137+ return 0;
53138+
53139+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53140+ gr_log_learn_id_change('g', real, effective, fs);
53141+
53142+ num = current->acl->group_trans_num;
53143+ gidlist = current->acl->group_transitions;
53144+
53145+ if (gidlist == NULL)
53146+ return 0;
53147+
53148+ if (real == -1)
53149+ realok = 1;
53150+ if (effective == -1)
53151+ effectiveok = 1;
53152+ if (fs == -1)
53153+ fsok = 1;
53154+
53155+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
53156+ for (i = 0; i < num; i++) {
53157+ curgid = (int)gidlist[i];
53158+ if (real == curgid)
53159+ realok = 1;
53160+ if (effective == curgid)
53161+ effectiveok = 1;
53162+ if (fs == curgid)
53163+ fsok = 1;
53164+ }
53165+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
53166+ for (i = 0; i < num; i++) {
53167+ curgid = (int)gidlist[i];
53168+ if (real == curgid)
53169+ break;
53170+ if (effective == curgid)
53171+ break;
53172+ if (fs == curgid)
53173+ break;
53174+ }
53175+ /* not in deny list */
53176+ if (i == num) {
53177+ realok = 1;
53178+ effectiveok = 1;
53179+ fsok = 1;
53180+ }
53181+ }
53182+
53183+ if (realok && effectiveok && fsok)
53184+ return 0;
53185+ else {
53186+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53187+ return 1;
53188+ }
53189+}
53190+
53191+void
53192+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53193+{
53194+ struct acl_role_label *role = task->role;
53195+ struct acl_subject_label *subj = NULL;
53196+ struct acl_object_label *obj;
53197+ struct file *filp;
53198+
53199+ if (unlikely(!(gr_status & GR_READY)))
53200+ return;
53201+
53202+ filp = task->exec_file;
53203+
53204+ /* kernel process, we'll give them the kernel role */
53205+ if (unlikely(!filp)) {
53206+ task->role = kernel_role;
53207+ task->acl = kernel_role->root_label;
53208+ return;
53209+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53210+ role = lookup_acl_role_label(task, uid, gid);
53211+
53212+ /* perform subject lookup in possibly new role
53213+ we can use this result below in the case where role == task->role
53214+ */
53215+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53216+
53217+ /* if we changed uid/gid, but result in the same role
53218+ and are using inheritance, don't lose the inherited subject
53219+ if current subject is other than what normal lookup
53220+ would result in, we arrived via inheritance, don't
53221+ lose subject
53222+ */
53223+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53224+ (subj == task->acl)))
53225+ task->acl = subj;
53226+
53227+ task->role = role;
53228+
53229+ task->is_writable = 0;
53230+
53231+ /* ignore additional mmap checks for processes that are writable
53232+ by the default ACL */
53233+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53234+ if (unlikely(obj->mode & GR_WRITE))
53235+ task->is_writable = 1;
53236+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53237+ if (unlikely(obj->mode & GR_WRITE))
53238+ task->is_writable = 1;
53239+
53240+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53241+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53242+#endif
53243+
53244+ gr_set_proc_res(task);
53245+
53246+ return;
53247+}
53248+
53249+int
53250+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53251+ const int unsafe_share)
53252+{
53253+ struct task_struct *task = current;
53254+ struct acl_subject_label *newacl;
53255+ struct acl_object_label *obj;
53256+ __u32 retmode;
53257+
53258+ if (unlikely(!(gr_status & GR_READY)))
53259+ return 0;
53260+
53261+ newacl = chk_subj_label(dentry, mnt, task->role);
53262+
53263+ task_lock(task);
53264+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53265+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53266+ !(task->role->roletype & GR_ROLE_GOD) &&
53267+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53268+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53269+ task_unlock(task);
53270+ if (unsafe_share)
53271+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53272+ else
53273+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53274+ return -EACCES;
53275+ }
53276+ task_unlock(task);
53277+
53278+ obj = chk_obj_label(dentry, mnt, task->acl);
53279+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53280+
53281+ if (!(task->acl->mode & GR_INHERITLEARN) &&
53282+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53283+ if (obj->nested)
53284+ task->acl = obj->nested;
53285+ else
53286+ task->acl = newacl;
53287+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53288+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53289+
53290+ task->is_writable = 0;
53291+
53292+ /* ignore additional mmap checks for processes that are writable
53293+ by the default ACL */
53294+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
53295+ if (unlikely(obj->mode & GR_WRITE))
53296+ task->is_writable = 1;
53297+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
53298+ if (unlikely(obj->mode & GR_WRITE))
53299+ task->is_writable = 1;
53300+
53301+ gr_set_proc_res(task);
53302+
53303+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53304+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53305+#endif
53306+ return 0;
53307+}
53308+
53309+/* always called with valid inodev ptr */
53310+static void
53311+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53312+{
53313+ struct acl_object_label *matchpo;
53314+ struct acl_subject_label *matchps;
53315+ struct acl_subject_label *subj;
53316+ struct acl_role_label *role;
53317+ unsigned int x;
53318+
53319+ FOR_EACH_ROLE_START(role)
53320+ FOR_EACH_SUBJECT_START(role, subj, x)
53321+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53322+ matchpo->mode |= GR_DELETED;
53323+ FOR_EACH_SUBJECT_END(subj,x)
53324+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53325+ if (subj->inode == ino && subj->device == dev)
53326+ subj->mode |= GR_DELETED;
53327+ FOR_EACH_NESTED_SUBJECT_END(subj)
53328+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53329+ matchps->mode |= GR_DELETED;
53330+ FOR_EACH_ROLE_END(role)
53331+
53332+ inodev->nentry->deleted = 1;
53333+
53334+ return;
53335+}
53336+
53337+void
53338+gr_handle_delete(const ino_t ino, const dev_t dev)
53339+{
53340+ struct inodev_entry *inodev;
53341+
53342+ if (unlikely(!(gr_status & GR_READY)))
53343+ return;
53344+
53345+ write_lock(&gr_inode_lock);
53346+ inodev = lookup_inodev_entry(ino, dev);
53347+ if (inodev != NULL)
53348+ do_handle_delete(inodev, ino, dev);
53349+ write_unlock(&gr_inode_lock);
53350+
53351+ return;
53352+}
53353+
53354+static void
53355+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53356+ const ino_t newinode, const dev_t newdevice,
53357+ struct acl_subject_label *subj)
53358+{
53359+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53360+ struct acl_object_label *match;
53361+
53362+ match = subj->obj_hash[index];
53363+
53364+ while (match && (match->inode != oldinode ||
53365+ match->device != olddevice ||
53366+ !(match->mode & GR_DELETED)))
53367+ match = match->next;
53368+
53369+ if (match && (match->inode == oldinode)
53370+ && (match->device == olddevice)
53371+ && (match->mode & GR_DELETED)) {
53372+ if (match->prev == NULL) {
53373+ subj->obj_hash[index] = match->next;
53374+ if (match->next != NULL)
53375+ match->next->prev = NULL;
53376+ } else {
53377+ match->prev->next = match->next;
53378+ if (match->next != NULL)
53379+ match->next->prev = match->prev;
53380+ }
53381+ match->prev = NULL;
53382+ match->next = NULL;
53383+ match->inode = newinode;
53384+ match->device = newdevice;
53385+ match->mode &= ~GR_DELETED;
53386+
53387+ insert_acl_obj_label(match, subj);
53388+ }
53389+
53390+ return;
53391+}
53392+
53393+static void
53394+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53395+ const ino_t newinode, const dev_t newdevice,
53396+ struct acl_role_label *role)
53397+{
53398+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53399+ struct acl_subject_label *match;
53400+
53401+ match = role->subj_hash[index];
53402+
53403+ while (match && (match->inode != oldinode ||
53404+ match->device != olddevice ||
53405+ !(match->mode & GR_DELETED)))
53406+ match = match->next;
53407+
53408+ if (match && (match->inode == oldinode)
53409+ && (match->device == olddevice)
53410+ && (match->mode & GR_DELETED)) {
53411+ if (match->prev == NULL) {
53412+ role->subj_hash[index] = match->next;
53413+ if (match->next != NULL)
53414+ match->next->prev = NULL;
53415+ } else {
53416+ match->prev->next = match->next;
53417+ if (match->next != NULL)
53418+ match->next->prev = match->prev;
53419+ }
53420+ match->prev = NULL;
53421+ match->next = NULL;
53422+ match->inode = newinode;
53423+ match->device = newdevice;
53424+ match->mode &= ~GR_DELETED;
53425+
53426+ insert_acl_subj_label(match, role);
53427+ }
53428+
53429+ return;
53430+}
53431+
53432+static void
53433+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53434+ const ino_t newinode, const dev_t newdevice)
53435+{
53436+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53437+ struct inodev_entry *match;
53438+
53439+ match = inodev_set.i_hash[index];
53440+
53441+ while (match && (match->nentry->inode != oldinode ||
53442+ match->nentry->device != olddevice || !match->nentry->deleted))
53443+ match = match->next;
53444+
53445+ if (match && (match->nentry->inode == oldinode)
53446+ && (match->nentry->device == olddevice) &&
53447+ match->nentry->deleted) {
53448+ if (match->prev == NULL) {
53449+ inodev_set.i_hash[index] = match->next;
53450+ if (match->next != NULL)
53451+ match->next->prev = NULL;
53452+ } else {
53453+ match->prev->next = match->next;
53454+ if (match->next != NULL)
53455+ match->next->prev = match->prev;
53456+ }
53457+ match->prev = NULL;
53458+ match->next = NULL;
53459+ match->nentry->inode = newinode;
53460+ match->nentry->device = newdevice;
53461+ match->nentry->deleted = 0;
53462+
53463+ insert_inodev_entry(match);
53464+ }
53465+
53466+ return;
53467+}
53468+
53469+static void
53470+__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
53471+{
53472+ struct acl_subject_label *subj;
53473+ struct acl_role_label *role;
53474+ unsigned int x;
53475+
53476+ FOR_EACH_ROLE_START(role)
53477+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
53478+
53479+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53480+ if ((subj->inode == ino) && (subj->device == dev)) {
53481+ subj->inode = ino;
53482+ subj->device = dev;
53483+ }
53484+ FOR_EACH_NESTED_SUBJECT_END(subj)
53485+ FOR_EACH_SUBJECT_START(role, subj, x)
53486+ update_acl_obj_label(matchn->inode, matchn->device,
53487+ ino, dev, subj);
53488+ FOR_EACH_SUBJECT_END(subj,x)
53489+ FOR_EACH_ROLE_END(role)
53490+
53491+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
53492+
53493+ return;
53494+}
53495+
53496+static void
53497+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
53498+ const struct vfsmount *mnt)
53499+{
53500+ ino_t ino = dentry->d_inode->i_ino;
53501+ dev_t dev = __get_dev(dentry);
53502+
53503+ __do_handle_create(matchn, ino, dev);
53504+
53505+ return;
53506+}
53507+
53508+void
53509+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
53510+{
53511+ struct name_entry *matchn;
53512+
53513+ if (unlikely(!(gr_status & GR_READY)))
53514+ return;
53515+
53516+ preempt_disable();
53517+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
53518+
53519+ if (unlikely((unsigned long)matchn)) {
53520+ write_lock(&gr_inode_lock);
53521+ do_handle_create(matchn, dentry, mnt);
53522+ write_unlock(&gr_inode_lock);
53523+ }
53524+ preempt_enable();
53525+
53526+ return;
53527+}
53528+
53529+void
53530+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
53531+{
53532+ struct name_entry *matchn;
53533+
53534+ if (unlikely(!(gr_status & GR_READY)))
53535+ return;
53536+
53537+ preempt_disable();
53538+ matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
53539+
53540+ if (unlikely((unsigned long)matchn)) {
53541+ write_lock(&gr_inode_lock);
53542+ __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
53543+ write_unlock(&gr_inode_lock);
53544+ }
53545+ preempt_enable();
53546+
53547+ return;
53548+}
53549+
53550+void
53551+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
53552+ struct dentry *old_dentry,
53553+ struct dentry *new_dentry,
53554+ struct vfsmount *mnt, const __u8 replace)
53555+{
53556+ struct name_entry *matchn;
53557+ struct inodev_entry *inodev;
53558+ struct inode *inode = new_dentry->d_inode;
53559+ ino_t old_ino = old_dentry->d_inode->i_ino;
53560+ dev_t old_dev = __get_dev(old_dentry);
53561+
53562+ /* vfs_rename swaps the name and parent link for old_dentry and
53563+ new_dentry
53564+ at this point, old_dentry has the new name, parent link, and inode
53565+ for the renamed file
53566+ if a file is being replaced by a rename, new_dentry has the inode
53567+ and name for the replaced file
53568+ */
53569+
53570+ if (unlikely(!(gr_status & GR_READY)))
53571+ return;
53572+
53573+ preempt_disable();
53574+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
53575+
53576+ /* we wouldn't have to check d_inode if it weren't for
53577+ NFS silly-renaming
53578+ */
53579+
53580+ write_lock(&gr_inode_lock);
53581+ if (unlikely(replace && inode)) {
53582+ ino_t new_ino = inode->i_ino;
53583+ dev_t new_dev = __get_dev(new_dentry);
53584+
53585+ inodev = lookup_inodev_entry(new_ino, new_dev);
53586+ if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
53587+ do_handle_delete(inodev, new_ino, new_dev);
53588+ }
53589+
53590+ inodev = lookup_inodev_entry(old_ino, old_dev);
53591+ if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
53592+ do_handle_delete(inodev, old_ino, old_dev);
53593+
53594+ if (unlikely((unsigned long)matchn))
53595+ do_handle_create(matchn, old_dentry, mnt);
53596+
53597+ write_unlock(&gr_inode_lock);
53598+ preempt_enable();
53599+
53600+ return;
53601+}
53602+
53603+static int
53604+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
53605+ unsigned char **sum)
53606+{
53607+ struct acl_role_label *r;
53608+ struct role_allowed_ip *ipp;
53609+ struct role_transition *trans;
53610+ unsigned int i;
53611+ int found = 0;
53612+ u32 curr_ip = current->signal->curr_ip;
53613+
53614+ current->signal->saved_ip = curr_ip;
53615+
53616+ /* check transition table */
53617+
53618+ for (trans = current->role->transitions; trans; trans = trans->next) {
53619+ if (!strcmp(rolename, trans->rolename)) {
53620+ found = 1;
53621+ break;
53622+ }
53623+ }
53624+
53625+ if (!found)
53626+ return 0;
53627+
53628+ /* handle special roles that do not require authentication
53629+ and check ip */
53630+
53631+ FOR_EACH_ROLE_START(r)
53632+ if (!strcmp(rolename, r->rolename) &&
53633+ (r->roletype & GR_ROLE_SPECIAL)) {
53634+ found = 0;
53635+ if (r->allowed_ips != NULL) {
53636+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
53637+ if ((ntohl(curr_ip) & ipp->netmask) ==
53638+ (ntohl(ipp->addr) & ipp->netmask))
53639+ found = 1;
53640+ }
53641+ } else
53642+ found = 2;
53643+ if (!found)
53644+ return 0;
53645+
53646+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
53647+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
53648+ *salt = NULL;
53649+ *sum = NULL;
53650+ return 1;
53651+ }
53652+ }
53653+ FOR_EACH_ROLE_END(r)
53654+
53655+ for (i = 0; i < num_sprole_pws; i++) {
53656+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
53657+ *salt = acl_special_roles[i]->salt;
53658+ *sum = acl_special_roles[i]->sum;
53659+ return 1;
53660+ }
53661+ }
53662+
53663+ return 0;
53664+}
53665+
53666+static void
53667+assign_special_role(char *rolename)
53668+{
53669+ struct acl_object_label *obj;
53670+ struct acl_role_label *r;
53671+ struct acl_role_label *assigned = NULL;
53672+ struct task_struct *tsk;
53673+ struct file *filp;
53674+
53675+ FOR_EACH_ROLE_START(r)
53676+ if (!strcmp(rolename, r->rolename) &&
53677+ (r->roletype & GR_ROLE_SPECIAL)) {
53678+ assigned = r;
53679+ break;
53680+ }
53681+ FOR_EACH_ROLE_END(r)
53682+
53683+ if (!assigned)
53684+ return;
53685+
53686+ read_lock(&tasklist_lock);
53687+ read_lock(&grsec_exec_file_lock);
53688+
53689+ tsk = current->real_parent;
53690+ if (tsk == NULL)
53691+ goto out_unlock;
53692+
53693+ filp = tsk->exec_file;
53694+ if (filp == NULL)
53695+ goto out_unlock;
53696+
53697+ tsk->is_writable = 0;
53698+
53699+ tsk->acl_sp_role = 1;
53700+ tsk->acl_role_id = ++acl_sp_role_value;
53701+ tsk->role = assigned;
53702+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
53703+
53704+ /* ignore additional mmap checks for processes that are writable
53705+ by the default ACL */
53706+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53707+ if (unlikely(obj->mode & GR_WRITE))
53708+ tsk->is_writable = 1;
53709+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
53710+ if (unlikely(obj->mode & GR_WRITE))
53711+ tsk->is_writable = 1;
53712+
53713+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53714+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
53715+#endif
53716+
53717+out_unlock:
53718+ read_unlock(&grsec_exec_file_lock);
53719+ read_unlock(&tasklist_lock);
53720+ return;
53721+}
53722+
53723+int gr_check_secure_terminal(struct task_struct *task)
53724+{
53725+ struct task_struct *p, *p2, *p3;
53726+ struct files_struct *files;
53727+ struct fdtable *fdt;
53728+ struct file *our_file = NULL, *file;
53729+ int i;
53730+
53731+ if (task->signal->tty == NULL)
53732+ return 1;
53733+
53734+ files = get_files_struct(task);
53735+ if (files != NULL) {
53736+ rcu_read_lock();
53737+ fdt = files_fdtable(files);
53738+ for (i=0; i < fdt->max_fds; i++) {
53739+ file = fcheck_files(files, i);
53740+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
53741+ get_file(file);
53742+ our_file = file;
53743+ }
53744+ }
53745+ rcu_read_unlock();
53746+ put_files_struct(files);
53747+ }
53748+
53749+ if (our_file == NULL)
53750+ return 1;
53751+
53752+ read_lock(&tasklist_lock);
53753+ do_each_thread(p2, p) {
53754+ files = get_files_struct(p);
53755+ if (files == NULL ||
53756+ (p->signal && p->signal->tty == task->signal->tty)) {
53757+ if (files != NULL)
53758+ put_files_struct(files);
53759+ continue;
53760+ }
53761+ rcu_read_lock();
53762+ fdt = files_fdtable(files);
53763+ for (i=0; i < fdt->max_fds; i++) {
53764+ file = fcheck_files(files, i);
53765+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
53766+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
53767+ p3 = task;
53768+ while (p3->pid > 0) {
53769+ if (p3 == p)
53770+ break;
53771+ p3 = p3->real_parent;
53772+ }
53773+ if (p3 == p)
53774+ break;
53775+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
53776+ gr_handle_alertkill(p);
53777+ rcu_read_unlock();
53778+ put_files_struct(files);
53779+ read_unlock(&tasklist_lock);
53780+ fput(our_file);
53781+ return 0;
53782+ }
53783+ }
53784+ rcu_read_unlock();
53785+ put_files_struct(files);
53786+ } while_each_thread(p2, p);
53787+ read_unlock(&tasklist_lock);
53788+
53789+ fput(our_file);
53790+ return 1;
53791+}
53792+
53793+ssize_t
53794+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
53795+{
53796+ struct gr_arg_wrapper uwrap;
53797+ unsigned char *sprole_salt = NULL;
53798+ unsigned char *sprole_sum = NULL;
53799+ int error = sizeof (struct gr_arg_wrapper);
53800+ int error2 = 0;
53801+
53802+ mutex_lock(&gr_dev_mutex);
53803+
53804+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
53805+ error = -EPERM;
53806+ goto out;
53807+ }
53808+
53809+ if (count != sizeof (struct gr_arg_wrapper)) {
53810+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
53811+ error = -EINVAL;
53812+ goto out;
53813+ }
53814+
53815+
53816+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
53817+ gr_auth_expires = 0;
53818+ gr_auth_attempts = 0;
53819+ }
53820+
53821+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
53822+ error = -EFAULT;
53823+ goto out;
53824+ }
53825+
53826+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
53827+ error = -EINVAL;
53828+ goto out;
53829+ }
53830+
53831+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
53832+ error = -EFAULT;
53833+ goto out;
53834+ }
53835+
53836+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53837+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53838+ time_after(gr_auth_expires, get_seconds())) {
53839+ error = -EBUSY;
53840+ goto out;
53841+ }
53842+
53843+ /* if non-root trying to do anything other than use a special role,
53844+ do not attempt authentication, do not count towards authentication
53845+ locking
53846+ */
53847+
53848+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
53849+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53850+ current_uid()) {
53851+ error = -EPERM;
53852+ goto out;
53853+ }
53854+
53855+ /* ensure pw and special role name are null terminated */
53856+
53857+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
53858+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
53859+
53860+ /* Okay.
53861+ * We have our enough of the argument structure..(we have yet
53862+ * to copy_from_user the tables themselves) . Copy the tables
53863+ * only if we need them, i.e. for loading operations. */
53864+
53865+ switch (gr_usermode->mode) {
53866+ case GR_STATUS:
53867+ if (gr_status & GR_READY) {
53868+ error = 1;
53869+ if (!gr_check_secure_terminal(current))
53870+ error = 3;
53871+ } else
53872+ error = 2;
53873+ goto out;
53874+ case GR_SHUTDOWN:
53875+ if ((gr_status & GR_READY)
53876+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53877+ pax_open_kernel();
53878+ gr_status &= ~GR_READY;
53879+ pax_close_kernel();
53880+
53881+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
53882+ free_variables();
53883+ memset(gr_usermode, 0, sizeof (struct gr_arg));
53884+ memset(gr_system_salt, 0, GR_SALT_LEN);
53885+ memset(gr_system_sum, 0, GR_SHA_LEN);
53886+ } else if (gr_status & GR_READY) {
53887+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
53888+ error = -EPERM;
53889+ } else {
53890+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
53891+ error = -EAGAIN;
53892+ }
53893+ break;
53894+ case GR_ENABLE:
53895+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
53896+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
53897+ else {
53898+ if (gr_status & GR_READY)
53899+ error = -EAGAIN;
53900+ else
53901+ error = error2;
53902+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
53903+ }
53904+ break;
53905+ case GR_RELOAD:
53906+ if (!(gr_status & GR_READY)) {
53907+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
53908+ error = -EAGAIN;
53909+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53910+ preempt_disable();
53911+
53912+ pax_open_kernel();
53913+ gr_status &= ~GR_READY;
53914+ pax_close_kernel();
53915+
53916+ free_variables();
53917+ if (!(error2 = gracl_init(gr_usermode))) {
53918+ preempt_enable();
53919+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
53920+ } else {
53921+ preempt_enable();
53922+ error = error2;
53923+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53924+ }
53925+ } else {
53926+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53927+ error = -EPERM;
53928+ }
53929+ break;
53930+ case GR_SEGVMOD:
53931+ if (unlikely(!(gr_status & GR_READY))) {
53932+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
53933+ error = -EAGAIN;
53934+ break;
53935+ }
53936+
53937+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53938+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
53939+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
53940+ struct acl_subject_label *segvacl;
53941+ segvacl =
53942+ lookup_acl_subj_label(gr_usermode->segv_inode,
53943+ gr_usermode->segv_device,
53944+ current->role);
53945+ if (segvacl) {
53946+ segvacl->crashes = 0;
53947+ segvacl->expires = 0;
53948+ }
53949+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
53950+ gr_remove_uid(gr_usermode->segv_uid);
53951+ }
53952+ } else {
53953+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
53954+ error = -EPERM;
53955+ }
53956+ break;
53957+ case GR_SPROLE:
53958+ case GR_SPROLEPAM:
53959+ if (unlikely(!(gr_status & GR_READY))) {
53960+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
53961+ error = -EAGAIN;
53962+ break;
53963+ }
53964+
53965+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
53966+ current->role->expires = 0;
53967+ current->role->auth_attempts = 0;
53968+ }
53969+
53970+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53971+ time_after(current->role->expires, get_seconds())) {
53972+ error = -EBUSY;
53973+ goto out;
53974+ }
53975+
53976+ if (lookup_special_role_auth
53977+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
53978+ && ((!sprole_salt && !sprole_sum)
53979+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
53980+ char *p = "";
53981+ assign_special_role(gr_usermode->sp_role);
53982+ read_lock(&tasklist_lock);
53983+ if (current->real_parent)
53984+ p = current->real_parent->role->rolename;
53985+ read_unlock(&tasklist_lock);
53986+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
53987+ p, acl_sp_role_value);
53988+ } else {
53989+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
53990+ error = -EPERM;
53991+ if(!(current->role->auth_attempts++))
53992+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
53993+
53994+ goto out;
53995+ }
53996+ break;
53997+ case GR_UNSPROLE:
53998+ if (unlikely(!(gr_status & GR_READY))) {
53999+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54000+ error = -EAGAIN;
54001+ break;
54002+ }
54003+
54004+ if (current->role->roletype & GR_ROLE_SPECIAL) {
54005+ char *p = "";
54006+ int i = 0;
54007+
54008+ read_lock(&tasklist_lock);
54009+ if (current->real_parent) {
54010+ p = current->real_parent->role->rolename;
54011+ i = current->real_parent->acl_role_id;
54012+ }
54013+ read_unlock(&tasklist_lock);
54014+
54015+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54016+ gr_set_acls(1);
54017+ } else {
54018+ error = -EPERM;
54019+ goto out;
54020+ }
54021+ break;
54022+ default:
54023+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54024+ error = -EINVAL;
54025+ break;
54026+ }
54027+
54028+ if (error != -EPERM)
54029+ goto out;
54030+
54031+ if(!(gr_auth_attempts++))
54032+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54033+
54034+ out:
54035+ mutex_unlock(&gr_dev_mutex);
54036+ return error;
54037+}
54038+
54039+/* must be called with
54040+ rcu_read_lock();
54041+ read_lock(&tasklist_lock);
54042+ read_lock(&grsec_exec_file_lock);
54043+*/
54044+int gr_apply_subject_to_task(struct task_struct *task)
54045+{
54046+ struct acl_object_label *obj;
54047+ char *tmpname;
54048+ struct acl_subject_label *tmpsubj;
54049+ struct file *filp;
54050+ struct name_entry *nmatch;
54051+
54052+ filp = task->exec_file;
54053+ if (filp == NULL)
54054+ return 0;
54055+
54056+ /* the following is to apply the correct subject
54057+ on binaries running when the RBAC system
54058+ is enabled, when the binaries have been
54059+ replaced or deleted since their execution
54060+ -----
54061+ when the RBAC system starts, the inode/dev
54062+ from exec_file will be one the RBAC system
54063+ is unaware of. It only knows the inode/dev
54064+ of the present file on disk, or the absence
54065+ of it.
54066+ */
54067+ preempt_disable();
54068+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54069+
54070+ nmatch = lookup_name_entry(tmpname);
54071+ preempt_enable();
54072+ tmpsubj = NULL;
54073+ if (nmatch) {
54074+ if (nmatch->deleted)
54075+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54076+ else
54077+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54078+ if (tmpsubj != NULL)
54079+ task->acl = tmpsubj;
54080+ }
54081+ if (tmpsubj == NULL)
54082+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54083+ task->role);
54084+ if (task->acl) {
54085+ task->is_writable = 0;
54086+ /* ignore additional mmap checks for processes that are writable
54087+ by the default ACL */
54088+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54089+ if (unlikely(obj->mode & GR_WRITE))
54090+ task->is_writable = 1;
54091+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54092+ if (unlikely(obj->mode & GR_WRITE))
54093+ task->is_writable = 1;
54094+
54095+ gr_set_proc_res(task);
54096+
54097+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54098+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54099+#endif
54100+ } else {
54101+ return 1;
54102+ }
54103+
54104+ return 0;
54105+}
54106+
54107+int
54108+gr_set_acls(const int type)
54109+{
54110+ struct task_struct *task, *task2;
54111+ struct acl_role_label *role = current->role;
54112+ __u16 acl_role_id = current->acl_role_id;
54113+ const struct cred *cred;
54114+ int ret;
54115+
54116+ rcu_read_lock();
54117+ read_lock(&tasklist_lock);
54118+ read_lock(&grsec_exec_file_lock);
54119+ do_each_thread(task2, task) {
54120+ /* check to see if we're called from the exit handler,
54121+ if so, only replace ACLs that have inherited the admin
54122+ ACL */
54123+
54124+ if (type && (task->role != role ||
54125+ task->acl_role_id != acl_role_id))
54126+ continue;
54127+
54128+ task->acl_role_id = 0;
54129+ task->acl_sp_role = 0;
54130+
54131+ if (task->exec_file) {
54132+ cred = __task_cred(task);
54133+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54134+ ret = gr_apply_subject_to_task(task);
54135+ if (ret) {
54136+ read_unlock(&grsec_exec_file_lock);
54137+ read_unlock(&tasklist_lock);
54138+ rcu_read_unlock();
54139+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54140+ return ret;
54141+ }
54142+ } else {
54143+ // it's a kernel process
54144+ task->role = kernel_role;
54145+ task->acl = kernel_role->root_label;
54146+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54147+ task->acl->mode &= ~GR_PROCFIND;
54148+#endif
54149+ }
54150+ } while_each_thread(task2, task);
54151+ read_unlock(&grsec_exec_file_lock);
54152+ read_unlock(&tasklist_lock);
54153+ rcu_read_unlock();
54154+
54155+ return 0;
54156+}
54157+
54158+void
54159+gr_learn_resource(const struct task_struct *task,
54160+ const int res, const unsigned long wanted, const int gt)
54161+{
54162+ struct acl_subject_label *acl;
54163+ const struct cred *cred;
54164+
54165+ if (unlikely((gr_status & GR_READY) &&
54166+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54167+ goto skip_reslog;
54168+
54169+#ifdef CONFIG_GRKERNSEC_RESLOG
54170+ gr_log_resource(task, res, wanted, gt);
54171+#endif
54172+ skip_reslog:
54173+
54174+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54175+ return;
54176+
54177+ acl = task->acl;
54178+
54179+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54180+ !(acl->resmask & (1 << (unsigned short) res))))
54181+ return;
54182+
54183+ if (wanted >= acl->res[res].rlim_cur) {
54184+ unsigned long res_add;
54185+
54186+ res_add = wanted;
54187+ switch (res) {
54188+ case RLIMIT_CPU:
54189+ res_add += GR_RLIM_CPU_BUMP;
54190+ break;
54191+ case RLIMIT_FSIZE:
54192+ res_add += GR_RLIM_FSIZE_BUMP;
54193+ break;
54194+ case RLIMIT_DATA:
54195+ res_add += GR_RLIM_DATA_BUMP;
54196+ break;
54197+ case RLIMIT_STACK:
54198+ res_add += GR_RLIM_STACK_BUMP;
54199+ break;
54200+ case RLIMIT_CORE:
54201+ res_add += GR_RLIM_CORE_BUMP;
54202+ break;
54203+ case RLIMIT_RSS:
54204+ res_add += GR_RLIM_RSS_BUMP;
54205+ break;
54206+ case RLIMIT_NPROC:
54207+ res_add += GR_RLIM_NPROC_BUMP;
54208+ break;
54209+ case RLIMIT_NOFILE:
54210+ res_add += GR_RLIM_NOFILE_BUMP;
54211+ break;
54212+ case RLIMIT_MEMLOCK:
54213+ res_add += GR_RLIM_MEMLOCK_BUMP;
54214+ break;
54215+ case RLIMIT_AS:
54216+ res_add += GR_RLIM_AS_BUMP;
54217+ break;
54218+ case RLIMIT_LOCKS:
54219+ res_add += GR_RLIM_LOCKS_BUMP;
54220+ break;
54221+ case RLIMIT_SIGPENDING:
54222+ res_add += GR_RLIM_SIGPENDING_BUMP;
54223+ break;
54224+ case RLIMIT_MSGQUEUE:
54225+ res_add += GR_RLIM_MSGQUEUE_BUMP;
54226+ break;
54227+ case RLIMIT_NICE:
54228+ res_add += GR_RLIM_NICE_BUMP;
54229+ break;
54230+ case RLIMIT_RTPRIO:
54231+ res_add += GR_RLIM_RTPRIO_BUMP;
54232+ break;
54233+ case RLIMIT_RTTIME:
54234+ res_add += GR_RLIM_RTTIME_BUMP;
54235+ break;
54236+ }
54237+
54238+ acl->res[res].rlim_cur = res_add;
54239+
54240+ if (wanted > acl->res[res].rlim_max)
54241+ acl->res[res].rlim_max = res_add;
54242+
54243+ /* only log the subject filename, since resource logging is supported for
54244+ single-subject learning only */
54245+ rcu_read_lock();
54246+ cred = __task_cred(task);
54247+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54248+ task->role->roletype, cred->uid, cred->gid, acl->filename,
54249+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54250+ "", (unsigned long) res, &task->signal->saved_ip);
54251+ rcu_read_unlock();
54252+ }
54253+
54254+ return;
54255+}
54256+
54257+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54258+void
54259+pax_set_initial_flags(struct linux_binprm *bprm)
54260+{
54261+ struct task_struct *task = current;
54262+ struct acl_subject_label *proc;
54263+ unsigned long flags;
54264+
54265+ if (unlikely(!(gr_status & GR_READY)))
54266+ return;
54267+
54268+ flags = pax_get_flags(task);
54269+
54270+ proc = task->acl;
54271+
54272+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54273+ flags &= ~MF_PAX_PAGEEXEC;
54274+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54275+ flags &= ~MF_PAX_SEGMEXEC;
54276+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54277+ flags &= ~MF_PAX_RANDMMAP;
54278+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54279+ flags &= ~MF_PAX_EMUTRAMP;
54280+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54281+ flags &= ~MF_PAX_MPROTECT;
54282+
54283+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54284+ flags |= MF_PAX_PAGEEXEC;
54285+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54286+ flags |= MF_PAX_SEGMEXEC;
54287+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54288+ flags |= MF_PAX_RANDMMAP;
54289+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54290+ flags |= MF_PAX_EMUTRAMP;
54291+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54292+ flags |= MF_PAX_MPROTECT;
54293+
54294+ pax_set_flags(task, flags);
54295+
54296+ return;
54297+}
54298+#endif
54299+
54300+#ifdef CONFIG_SYSCTL
54301+/* Eric Biederman likes breaking userland ABI and every inode-based security
54302+ system to save 35kb of memory */
54303+
54304+/* we modify the passed in filename, but adjust it back before returning */
54305+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54306+{
54307+ struct name_entry *nmatch;
54308+ char *p, *lastp = NULL;
54309+ struct acl_object_label *obj = NULL, *tmp;
54310+ struct acl_subject_label *tmpsubj;
54311+ char c = '\0';
54312+
54313+ read_lock(&gr_inode_lock);
54314+
54315+ p = name + len - 1;
54316+ do {
54317+ nmatch = lookup_name_entry(name);
54318+ if (lastp != NULL)
54319+ *lastp = c;
54320+
54321+ if (nmatch == NULL)
54322+ goto next_component;
54323+ tmpsubj = current->acl;
54324+ do {
54325+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54326+ if (obj != NULL) {
54327+ tmp = obj->globbed;
54328+ while (tmp) {
54329+ if (!glob_match(tmp->filename, name)) {
54330+ obj = tmp;
54331+ goto found_obj;
54332+ }
54333+ tmp = tmp->next;
54334+ }
54335+ goto found_obj;
54336+ }
54337+ } while ((tmpsubj = tmpsubj->parent_subject));
54338+next_component:
54339+ /* end case */
54340+ if (p == name)
54341+ break;
54342+
54343+ while (*p != '/')
54344+ p--;
54345+ if (p == name)
54346+ lastp = p + 1;
54347+ else {
54348+ lastp = p;
54349+ p--;
54350+ }
54351+ c = *lastp;
54352+ *lastp = '\0';
54353+ } while (1);
54354+found_obj:
54355+ read_unlock(&gr_inode_lock);
54356+ /* obj returned will always be non-null */
54357+ return obj;
54358+}
54359+
54360+/* returns 0 when allowing, non-zero on error
54361+ op of 0 is used for readdir, so we don't log the names of hidden files
54362+*/
54363+__u32
54364+gr_handle_sysctl(const struct ctl_table *table, const int op)
54365+{
54366+ struct ctl_table *tmp;
54367+ const char *proc_sys = "/proc/sys";
54368+ char *path;
54369+ struct acl_object_label *obj;
54370+ unsigned short len = 0, pos = 0, depth = 0, i;
54371+ __u32 err = 0;
54372+ __u32 mode = 0;
54373+
54374+ if (unlikely(!(gr_status & GR_READY)))
54375+ return 0;
54376+
54377+ /* for now, ignore operations on non-sysctl entries if it's not a
54378+ readdir*/
54379+ if (table->child != NULL && op != 0)
54380+ return 0;
54381+
54382+ mode |= GR_FIND;
54383+ /* it's only a read if it's an entry, read on dirs is for readdir */
54384+ if (op & MAY_READ)
54385+ mode |= GR_READ;
54386+ if (op & MAY_WRITE)
54387+ mode |= GR_WRITE;
54388+
54389+ preempt_disable();
54390+
54391+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54392+
54393+ /* it's only a read/write if it's an actual entry, not a dir
54394+ (which are opened for readdir)
54395+ */
54396+
54397+ /* convert the requested sysctl entry into a pathname */
54398+
54399+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54400+ len += strlen(tmp->procname);
54401+ len++;
54402+ depth++;
54403+ }
54404+
54405+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54406+ /* deny */
54407+ goto out;
54408+ }
54409+
54410+ memset(path, 0, PAGE_SIZE);
54411+
54412+ memcpy(path, proc_sys, strlen(proc_sys));
54413+
54414+ pos += strlen(proc_sys);
54415+
54416+ for (; depth > 0; depth--) {
54417+ path[pos] = '/';
54418+ pos++;
54419+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54420+ if (depth == i) {
54421+ memcpy(path + pos, tmp->procname,
54422+ strlen(tmp->procname));
54423+ pos += strlen(tmp->procname);
54424+ }
54425+ i++;
54426+ }
54427+ }
54428+
54429+ obj = gr_lookup_by_name(path, pos);
54430+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
54431+
54432+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
54433+ ((err & mode) != mode))) {
54434+ __u32 new_mode = mode;
54435+
54436+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54437+
54438+ err = 0;
54439+ gr_log_learn_sysctl(path, new_mode);
54440+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
54441+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
54442+ err = -ENOENT;
54443+ } else if (!(err & GR_FIND)) {
54444+ err = -ENOENT;
54445+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
54446+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
54447+ path, (mode & GR_READ) ? " reading" : "",
54448+ (mode & GR_WRITE) ? " writing" : "");
54449+ err = -EACCES;
54450+ } else if ((err & mode) != mode) {
54451+ err = -EACCES;
54452+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
54453+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
54454+ path, (mode & GR_READ) ? " reading" : "",
54455+ (mode & GR_WRITE) ? " writing" : "");
54456+ err = 0;
54457+ } else
54458+ err = 0;
54459+
54460+ out:
54461+ preempt_enable();
54462+
54463+ return err;
54464+}
54465+#endif
54466+
54467+int
54468+gr_handle_proc_ptrace(struct task_struct *task)
54469+{
54470+ struct file *filp;
54471+ struct task_struct *tmp = task;
54472+ struct task_struct *curtemp = current;
54473+ __u32 retmode;
54474+
54475+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54476+ if (unlikely(!(gr_status & GR_READY)))
54477+ return 0;
54478+#endif
54479+
54480+ read_lock(&tasklist_lock);
54481+ read_lock(&grsec_exec_file_lock);
54482+ filp = task->exec_file;
54483+
54484+ while (tmp->pid > 0) {
54485+ if (tmp == curtemp)
54486+ break;
54487+ tmp = tmp->real_parent;
54488+ }
54489+
54490+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54491+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54492+ read_unlock(&grsec_exec_file_lock);
54493+ read_unlock(&tasklist_lock);
54494+ return 1;
54495+ }
54496+
54497+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54498+ if (!(gr_status & GR_READY)) {
54499+ read_unlock(&grsec_exec_file_lock);
54500+ read_unlock(&tasklist_lock);
54501+ return 0;
54502+ }
54503+#endif
54504+
54505+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
54506+ read_unlock(&grsec_exec_file_lock);
54507+ read_unlock(&tasklist_lock);
54508+
54509+ if (retmode & GR_NOPTRACE)
54510+ return 1;
54511+
54512+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
54513+ && (current->acl != task->acl || (current->acl != current->role->root_label
54514+ && current->pid != task->pid)))
54515+ return 1;
54516+
54517+ return 0;
54518+}
54519+
54520+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
54521+{
54522+ if (unlikely(!(gr_status & GR_READY)))
54523+ return;
54524+
54525+ if (!(current->role->roletype & GR_ROLE_GOD))
54526+ return;
54527+
54528+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
54529+ p->role->rolename, gr_task_roletype_to_char(p),
54530+ p->acl->filename);
54531+}
54532+
54533+int
54534+gr_handle_ptrace(struct task_struct *task, const long request)
54535+{
54536+ struct task_struct *tmp = task;
54537+ struct task_struct *curtemp = current;
54538+ __u32 retmode;
54539+
54540+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54541+ if (unlikely(!(gr_status & GR_READY)))
54542+ return 0;
54543+#endif
54544+
54545+ read_lock(&tasklist_lock);
54546+ while (tmp->pid > 0) {
54547+ if (tmp == curtemp)
54548+ break;
54549+ tmp = tmp->real_parent;
54550+ }
54551+
54552+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54553+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
54554+ read_unlock(&tasklist_lock);
54555+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54556+ return 1;
54557+ }
54558+ read_unlock(&tasklist_lock);
54559+
54560+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54561+ if (!(gr_status & GR_READY))
54562+ return 0;
54563+#endif
54564+
54565+ read_lock(&grsec_exec_file_lock);
54566+ if (unlikely(!task->exec_file)) {
54567+ read_unlock(&grsec_exec_file_lock);
54568+ return 0;
54569+ }
54570+
54571+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
54572+ read_unlock(&grsec_exec_file_lock);
54573+
54574+ if (retmode & GR_NOPTRACE) {
54575+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54576+ return 1;
54577+ }
54578+
54579+ if (retmode & GR_PTRACERD) {
54580+ switch (request) {
54581+ case PTRACE_SEIZE:
54582+ case PTRACE_POKETEXT:
54583+ case PTRACE_POKEDATA:
54584+ case PTRACE_POKEUSR:
54585+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
54586+ case PTRACE_SETREGS:
54587+ case PTRACE_SETFPREGS:
54588+#endif
54589+#ifdef CONFIG_X86
54590+ case PTRACE_SETFPXREGS:
54591+#endif
54592+#ifdef CONFIG_ALTIVEC
54593+ case PTRACE_SETVRREGS:
54594+#endif
54595+ return 1;
54596+ default:
54597+ return 0;
54598+ }
54599+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
54600+ !(current->role->roletype & GR_ROLE_GOD) &&
54601+ (current->acl != task->acl)) {
54602+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54603+ return 1;
54604+ }
54605+
54606+ return 0;
54607+}
54608+
54609+static int is_writable_mmap(const struct file *filp)
54610+{
54611+ struct task_struct *task = current;
54612+ struct acl_object_label *obj, *obj2;
54613+
54614+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
54615+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
54616+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54617+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
54618+ task->role->root_label);
54619+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
54620+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
54621+ return 1;
54622+ }
54623+ }
54624+ return 0;
54625+}
54626+
54627+int
54628+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
54629+{
54630+ __u32 mode;
54631+
54632+ if (unlikely(!file || !(prot & PROT_EXEC)))
54633+ return 1;
54634+
54635+ if (is_writable_mmap(file))
54636+ return 0;
54637+
54638+ mode =
54639+ gr_search_file(file->f_path.dentry,
54640+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54641+ file->f_path.mnt);
54642+
54643+ if (!gr_tpe_allow(file))
54644+ return 0;
54645+
54646+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54647+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54648+ return 0;
54649+ } else if (unlikely(!(mode & GR_EXEC))) {
54650+ return 0;
54651+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54652+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54653+ return 1;
54654+ }
54655+
54656+ return 1;
54657+}
54658+
54659+int
54660+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
54661+{
54662+ __u32 mode;
54663+
54664+ if (unlikely(!file || !(prot & PROT_EXEC)))
54665+ return 1;
54666+
54667+ if (is_writable_mmap(file))
54668+ return 0;
54669+
54670+ mode =
54671+ gr_search_file(file->f_path.dentry,
54672+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54673+ file->f_path.mnt);
54674+
54675+ if (!gr_tpe_allow(file))
54676+ return 0;
54677+
54678+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54679+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54680+ return 0;
54681+ } else if (unlikely(!(mode & GR_EXEC))) {
54682+ return 0;
54683+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54684+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54685+ return 1;
54686+ }
54687+
54688+ return 1;
54689+}
54690+
54691+void
54692+gr_acl_handle_psacct(struct task_struct *task, const long code)
54693+{
54694+ unsigned long runtime;
54695+ unsigned long cputime;
54696+ unsigned int wday, cday;
54697+ __u8 whr, chr;
54698+ __u8 wmin, cmin;
54699+ __u8 wsec, csec;
54700+ struct timespec timeval;
54701+
54702+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
54703+ !(task->acl->mode & GR_PROCACCT)))
54704+ return;
54705+
54706+ do_posix_clock_monotonic_gettime(&timeval);
54707+ runtime = timeval.tv_sec - task->start_time.tv_sec;
54708+ wday = runtime / (3600 * 24);
54709+ runtime -= wday * (3600 * 24);
54710+ whr = runtime / 3600;
54711+ runtime -= whr * 3600;
54712+ wmin = runtime / 60;
54713+ runtime -= wmin * 60;
54714+ wsec = runtime;
54715+
54716+ cputime = (task->utime + task->stime) / HZ;
54717+ cday = cputime / (3600 * 24);
54718+ cputime -= cday * (3600 * 24);
54719+ chr = cputime / 3600;
54720+ cputime -= chr * 3600;
54721+ cmin = cputime / 60;
54722+ cputime -= cmin * 60;
54723+ csec = cputime;
54724+
54725+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
54726+
54727+ return;
54728+}
54729+
54730+void gr_set_kernel_label(struct task_struct *task)
54731+{
54732+ if (gr_status & GR_READY) {
54733+ task->role = kernel_role;
54734+ task->acl = kernel_role->root_label;
54735+ }
54736+ return;
54737+}
54738+
54739+#ifdef CONFIG_TASKSTATS
54740+int gr_is_taskstats_denied(int pid)
54741+{
54742+ struct task_struct *task;
54743+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54744+ const struct cred *cred;
54745+#endif
54746+ int ret = 0;
54747+
54748+ /* restrict taskstats viewing to un-chrooted root users
54749+ who have the 'view' subject flag if the RBAC system is enabled
54750+ */
54751+
54752+ rcu_read_lock();
54753+ read_lock(&tasklist_lock);
54754+ task = find_task_by_vpid(pid);
54755+ if (task) {
54756+#ifdef CONFIG_GRKERNSEC_CHROOT
54757+ if (proc_is_chrooted(task))
54758+ ret = -EACCES;
54759+#endif
54760+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54761+ cred = __task_cred(task);
54762+#ifdef CONFIG_GRKERNSEC_PROC_USER
54763+ if (cred->uid != 0)
54764+ ret = -EACCES;
54765+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54766+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
54767+ ret = -EACCES;
54768+#endif
54769+#endif
54770+ if (gr_status & GR_READY) {
54771+ if (!(task->acl->mode & GR_VIEW))
54772+ ret = -EACCES;
54773+ }
54774+ } else
54775+ ret = -ENOENT;
54776+
54777+ read_unlock(&tasklist_lock);
54778+ rcu_read_unlock();
54779+
54780+ return ret;
54781+}
54782+#endif
54783+
54784+/* AUXV entries are filled via a descendant of search_binary_handler
54785+ after we've already applied the subject for the target
54786+*/
54787+int gr_acl_enable_at_secure(void)
54788+{
54789+ if (unlikely(!(gr_status & GR_READY)))
54790+ return 0;
54791+
54792+ if (current->acl->mode & GR_ATSECURE)
54793+ return 1;
54794+
54795+ return 0;
54796+}
54797+
54798+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
54799+{
54800+ struct task_struct *task = current;
54801+ struct dentry *dentry = file->f_path.dentry;
54802+ struct vfsmount *mnt = file->f_path.mnt;
54803+ struct acl_object_label *obj, *tmp;
54804+ struct acl_subject_label *subj;
54805+ unsigned int bufsize;
54806+ int is_not_root;
54807+ char *path;
54808+ dev_t dev = __get_dev(dentry);
54809+
54810+ if (unlikely(!(gr_status & GR_READY)))
54811+ return 1;
54812+
54813+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
54814+ return 1;
54815+
54816+ /* ignore Eric Biederman */
54817+ if (IS_PRIVATE(dentry->d_inode))
54818+ return 1;
54819+
54820+ subj = task->acl;
54821+ do {
54822+ obj = lookup_acl_obj_label(ino, dev, subj);
54823+ if (obj != NULL)
54824+ return (obj->mode & GR_FIND) ? 1 : 0;
54825+ } while ((subj = subj->parent_subject));
54826+
54827+ /* this is purely an optimization since we're looking for an object
54828+ for the directory we're doing a readdir on
54829+ if it's possible for any globbed object to match the entry we're
54830+ filling into the directory, then the object we find here will be
54831+ an anchor point with attached globbed objects
54832+ */
54833+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
54834+ if (obj->globbed == NULL)
54835+ return (obj->mode & GR_FIND) ? 1 : 0;
54836+
54837+ is_not_root = ((obj->filename[0] == '/') &&
54838+ (obj->filename[1] == '\0')) ? 0 : 1;
54839+ bufsize = PAGE_SIZE - namelen - is_not_root;
54840+
54841+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
54842+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
54843+ return 1;
54844+
54845+ preempt_disable();
54846+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
54847+ bufsize);
54848+
54849+ bufsize = strlen(path);
54850+
54851+ /* if base is "/", don't append an additional slash */
54852+ if (is_not_root)
54853+ *(path + bufsize) = '/';
54854+ memcpy(path + bufsize + is_not_root, name, namelen);
54855+ *(path + bufsize + namelen + is_not_root) = '\0';
54856+
54857+ tmp = obj->globbed;
54858+ while (tmp) {
54859+ if (!glob_match(tmp->filename, path)) {
54860+ preempt_enable();
54861+ return (tmp->mode & GR_FIND) ? 1 : 0;
54862+ }
54863+ tmp = tmp->next;
54864+ }
54865+ preempt_enable();
54866+ return (obj->mode & GR_FIND) ? 1 : 0;
54867+}
54868+
54869+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
54870+EXPORT_SYMBOL(gr_acl_is_enabled);
54871+#endif
54872+EXPORT_SYMBOL(gr_learn_resource);
54873+EXPORT_SYMBOL(gr_set_kernel_label);
54874+#ifdef CONFIG_SECURITY
54875+EXPORT_SYMBOL(gr_check_user_change);
54876+EXPORT_SYMBOL(gr_check_group_change);
54877+#endif
54878+
54879diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
54880new file mode 100644
54881index 0000000..34fefda
54882--- /dev/null
54883+++ b/grsecurity/gracl_alloc.c
54884@@ -0,0 +1,105 @@
54885+#include <linux/kernel.h>
54886+#include <linux/mm.h>
54887+#include <linux/slab.h>
54888+#include <linux/vmalloc.h>
54889+#include <linux/gracl.h>
54890+#include <linux/grsecurity.h>
54891+
54892+static unsigned long alloc_stack_next = 1;
54893+static unsigned long alloc_stack_size = 1;
54894+static void **alloc_stack;
54895+
54896+static __inline__ int
54897+alloc_pop(void)
54898+{
54899+ if (alloc_stack_next == 1)
54900+ return 0;
54901+
54902+ kfree(alloc_stack[alloc_stack_next - 2]);
54903+
54904+ alloc_stack_next--;
54905+
54906+ return 1;
54907+}
54908+
54909+static __inline__ int
54910+alloc_push(void *buf)
54911+{
54912+ if (alloc_stack_next >= alloc_stack_size)
54913+ return 1;
54914+
54915+ alloc_stack[alloc_stack_next - 1] = buf;
54916+
54917+ alloc_stack_next++;
54918+
54919+ return 0;
54920+}
54921+
54922+void *
54923+acl_alloc(unsigned long len)
54924+{
54925+ void *ret = NULL;
54926+
54927+ if (!len || len > PAGE_SIZE)
54928+ goto out;
54929+
54930+ ret = kmalloc(len, GFP_KERNEL);
54931+
54932+ if (ret) {
54933+ if (alloc_push(ret)) {
54934+ kfree(ret);
54935+ ret = NULL;
54936+ }
54937+ }
54938+
54939+out:
54940+ return ret;
54941+}
54942+
54943+void *
54944+acl_alloc_num(unsigned long num, unsigned long len)
54945+{
54946+ if (!len || (num > (PAGE_SIZE / len)))
54947+ return NULL;
54948+
54949+ return acl_alloc(num * len);
54950+}
54951+
54952+void
54953+acl_free_all(void)
54954+{
54955+ if (gr_acl_is_enabled() || !alloc_stack)
54956+ return;
54957+
54958+ while (alloc_pop()) ;
54959+
54960+ if (alloc_stack) {
54961+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
54962+ kfree(alloc_stack);
54963+ else
54964+ vfree(alloc_stack);
54965+ }
54966+
54967+ alloc_stack = NULL;
54968+ alloc_stack_size = 1;
54969+ alloc_stack_next = 1;
54970+
54971+ return;
54972+}
54973+
54974+int
54975+acl_alloc_stack_init(unsigned long size)
54976+{
54977+ if ((size * sizeof (void *)) <= PAGE_SIZE)
54978+ alloc_stack =
54979+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
54980+ else
54981+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
54982+
54983+ alloc_stack_size = size;
54984+
54985+ if (!alloc_stack)
54986+ return 0;
54987+ else
54988+ return 1;
54989+}
54990diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
54991new file mode 100644
54992index 0000000..955ddfb
54993--- /dev/null
54994+++ b/grsecurity/gracl_cap.c
54995@@ -0,0 +1,101 @@
54996+#include <linux/kernel.h>
54997+#include <linux/module.h>
54998+#include <linux/sched.h>
54999+#include <linux/gracl.h>
55000+#include <linux/grsecurity.h>
55001+#include <linux/grinternal.h>
55002+
55003+extern const char *captab_log[];
55004+extern int captab_log_entries;
55005+
55006+int
55007+gr_acl_is_capable(const int cap)
55008+{
55009+ struct task_struct *task = current;
55010+ const struct cred *cred = current_cred();
55011+ struct acl_subject_label *curracl;
55012+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55013+ kernel_cap_t cap_audit = __cap_empty_set;
55014+
55015+ if (!gr_acl_is_enabled())
55016+ return 1;
55017+
55018+ curracl = task->acl;
55019+
55020+ cap_drop = curracl->cap_lower;
55021+ cap_mask = curracl->cap_mask;
55022+ cap_audit = curracl->cap_invert_audit;
55023+
55024+ while ((curracl = curracl->parent_subject)) {
55025+ /* if the cap isn't specified in the current computed mask but is specified in the
55026+ current level subject, and is lowered in the current level subject, then add
55027+ it to the set of dropped capabilities
55028+ otherwise, add the current level subject's mask to the current computed mask
55029+ */
55030+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55031+ cap_raise(cap_mask, cap);
55032+ if (cap_raised(curracl->cap_lower, cap))
55033+ cap_raise(cap_drop, cap);
55034+ if (cap_raised(curracl->cap_invert_audit, cap))
55035+ cap_raise(cap_audit, cap);
55036+ }
55037+ }
55038+
55039+ if (!cap_raised(cap_drop, cap)) {
55040+ if (cap_raised(cap_audit, cap))
55041+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55042+ return 1;
55043+ }
55044+
55045+ curracl = task->acl;
55046+
55047+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55048+ && cap_raised(cred->cap_effective, cap)) {
55049+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55050+ task->role->roletype, cred->uid,
55051+ cred->gid, task->exec_file ?
55052+ gr_to_filename(task->exec_file->f_path.dentry,
55053+ task->exec_file->f_path.mnt) : curracl->filename,
55054+ curracl->filename, 0UL,
55055+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55056+ return 1;
55057+ }
55058+
55059+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55060+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55061+ return 0;
55062+}
55063+
55064+int
55065+gr_acl_is_capable_nolog(const int cap)
55066+{
55067+ struct acl_subject_label *curracl;
55068+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55069+
55070+ if (!gr_acl_is_enabled())
55071+ return 1;
55072+
55073+ curracl = current->acl;
55074+
55075+ cap_drop = curracl->cap_lower;
55076+ cap_mask = curracl->cap_mask;
55077+
55078+ while ((curracl = curracl->parent_subject)) {
55079+ /* if the cap isn't specified in the current computed mask but is specified in the
55080+ current level subject, and is lowered in the current level subject, then add
55081+ it to the set of dropped capabilities
55082+ otherwise, add the current level subject's mask to the current computed mask
55083+ */
55084+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55085+ cap_raise(cap_mask, cap);
55086+ if (cap_raised(curracl->cap_lower, cap))
55087+ cap_raise(cap_drop, cap);
55088+ }
55089+ }
55090+
55091+ if (!cap_raised(cap_drop, cap))
55092+ return 1;
55093+
55094+ return 0;
55095+}
55096+
55097diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
55098new file mode 100644
55099index 0000000..4eda5c3
55100--- /dev/null
55101+++ b/grsecurity/gracl_fs.c
55102@@ -0,0 +1,433 @@
55103+#include <linux/kernel.h>
55104+#include <linux/sched.h>
55105+#include <linux/types.h>
55106+#include <linux/fs.h>
55107+#include <linux/file.h>
55108+#include <linux/stat.h>
55109+#include <linux/grsecurity.h>
55110+#include <linux/grinternal.h>
55111+#include <linux/gracl.h>
55112+
55113+__u32
55114+gr_acl_handle_hidden_file(const struct dentry * dentry,
55115+ const struct vfsmount * mnt)
55116+{
55117+ __u32 mode;
55118+
55119+ if (unlikely(!dentry->d_inode))
55120+ return GR_FIND;
55121+
55122+ mode =
55123+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55124+
55125+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55126+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55127+ return mode;
55128+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55129+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55130+ return 0;
55131+ } else if (unlikely(!(mode & GR_FIND)))
55132+ return 0;
55133+
55134+ return GR_FIND;
55135+}
55136+
55137+__u32
55138+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55139+ int acc_mode)
55140+{
55141+ __u32 reqmode = GR_FIND;
55142+ __u32 mode;
55143+
55144+ if (unlikely(!dentry->d_inode))
55145+ return reqmode;
55146+
55147+ if (acc_mode & MAY_APPEND)
55148+ reqmode |= GR_APPEND;
55149+ else if (acc_mode & MAY_WRITE)
55150+ reqmode |= GR_WRITE;
55151+ if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
55152+ reqmode |= GR_READ;
55153+
55154+ mode =
55155+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55156+ mnt);
55157+
55158+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55159+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55160+ reqmode & GR_READ ? " reading" : "",
55161+ reqmode & GR_WRITE ? " writing" : reqmode &
55162+ GR_APPEND ? " appending" : "");
55163+ return reqmode;
55164+ } else
55165+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55166+ {
55167+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55168+ reqmode & GR_READ ? " reading" : "",
55169+ reqmode & GR_WRITE ? " writing" : reqmode &
55170+ GR_APPEND ? " appending" : "");
55171+ return 0;
55172+ } else if (unlikely((mode & reqmode) != reqmode))
55173+ return 0;
55174+
55175+ return reqmode;
55176+}
55177+
55178+__u32
55179+gr_acl_handle_creat(const struct dentry * dentry,
55180+ const struct dentry * p_dentry,
55181+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
55182+ const int imode)
55183+{
55184+ __u32 reqmode = GR_WRITE | GR_CREATE;
55185+ __u32 mode;
55186+
55187+ if (acc_mode & MAY_APPEND)
55188+ reqmode |= GR_APPEND;
55189+ // if a directory was required or the directory already exists, then
55190+ // don't count this open as a read
55191+ if ((acc_mode & MAY_READ) &&
55192+ !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
55193+ reqmode |= GR_READ;
55194+ if ((open_flags & O_CREAT) && (imode & (S_ISUID | S_ISGID)))
55195+ reqmode |= GR_SETID;
55196+
55197+ mode =
55198+ gr_check_create(dentry, p_dentry, p_mnt,
55199+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55200+
55201+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55202+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55203+ reqmode & GR_READ ? " reading" : "",
55204+ reqmode & GR_WRITE ? " writing" : reqmode &
55205+ GR_APPEND ? " appending" : "");
55206+ return reqmode;
55207+ } else
55208+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55209+ {
55210+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55211+ reqmode & GR_READ ? " reading" : "",
55212+ reqmode & GR_WRITE ? " writing" : reqmode &
55213+ GR_APPEND ? " appending" : "");
55214+ return 0;
55215+ } else if (unlikely((mode & reqmode) != reqmode))
55216+ return 0;
55217+
55218+ return reqmode;
55219+}
55220+
55221+__u32
55222+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55223+ const int fmode)
55224+{
55225+ __u32 mode, reqmode = GR_FIND;
55226+
55227+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55228+ reqmode |= GR_EXEC;
55229+ if (fmode & S_IWOTH)
55230+ reqmode |= GR_WRITE;
55231+ if (fmode & S_IROTH)
55232+ reqmode |= GR_READ;
55233+
55234+ mode =
55235+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55236+ mnt);
55237+
55238+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55239+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55240+ reqmode & GR_READ ? " reading" : "",
55241+ reqmode & GR_WRITE ? " writing" : "",
55242+ reqmode & GR_EXEC ? " executing" : "");
55243+ return reqmode;
55244+ } else
55245+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55246+ {
55247+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55248+ reqmode & GR_READ ? " reading" : "",
55249+ reqmode & GR_WRITE ? " writing" : "",
55250+ reqmode & GR_EXEC ? " executing" : "");
55251+ return 0;
55252+ } else if (unlikely((mode & reqmode) != reqmode))
55253+ return 0;
55254+
55255+ return reqmode;
55256+}
55257+
55258+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55259+{
55260+ __u32 mode;
55261+
55262+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55263+
55264+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55265+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55266+ return mode;
55267+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55268+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55269+ return 0;
55270+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55271+ return 0;
55272+
55273+ return (reqmode);
55274+}
55275+
55276+__u32
55277+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55278+{
55279+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55280+}
55281+
55282+__u32
55283+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55284+{
55285+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55286+}
55287+
55288+__u32
55289+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55290+{
55291+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55292+}
55293+
55294+__u32
55295+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55296+{
55297+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55298+}
55299+
55300+__u32
55301+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55302+ mode_t mode)
55303+{
55304+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55305+ return 1;
55306+
55307+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55308+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55309+ GR_FCHMOD_ACL_MSG);
55310+ } else {
55311+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55312+ }
55313+}
55314+
55315+__u32
55316+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55317+ mode_t mode)
55318+{
55319+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55320+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55321+ GR_CHMOD_ACL_MSG);
55322+ } else {
55323+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55324+ }
55325+}
55326+
55327+__u32
55328+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55329+{
55330+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55331+}
55332+
55333+__u32
55334+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55335+{
55336+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55337+}
55338+
55339+__u32
55340+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55341+{
55342+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55343+}
55344+
55345+__u32
55346+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55347+{
55348+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55349+ GR_UNIXCONNECT_ACL_MSG);
55350+}
55351+
55352+/* hardlinks require at minimum create and link permission,
55353+ any additional privilege required is based on the
55354+ privilege of the file being linked to
55355+*/
55356+__u32
55357+gr_acl_handle_link(const struct dentry * new_dentry,
55358+ const struct dentry * parent_dentry,
55359+ const struct vfsmount * parent_mnt,
55360+ const struct dentry * old_dentry,
55361+ const struct vfsmount * old_mnt, const char *to)
55362+{
55363+ __u32 mode;
55364+ __u32 needmode = GR_CREATE | GR_LINK;
55365+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55366+
55367+ mode =
55368+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55369+ old_mnt);
55370+
55371+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55372+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55373+ return mode;
55374+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55375+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55376+ return 0;
55377+ } else if (unlikely((mode & needmode) != needmode))
55378+ return 0;
55379+
55380+ return 1;
55381+}
55382+
55383+__u32
55384+gr_acl_handle_symlink(const struct dentry * new_dentry,
55385+ const struct dentry * parent_dentry,
55386+ const struct vfsmount * parent_mnt, const char *from)
55387+{
55388+ __u32 needmode = GR_WRITE | GR_CREATE;
55389+ __u32 mode;
55390+
55391+ mode =
55392+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
55393+ GR_CREATE | GR_AUDIT_CREATE |
55394+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55395+
55396+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55397+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55398+ return mode;
55399+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55400+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55401+ return 0;
55402+ } else if (unlikely((mode & needmode) != needmode))
55403+ return 0;
55404+
55405+ return (GR_WRITE | GR_CREATE);
55406+}
55407+
55408+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55409+{
55410+ __u32 mode;
55411+
55412+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55413+
55414+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55415+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55416+ return mode;
55417+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55418+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55419+ return 0;
55420+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55421+ return 0;
55422+
55423+ return (reqmode);
55424+}
55425+
55426+__u32
55427+gr_acl_handle_mknod(const struct dentry * new_dentry,
55428+ const struct dentry * parent_dentry,
55429+ const struct vfsmount * parent_mnt,
55430+ const int mode)
55431+{
55432+ __u32 reqmode = GR_WRITE | GR_CREATE;
55433+ if (unlikely(mode & (S_ISUID | S_ISGID)))
55434+ reqmode |= GR_SETID;
55435+
55436+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55437+ reqmode, GR_MKNOD_ACL_MSG);
55438+}
55439+
55440+__u32
55441+gr_acl_handle_mkdir(const struct dentry *new_dentry,
55442+ const struct dentry *parent_dentry,
55443+ const struct vfsmount *parent_mnt)
55444+{
55445+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55446+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55447+}
55448+
55449+#define RENAME_CHECK_SUCCESS(old, new) \
55450+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55451+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55452+
55453+int
55454+gr_acl_handle_rename(struct dentry *new_dentry,
55455+ struct dentry *parent_dentry,
55456+ const struct vfsmount *parent_mnt,
55457+ struct dentry *old_dentry,
55458+ struct inode *old_parent_inode,
55459+ struct vfsmount *old_mnt, const char *newname)
55460+{
55461+ __u32 comp1, comp2;
55462+ int error = 0;
55463+
55464+ if (unlikely(!gr_acl_is_enabled()))
55465+ return 0;
55466+
55467+ if (!new_dentry->d_inode) {
55468+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55469+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55470+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55471+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55472+ GR_DELETE | GR_AUDIT_DELETE |
55473+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55474+ GR_SUPPRESS, old_mnt);
55475+ } else {
55476+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55477+ GR_CREATE | GR_DELETE |
55478+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55479+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55480+ GR_SUPPRESS, parent_mnt);
55481+ comp2 =
55482+ gr_search_file(old_dentry,
55483+ GR_READ | GR_WRITE | GR_AUDIT_READ |
55484+ GR_DELETE | GR_AUDIT_DELETE |
55485+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55486+ }
55487+
55488+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55489+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55490+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55491+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55492+ && !(comp2 & GR_SUPPRESS)) {
55493+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55494+ error = -EACCES;
55495+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55496+ error = -EACCES;
55497+
55498+ return error;
55499+}
55500+
55501+void
55502+gr_acl_handle_exit(void)
55503+{
55504+ u16 id;
55505+ char *rolename;
55506+ struct file *exec_file;
55507+
55508+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55509+ !(current->role->roletype & GR_ROLE_PERSIST))) {
55510+ id = current->acl_role_id;
55511+ rolename = current->role->rolename;
55512+ gr_set_acls(1);
55513+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55514+ }
55515+
55516+ write_lock(&grsec_exec_file_lock);
55517+ exec_file = current->exec_file;
55518+ current->exec_file = NULL;
55519+ write_unlock(&grsec_exec_file_lock);
55520+
55521+ if (exec_file)
55522+ fput(exec_file);
55523+}
55524+
55525+int
55526+gr_acl_handle_procpidmem(const struct task_struct *task)
55527+{
55528+ if (unlikely(!gr_acl_is_enabled()))
55529+ return 0;
55530+
55531+ if (task != current && task->acl->mode & GR_PROTPROCFD)
55532+ return -EACCES;
55533+
55534+ return 0;
55535+}
55536diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
55537new file mode 100644
55538index 0000000..17050ca
55539--- /dev/null
55540+++ b/grsecurity/gracl_ip.c
55541@@ -0,0 +1,381 @@
55542+#include <linux/kernel.h>
55543+#include <asm/uaccess.h>
55544+#include <asm/errno.h>
55545+#include <net/sock.h>
55546+#include <linux/file.h>
55547+#include <linux/fs.h>
55548+#include <linux/net.h>
55549+#include <linux/in.h>
55550+#include <linux/skbuff.h>
55551+#include <linux/ip.h>
55552+#include <linux/udp.h>
55553+#include <linux/types.h>
55554+#include <linux/sched.h>
55555+#include <linux/netdevice.h>
55556+#include <linux/inetdevice.h>
55557+#include <linux/gracl.h>
55558+#include <linux/grsecurity.h>
55559+#include <linux/grinternal.h>
55560+
55561+#define GR_BIND 0x01
55562+#define GR_CONNECT 0x02
55563+#define GR_INVERT 0x04
55564+#define GR_BINDOVERRIDE 0x08
55565+#define GR_CONNECTOVERRIDE 0x10
55566+#define GR_SOCK_FAMILY 0x20
55567+
55568+static const char * gr_protocols[IPPROTO_MAX] = {
55569+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55570+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55571+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55572+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55573+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55574+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55575+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55576+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55577+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
55578+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
55579+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
55580+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
55581+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
55582+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
55583+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
55584+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
55585+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
55586+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
55587+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
55588+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
55589+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
55590+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
55591+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
55592+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
55593+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
55594+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
55595+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
55596+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
55597+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
55598+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
55599+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
55600+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
55601+ };
55602+
55603+static const char * gr_socktypes[SOCK_MAX] = {
55604+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
55605+ "unknown:7", "unknown:8", "unknown:9", "packet"
55606+ };
55607+
55608+static const char * gr_sockfamilies[AF_MAX+1] = {
55609+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
55610+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
55611+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
55612+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
55613+ };
55614+
55615+const char *
55616+gr_proto_to_name(unsigned char proto)
55617+{
55618+ return gr_protocols[proto];
55619+}
55620+
55621+const char *
55622+gr_socktype_to_name(unsigned char type)
55623+{
55624+ return gr_socktypes[type];
55625+}
55626+
55627+const char *
55628+gr_sockfamily_to_name(unsigned char family)
55629+{
55630+ return gr_sockfamilies[family];
55631+}
55632+
55633+int
55634+gr_search_socket(const int domain, const int type, const int protocol)
55635+{
55636+ struct acl_subject_label *curr;
55637+ const struct cred *cred = current_cred();
55638+
55639+ if (unlikely(!gr_acl_is_enabled()))
55640+ goto exit;
55641+
55642+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
55643+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
55644+ goto exit; // let the kernel handle it
55645+
55646+ curr = current->acl;
55647+
55648+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
55649+ /* the family is allowed, if this is PF_INET allow it only if
55650+ the extra sock type/protocol checks pass */
55651+ if (domain == PF_INET)
55652+ goto inet_check;
55653+ goto exit;
55654+ } else {
55655+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55656+ __u32 fakeip = 0;
55657+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55658+ current->role->roletype, cred->uid,
55659+ cred->gid, current->exec_file ?
55660+ gr_to_filename(current->exec_file->f_path.dentry,
55661+ current->exec_file->f_path.mnt) :
55662+ curr->filename, curr->filename,
55663+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
55664+ &current->signal->saved_ip);
55665+ goto exit;
55666+ }
55667+ goto exit_fail;
55668+ }
55669+
55670+inet_check:
55671+ /* the rest of this checking is for IPv4 only */
55672+ if (!curr->ips)
55673+ goto exit;
55674+
55675+ if ((curr->ip_type & (1 << type)) &&
55676+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
55677+ goto exit;
55678+
55679+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55680+ /* we don't place acls on raw sockets , and sometimes
55681+ dgram/ip sockets are opened for ioctl and not
55682+ bind/connect, so we'll fake a bind learn log */
55683+ if (type == SOCK_RAW || type == SOCK_PACKET) {
55684+ __u32 fakeip = 0;
55685+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55686+ current->role->roletype, cred->uid,
55687+ cred->gid, current->exec_file ?
55688+ gr_to_filename(current->exec_file->f_path.dentry,
55689+ current->exec_file->f_path.mnt) :
55690+ curr->filename, curr->filename,
55691+ &fakeip, 0, type,
55692+ protocol, GR_CONNECT, &current->signal->saved_ip);
55693+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
55694+ __u32 fakeip = 0;
55695+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55696+ current->role->roletype, cred->uid,
55697+ cred->gid, current->exec_file ?
55698+ gr_to_filename(current->exec_file->f_path.dentry,
55699+ current->exec_file->f_path.mnt) :
55700+ curr->filename, curr->filename,
55701+ &fakeip, 0, type,
55702+ protocol, GR_BIND, &current->signal->saved_ip);
55703+ }
55704+ /* we'll log when they use connect or bind */
55705+ goto exit;
55706+ }
55707+
55708+exit_fail:
55709+ if (domain == PF_INET)
55710+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
55711+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
55712+ else
55713+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
55714+ gr_socktype_to_name(type), protocol);
55715+
55716+ return 0;
55717+exit:
55718+ return 1;
55719+}
55720+
55721+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
55722+{
55723+ if ((ip->mode & mode) &&
55724+ (ip_port >= ip->low) &&
55725+ (ip_port <= ip->high) &&
55726+ ((ntohl(ip_addr) & our_netmask) ==
55727+ (ntohl(our_addr) & our_netmask))
55728+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
55729+ && (ip->type & (1 << type))) {
55730+ if (ip->mode & GR_INVERT)
55731+ return 2; // specifically denied
55732+ else
55733+ return 1; // allowed
55734+ }
55735+
55736+ return 0; // not specifically allowed, may continue parsing
55737+}
55738+
55739+static int
55740+gr_search_connectbind(const int full_mode, struct sock *sk,
55741+ struct sockaddr_in *addr, const int type)
55742+{
55743+ char iface[IFNAMSIZ] = {0};
55744+ struct acl_subject_label *curr;
55745+ struct acl_ip_label *ip;
55746+ struct inet_sock *isk;
55747+ struct net_device *dev;
55748+ struct in_device *idev;
55749+ unsigned long i;
55750+ int ret;
55751+ int mode = full_mode & (GR_BIND | GR_CONNECT);
55752+ __u32 ip_addr = 0;
55753+ __u32 our_addr;
55754+ __u32 our_netmask;
55755+ char *p;
55756+ __u16 ip_port = 0;
55757+ const struct cred *cred = current_cred();
55758+
55759+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
55760+ return 0;
55761+
55762+ curr = current->acl;
55763+ isk = inet_sk(sk);
55764+
55765+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
55766+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
55767+ addr->sin_addr.s_addr = curr->inaddr_any_override;
55768+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
55769+ struct sockaddr_in saddr;
55770+ int err;
55771+
55772+ saddr.sin_family = AF_INET;
55773+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
55774+ saddr.sin_port = isk->inet_sport;
55775+
55776+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55777+ if (err)
55778+ return err;
55779+
55780+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55781+ if (err)
55782+ return err;
55783+ }
55784+
55785+ if (!curr->ips)
55786+ return 0;
55787+
55788+ ip_addr = addr->sin_addr.s_addr;
55789+ ip_port = ntohs(addr->sin_port);
55790+
55791+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55792+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55793+ current->role->roletype, cred->uid,
55794+ cred->gid, current->exec_file ?
55795+ gr_to_filename(current->exec_file->f_path.dentry,
55796+ current->exec_file->f_path.mnt) :
55797+ curr->filename, curr->filename,
55798+ &ip_addr, ip_port, type,
55799+ sk->sk_protocol, mode, &current->signal->saved_ip);
55800+ return 0;
55801+ }
55802+
55803+ for (i = 0; i < curr->ip_num; i++) {
55804+ ip = *(curr->ips + i);
55805+ if (ip->iface != NULL) {
55806+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
55807+ p = strchr(iface, ':');
55808+ if (p != NULL)
55809+ *p = '\0';
55810+ dev = dev_get_by_name(sock_net(sk), iface);
55811+ if (dev == NULL)
55812+ continue;
55813+ idev = in_dev_get(dev);
55814+ if (idev == NULL) {
55815+ dev_put(dev);
55816+ continue;
55817+ }
55818+ rcu_read_lock();
55819+ for_ifa(idev) {
55820+ if (!strcmp(ip->iface, ifa->ifa_label)) {
55821+ our_addr = ifa->ifa_address;
55822+ our_netmask = 0xffffffff;
55823+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55824+ if (ret == 1) {
55825+ rcu_read_unlock();
55826+ in_dev_put(idev);
55827+ dev_put(dev);
55828+ return 0;
55829+ } else if (ret == 2) {
55830+ rcu_read_unlock();
55831+ in_dev_put(idev);
55832+ dev_put(dev);
55833+ goto denied;
55834+ }
55835+ }
55836+ } endfor_ifa(idev);
55837+ rcu_read_unlock();
55838+ in_dev_put(idev);
55839+ dev_put(dev);
55840+ } else {
55841+ our_addr = ip->addr;
55842+ our_netmask = ip->netmask;
55843+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55844+ if (ret == 1)
55845+ return 0;
55846+ else if (ret == 2)
55847+ goto denied;
55848+ }
55849+ }
55850+
55851+denied:
55852+ if (mode == GR_BIND)
55853+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55854+ else if (mode == GR_CONNECT)
55855+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55856+
55857+ return -EACCES;
55858+}
55859+
55860+int
55861+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
55862+{
55863+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
55864+}
55865+
55866+int
55867+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
55868+{
55869+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
55870+}
55871+
55872+int gr_search_listen(struct socket *sock)
55873+{
55874+ struct sock *sk = sock->sk;
55875+ struct sockaddr_in addr;
55876+
55877+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
55878+ addr.sin_port = inet_sk(sk)->inet_sport;
55879+
55880+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55881+}
55882+
55883+int gr_search_accept(struct socket *sock)
55884+{
55885+ struct sock *sk = sock->sk;
55886+ struct sockaddr_in addr;
55887+
55888+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
55889+ addr.sin_port = inet_sk(sk)->inet_sport;
55890+
55891+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55892+}
55893+
55894+int
55895+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
55896+{
55897+ if (addr)
55898+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
55899+ else {
55900+ struct sockaddr_in sin;
55901+ const struct inet_sock *inet = inet_sk(sk);
55902+
55903+ sin.sin_addr.s_addr = inet->inet_daddr;
55904+ sin.sin_port = inet->inet_dport;
55905+
55906+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55907+ }
55908+}
55909+
55910+int
55911+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
55912+{
55913+ struct sockaddr_in sin;
55914+
55915+ if (unlikely(skb->len < sizeof (struct udphdr)))
55916+ return 0; // skip this packet
55917+
55918+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
55919+ sin.sin_port = udp_hdr(skb)->source;
55920+
55921+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55922+}
55923diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
55924new file mode 100644
55925index 0000000..25f54ef
55926--- /dev/null
55927+++ b/grsecurity/gracl_learn.c
55928@@ -0,0 +1,207 @@
55929+#include <linux/kernel.h>
55930+#include <linux/mm.h>
55931+#include <linux/sched.h>
55932+#include <linux/poll.h>
55933+#include <linux/string.h>
55934+#include <linux/file.h>
55935+#include <linux/types.h>
55936+#include <linux/vmalloc.h>
55937+#include <linux/grinternal.h>
55938+
55939+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
55940+ size_t count, loff_t *ppos);
55941+extern int gr_acl_is_enabled(void);
55942+
55943+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
55944+static int gr_learn_attached;
55945+
55946+/* use a 512k buffer */
55947+#define LEARN_BUFFER_SIZE (512 * 1024)
55948+
55949+static DEFINE_SPINLOCK(gr_learn_lock);
55950+static DEFINE_MUTEX(gr_learn_user_mutex);
55951+
55952+/* we need to maintain two buffers, so that the kernel context of grlearn
55953+ uses a semaphore around the userspace copying, and the other kernel contexts
55954+ use a spinlock when copying into the buffer, since they cannot sleep
55955+*/
55956+static char *learn_buffer;
55957+static char *learn_buffer_user;
55958+static int learn_buffer_len;
55959+static int learn_buffer_user_len;
55960+
55961+static ssize_t
55962+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
55963+{
55964+ DECLARE_WAITQUEUE(wait, current);
55965+ ssize_t retval = 0;
55966+
55967+ add_wait_queue(&learn_wait, &wait);
55968+ set_current_state(TASK_INTERRUPTIBLE);
55969+ do {
55970+ mutex_lock(&gr_learn_user_mutex);
55971+ spin_lock(&gr_learn_lock);
55972+ if (learn_buffer_len)
55973+ break;
55974+ spin_unlock(&gr_learn_lock);
55975+ mutex_unlock(&gr_learn_user_mutex);
55976+ if (file->f_flags & O_NONBLOCK) {
55977+ retval = -EAGAIN;
55978+ goto out;
55979+ }
55980+ if (signal_pending(current)) {
55981+ retval = -ERESTARTSYS;
55982+ goto out;
55983+ }
55984+
55985+ schedule();
55986+ } while (1);
55987+
55988+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
55989+ learn_buffer_user_len = learn_buffer_len;
55990+ retval = learn_buffer_len;
55991+ learn_buffer_len = 0;
55992+
55993+ spin_unlock(&gr_learn_lock);
55994+
55995+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
55996+ retval = -EFAULT;
55997+
55998+ mutex_unlock(&gr_learn_user_mutex);
55999+out:
56000+ set_current_state(TASK_RUNNING);
56001+ remove_wait_queue(&learn_wait, &wait);
56002+ return retval;
56003+}
56004+
56005+static unsigned int
56006+poll_learn(struct file * file, poll_table * wait)
56007+{
56008+ poll_wait(file, &learn_wait, wait);
56009+
56010+ if (learn_buffer_len)
56011+ return (POLLIN | POLLRDNORM);
56012+
56013+ return 0;
56014+}
56015+
56016+void
56017+gr_clear_learn_entries(void)
56018+{
56019+ char *tmp;
56020+
56021+ mutex_lock(&gr_learn_user_mutex);
56022+ spin_lock(&gr_learn_lock);
56023+ tmp = learn_buffer;
56024+ learn_buffer = NULL;
56025+ spin_unlock(&gr_learn_lock);
56026+ if (tmp)
56027+ vfree(tmp);
56028+ if (learn_buffer_user != NULL) {
56029+ vfree(learn_buffer_user);
56030+ learn_buffer_user = NULL;
56031+ }
56032+ learn_buffer_len = 0;
56033+ mutex_unlock(&gr_learn_user_mutex);
56034+
56035+ return;
56036+}
56037+
56038+void
56039+gr_add_learn_entry(const char *fmt, ...)
56040+{
56041+ va_list args;
56042+ unsigned int len;
56043+
56044+ if (!gr_learn_attached)
56045+ return;
56046+
56047+ spin_lock(&gr_learn_lock);
56048+
56049+ /* leave a gap at the end so we know when it's "full" but don't have to
56050+ compute the exact length of the string we're trying to append
56051+ */
56052+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56053+ spin_unlock(&gr_learn_lock);
56054+ wake_up_interruptible(&learn_wait);
56055+ return;
56056+ }
56057+ if (learn_buffer == NULL) {
56058+ spin_unlock(&gr_learn_lock);
56059+ return;
56060+ }
56061+
56062+ va_start(args, fmt);
56063+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56064+ va_end(args);
56065+
56066+ learn_buffer_len += len + 1;
56067+
56068+ spin_unlock(&gr_learn_lock);
56069+ wake_up_interruptible(&learn_wait);
56070+
56071+ return;
56072+}
56073+
56074+static int
56075+open_learn(struct inode *inode, struct file *file)
56076+{
56077+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56078+ return -EBUSY;
56079+ if (file->f_mode & FMODE_READ) {
56080+ int retval = 0;
56081+ mutex_lock(&gr_learn_user_mutex);
56082+ if (learn_buffer == NULL)
56083+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56084+ if (learn_buffer_user == NULL)
56085+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56086+ if (learn_buffer == NULL) {
56087+ retval = -ENOMEM;
56088+ goto out_error;
56089+ }
56090+ if (learn_buffer_user == NULL) {
56091+ retval = -ENOMEM;
56092+ goto out_error;
56093+ }
56094+ learn_buffer_len = 0;
56095+ learn_buffer_user_len = 0;
56096+ gr_learn_attached = 1;
56097+out_error:
56098+ mutex_unlock(&gr_learn_user_mutex);
56099+ return retval;
56100+ }
56101+ return 0;
56102+}
56103+
56104+static int
56105+close_learn(struct inode *inode, struct file *file)
56106+{
56107+ if (file->f_mode & FMODE_READ) {
56108+ char *tmp = NULL;
56109+ mutex_lock(&gr_learn_user_mutex);
56110+ spin_lock(&gr_learn_lock);
56111+ tmp = learn_buffer;
56112+ learn_buffer = NULL;
56113+ spin_unlock(&gr_learn_lock);
56114+ if (tmp)
56115+ vfree(tmp);
56116+ if (learn_buffer_user != NULL) {
56117+ vfree(learn_buffer_user);
56118+ learn_buffer_user = NULL;
56119+ }
56120+ learn_buffer_len = 0;
56121+ learn_buffer_user_len = 0;
56122+ gr_learn_attached = 0;
56123+ mutex_unlock(&gr_learn_user_mutex);
56124+ }
56125+
56126+ return 0;
56127+}
56128+
56129+const struct file_operations grsec_fops = {
56130+ .read = read_learn,
56131+ .write = write_grsec_handler,
56132+ .open = open_learn,
56133+ .release = close_learn,
56134+ .poll = poll_learn,
56135+};
56136diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
56137new file mode 100644
56138index 0000000..39645c9
56139--- /dev/null
56140+++ b/grsecurity/gracl_res.c
56141@@ -0,0 +1,68 @@
56142+#include <linux/kernel.h>
56143+#include <linux/sched.h>
56144+#include <linux/gracl.h>
56145+#include <linux/grinternal.h>
56146+
56147+static const char *restab_log[] = {
56148+ [RLIMIT_CPU] = "RLIMIT_CPU",
56149+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56150+ [RLIMIT_DATA] = "RLIMIT_DATA",
56151+ [RLIMIT_STACK] = "RLIMIT_STACK",
56152+ [RLIMIT_CORE] = "RLIMIT_CORE",
56153+ [RLIMIT_RSS] = "RLIMIT_RSS",
56154+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56155+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56156+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56157+ [RLIMIT_AS] = "RLIMIT_AS",
56158+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56159+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56160+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56161+ [RLIMIT_NICE] = "RLIMIT_NICE",
56162+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56163+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56164+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56165+};
56166+
56167+void
56168+gr_log_resource(const struct task_struct *task,
56169+ const int res, const unsigned long wanted, const int gt)
56170+{
56171+ const struct cred *cred;
56172+ unsigned long rlim;
56173+
56174+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56175+ return;
56176+
56177+ // not yet supported resource
56178+ if (unlikely(!restab_log[res]))
56179+ return;
56180+
56181+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56182+ rlim = task_rlimit_max(task, res);
56183+ else
56184+ rlim = task_rlimit(task, res);
56185+
56186+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56187+ return;
56188+
56189+ rcu_read_lock();
56190+ cred = __task_cred(task);
56191+
56192+ if (res == RLIMIT_NPROC &&
56193+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56194+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56195+ goto out_rcu_unlock;
56196+ else if (res == RLIMIT_MEMLOCK &&
56197+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56198+ goto out_rcu_unlock;
56199+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56200+ goto out_rcu_unlock;
56201+ rcu_read_unlock();
56202+
56203+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56204+
56205+ return;
56206+out_rcu_unlock:
56207+ rcu_read_unlock();
56208+ return;
56209+}
56210diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
56211new file mode 100644
56212index 0000000..5556be3
56213--- /dev/null
56214+++ b/grsecurity/gracl_segv.c
56215@@ -0,0 +1,299 @@
56216+#include <linux/kernel.h>
56217+#include <linux/mm.h>
56218+#include <asm/uaccess.h>
56219+#include <asm/errno.h>
56220+#include <asm/mman.h>
56221+#include <net/sock.h>
56222+#include <linux/file.h>
56223+#include <linux/fs.h>
56224+#include <linux/net.h>
56225+#include <linux/in.h>
56226+#include <linux/slab.h>
56227+#include <linux/types.h>
56228+#include <linux/sched.h>
56229+#include <linux/timer.h>
56230+#include <linux/gracl.h>
56231+#include <linux/grsecurity.h>
56232+#include <linux/grinternal.h>
56233+
56234+static struct crash_uid *uid_set;
56235+static unsigned short uid_used;
56236+static DEFINE_SPINLOCK(gr_uid_lock);
56237+extern rwlock_t gr_inode_lock;
56238+extern struct acl_subject_label *
56239+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56240+ struct acl_role_label *role);
56241+
56242+#ifdef CONFIG_BTRFS_FS
56243+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56244+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56245+#endif
56246+
56247+static inline dev_t __get_dev(const struct dentry *dentry)
56248+{
56249+#ifdef CONFIG_BTRFS_FS
56250+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56251+ return get_btrfs_dev_from_inode(dentry->d_inode);
56252+ else
56253+#endif
56254+ return dentry->d_inode->i_sb->s_dev;
56255+}
56256+
56257+int
56258+gr_init_uidset(void)
56259+{
56260+ uid_set =
56261+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56262+ uid_used = 0;
56263+
56264+ return uid_set ? 1 : 0;
56265+}
56266+
56267+void
56268+gr_free_uidset(void)
56269+{
56270+ if (uid_set)
56271+ kfree(uid_set);
56272+
56273+ return;
56274+}
56275+
56276+int
56277+gr_find_uid(const uid_t uid)
56278+{
56279+ struct crash_uid *tmp = uid_set;
56280+ uid_t buid;
56281+ int low = 0, high = uid_used - 1, mid;
56282+
56283+ while (high >= low) {
56284+ mid = (low + high) >> 1;
56285+ buid = tmp[mid].uid;
56286+ if (buid == uid)
56287+ return mid;
56288+ if (buid > uid)
56289+ high = mid - 1;
56290+ if (buid < uid)
56291+ low = mid + 1;
56292+ }
56293+
56294+ return -1;
56295+}
56296+
56297+static __inline__ void
56298+gr_insertsort(void)
56299+{
56300+ unsigned short i, j;
56301+ struct crash_uid index;
56302+
56303+ for (i = 1; i < uid_used; i++) {
56304+ index = uid_set[i];
56305+ j = i;
56306+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56307+ uid_set[j] = uid_set[j - 1];
56308+ j--;
56309+ }
56310+ uid_set[j] = index;
56311+ }
56312+
56313+ return;
56314+}
56315+
56316+static __inline__ void
56317+gr_insert_uid(const uid_t uid, const unsigned long expires)
56318+{
56319+ int loc;
56320+
56321+ if (uid_used == GR_UIDTABLE_MAX)
56322+ return;
56323+
56324+ loc = gr_find_uid(uid);
56325+
56326+ if (loc >= 0) {
56327+ uid_set[loc].expires = expires;
56328+ return;
56329+ }
56330+
56331+ uid_set[uid_used].uid = uid;
56332+ uid_set[uid_used].expires = expires;
56333+ uid_used++;
56334+
56335+ gr_insertsort();
56336+
56337+ return;
56338+}
56339+
56340+void
56341+gr_remove_uid(const unsigned short loc)
56342+{
56343+ unsigned short i;
56344+
56345+ for (i = loc + 1; i < uid_used; i++)
56346+ uid_set[i - 1] = uid_set[i];
56347+
56348+ uid_used--;
56349+
56350+ return;
56351+}
56352+
56353+int
56354+gr_check_crash_uid(const uid_t uid)
56355+{
56356+ int loc;
56357+ int ret = 0;
56358+
56359+ if (unlikely(!gr_acl_is_enabled()))
56360+ return 0;
56361+
56362+ spin_lock(&gr_uid_lock);
56363+ loc = gr_find_uid(uid);
56364+
56365+ if (loc < 0)
56366+ goto out_unlock;
56367+
56368+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
56369+ gr_remove_uid(loc);
56370+ else
56371+ ret = 1;
56372+
56373+out_unlock:
56374+ spin_unlock(&gr_uid_lock);
56375+ return ret;
56376+}
56377+
56378+static __inline__ int
56379+proc_is_setxid(const struct cred *cred)
56380+{
56381+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
56382+ cred->uid != cred->fsuid)
56383+ return 1;
56384+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56385+ cred->gid != cred->fsgid)
56386+ return 1;
56387+
56388+ return 0;
56389+}
56390+
56391+extern int gr_fake_force_sig(int sig, struct task_struct *t);
56392+
56393+void
56394+gr_handle_crash(struct task_struct *task, const int sig)
56395+{
56396+ struct acl_subject_label *curr;
56397+ struct task_struct *tsk, *tsk2;
56398+ const struct cred *cred;
56399+ const struct cred *cred2;
56400+
56401+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56402+ return;
56403+
56404+ if (unlikely(!gr_acl_is_enabled()))
56405+ return;
56406+
56407+ curr = task->acl;
56408+
56409+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
56410+ return;
56411+
56412+ if (time_before_eq(curr->expires, get_seconds())) {
56413+ curr->expires = 0;
56414+ curr->crashes = 0;
56415+ }
56416+
56417+ curr->crashes++;
56418+
56419+ if (!curr->expires)
56420+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56421+
56422+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56423+ time_after(curr->expires, get_seconds())) {
56424+ rcu_read_lock();
56425+ cred = __task_cred(task);
56426+ if (cred->uid && proc_is_setxid(cred)) {
56427+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56428+ spin_lock(&gr_uid_lock);
56429+ gr_insert_uid(cred->uid, curr->expires);
56430+ spin_unlock(&gr_uid_lock);
56431+ curr->expires = 0;
56432+ curr->crashes = 0;
56433+ read_lock(&tasklist_lock);
56434+ do_each_thread(tsk2, tsk) {
56435+ cred2 = __task_cred(tsk);
56436+ if (tsk != task && cred2->uid == cred->uid)
56437+ gr_fake_force_sig(SIGKILL, tsk);
56438+ } while_each_thread(tsk2, tsk);
56439+ read_unlock(&tasklist_lock);
56440+ } else {
56441+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56442+ read_lock(&tasklist_lock);
56443+ read_lock(&grsec_exec_file_lock);
56444+ do_each_thread(tsk2, tsk) {
56445+ if (likely(tsk != task)) {
56446+ // if this thread has the same subject as the one that triggered
56447+ // RES_CRASH and it's the same binary, kill it
56448+ if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
56449+ gr_fake_force_sig(SIGKILL, tsk);
56450+ }
56451+ } while_each_thread(tsk2, tsk);
56452+ read_unlock(&grsec_exec_file_lock);
56453+ read_unlock(&tasklist_lock);
56454+ }
56455+ rcu_read_unlock();
56456+ }
56457+
56458+ return;
56459+}
56460+
56461+int
56462+gr_check_crash_exec(const struct file *filp)
56463+{
56464+ struct acl_subject_label *curr;
56465+
56466+ if (unlikely(!gr_acl_is_enabled()))
56467+ return 0;
56468+
56469+ read_lock(&gr_inode_lock);
56470+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56471+ __get_dev(filp->f_path.dentry),
56472+ current->role);
56473+ read_unlock(&gr_inode_lock);
56474+
56475+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56476+ (!curr->crashes && !curr->expires))
56477+ return 0;
56478+
56479+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56480+ time_after(curr->expires, get_seconds()))
56481+ return 1;
56482+ else if (time_before_eq(curr->expires, get_seconds())) {
56483+ curr->crashes = 0;
56484+ curr->expires = 0;
56485+ }
56486+
56487+ return 0;
56488+}
56489+
56490+void
56491+gr_handle_alertkill(struct task_struct *task)
56492+{
56493+ struct acl_subject_label *curracl;
56494+ __u32 curr_ip;
56495+ struct task_struct *p, *p2;
56496+
56497+ if (unlikely(!gr_acl_is_enabled()))
56498+ return;
56499+
56500+ curracl = task->acl;
56501+ curr_ip = task->signal->curr_ip;
56502+
56503+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56504+ read_lock(&tasklist_lock);
56505+ do_each_thread(p2, p) {
56506+ if (p->signal->curr_ip == curr_ip)
56507+ gr_fake_force_sig(SIGKILL, p);
56508+ } while_each_thread(p2, p);
56509+ read_unlock(&tasklist_lock);
56510+ } else if (curracl->mode & GR_KILLPROC)
56511+ gr_fake_force_sig(SIGKILL, task);
56512+
56513+ return;
56514+}
56515diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
56516new file mode 100644
56517index 0000000..9d83a69
56518--- /dev/null
56519+++ b/grsecurity/gracl_shm.c
56520@@ -0,0 +1,40 @@
56521+#include <linux/kernel.h>
56522+#include <linux/mm.h>
56523+#include <linux/sched.h>
56524+#include <linux/file.h>
56525+#include <linux/ipc.h>
56526+#include <linux/gracl.h>
56527+#include <linux/grsecurity.h>
56528+#include <linux/grinternal.h>
56529+
56530+int
56531+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56532+ const time_t shm_createtime, const uid_t cuid, const int shmid)
56533+{
56534+ struct task_struct *task;
56535+
56536+ if (!gr_acl_is_enabled())
56537+ return 1;
56538+
56539+ rcu_read_lock();
56540+ read_lock(&tasklist_lock);
56541+
56542+ task = find_task_by_vpid(shm_cprid);
56543+
56544+ if (unlikely(!task))
56545+ task = find_task_by_vpid(shm_lapid);
56546+
56547+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56548+ (task->pid == shm_lapid)) &&
56549+ (task->acl->mode & GR_PROTSHM) &&
56550+ (task->acl != current->acl))) {
56551+ read_unlock(&tasklist_lock);
56552+ rcu_read_unlock();
56553+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56554+ return 0;
56555+ }
56556+ read_unlock(&tasklist_lock);
56557+ rcu_read_unlock();
56558+
56559+ return 1;
56560+}
56561diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
56562new file mode 100644
56563index 0000000..bc0be01
56564--- /dev/null
56565+++ b/grsecurity/grsec_chdir.c
56566@@ -0,0 +1,19 @@
56567+#include <linux/kernel.h>
56568+#include <linux/sched.h>
56569+#include <linux/fs.h>
56570+#include <linux/file.h>
56571+#include <linux/grsecurity.h>
56572+#include <linux/grinternal.h>
56573+
56574+void
56575+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56576+{
56577+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56578+ if ((grsec_enable_chdir && grsec_enable_group &&
56579+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56580+ !grsec_enable_group)) {
56581+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56582+ }
56583+#endif
56584+ return;
56585+}
56586diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
56587new file mode 100644
56588index 0000000..a2dc675
56589--- /dev/null
56590+++ b/grsecurity/grsec_chroot.c
56591@@ -0,0 +1,351 @@
56592+#include <linux/kernel.h>
56593+#include <linux/module.h>
56594+#include <linux/sched.h>
56595+#include <linux/file.h>
56596+#include <linux/fs.h>
56597+#include <linux/mount.h>
56598+#include <linux/types.h>
56599+#include <linux/pid_namespace.h>
56600+#include <linux/grsecurity.h>
56601+#include <linux/grinternal.h>
56602+
56603+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
56604+{
56605+#ifdef CONFIG_GRKERNSEC
56606+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
56607+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
56608+ task->gr_is_chrooted = 1;
56609+ else
56610+ task->gr_is_chrooted = 0;
56611+
56612+ task->gr_chroot_dentry = path->dentry;
56613+#endif
56614+ return;
56615+}
56616+
56617+void gr_clear_chroot_entries(struct task_struct *task)
56618+{
56619+#ifdef CONFIG_GRKERNSEC
56620+ task->gr_is_chrooted = 0;
56621+ task->gr_chroot_dentry = NULL;
56622+#endif
56623+ return;
56624+}
56625+
56626+int
56627+gr_handle_chroot_unix(const pid_t pid)
56628+{
56629+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
56630+ struct task_struct *p;
56631+
56632+ if (unlikely(!grsec_enable_chroot_unix))
56633+ return 1;
56634+
56635+ if (likely(!proc_is_chrooted(current)))
56636+ return 1;
56637+
56638+ rcu_read_lock();
56639+ read_lock(&tasklist_lock);
56640+ p = find_task_by_vpid_unrestricted(pid);
56641+ if (unlikely(p && !have_same_root(current, p))) {
56642+ read_unlock(&tasklist_lock);
56643+ rcu_read_unlock();
56644+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
56645+ return 0;
56646+ }
56647+ read_unlock(&tasklist_lock);
56648+ rcu_read_unlock();
56649+#endif
56650+ return 1;
56651+}
56652+
56653+int
56654+gr_handle_chroot_nice(void)
56655+{
56656+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56657+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
56658+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
56659+ return -EPERM;
56660+ }
56661+#endif
56662+ return 0;
56663+}
56664+
56665+int
56666+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
56667+{
56668+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56669+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
56670+ && proc_is_chrooted(current)) {
56671+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
56672+ return -EACCES;
56673+ }
56674+#endif
56675+ return 0;
56676+}
56677+
56678+int
56679+gr_handle_chroot_rawio(const struct inode *inode)
56680+{
56681+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56682+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
56683+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
56684+ return 1;
56685+#endif
56686+ return 0;
56687+}
56688+
56689+int
56690+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
56691+{
56692+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56693+ struct task_struct *p;
56694+ int ret = 0;
56695+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
56696+ return ret;
56697+
56698+ read_lock(&tasklist_lock);
56699+ do_each_pid_task(pid, type, p) {
56700+ if (!have_same_root(current, p)) {
56701+ ret = 1;
56702+ goto out;
56703+ }
56704+ } while_each_pid_task(pid, type, p);
56705+out:
56706+ read_unlock(&tasklist_lock);
56707+ return ret;
56708+#endif
56709+ return 0;
56710+}
56711+
56712+int
56713+gr_pid_is_chrooted(struct task_struct *p)
56714+{
56715+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56716+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
56717+ return 0;
56718+
56719+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
56720+ !have_same_root(current, p)) {
56721+ return 1;
56722+ }
56723+#endif
56724+ return 0;
56725+}
56726+
56727+EXPORT_SYMBOL(gr_pid_is_chrooted);
56728+
56729+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
56730+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
56731+{
56732+ struct path path, currentroot;
56733+ int ret = 0;
56734+
56735+ path.dentry = (struct dentry *)u_dentry;
56736+ path.mnt = (struct vfsmount *)u_mnt;
56737+ get_fs_root(current->fs, &currentroot);
56738+ if (path_is_under(&path, &currentroot))
56739+ ret = 1;
56740+ path_put(&currentroot);
56741+
56742+ return ret;
56743+}
56744+#endif
56745+
56746+int
56747+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
56748+{
56749+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
56750+ if (!grsec_enable_chroot_fchdir)
56751+ return 1;
56752+
56753+ if (!proc_is_chrooted(current))
56754+ return 1;
56755+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
56756+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
56757+ return 0;
56758+ }
56759+#endif
56760+ return 1;
56761+}
56762+
56763+int
56764+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56765+ const time_t shm_createtime)
56766+{
56767+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
56768+ struct task_struct *p;
56769+ time_t starttime;
56770+
56771+ if (unlikely(!grsec_enable_chroot_shmat))
56772+ return 1;
56773+
56774+ if (likely(!proc_is_chrooted(current)))
56775+ return 1;
56776+
56777+ rcu_read_lock();
56778+ read_lock(&tasklist_lock);
56779+
56780+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
56781+ starttime = p->start_time.tv_sec;
56782+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
56783+ if (have_same_root(current, p)) {
56784+ goto allow;
56785+ } else {
56786+ read_unlock(&tasklist_lock);
56787+ rcu_read_unlock();
56788+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56789+ return 0;
56790+ }
56791+ }
56792+ /* creator exited, pid reuse, fall through to next check */
56793+ }
56794+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
56795+ if (unlikely(!have_same_root(current, p))) {
56796+ read_unlock(&tasklist_lock);
56797+ rcu_read_unlock();
56798+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56799+ return 0;
56800+ }
56801+ }
56802+
56803+allow:
56804+ read_unlock(&tasklist_lock);
56805+ rcu_read_unlock();
56806+#endif
56807+ return 1;
56808+}
56809+
56810+void
56811+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
56812+{
56813+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
56814+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
56815+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
56816+#endif
56817+ return;
56818+}
56819+
56820+int
56821+gr_handle_chroot_mknod(const struct dentry *dentry,
56822+ const struct vfsmount *mnt, const int mode)
56823+{
56824+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
56825+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
56826+ proc_is_chrooted(current)) {
56827+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
56828+ return -EPERM;
56829+ }
56830+#endif
56831+ return 0;
56832+}
56833+
56834+int
56835+gr_handle_chroot_mount(const struct dentry *dentry,
56836+ const struct vfsmount *mnt, const char *dev_name)
56837+{
56838+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
56839+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
56840+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
56841+ return -EPERM;
56842+ }
56843+#endif
56844+ return 0;
56845+}
56846+
56847+int
56848+gr_handle_chroot_pivot(void)
56849+{
56850+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
56851+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
56852+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
56853+ return -EPERM;
56854+ }
56855+#endif
56856+ return 0;
56857+}
56858+
56859+int
56860+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
56861+{
56862+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
56863+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
56864+ !gr_is_outside_chroot(dentry, mnt)) {
56865+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
56866+ return -EPERM;
56867+ }
56868+#endif
56869+ return 0;
56870+}
56871+
56872+extern const char *captab_log[];
56873+extern int captab_log_entries;
56874+
56875+int
56876+gr_chroot_is_capable(const int cap)
56877+{
56878+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56879+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56880+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56881+ if (cap_raised(chroot_caps, cap)) {
56882+ const struct cred *creds = current_cred();
56883+ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
56884+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
56885+ }
56886+ return 0;
56887+ }
56888+ }
56889+#endif
56890+ return 1;
56891+}
56892+
56893+int
56894+gr_chroot_is_capable_nolog(const int cap)
56895+{
56896+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56897+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56898+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56899+ if (cap_raised(chroot_caps, cap)) {
56900+ return 0;
56901+ }
56902+ }
56903+#endif
56904+ return 1;
56905+}
56906+
56907+int
56908+gr_handle_chroot_sysctl(const int op)
56909+{
56910+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
56911+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
56912+ proc_is_chrooted(current))
56913+ return -EACCES;
56914+#endif
56915+ return 0;
56916+}
56917+
56918+void
56919+gr_handle_chroot_chdir(struct path *path)
56920+{
56921+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
56922+ if (grsec_enable_chroot_chdir)
56923+ set_fs_pwd(current->fs, path);
56924+#endif
56925+ return;
56926+}
56927+
56928+int
56929+gr_handle_chroot_chmod(const struct dentry *dentry,
56930+ const struct vfsmount *mnt, const int mode)
56931+{
56932+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
56933+ /* allow chmod +s on directories, but not files */
56934+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
56935+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
56936+ proc_is_chrooted(current)) {
56937+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
56938+ return -EPERM;
56939+ }
56940+#endif
56941+ return 0;
56942+}
56943diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
56944new file mode 100644
56945index 0000000..d81a586
56946--- /dev/null
56947+++ b/grsecurity/grsec_disabled.c
56948@@ -0,0 +1,439 @@
56949+#include <linux/kernel.h>
56950+#include <linux/module.h>
56951+#include <linux/sched.h>
56952+#include <linux/file.h>
56953+#include <linux/fs.h>
56954+#include <linux/kdev_t.h>
56955+#include <linux/net.h>
56956+#include <linux/in.h>
56957+#include <linux/ip.h>
56958+#include <linux/skbuff.h>
56959+#include <linux/sysctl.h>
56960+
56961+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
56962+void
56963+pax_set_initial_flags(struct linux_binprm *bprm)
56964+{
56965+ return;
56966+}
56967+#endif
56968+
56969+#ifdef CONFIG_SYSCTL
56970+__u32
56971+gr_handle_sysctl(const struct ctl_table * table, const int op)
56972+{
56973+ return 0;
56974+}
56975+#endif
56976+
56977+#ifdef CONFIG_TASKSTATS
56978+int gr_is_taskstats_denied(int pid)
56979+{
56980+ return 0;
56981+}
56982+#endif
56983+
56984+int
56985+gr_acl_is_enabled(void)
56986+{
56987+ return 0;
56988+}
56989+
56990+void
56991+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
56992+{
56993+ return;
56994+}
56995+
56996+int
56997+gr_handle_rawio(const struct inode *inode)
56998+{
56999+ return 0;
57000+}
57001+
57002+void
57003+gr_acl_handle_psacct(struct task_struct *task, const long code)
57004+{
57005+ return;
57006+}
57007+
57008+int
57009+gr_handle_ptrace(struct task_struct *task, const long request)
57010+{
57011+ return 0;
57012+}
57013+
57014+int
57015+gr_handle_proc_ptrace(struct task_struct *task)
57016+{
57017+ return 0;
57018+}
57019+
57020+void
57021+gr_learn_resource(const struct task_struct *task,
57022+ const int res, const unsigned long wanted, const int gt)
57023+{
57024+ return;
57025+}
57026+
57027+int
57028+gr_set_acls(const int type)
57029+{
57030+ return 0;
57031+}
57032+
57033+int
57034+gr_check_hidden_task(const struct task_struct *tsk)
57035+{
57036+ return 0;
57037+}
57038+
57039+int
57040+gr_check_protected_task(const struct task_struct *task)
57041+{
57042+ return 0;
57043+}
57044+
57045+int
57046+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57047+{
57048+ return 0;
57049+}
57050+
57051+void
57052+gr_copy_label(struct task_struct *tsk)
57053+{
57054+ return;
57055+}
57056+
57057+void
57058+gr_set_pax_flags(struct task_struct *task)
57059+{
57060+ return;
57061+}
57062+
57063+int
57064+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57065+ const int unsafe_share)
57066+{
57067+ return 0;
57068+}
57069+
57070+void
57071+gr_handle_delete(const ino_t ino, const dev_t dev)
57072+{
57073+ return;
57074+}
57075+
57076+void
57077+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57078+{
57079+ return;
57080+}
57081+
57082+void
57083+gr_handle_crash(struct task_struct *task, const int sig)
57084+{
57085+ return;
57086+}
57087+
57088+int
57089+gr_check_crash_exec(const struct file *filp)
57090+{
57091+ return 0;
57092+}
57093+
57094+int
57095+gr_check_crash_uid(const uid_t uid)
57096+{
57097+ return 0;
57098+}
57099+
57100+void
57101+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57102+ struct dentry *old_dentry,
57103+ struct dentry *new_dentry,
57104+ struct vfsmount *mnt, const __u8 replace)
57105+{
57106+ return;
57107+}
57108+
57109+int
57110+gr_search_socket(const int family, const int type, const int protocol)
57111+{
57112+ return 1;
57113+}
57114+
57115+int
57116+gr_search_connectbind(const int mode, const struct socket *sock,
57117+ const struct sockaddr_in *addr)
57118+{
57119+ return 0;
57120+}
57121+
57122+void
57123+gr_handle_alertkill(struct task_struct *task)
57124+{
57125+ return;
57126+}
57127+
57128+__u32
57129+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57130+{
57131+ return 1;
57132+}
57133+
57134+__u32
57135+gr_acl_handle_hidden_file(const struct dentry * dentry,
57136+ const struct vfsmount * mnt)
57137+{
57138+ return 1;
57139+}
57140+
57141+__u32
57142+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57143+ int acc_mode)
57144+{
57145+ return 1;
57146+}
57147+
57148+__u32
57149+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57150+{
57151+ return 1;
57152+}
57153+
57154+__u32
57155+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57156+{
57157+ return 1;
57158+}
57159+
57160+int
57161+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57162+ unsigned int *vm_flags)
57163+{
57164+ return 1;
57165+}
57166+
57167+__u32
57168+gr_acl_handle_truncate(const struct dentry * dentry,
57169+ const struct vfsmount * mnt)
57170+{
57171+ return 1;
57172+}
57173+
57174+__u32
57175+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57176+{
57177+ return 1;
57178+}
57179+
57180+__u32
57181+gr_acl_handle_access(const struct dentry * dentry,
57182+ const struct vfsmount * mnt, const int fmode)
57183+{
57184+ return 1;
57185+}
57186+
57187+__u32
57188+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57189+ mode_t mode)
57190+{
57191+ return 1;
57192+}
57193+
57194+__u32
57195+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57196+ mode_t mode)
57197+{
57198+ return 1;
57199+}
57200+
57201+__u32
57202+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57203+{
57204+ return 1;
57205+}
57206+
57207+__u32
57208+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57209+{
57210+ return 1;
57211+}
57212+
57213+void
57214+grsecurity_init(void)
57215+{
57216+ return;
57217+}
57218+
57219+__u32
57220+gr_acl_handle_mknod(const struct dentry * new_dentry,
57221+ const struct dentry * parent_dentry,
57222+ const struct vfsmount * parent_mnt,
57223+ const int mode)
57224+{
57225+ return 1;
57226+}
57227+
57228+__u32
57229+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57230+ const struct dentry * parent_dentry,
57231+ const struct vfsmount * parent_mnt)
57232+{
57233+ return 1;
57234+}
57235+
57236+__u32
57237+gr_acl_handle_symlink(const struct dentry * new_dentry,
57238+ const struct dentry * parent_dentry,
57239+ const struct vfsmount * parent_mnt, const char *from)
57240+{
57241+ return 1;
57242+}
57243+
57244+__u32
57245+gr_acl_handle_link(const struct dentry * new_dentry,
57246+ const struct dentry * parent_dentry,
57247+ const struct vfsmount * parent_mnt,
57248+ const struct dentry * old_dentry,
57249+ const struct vfsmount * old_mnt, const char *to)
57250+{
57251+ return 1;
57252+}
57253+
57254+int
57255+gr_acl_handle_rename(const struct dentry *new_dentry,
57256+ const struct dentry *parent_dentry,
57257+ const struct vfsmount *parent_mnt,
57258+ const struct dentry *old_dentry,
57259+ const struct inode *old_parent_inode,
57260+ const struct vfsmount *old_mnt, const char *newname)
57261+{
57262+ return 0;
57263+}
57264+
57265+int
57266+gr_acl_handle_filldir(const struct file *file, const char *name,
57267+ const int namelen, const ino_t ino)
57268+{
57269+ return 1;
57270+}
57271+
57272+int
57273+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57274+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57275+{
57276+ return 1;
57277+}
57278+
57279+int
57280+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57281+{
57282+ return 0;
57283+}
57284+
57285+int
57286+gr_search_accept(const struct socket *sock)
57287+{
57288+ return 0;
57289+}
57290+
57291+int
57292+gr_search_listen(const struct socket *sock)
57293+{
57294+ return 0;
57295+}
57296+
57297+int
57298+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57299+{
57300+ return 0;
57301+}
57302+
57303+__u32
57304+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57305+{
57306+ return 1;
57307+}
57308+
57309+__u32
57310+gr_acl_handle_creat(const struct dentry * dentry,
57311+ const struct dentry * p_dentry,
57312+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
57313+ const int imode)
57314+{
57315+ return 1;
57316+}
57317+
57318+void
57319+gr_acl_handle_exit(void)
57320+{
57321+ return;
57322+}
57323+
57324+int
57325+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57326+{
57327+ return 1;
57328+}
57329+
57330+void
57331+gr_set_role_label(const uid_t uid, const gid_t gid)
57332+{
57333+ return;
57334+}
57335+
57336+int
57337+gr_acl_handle_procpidmem(const struct task_struct *task)
57338+{
57339+ return 0;
57340+}
57341+
57342+int
57343+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57344+{
57345+ return 0;
57346+}
57347+
57348+int
57349+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57350+{
57351+ return 0;
57352+}
57353+
57354+void
57355+gr_set_kernel_label(struct task_struct *task)
57356+{
57357+ return;
57358+}
57359+
57360+int
57361+gr_check_user_change(int real, int effective, int fs)
57362+{
57363+ return 0;
57364+}
57365+
57366+int
57367+gr_check_group_change(int real, int effective, int fs)
57368+{
57369+ return 0;
57370+}
57371+
57372+int gr_acl_enable_at_secure(void)
57373+{
57374+ return 0;
57375+}
57376+
57377+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57378+{
57379+ return dentry->d_inode->i_sb->s_dev;
57380+}
57381+
57382+EXPORT_SYMBOL(gr_learn_resource);
57383+EXPORT_SYMBOL(gr_set_kernel_label);
57384+#ifdef CONFIG_SECURITY
57385+EXPORT_SYMBOL(gr_check_user_change);
57386+EXPORT_SYMBOL(gr_check_group_change);
57387+#endif
57388diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
57389new file mode 100644
57390index 0000000..2b05ada
57391--- /dev/null
57392+++ b/grsecurity/grsec_exec.c
57393@@ -0,0 +1,146 @@
57394+#include <linux/kernel.h>
57395+#include <linux/sched.h>
57396+#include <linux/file.h>
57397+#include <linux/binfmts.h>
57398+#include <linux/fs.h>
57399+#include <linux/types.h>
57400+#include <linux/grdefs.h>
57401+#include <linux/grsecurity.h>
57402+#include <linux/grinternal.h>
57403+#include <linux/capability.h>
57404+#include <linux/module.h>
57405+
57406+#include <asm/uaccess.h>
57407+
57408+#ifdef CONFIG_GRKERNSEC_EXECLOG
57409+static char gr_exec_arg_buf[132];
57410+static DEFINE_MUTEX(gr_exec_arg_mutex);
57411+#endif
57412+
57413+extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
57414+
57415+void
57416+gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
57417+{
57418+#ifdef CONFIG_GRKERNSEC_EXECLOG
57419+ char *grarg = gr_exec_arg_buf;
57420+ unsigned int i, x, execlen = 0;
57421+ char c;
57422+
57423+ if (!((grsec_enable_execlog && grsec_enable_group &&
57424+ in_group_p(grsec_audit_gid))
57425+ || (grsec_enable_execlog && !grsec_enable_group)))
57426+ return;
57427+
57428+ mutex_lock(&gr_exec_arg_mutex);
57429+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57430+
57431+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57432+ const char __user *p;
57433+ unsigned int len;
57434+
57435+ p = get_user_arg_ptr(argv, i);
57436+ if (IS_ERR(p))
57437+ goto log;
57438+
57439+ len = strnlen_user(p, 128 - execlen);
57440+ if (len > 128 - execlen)
57441+ len = 128 - execlen;
57442+ else if (len > 0)
57443+ len--;
57444+ if (copy_from_user(grarg + execlen, p, len))
57445+ goto log;
57446+
57447+ /* rewrite unprintable characters */
57448+ for (x = 0; x < len; x++) {
57449+ c = *(grarg + execlen + x);
57450+ if (c < 32 || c > 126)
57451+ *(grarg + execlen + x) = ' ';
57452+ }
57453+
57454+ execlen += len;
57455+ *(grarg + execlen) = ' ';
57456+ *(grarg + execlen + 1) = '\0';
57457+ execlen++;
57458+ }
57459+
57460+ log:
57461+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57462+ bprm->file->f_path.mnt, grarg);
57463+ mutex_unlock(&gr_exec_arg_mutex);
57464+#endif
57465+ return;
57466+}
57467+
57468+#ifdef CONFIG_GRKERNSEC
57469+extern int gr_acl_is_capable(const int cap);
57470+extern int gr_acl_is_capable_nolog(const int cap);
57471+extern int gr_chroot_is_capable(const int cap);
57472+extern int gr_chroot_is_capable_nolog(const int cap);
57473+#endif
57474+
57475+const char *captab_log[] = {
57476+ "CAP_CHOWN",
57477+ "CAP_DAC_OVERRIDE",
57478+ "CAP_DAC_READ_SEARCH",
57479+ "CAP_FOWNER",
57480+ "CAP_FSETID",
57481+ "CAP_KILL",
57482+ "CAP_SETGID",
57483+ "CAP_SETUID",
57484+ "CAP_SETPCAP",
57485+ "CAP_LINUX_IMMUTABLE",
57486+ "CAP_NET_BIND_SERVICE",
57487+ "CAP_NET_BROADCAST",
57488+ "CAP_NET_ADMIN",
57489+ "CAP_NET_RAW",
57490+ "CAP_IPC_LOCK",
57491+ "CAP_IPC_OWNER",
57492+ "CAP_SYS_MODULE",
57493+ "CAP_SYS_RAWIO",
57494+ "CAP_SYS_CHROOT",
57495+ "CAP_SYS_PTRACE",
57496+ "CAP_SYS_PACCT",
57497+ "CAP_SYS_ADMIN",
57498+ "CAP_SYS_BOOT",
57499+ "CAP_SYS_NICE",
57500+ "CAP_SYS_RESOURCE",
57501+ "CAP_SYS_TIME",
57502+ "CAP_SYS_TTY_CONFIG",
57503+ "CAP_MKNOD",
57504+ "CAP_LEASE",
57505+ "CAP_AUDIT_WRITE",
57506+ "CAP_AUDIT_CONTROL",
57507+ "CAP_SETFCAP",
57508+ "CAP_MAC_OVERRIDE",
57509+ "CAP_MAC_ADMIN",
57510+ "CAP_SYSLOG",
57511+ "CAP_WAKE_ALARM"
57512+};
57513+
57514+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
57515+
57516+int gr_is_capable(const int cap)
57517+{
57518+#ifdef CONFIG_GRKERNSEC
57519+ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
57520+ return 1;
57521+ return 0;
57522+#else
57523+ return 1;
57524+#endif
57525+}
57526+
57527+int gr_is_capable_nolog(const int cap)
57528+{
57529+#ifdef CONFIG_GRKERNSEC
57530+ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
57531+ return 1;
57532+ return 0;
57533+#else
57534+ return 1;
57535+#endif
57536+}
57537+
57538+EXPORT_SYMBOL(gr_is_capable);
57539+EXPORT_SYMBOL(gr_is_capable_nolog);
57540diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
57541new file mode 100644
57542index 0000000..d3ee748
57543--- /dev/null
57544+++ b/grsecurity/grsec_fifo.c
57545@@ -0,0 +1,24 @@
57546+#include <linux/kernel.h>
57547+#include <linux/sched.h>
57548+#include <linux/fs.h>
57549+#include <linux/file.h>
57550+#include <linux/grinternal.h>
57551+
57552+int
57553+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
57554+ const struct dentry *dir, const int flag, const int acc_mode)
57555+{
57556+#ifdef CONFIG_GRKERNSEC_FIFO
57557+ const struct cred *cred = current_cred();
57558+
57559+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
57560+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
57561+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
57562+ (cred->fsuid != dentry->d_inode->i_uid)) {
57563+ if (!inode_permission(dentry->d_inode, acc_mode))
57564+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
57565+ return -EACCES;
57566+ }
57567+#endif
57568+ return 0;
57569+}
57570diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
57571new file mode 100644
57572index 0000000..8ca18bf
57573--- /dev/null
57574+++ b/grsecurity/grsec_fork.c
57575@@ -0,0 +1,23 @@
57576+#include <linux/kernel.h>
57577+#include <linux/sched.h>
57578+#include <linux/grsecurity.h>
57579+#include <linux/grinternal.h>
57580+#include <linux/errno.h>
57581+
57582+void
57583+gr_log_forkfail(const int retval)
57584+{
57585+#ifdef CONFIG_GRKERNSEC_FORKFAIL
57586+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
57587+ switch (retval) {
57588+ case -EAGAIN:
57589+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
57590+ break;
57591+ case -ENOMEM:
57592+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
57593+ break;
57594+ }
57595+ }
57596+#endif
57597+ return;
57598+}
57599diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
57600new file mode 100644
57601index 0000000..cb8e5a1
57602--- /dev/null
57603+++ b/grsecurity/grsec_init.c
57604@@ -0,0 +1,273 @@
57605+#include <linux/kernel.h>
57606+#include <linux/sched.h>
57607+#include <linux/mm.h>
57608+#include <linux/gracl.h>
57609+#include <linux/slab.h>
57610+#include <linux/vmalloc.h>
57611+#include <linux/percpu.h>
57612+#include <linux/module.h>
57613+
57614+int grsec_enable_setxid;
57615+int grsec_enable_brute;
57616+int grsec_enable_link;
57617+int grsec_enable_dmesg;
57618+int grsec_enable_harden_ptrace;
57619+int grsec_enable_fifo;
57620+int grsec_enable_execlog;
57621+int grsec_enable_signal;
57622+int grsec_enable_forkfail;
57623+int grsec_enable_audit_ptrace;
57624+int grsec_enable_time;
57625+int grsec_enable_audit_textrel;
57626+int grsec_enable_group;
57627+int grsec_audit_gid;
57628+int grsec_enable_chdir;
57629+int grsec_enable_mount;
57630+int grsec_enable_rofs;
57631+int grsec_enable_chroot_findtask;
57632+int grsec_enable_chroot_mount;
57633+int grsec_enable_chroot_shmat;
57634+int grsec_enable_chroot_fchdir;
57635+int grsec_enable_chroot_double;
57636+int grsec_enable_chroot_pivot;
57637+int grsec_enable_chroot_chdir;
57638+int grsec_enable_chroot_chmod;
57639+int grsec_enable_chroot_mknod;
57640+int grsec_enable_chroot_nice;
57641+int grsec_enable_chroot_execlog;
57642+int grsec_enable_chroot_caps;
57643+int grsec_enable_chroot_sysctl;
57644+int grsec_enable_chroot_unix;
57645+int grsec_enable_tpe;
57646+int grsec_tpe_gid;
57647+int grsec_enable_blackhole;
57648+#ifdef CONFIG_IPV6_MODULE
57649+EXPORT_SYMBOL(grsec_enable_blackhole);
57650+#endif
57651+int grsec_lastack_retries;
57652+int grsec_enable_tpe_all;
57653+int grsec_enable_tpe_invert;
57654+int grsec_enable_socket_all;
57655+int grsec_socket_all_gid;
57656+int grsec_enable_socket_client;
57657+int grsec_socket_client_gid;
57658+int grsec_enable_socket_server;
57659+int grsec_socket_server_gid;
57660+int grsec_resource_logging;
57661+int grsec_disable_privio;
57662+int grsec_enable_log_rwxmaps;
57663+int grsec_lock;
57664+
57665+DEFINE_SPINLOCK(grsec_alert_lock);
57666+unsigned long grsec_alert_wtime = 0;
57667+unsigned long grsec_alert_fyet = 0;
57668+
57669+DEFINE_SPINLOCK(grsec_audit_lock);
57670+
57671+DEFINE_RWLOCK(grsec_exec_file_lock);
57672+
57673+char *gr_shared_page[4];
57674+
57675+char *gr_alert_log_fmt;
57676+char *gr_audit_log_fmt;
57677+char *gr_alert_log_buf;
57678+char *gr_audit_log_buf;
57679+
57680+extern struct gr_arg *gr_usermode;
57681+extern unsigned char *gr_system_salt;
57682+extern unsigned char *gr_system_sum;
57683+
57684+void __init
57685+grsecurity_init(void)
57686+{
57687+ int j;
57688+ /* create the per-cpu shared pages */
57689+
57690+#ifdef CONFIG_X86
57691+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
57692+#endif
57693+
57694+ for (j = 0; j < 4; j++) {
57695+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
57696+ if (gr_shared_page[j] == NULL) {
57697+ panic("Unable to allocate grsecurity shared page");
57698+ return;
57699+ }
57700+ }
57701+
57702+ /* allocate log buffers */
57703+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
57704+ if (!gr_alert_log_fmt) {
57705+ panic("Unable to allocate grsecurity alert log format buffer");
57706+ return;
57707+ }
57708+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
57709+ if (!gr_audit_log_fmt) {
57710+ panic("Unable to allocate grsecurity audit log format buffer");
57711+ return;
57712+ }
57713+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57714+ if (!gr_alert_log_buf) {
57715+ panic("Unable to allocate grsecurity alert log buffer");
57716+ return;
57717+ }
57718+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57719+ if (!gr_audit_log_buf) {
57720+ panic("Unable to allocate grsecurity audit log buffer");
57721+ return;
57722+ }
57723+
57724+ /* allocate memory for authentication structure */
57725+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
57726+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
57727+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
57728+
57729+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
57730+ panic("Unable to allocate grsecurity authentication structure");
57731+ return;
57732+ }
57733+
57734+
57735+#ifdef CONFIG_GRKERNSEC_IO
57736+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
57737+ grsec_disable_privio = 1;
57738+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57739+ grsec_disable_privio = 1;
57740+#else
57741+ grsec_disable_privio = 0;
57742+#endif
57743+#endif
57744+
57745+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
57746+ /* for backward compatibility, tpe_invert always defaults to on if
57747+ enabled in the kernel
57748+ */
57749+ grsec_enable_tpe_invert = 1;
57750+#endif
57751+
57752+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57753+#ifndef CONFIG_GRKERNSEC_SYSCTL
57754+ grsec_lock = 1;
57755+#endif
57756+
57757+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
57758+ grsec_enable_audit_textrel = 1;
57759+#endif
57760+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
57761+ grsec_enable_log_rwxmaps = 1;
57762+#endif
57763+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
57764+ grsec_enable_group = 1;
57765+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
57766+#endif
57767+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57768+ grsec_enable_chdir = 1;
57769+#endif
57770+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
57771+ grsec_enable_harden_ptrace = 1;
57772+#endif
57773+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
57774+ grsec_enable_mount = 1;
57775+#endif
57776+#ifdef CONFIG_GRKERNSEC_LINK
57777+ grsec_enable_link = 1;
57778+#endif
57779+#ifdef CONFIG_GRKERNSEC_BRUTE
57780+ grsec_enable_brute = 1;
57781+#endif
57782+#ifdef CONFIG_GRKERNSEC_DMESG
57783+ grsec_enable_dmesg = 1;
57784+#endif
57785+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
57786+ grsec_enable_blackhole = 1;
57787+ grsec_lastack_retries = 4;
57788+#endif
57789+#ifdef CONFIG_GRKERNSEC_FIFO
57790+ grsec_enable_fifo = 1;
57791+#endif
57792+#ifdef CONFIG_GRKERNSEC_EXECLOG
57793+ grsec_enable_execlog = 1;
57794+#endif
57795+#ifdef CONFIG_GRKERNSEC_SETXID
57796+ grsec_enable_setxid = 1;
57797+#endif
57798+#ifdef CONFIG_GRKERNSEC_SIGNAL
57799+ grsec_enable_signal = 1;
57800+#endif
57801+#ifdef CONFIG_GRKERNSEC_FORKFAIL
57802+ grsec_enable_forkfail = 1;
57803+#endif
57804+#ifdef CONFIG_GRKERNSEC_TIME
57805+ grsec_enable_time = 1;
57806+#endif
57807+#ifdef CONFIG_GRKERNSEC_RESLOG
57808+ grsec_resource_logging = 1;
57809+#endif
57810+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57811+ grsec_enable_chroot_findtask = 1;
57812+#endif
57813+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57814+ grsec_enable_chroot_unix = 1;
57815+#endif
57816+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57817+ grsec_enable_chroot_mount = 1;
57818+#endif
57819+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57820+ grsec_enable_chroot_fchdir = 1;
57821+#endif
57822+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57823+ grsec_enable_chroot_shmat = 1;
57824+#endif
57825+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
57826+ grsec_enable_audit_ptrace = 1;
57827+#endif
57828+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57829+ grsec_enable_chroot_double = 1;
57830+#endif
57831+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57832+ grsec_enable_chroot_pivot = 1;
57833+#endif
57834+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57835+ grsec_enable_chroot_chdir = 1;
57836+#endif
57837+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57838+ grsec_enable_chroot_chmod = 1;
57839+#endif
57840+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57841+ grsec_enable_chroot_mknod = 1;
57842+#endif
57843+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57844+ grsec_enable_chroot_nice = 1;
57845+#endif
57846+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57847+ grsec_enable_chroot_execlog = 1;
57848+#endif
57849+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57850+ grsec_enable_chroot_caps = 1;
57851+#endif
57852+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57853+ grsec_enable_chroot_sysctl = 1;
57854+#endif
57855+#ifdef CONFIG_GRKERNSEC_TPE
57856+ grsec_enable_tpe = 1;
57857+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
57858+#ifdef CONFIG_GRKERNSEC_TPE_ALL
57859+ grsec_enable_tpe_all = 1;
57860+#endif
57861+#endif
57862+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
57863+ grsec_enable_socket_all = 1;
57864+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
57865+#endif
57866+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
57867+ grsec_enable_socket_client = 1;
57868+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
57869+#endif
57870+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57871+ grsec_enable_socket_server = 1;
57872+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
57873+#endif
57874+#endif
57875+
57876+ return;
57877+}
57878diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
57879new file mode 100644
57880index 0000000..3efe141
57881--- /dev/null
57882+++ b/grsecurity/grsec_link.c
57883@@ -0,0 +1,43 @@
57884+#include <linux/kernel.h>
57885+#include <linux/sched.h>
57886+#include <linux/fs.h>
57887+#include <linux/file.h>
57888+#include <linux/grinternal.h>
57889+
57890+int
57891+gr_handle_follow_link(const struct inode *parent,
57892+ const struct inode *inode,
57893+ const struct dentry *dentry, const struct vfsmount *mnt)
57894+{
57895+#ifdef CONFIG_GRKERNSEC_LINK
57896+ const struct cred *cred = current_cred();
57897+
57898+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
57899+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
57900+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
57901+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
57902+ return -EACCES;
57903+ }
57904+#endif
57905+ return 0;
57906+}
57907+
57908+int
57909+gr_handle_hardlink(const struct dentry *dentry,
57910+ const struct vfsmount *mnt,
57911+ struct inode *inode, const int mode, const char *to)
57912+{
57913+#ifdef CONFIG_GRKERNSEC_LINK
57914+ const struct cred *cred = current_cred();
57915+
57916+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
57917+ (!S_ISREG(mode) || (mode & S_ISUID) ||
57918+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
57919+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
57920+ !capable(CAP_FOWNER) && cred->uid) {
57921+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
57922+ return -EPERM;
57923+ }
57924+#endif
57925+ return 0;
57926+}
57927diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
57928new file mode 100644
57929index 0000000..a45d2e9
57930--- /dev/null
57931+++ b/grsecurity/grsec_log.c
57932@@ -0,0 +1,322 @@
57933+#include <linux/kernel.h>
57934+#include <linux/sched.h>
57935+#include <linux/file.h>
57936+#include <linux/tty.h>
57937+#include <linux/fs.h>
57938+#include <linux/grinternal.h>
57939+
57940+#ifdef CONFIG_TREE_PREEMPT_RCU
57941+#define DISABLE_PREEMPT() preempt_disable()
57942+#define ENABLE_PREEMPT() preempt_enable()
57943+#else
57944+#define DISABLE_PREEMPT()
57945+#define ENABLE_PREEMPT()
57946+#endif
57947+
57948+#define BEGIN_LOCKS(x) \
57949+ DISABLE_PREEMPT(); \
57950+ rcu_read_lock(); \
57951+ read_lock(&tasklist_lock); \
57952+ read_lock(&grsec_exec_file_lock); \
57953+ if (x != GR_DO_AUDIT) \
57954+ spin_lock(&grsec_alert_lock); \
57955+ else \
57956+ spin_lock(&grsec_audit_lock)
57957+
57958+#define END_LOCKS(x) \
57959+ if (x != GR_DO_AUDIT) \
57960+ spin_unlock(&grsec_alert_lock); \
57961+ else \
57962+ spin_unlock(&grsec_audit_lock); \
57963+ read_unlock(&grsec_exec_file_lock); \
57964+ read_unlock(&tasklist_lock); \
57965+ rcu_read_unlock(); \
57966+ ENABLE_PREEMPT(); \
57967+ if (x == GR_DONT_AUDIT) \
57968+ gr_handle_alertkill(current)
57969+
57970+enum {
57971+ FLOODING,
57972+ NO_FLOODING
57973+};
57974+
57975+extern char *gr_alert_log_fmt;
57976+extern char *gr_audit_log_fmt;
57977+extern char *gr_alert_log_buf;
57978+extern char *gr_audit_log_buf;
57979+
57980+static int gr_log_start(int audit)
57981+{
57982+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
57983+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
57984+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57985+#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
57986+ unsigned long curr_secs = get_seconds();
57987+
57988+ if (audit == GR_DO_AUDIT)
57989+ goto set_fmt;
57990+
57991+ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
57992+ grsec_alert_wtime = curr_secs;
57993+ grsec_alert_fyet = 0;
57994+ } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
57995+ && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
57996+ grsec_alert_fyet++;
57997+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
57998+ grsec_alert_wtime = curr_secs;
57999+ grsec_alert_fyet++;
58000+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58001+ return FLOODING;
58002+ }
58003+ else return FLOODING;
58004+
58005+set_fmt:
58006+#endif
58007+ memset(buf, 0, PAGE_SIZE);
58008+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
58009+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58010+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58011+ } else if (current->signal->curr_ip) {
58012+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58013+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58014+ } else if (gr_acl_is_enabled()) {
58015+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58016+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58017+ } else {
58018+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
58019+ strcpy(buf, fmt);
58020+ }
58021+
58022+ return NO_FLOODING;
58023+}
58024+
58025+static void gr_log_middle(int audit, const char *msg, va_list ap)
58026+ __attribute__ ((format (printf, 2, 0)));
58027+
58028+static void gr_log_middle(int audit, const char *msg, va_list ap)
58029+{
58030+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58031+ unsigned int len = strlen(buf);
58032+
58033+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58034+
58035+ return;
58036+}
58037+
58038+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58039+ __attribute__ ((format (printf, 2, 3)));
58040+
58041+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58042+{
58043+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58044+ unsigned int len = strlen(buf);
58045+ va_list ap;
58046+
58047+ va_start(ap, msg);
58048+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58049+ va_end(ap);
58050+
58051+ return;
58052+}
58053+
58054+static void gr_log_end(int audit, int append_default)
58055+{
58056+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58057+
58058+ if (append_default) {
58059+ unsigned int len = strlen(buf);
58060+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58061+ }
58062+
58063+ printk("%s\n", buf);
58064+
58065+ return;
58066+}
58067+
58068+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58069+{
58070+ int logtype;
58071+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58072+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58073+ void *voidptr = NULL;
58074+ int num1 = 0, num2 = 0;
58075+ unsigned long ulong1 = 0, ulong2 = 0;
58076+ struct dentry *dentry = NULL;
58077+ struct vfsmount *mnt = NULL;
58078+ struct file *file = NULL;
58079+ struct task_struct *task = NULL;
58080+ const struct cred *cred, *pcred;
58081+ va_list ap;
58082+
58083+ BEGIN_LOCKS(audit);
58084+ logtype = gr_log_start(audit);
58085+ if (logtype == FLOODING) {
58086+ END_LOCKS(audit);
58087+ return;
58088+ }
58089+ va_start(ap, argtypes);
58090+ switch (argtypes) {
58091+ case GR_TTYSNIFF:
58092+ task = va_arg(ap, struct task_struct *);
58093+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58094+ break;
58095+ case GR_SYSCTL_HIDDEN:
58096+ str1 = va_arg(ap, char *);
58097+ gr_log_middle_varargs(audit, msg, result, str1);
58098+ break;
58099+ case GR_RBAC:
58100+ dentry = va_arg(ap, struct dentry *);
58101+ mnt = va_arg(ap, struct vfsmount *);
58102+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58103+ break;
58104+ case GR_RBAC_STR:
58105+ dentry = va_arg(ap, struct dentry *);
58106+ mnt = va_arg(ap, struct vfsmount *);
58107+ str1 = va_arg(ap, char *);
58108+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58109+ break;
58110+ case GR_STR_RBAC:
58111+ str1 = va_arg(ap, char *);
58112+ dentry = va_arg(ap, struct dentry *);
58113+ mnt = va_arg(ap, struct vfsmount *);
58114+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58115+ break;
58116+ case GR_RBAC_MODE2:
58117+ dentry = va_arg(ap, struct dentry *);
58118+ mnt = va_arg(ap, struct vfsmount *);
58119+ str1 = va_arg(ap, char *);
58120+ str2 = va_arg(ap, char *);
58121+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58122+ break;
58123+ case GR_RBAC_MODE3:
58124+ dentry = va_arg(ap, struct dentry *);
58125+ mnt = va_arg(ap, struct vfsmount *);
58126+ str1 = va_arg(ap, char *);
58127+ str2 = va_arg(ap, char *);
58128+ str3 = va_arg(ap, char *);
58129+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58130+ break;
58131+ case GR_FILENAME:
58132+ dentry = va_arg(ap, struct dentry *);
58133+ mnt = va_arg(ap, struct vfsmount *);
58134+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58135+ break;
58136+ case GR_STR_FILENAME:
58137+ str1 = va_arg(ap, char *);
58138+ dentry = va_arg(ap, struct dentry *);
58139+ mnt = va_arg(ap, struct vfsmount *);
58140+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58141+ break;
58142+ case GR_FILENAME_STR:
58143+ dentry = va_arg(ap, struct dentry *);
58144+ mnt = va_arg(ap, struct vfsmount *);
58145+ str1 = va_arg(ap, char *);
58146+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58147+ break;
58148+ case GR_FILENAME_TWO_INT:
58149+ dentry = va_arg(ap, struct dentry *);
58150+ mnt = va_arg(ap, struct vfsmount *);
58151+ num1 = va_arg(ap, int);
58152+ num2 = va_arg(ap, int);
58153+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58154+ break;
58155+ case GR_FILENAME_TWO_INT_STR:
58156+ dentry = va_arg(ap, struct dentry *);
58157+ mnt = va_arg(ap, struct vfsmount *);
58158+ num1 = va_arg(ap, int);
58159+ num2 = va_arg(ap, int);
58160+ str1 = va_arg(ap, char *);
58161+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58162+ break;
58163+ case GR_TEXTREL:
58164+ file = va_arg(ap, struct file *);
58165+ ulong1 = va_arg(ap, unsigned long);
58166+ ulong2 = va_arg(ap, unsigned long);
58167+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58168+ break;
58169+ case GR_PTRACE:
58170+ task = va_arg(ap, struct task_struct *);
58171+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58172+ break;
58173+ case GR_RESOURCE:
58174+ task = va_arg(ap, struct task_struct *);
58175+ cred = __task_cred(task);
58176+ pcred = __task_cred(task->real_parent);
58177+ ulong1 = va_arg(ap, unsigned long);
58178+ str1 = va_arg(ap, char *);
58179+ ulong2 = va_arg(ap, unsigned long);
58180+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58181+ break;
58182+ case GR_CAP:
58183+ task = va_arg(ap, struct task_struct *);
58184+ cred = __task_cred(task);
58185+ pcred = __task_cred(task->real_parent);
58186+ str1 = va_arg(ap, char *);
58187+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58188+ break;
58189+ case GR_SIG:
58190+ str1 = va_arg(ap, char *);
58191+ voidptr = va_arg(ap, void *);
58192+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58193+ break;
58194+ case GR_SIG2:
58195+ task = va_arg(ap, struct task_struct *);
58196+ cred = __task_cred(task);
58197+ pcred = __task_cred(task->real_parent);
58198+ num1 = va_arg(ap, int);
58199+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58200+ break;
58201+ case GR_CRASH1:
58202+ task = va_arg(ap, struct task_struct *);
58203+ cred = __task_cred(task);
58204+ pcred = __task_cred(task->real_parent);
58205+ ulong1 = va_arg(ap, unsigned long);
58206+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58207+ break;
58208+ case GR_CRASH2:
58209+ task = va_arg(ap, struct task_struct *);
58210+ cred = __task_cred(task);
58211+ pcred = __task_cred(task->real_parent);
58212+ ulong1 = va_arg(ap, unsigned long);
58213+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58214+ break;
58215+ case GR_RWXMAP:
58216+ file = va_arg(ap, struct file *);
58217+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58218+ break;
58219+ case GR_PSACCT:
58220+ {
58221+ unsigned int wday, cday;
58222+ __u8 whr, chr;
58223+ __u8 wmin, cmin;
58224+ __u8 wsec, csec;
58225+ char cur_tty[64] = { 0 };
58226+ char parent_tty[64] = { 0 };
58227+
58228+ task = va_arg(ap, struct task_struct *);
58229+ wday = va_arg(ap, unsigned int);
58230+ cday = va_arg(ap, unsigned int);
58231+ whr = va_arg(ap, int);
58232+ chr = va_arg(ap, int);
58233+ wmin = va_arg(ap, int);
58234+ cmin = va_arg(ap, int);
58235+ wsec = va_arg(ap, int);
58236+ csec = va_arg(ap, int);
58237+ ulong1 = va_arg(ap, unsigned long);
58238+ cred = __task_cred(task);
58239+ pcred = __task_cred(task->real_parent);
58240+
58241+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58242+ }
58243+ break;
58244+ default:
58245+ gr_log_middle(audit, msg, ap);
58246+ }
58247+ va_end(ap);
58248+ // these don't need DEFAULTSECARGS printed on the end
58249+ if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
58250+ gr_log_end(audit, 0);
58251+ else
58252+ gr_log_end(audit, 1);
58253+ END_LOCKS(audit);
58254+}
58255diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
58256new file mode 100644
58257index 0000000..6c0416b
58258--- /dev/null
58259+++ b/grsecurity/grsec_mem.c
58260@@ -0,0 +1,33 @@
58261+#include <linux/kernel.h>
58262+#include <linux/sched.h>
58263+#include <linux/mm.h>
58264+#include <linux/mman.h>
58265+#include <linux/grinternal.h>
58266+
58267+void
58268+gr_handle_ioperm(void)
58269+{
58270+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58271+ return;
58272+}
58273+
58274+void
58275+gr_handle_iopl(void)
58276+{
58277+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58278+ return;
58279+}
58280+
58281+void
58282+gr_handle_mem_readwrite(u64 from, u64 to)
58283+{
58284+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58285+ return;
58286+}
58287+
58288+void
58289+gr_handle_vm86(void)
58290+{
58291+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58292+ return;
58293+}
58294diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
58295new file mode 100644
58296index 0000000..2131422
58297--- /dev/null
58298+++ b/grsecurity/grsec_mount.c
58299@@ -0,0 +1,62 @@
58300+#include <linux/kernel.h>
58301+#include <linux/sched.h>
58302+#include <linux/mount.h>
58303+#include <linux/grsecurity.h>
58304+#include <linux/grinternal.h>
58305+
58306+void
58307+gr_log_remount(const char *devname, const int retval)
58308+{
58309+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58310+ if (grsec_enable_mount && (retval >= 0))
58311+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58312+#endif
58313+ return;
58314+}
58315+
58316+void
58317+gr_log_unmount(const char *devname, const int retval)
58318+{
58319+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58320+ if (grsec_enable_mount && (retval >= 0))
58321+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58322+#endif
58323+ return;
58324+}
58325+
58326+void
58327+gr_log_mount(const char *from, const char *to, const int retval)
58328+{
58329+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58330+ if (grsec_enable_mount && (retval >= 0))
58331+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
58332+#endif
58333+ return;
58334+}
58335+
58336+int
58337+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58338+{
58339+#ifdef CONFIG_GRKERNSEC_ROFS
58340+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58341+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58342+ return -EPERM;
58343+ } else
58344+ return 0;
58345+#endif
58346+ return 0;
58347+}
58348+
58349+int
58350+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58351+{
58352+#ifdef CONFIG_GRKERNSEC_ROFS
58353+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58354+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58355+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58356+ return -EPERM;
58357+ } else
58358+ return 0;
58359+#endif
58360+ return 0;
58361+}
58362diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
58363new file mode 100644
58364index 0000000..a3b12a0
58365--- /dev/null
58366+++ b/grsecurity/grsec_pax.c
58367@@ -0,0 +1,36 @@
58368+#include <linux/kernel.h>
58369+#include <linux/sched.h>
58370+#include <linux/mm.h>
58371+#include <linux/file.h>
58372+#include <linux/grinternal.h>
58373+#include <linux/grsecurity.h>
58374+
58375+void
58376+gr_log_textrel(struct vm_area_struct * vma)
58377+{
58378+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58379+ if (grsec_enable_audit_textrel)
58380+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58381+#endif
58382+ return;
58383+}
58384+
58385+void
58386+gr_log_rwxmmap(struct file *file)
58387+{
58388+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58389+ if (grsec_enable_log_rwxmaps)
58390+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58391+#endif
58392+ return;
58393+}
58394+
58395+void
58396+gr_log_rwxmprotect(struct file *file)
58397+{
58398+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58399+ if (grsec_enable_log_rwxmaps)
58400+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58401+#endif
58402+ return;
58403+}
58404diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
58405new file mode 100644
58406index 0000000..472c1d6
58407--- /dev/null
58408+++ b/grsecurity/grsec_ptrace.c
58409@@ -0,0 +1,14 @@
58410+#include <linux/kernel.h>
58411+#include <linux/sched.h>
58412+#include <linux/grinternal.h>
58413+#include <linux/grsecurity.h>
58414+
58415+void
58416+gr_audit_ptrace(struct task_struct *task)
58417+{
58418+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58419+ if (grsec_enable_audit_ptrace)
58420+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58421+#endif
58422+ return;
58423+}
58424diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
58425new file mode 100644
58426index 0000000..cf090b3
58427--- /dev/null
58428+++ b/grsecurity/grsec_sig.c
58429@@ -0,0 +1,206 @@
58430+#include <linux/kernel.h>
58431+#include <linux/sched.h>
58432+#include <linux/delay.h>
58433+#include <linux/grsecurity.h>
58434+#include <linux/grinternal.h>
58435+#include <linux/hardirq.h>
58436+
58437+char *signames[] = {
58438+ [SIGSEGV] = "Segmentation fault",
58439+ [SIGILL] = "Illegal instruction",
58440+ [SIGABRT] = "Abort",
58441+ [SIGBUS] = "Invalid alignment/Bus error"
58442+};
58443+
58444+void
58445+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58446+{
58447+#ifdef CONFIG_GRKERNSEC_SIGNAL
58448+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58449+ (sig == SIGABRT) || (sig == SIGBUS))) {
58450+ if (t->pid == current->pid) {
58451+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58452+ } else {
58453+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58454+ }
58455+ }
58456+#endif
58457+ return;
58458+}
58459+
58460+int
58461+gr_handle_signal(const struct task_struct *p, const int sig)
58462+{
58463+#ifdef CONFIG_GRKERNSEC
58464+ if (current->pid > 1 && gr_check_protected_task(p)) {
58465+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58466+ return -EPERM;
58467+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58468+ return -EPERM;
58469+ }
58470+#endif
58471+ return 0;
58472+}
58473+
58474+#ifdef CONFIG_GRKERNSEC
58475+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58476+
58477+int gr_fake_force_sig(int sig, struct task_struct *t)
58478+{
58479+ unsigned long int flags;
58480+ int ret, blocked, ignored;
58481+ struct k_sigaction *action;
58482+
58483+ spin_lock_irqsave(&t->sighand->siglock, flags);
58484+ action = &t->sighand->action[sig-1];
58485+ ignored = action->sa.sa_handler == SIG_IGN;
58486+ blocked = sigismember(&t->blocked, sig);
58487+ if (blocked || ignored) {
58488+ action->sa.sa_handler = SIG_DFL;
58489+ if (blocked) {
58490+ sigdelset(&t->blocked, sig);
58491+ recalc_sigpending_and_wake(t);
58492+ }
58493+ }
58494+ if (action->sa.sa_handler == SIG_DFL)
58495+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
58496+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58497+
58498+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
58499+
58500+ return ret;
58501+}
58502+#endif
58503+
58504+#ifdef CONFIG_GRKERNSEC_BRUTE
58505+#define GR_USER_BAN_TIME (15 * 60)
58506+
58507+static int __get_dumpable(unsigned long mm_flags)
58508+{
58509+ int ret;
58510+
58511+ ret = mm_flags & MMF_DUMPABLE_MASK;
58512+ return (ret >= 2) ? 2 : ret;
58513+}
58514+#endif
58515+
58516+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58517+{
58518+#ifdef CONFIG_GRKERNSEC_BRUTE
58519+ uid_t uid = 0;
58520+
58521+ if (!grsec_enable_brute)
58522+ return;
58523+
58524+ rcu_read_lock();
58525+ read_lock(&tasklist_lock);
58526+ read_lock(&grsec_exec_file_lock);
58527+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58528+ p->real_parent->brute = 1;
58529+ else {
58530+ const struct cred *cred = __task_cred(p), *cred2;
58531+ struct task_struct *tsk, *tsk2;
58532+
58533+ if (!__get_dumpable(mm_flags) && cred->uid) {
58534+ struct user_struct *user;
58535+
58536+ uid = cred->uid;
58537+
58538+ /* this is put upon execution past expiration */
58539+ user = find_user(uid);
58540+ if (user == NULL)
58541+ goto unlock;
58542+ user->banned = 1;
58543+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
58544+ if (user->ban_expires == ~0UL)
58545+ user->ban_expires--;
58546+
58547+ do_each_thread(tsk2, tsk) {
58548+ cred2 = __task_cred(tsk);
58549+ if (tsk != p && cred2->uid == uid)
58550+ gr_fake_force_sig(SIGKILL, tsk);
58551+ } while_each_thread(tsk2, tsk);
58552+ }
58553+ }
58554+unlock:
58555+ read_unlock(&grsec_exec_file_lock);
58556+ read_unlock(&tasklist_lock);
58557+ rcu_read_unlock();
58558+
58559+ if (uid)
58560+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
58561+
58562+#endif
58563+ return;
58564+}
58565+
58566+void gr_handle_brute_check(void)
58567+{
58568+#ifdef CONFIG_GRKERNSEC_BRUTE
58569+ if (current->brute)
58570+ msleep(30 * 1000);
58571+#endif
58572+ return;
58573+}
58574+
58575+void gr_handle_kernel_exploit(void)
58576+{
58577+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
58578+ const struct cred *cred;
58579+ struct task_struct *tsk, *tsk2;
58580+ struct user_struct *user;
58581+ uid_t uid;
58582+
58583+ if (in_irq() || in_serving_softirq() || in_nmi())
58584+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
58585+
58586+ uid = current_uid();
58587+
58588+ if (uid == 0)
58589+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
58590+ else {
58591+ /* kill all the processes of this user, hold a reference
58592+ to their creds struct, and prevent them from creating
58593+ another process until system reset
58594+ */
58595+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
58596+ /* we intentionally leak this ref */
58597+ user = get_uid(current->cred->user);
58598+ if (user) {
58599+ user->banned = 1;
58600+ user->ban_expires = ~0UL;
58601+ }
58602+
58603+ read_lock(&tasklist_lock);
58604+ do_each_thread(tsk2, tsk) {
58605+ cred = __task_cred(tsk);
58606+ if (cred->uid == uid)
58607+ gr_fake_force_sig(SIGKILL, tsk);
58608+ } while_each_thread(tsk2, tsk);
58609+ read_unlock(&tasklist_lock);
58610+ }
58611+#endif
58612+}
58613+
58614+int __gr_process_user_ban(struct user_struct *user)
58615+{
58616+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58617+ if (unlikely(user->banned)) {
58618+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
58619+ user->banned = 0;
58620+ user->ban_expires = 0;
58621+ free_uid(user);
58622+ } else
58623+ return -EPERM;
58624+ }
58625+#endif
58626+ return 0;
58627+}
58628+
58629+int gr_process_user_ban(void)
58630+{
58631+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58632+ return __gr_process_user_ban(current->cred->user);
58633+#endif
58634+ return 0;
58635+}
58636diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
58637new file mode 100644
58638index 0000000..4030d57
58639--- /dev/null
58640+++ b/grsecurity/grsec_sock.c
58641@@ -0,0 +1,244 @@
58642+#include <linux/kernel.h>
58643+#include <linux/module.h>
58644+#include <linux/sched.h>
58645+#include <linux/file.h>
58646+#include <linux/net.h>
58647+#include <linux/in.h>
58648+#include <linux/ip.h>
58649+#include <net/sock.h>
58650+#include <net/inet_sock.h>
58651+#include <linux/grsecurity.h>
58652+#include <linux/grinternal.h>
58653+#include <linux/gracl.h>
58654+
58655+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
58656+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
58657+
58658+EXPORT_SYMBOL(gr_search_udp_recvmsg);
58659+EXPORT_SYMBOL(gr_search_udp_sendmsg);
58660+
58661+#ifdef CONFIG_UNIX_MODULE
58662+EXPORT_SYMBOL(gr_acl_handle_unix);
58663+EXPORT_SYMBOL(gr_acl_handle_mknod);
58664+EXPORT_SYMBOL(gr_handle_chroot_unix);
58665+EXPORT_SYMBOL(gr_handle_create);
58666+#endif
58667+
58668+#ifdef CONFIG_GRKERNSEC
58669+#define gr_conn_table_size 32749
58670+struct conn_table_entry {
58671+ struct conn_table_entry *next;
58672+ struct signal_struct *sig;
58673+};
58674+
58675+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
58676+DEFINE_SPINLOCK(gr_conn_table_lock);
58677+
58678+extern const char * gr_socktype_to_name(unsigned char type);
58679+extern const char * gr_proto_to_name(unsigned char proto);
58680+extern const char * gr_sockfamily_to_name(unsigned char family);
58681+
58682+static __inline__ int
58683+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
58684+{
58685+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
58686+}
58687+
58688+static __inline__ int
58689+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
58690+ __u16 sport, __u16 dport)
58691+{
58692+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
58693+ sig->gr_sport == sport && sig->gr_dport == dport))
58694+ return 1;
58695+ else
58696+ return 0;
58697+}
58698+
58699+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
58700+{
58701+ struct conn_table_entry **match;
58702+ unsigned int index;
58703+
58704+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58705+ sig->gr_sport, sig->gr_dport,
58706+ gr_conn_table_size);
58707+
58708+ newent->sig = sig;
58709+
58710+ match = &gr_conn_table[index];
58711+ newent->next = *match;
58712+ *match = newent;
58713+
58714+ return;
58715+}
58716+
58717+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
58718+{
58719+ struct conn_table_entry *match, *last = NULL;
58720+ unsigned int index;
58721+
58722+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58723+ sig->gr_sport, sig->gr_dport,
58724+ gr_conn_table_size);
58725+
58726+ match = gr_conn_table[index];
58727+ while (match && !conn_match(match->sig,
58728+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
58729+ sig->gr_dport)) {
58730+ last = match;
58731+ match = match->next;
58732+ }
58733+
58734+ if (match) {
58735+ if (last)
58736+ last->next = match->next;
58737+ else
58738+ gr_conn_table[index] = NULL;
58739+ kfree(match);
58740+ }
58741+
58742+ return;
58743+}
58744+
58745+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
58746+ __u16 sport, __u16 dport)
58747+{
58748+ struct conn_table_entry *match;
58749+ unsigned int index;
58750+
58751+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
58752+
58753+ match = gr_conn_table[index];
58754+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
58755+ match = match->next;
58756+
58757+ if (match)
58758+ return match->sig;
58759+ else
58760+ return NULL;
58761+}
58762+
58763+#endif
58764+
58765+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
58766+{
58767+#ifdef CONFIG_GRKERNSEC
58768+ struct signal_struct *sig = task->signal;
58769+ struct conn_table_entry *newent;
58770+
58771+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
58772+ if (newent == NULL)
58773+ return;
58774+ /* no bh lock needed since we are called with bh disabled */
58775+ spin_lock(&gr_conn_table_lock);
58776+ gr_del_task_from_ip_table_nolock(sig);
58777+ sig->gr_saddr = inet->inet_rcv_saddr;
58778+ sig->gr_daddr = inet->inet_daddr;
58779+ sig->gr_sport = inet->inet_sport;
58780+ sig->gr_dport = inet->inet_dport;
58781+ gr_add_to_task_ip_table_nolock(sig, newent);
58782+ spin_unlock(&gr_conn_table_lock);
58783+#endif
58784+ return;
58785+}
58786+
58787+void gr_del_task_from_ip_table(struct task_struct *task)
58788+{
58789+#ifdef CONFIG_GRKERNSEC
58790+ spin_lock_bh(&gr_conn_table_lock);
58791+ gr_del_task_from_ip_table_nolock(task->signal);
58792+ spin_unlock_bh(&gr_conn_table_lock);
58793+#endif
58794+ return;
58795+}
58796+
58797+void
58798+gr_attach_curr_ip(const struct sock *sk)
58799+{
58800+#ifdef CONFIG_GRKERNSEC
58801+ struct signal_struct *p, *set;
58802+ const struct inet_sock *inet = inet_sk(sk);
58803+
58804+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
58805+ return;
58806+
58807+ set = current->signal;
58808+
58809+ spin_lock_bh(&gr_conn_table_lock);
58810+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
58811+ inet->inet_dport, inet->inet_sport);
58812+ if (unlikely(p != NULL)) {
58813+ set->curr_ip = p->curr_ip;
58814+ set->used_accept = 1;
58815+ gr_del_task_from_ip_table_nolock(p);
58816+ spin_unlock_bh(&gr_conn_table_lock);
58817+ return;
58818+ }
58819+ spin_unlock_bh(&gr_conn_table_lock);
58820+
58821+ set->curr_ip = inet->inet_daddr;
58822+ set->used_accept = 1;
58823+#endif
58824+ return;
58825+}
58826+
58827+int
58828+gr_handle_sock_all(const int family, const int type, const int protocol)
58829+{
58830+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58831+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
58832+ (family != AF_UNIX)) {
58833+ if (family == AF_INET)
58834+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
58835+ else
58836+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
58837+ return -EACCES;
58838+ }
58839+#endif
58840+ return 0;
58841+}
58842+
58843+int
58844+gr_handle_sock_server(const struct sockaddr *sck)
58845+{
58846+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58847+ if (grsec_enable_socket_server &&
58848+ in_group_p(grsec_socket_server_gid) &&
58849+ sck && (sck->sa_family != AF_UNIX) &&
58850+ (sck->sa_family != AF_LOCAL)) {
58851+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58852+ return -EACCES;
58853+ }
58854+#endif
58855+ return 0;
58856+}
58857+
58858+int
58859+gr_handle_sock_server_other(const struct sock *sck)
58860+{
58861+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58862+ if (grsec_enable_socket_server &&
58863+ in_group_p(grsec_socket_server_gid) &&
58864+ sck && (sck->sk_family != AF_UNIX) &&
58865+ (sck->sk_family != AF_LOCAL)) {
58866+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58867+ return -EACCES;
58868+ }
58869+#endif
58870+ return 0;
58871+}
58872+
58873+int
58874+gr_handle_sock_client(const struct sockaddr *sck)
58875+{
58876+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58877+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
58878+ sck && (sck->sa_family != AF_UNIX) &&
58879+ (sck->sa_family != AF_LOCAL)) {
58880+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
58881+ return -EACCES;
58882+ }
58883+#endif
58884+ return 0;
58885+}
58886diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
58887new file mode 100644
58888index 0000000..bceef2f
58889--- /dev/null
58890+++ b/grsecurity/grsec_sysctl.c
58891@@ -0,0 +1,442 @@
58892+#include <linux/kernel.h>
58893+#include <linux/sched.h>
58894+#include <linux/sysctl.h>
58895+#include <linux/grsecurity.h>
58896+#include <linux/grinternal.h>
58897+
58898+int
58899+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
58900+{
58901+#ifdef CONFIG_GRKERNSEC_SYSCTL
58902+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
58903+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
58904+ return -EACCES;
58905+ }
58906+#endif
58907+ return 0;
58908+}
58909+
58910+#ifdef CONFIG_GRKERNSEC_ROFS
58911+static int __maybe_unused one = 1;
58912+#endif
58913+
58914+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
58915+struct ctl_table grsecurity_table[] = {
58916+#ifdef CONFIG_GRKERNSEC_SYSCTL
58917+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
58918+#ifdef CONFIG_GRKERNSEC_IO
58919+ {
58920+ .procname = "disable_priv_io",
58921+ .data = &grsec_disable_privio,
58922+ .maxlen = sizeof(int),
58923+ .mode = 0600,
58924+ .proc_handler = &proc_dointvec,
58925+ },
58926+#endif
58927+#endif
58928+#ifdef CONFIG_GRKERNSEC_LINK
58929+ {
58930+ .procname = "linking_restrictions",
58931+ .data = &grsec_enable_link,
58932+ .maxlen = sizeof(int),
58933+ .mode = 0600,
58934+ .proc_handler = &proc_dointvec,
58935+ },
58936+#endif
58937+#ifdef CONFIG_GRKERNSEC_BRUTE
58938+ {
58939+ .procname = "deter_bruteforce",
58940+ .data = &grsec_enable_brute,
58941+ .maxlen = sizeof(int),
58942+ .mode = 0600,
58943+ .proc_handler = &proc_dointvec,
58944+ },
58945+#endif
58946+#ifdef CONFIG_GRKERNSEC_FIFO
58947+ {
58948+ .procname = "fifo_restrictions",
58949+ .data = &grsec_enable_fifo,
58950+ .maxlen = sizeof(int),
58951+ .mode = 0600,
58952+ .proc_handler = &proc_dointvec,
58953+ },
58954+#endif
58955+#ifdef CONFIG_GRKERNSEC_SETXID
58956+ {
58957+ .procname = "consistent_setxid",
58958+ .data = &grsec_enable_setxid,
58959+ .maxlen = sizeof(int),
58960+ .mode = 0600,
58961+ .proc_handler = &proc_dointvec,
58962+ },
58963+#endif
58964+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58965+ {
58966+ .procname = "ip_blackhole",
58967+ .data = &grsec_enable_blackhole,
58968+ .maxlen = sizeof(int),
58969+ .mode = 0600,
58970+ .proc_handler = &proc_dointvec,
58971+ },
58972+ {
58973+ .procname = "lastack_retries",
58974+ .data = &grsec_lastack_retries,
58975+ .maxlen = sizeof(int),
58976+ .mode = 0600,
58977+ .proc_handler = &proc_dointvec,
58978+ },
58979+#endif
58980+#ifdef CONFIG_GRKERNSEC_EXECLOG
58981+ {
58982+ .procname = "exec_logging",
58983+ .data = &grsec_enable_execlog,
58984+ .maxlen = sizeof(int),
58985+ .mode = 0600,
58986+ .proc_handler = &proc_dointvec,
58987+ },
58988+#endif
58989+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58990+ {
58991+ .procname = "rwxmap_logging",
58992+ .data = &grsec_enable_log_rwxmaps,
58993+ .maxlen = sizeof(int),
58994+ .mode = 0600,
58995+ .proc_handler = &proc_dointvec,
58996+ },
58997+#endif
58998+#ifdef CONFIG_GRKERNSEC_SIGNAL
58999+ {
59000+ .procname = "signal_logging",
59001+ .data = &grsec_enable_signal,
59002+ .maxlen = sizeof(int),
59003+ .mode = 0600,
59004+ .proc_handler = &proc_dointvec,
59005+ },
59006+#endif
59007+#ifdef CONFIG_GRKERNSEC_FORKFAIL
59008+ {
59009+ .procname = "forkfail_logging",
59010+ .data = &grsec_enable_forkfail,
59011+ .maxlen = sizeof(int),
59012+ .mode = 0600,
59013+ .proc_handler = &proc_dointvec,
59014+ },
59015+#endif
59016+#ifdef CONFIG_GRKERNSEC_TIME
59017+ {
59018+ .procname = "timechange_logging",
59019+ .data = &grsec_enable_time,
59020+ .maxlen = sizeof(int),
59021+ .mode = 0600,
59022+ .proc_handler = &proc_dointvec,
59023+ },
59024+#endif
59025+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59026+ {
59027+ .procname = "chroot_deny_shmat",
59028+ .data = &grsec_enable_chroot_shmat,
59029+ .maxlen = sizeof(int),
59030+ .mode = 0600,
59031+ .proc_handler = &proc_dointvec,
59032+ },
59033+#endif
59034+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59035+ {
59036+ .procname = "chroot_deny_unix",
59037+ .data = &grsec_enable_chroot_unix,
59038+ .maxlen = sizeof(int),
59039+ .mode = 0600,
59040+ .proc_handler = &proc_dointvec,
59041+ },
59042+#endif
59043+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59044+ {
59045+ .procname = "chroot_deny_mount",
59046+ .data = &grsec_enable_chroot_mount,
59047+ .maxlen = sizeof(int),
59048+ .mode = 0600,
59049+ .proc_handler = &proc_dointvec,
59050+ },
59051+#endif
59052+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59053+ {
59054+ .procname = "chroot_deny_fchdir",
59055+ .data = &grsec_enable_chroot_fchdir,
59056+ .maxlen = sizeof(int),
59057+ .mode = 0600,
59058+ .proc_handler = &proc_dointvec,
59059+ },
59060+#endif
59061+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59062+ {
59063+ .procname = "chroot_deny_chroot",
59064+ .data = &grsec_enable_chroot_double,
59065+ .maxlen = sizeof(int),
59066+ .mode = 0600,
59067+ .proc_handler = &proc_dointvec,
59068+ },
59069+#endif
59070+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59071+ {
59072+ .procname = "chroot_deny_pivot",
59073+ .data = &grsec_enable_chroot_pivot,
59074+ .maxlen = sizeof(int),
59075+ .mode = 0600,
59076+ .proc_handler = &proc_dointvec,
59077+ },
59078+#endif
59079+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59080+ {
59081+ .procname = "chroot_enforce_chdir",
59082+ .data = &grsec_enable_chroot_chdir,
59083+ .maxlen = sizeof(int),
59084+ .mode = 0600,
59085+ .proc_handler = &proc_dointvec,
59086+ },
59087+#endif
59088+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59089+ {
59090+ .procname = "chroot_deny_chmod",
59091+ .data = &grsec_enable_chroot_chmod,
59092+ .maxlen = sizeof(int),
59093+ .mode = 0600,
59094+ .proc_handler = &proc_dointvec,
59095+ },
59096+#endif
59097+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59098+ {
59099+ .procname = "chroot_deny_mknod",
59100+ .data = &grsec_enable_chroot_mknod,
59101+ .maxlen = sizeof(int),
59102+ .mode = 0600,
59103+ .proc_handler = &proc_dointvec,
59104+ },
59105+#endif
59106+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59107+ {
59108+ .procname = "chroot_restrict_nice",
59109+ .data = &grsec_enable_chroot_nice,
59110+ .maxlen = sizeof(int),
59111+ .mode = 0600,
59112+ .proc_handler = &proc_dointvec,
59113+ },
59114+#endif
59115+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59116+ {
59117+ .procname = "chroot_execlog",
59118+ .data = &grsec_enable_chroot_execlog,
59119+ .maxlen = sizeof(int),
59120+ .mode = 0600,
59121+ .proc_handler = &proc_dointvec,
59122+ },
59123+#endif
59124+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59125+ {
59126+ .procname = "chroot_caps",
59127+ .data = &grsec_enable_chroot_caps,
59128+ .maxlen = sizeof(int),
59129+ .mode = 0600,
59130+ .proc_handler = &proc_dointvec,
59131+ },
59132+#endif
59133+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59134+ {
59135+ .procname = "chroot_deny_sysctl",
59136+ .data = &grsec_enable_chroot_sysctl,
59137+ .maxlen = sizeof(int),
59138+ .mode = 0600,
59139+ .proc_handler = &proc_dointvec,
59140+ },
59141+#endif
59142+#ifdef CONFIG_GRKERNSEC_TPE
59143+ {
59144+ .procname = "tpe",
59145+ .data = &grsec_enable_tpe,
59146+ .maxlen = sizeof(int),
59147+ .mode = 0600,
59148+ .proc_handler = &proc_dointvec,
59149+ },
59150+ {
59151+ .procname = "tpe_gid",
59152+ .data = &grsec_tpe_gid,
59153+ .maxlen = sizeof(int),
59154+ .mode = 0600,
59155+ .proc_handler = &proc_dointvec,
59156+ },
59157+#endif
59158+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59159+ {
59160+ .procname = "tpe_invert",
59161+ .data = &grsec_enable_tpe_invert,
59162+ .maxlen = sizeof(int),
59163+ .mode = 0600,
59164+ .proc_handler = &proc_dointvec,
59165+ },
59166+#endif
59167+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59168+ {
59169+ .procname = "tpe_restrict_all",
59170+ .data = &grsec_enable_tpe_all,
59171+ .maxlen = sizeof(int),
59172+ .mode = 0600,
59173+ .proc_handler = &proc_dointvec,
59174+ },
59175+#endif
59176+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59177+ {
59178+ .procname = "socket_all",
59179+ .data = &grsec_enable_socket_all,
59180+ .maxlen = sizeof(int),
59181+ .mode = 0600,
59182+ .proc_handler = &proc_dointvec,
59183+ },
59184+ {
59185+ .procname = "socket_all_gid",
59186+ .data = &grsec_socket_all_gid,
59187+ .maxlen = sizeof(int),
59188+ .mode = 0600,
59189+ .proc_handler = &proc_dointvec,
59190+ },
59191+#endif
59192+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59193+ {
59194+ .procname = "socket_client",
59195+ .data = &grsec_enable_socket_client,
59196+ .maxlen = sizeof(int),
59197+ .mode = 0600,
59198+ .proc_handler = &proc_dointvec,
59199+ },
59200+ {
59201+ .procname = "socket_client_gid",
59202+ .data = &grsec_socket_client_gid,
59203+ .maxlen = sizeof(int),
59204+ .mode = 0600,
59205+ .proc_handler = &proc_dointvec,
59206+ },
59207+#endif
59208+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59209+ {
59210+ .procname = "socket_server",
59211+ .data = &grsec_enable_socket_server,
59212+ .maxlen = sizeof(int),
59213+ .mode = 0600,
59214+ .proc_handler = &proc_dointvec,
59215+ },
59216+ {
59217+ .procname = "socket_server_gid",
59218+ .data = &grsec_socket_server_gid,
59219+ .maxlen = sizeof(int),
59220+ .mode = 0600,
59221+ .proc_handler = &proc_dointvec,
59222+ },
59223+#endif
59224+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59225+ {
59226+ .procname = "audit_group",
59227+ .data = &grsec_enable_group,
59228+ .maxlen = sizeof(int),
59229+ .mode = 0600,
59230+ .proc_handler = &proc_dointvec,
59231+ },
59232+ {
59233+ .procname = "audit_gid",
59234+ .data = &grsec_audit_gid,
59235+ .maxlen = sizeof(int),
59236+ .mode = 0600,
59237+ .proc_handler = &proc_dointvec,
59238+ },
59239+#endif
59240+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59241+ {
59242+ .procname = "audit_chdir",
59243+ .data = &grsec_enable_chdir,
59244+ .maxlen = sizeof(int),
59245+ .mode = 0600,
59246+ .proc_handler = &proc_dointvec,
59247+ },
59248+#endif
59249+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59250+ {
59251+ .procname = "audit_mount",
59252+ .data = &grsec_enable_mount,
59253+ .maxlen = sizeof(int),
59254+ .mode = 0600,
59255+ .proc_handler = &proc_dointvec,
59256+ },
59257+#endif
59258+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59259+ {
59260+ .procname = "audit_textrel",
59261+ .data = &grsec_enable_audit_textrel,
59262+ .maxlen = sizeof(int),
59263+ .mode = 0600,
59264+ .proc_handler = &proc_dointvec,
59265+ },
59266+#endif
59267+#ifdef CONFIG_GRKERNSEC_DMESG
59268+ {
59269+ .procname = "dmesg",
59270+ .data = &grsec_enable_dmesg,
59271+ .maxlen = sizeof(int),
59272+ .mode = 0600,
59273+ .proc_handler = &proc_dointvec,
59274+ },
59275+#endif
59276+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59277+ {
59278+ .procname = "chroot_findtask",
59279+ .data = &grsec_enable_chroot_findtask,
59280+ .maxlen = sizeof(int),
59281+ .mode = 0600,
59282+ .proc_handler = &proc_dointvec,
59283+ },
59284+#endif
59285+#ifdef CONFIG_GRKERNSEC_RESLOG
59286+ {
59287+ .procname = "resource_logging",
59288+ .data = &grsec_resource_logging,
59289+ .maxlen = sizeof(int),
59290+ .mode = 0600,
59291+ .proc_handler = &proc_dointvec,
59292+ },
59293+#endif
59294+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59295+ {
59296+ .procname = "audit_ptrace",
59297+ .data = &grsec_enable_audit_ptrace,
59298+ .maxlen = sizeof(int),
59299+ .mode = 0600,
59300+ .proc_handler = &proc_dointvec,
59301+ },
59302+#endif
59303+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59304+ {
59305+ .procname = "harden_ptrace",
59306+ .data = &grsec_enable_harden_ptrace,
59307+ .maxlen = sizeof(int),
59308+ .mode = 0600,
59309+ .proc_handler = &proc_dointvec,
59310+ },
59311+#endif
59312+ {
59313+ .procname = "grsec_lock",
59314+ .data = &grsec_lock,
59315+ .maxlen = sizeof(int),
59316+ .mode = 0600,
59317+ .proc_handler = &proc_dointvec,
59318+ },
59319+#endif
59320+#ifdef CONFIG_GRKERNSEC_ROFS
59321+ {
59322+ .procname = "romount_protect",
59323+ .data = &grsec_enable_rofs,
59324+ .maxlen = sizeof(int),
59325+ .mode = 0600,
59326+ .proc_handler = &proc_dointvec_minmax,
59327+ .extra1 = &one,
59328+ .extra2 = &one,
59329+ },
59330+#endif
59331+ { }
59332+};
59333+#endif
59334diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
59335new file mode 100644
59336index 0000000..0dc13c3
59337--- /dev/null
59338+++ b/grsecurity/grsec_time.c
59339@@ -0,0 +1,16 @@
59340+#include <linux/kernel.h>
59341+#include <linux/sched.h>
59342+#include <linux/grinternal.h>
59343+#include <linux/module.h>
59344+
59345+void
59346+gr_log_timechange(void)
59347+{
59348+#ifdef CONFIG_GRKERNSEC_TIME
59349+ if (grsec_enable_time)
59350+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59351+#endif
59352+ return;
59353+}
59354+
59355+EXPORT_SYMBOL(gr_log_timechange);
59356diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
59357new file mode 100644
59358index 0000000..4a78774
59359--- /dev/null
59360+++ b/grsecurity/grsec_tpe.c
59361@@ -0,0 +1,39 @@
59362+#include <linux/kernel.h>
59363+#include <linux/sched.h>
59364+#include <linux/file.h>
59365+#include <linux/fs.h>
59366+#include <linux/grinternal.h>
59367+
59368+extern int gr_acl_tpe_check(void);
59369+
59370+int
59371+gr_tpe_allow(const struct file *file)
59372+{
59373+#ifdef CONFIG_GRKERNSEC
59374+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59375+ const struct cred *cred = current_cred();
59376+
59377+ if (cred->uid && ((grsec_enable_tpe &&
59378+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59379+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59380+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59381+#else
59382+ in_group_p(grsec_tpe_gid)
59383+#endif
59384+ ) || gr_acl_tpe_check()) &&
59385+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59386+ (inode->i_mode & S_IWOTH))))) {
59387+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59388+ return 0;
59389+ }
59390+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59391+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59392+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59393+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59394+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59395+ return 0;
59396+ }
59397+#endif
59398+#endif
59399+ return 1;
59400+}
59401diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
59402new file mode 100644
59403index 0000000..9f7b1ac
59404--- /dev/null
59405+++ b/grsecurity/grsum.c
59406@@ -0,0 +1,61 @@
59407+#include <linux/err.h>
59408+#include <linux/kernel.h>
59409+#include <linux/sched.h>
59410+#include <linux/mm.h>
59411+#include <linux/scatterlist.h>
59412+#include <linux/crypto.h>
59413+#include <linux/gracl.h>
59414+
59415+
59416+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59417+#error "crypto and sha256 must be built into the kernel"
59418+#endif
59419+
59420+int
59421+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59422+{
59423+ char *p;
59424+ struct crypto_hash *tfm;
59425+ struct hash_desc desc;
59426+ struct scatterlist sg;
59427+ unsigned char temp_sum[GR_SHA_LEN];
59428+ volatile int retval = 0;
59429+ volatile int dummy = 0;
59430+ unsigned int i;
59431+
59432+ sg_init_table(&sg, 1);
59433+
59434+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59435+ if (IS_ERR(tfm)) {
59436+ /* should never happen, since sha256 should be built in */
59437+ return 1;
59438+ }
59439+
59440+ desc.tfm = tfm;
59441+ desc.flags = 0;
59442+
59443+ crypto_hash_init(&desc);
59444+
59445+ p = salt;
59446+ sg_set_buf(&sg, p, GR_SALT_LEN);
59447+ crypto_hash_update(&desc, &sg, sg.length);
59448+
59449+ p = entry->pw;
59450+ sg_set_buf(&sg, p, strlen(p));
59451+
59452+ crypto_hash_update(&desc, &sg, sg.length);
59453+
59454+ crypto_hash_final(&desc, temp_sum);
59455+
59456+ memset(entry->pw, 0, GR_PW_LEN);
59457+
59458+ for (i = 0; i < GR_SHA_LEN; i++)
59459+ if (sum[i] != temp_sum[i])
59460+ retval = 1;
59461+ else
59462+ dummy = 1; // waste a cycle
59463+
59464+ crypto_free_hash(tfm);
59465+
59466+ return retval;
59467+}
59468diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
59469index 6cd5b64..f620d2d 100644
59470--- a/include/acpi/acpi_bus.h
59471+++ b/include/acpi/acpi_bus.h
59472@@ -107,7 +107,7 @@ struct acpi_device_ops {
59473 acpi_op_bind bind;
59474 acpi_op_unbind unbind;
59475 acpi_op_notify notify;
59476-};
59477+} __no_const;
59478
59479 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
59480
59481diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
59482index b7babf0..71e4e74 100644
59483--- a/include/asm-generic/atomic-long.h
59484+++ b/include/asm-generic/atomic-long.h
59485@@ -22,6 +22,12 @@
59486
59487 typedef atomic64_t atomic_long_t;
59488
59489+#ifdef CONFIG_PAX_REFCOUNT
59490+typedef atomic64_unchecked_t atomic_long_unchecked_t;
59491+#else
59492+typedef atomic64_t atomic_long_unchecked_t;
59493+#endif
59494+
59495 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
59496
59497 static inline long atomic_long_read(atomic_long_t *l)
59498@@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
59499 return (long)atomic64_read(v);
59500 }
59501
59502+#ifdef CONFIG_PAX_REFCOUNT
59503+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59504+{
59505+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59506+
59507+ return (long)atomic64_read_unchecked(v);
59508+}
59509+#endif
59510+
59511 static inline void atomic_long_set(atomic_long_t *l, long i)
59512 {
59513 atomic64_t *v = (atomic64_t *)l;
59514@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
59515 atomic64_set(v, i);
59516 }
59517
59518+#ifdef CONFIG_PAX_REFCOUNT
59519+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59520+{
59521+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59522+
59523+ atomic64_set_unchecked(v, i);
59524+}
59525+#endif
59526+
59527 static inline void atomic_long_inc(atomic_long_t *l)
59528 {
59529 atomic64_t *v = (atomic64_t *)l;
59530@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
59531 atomic64_inc(v);
59532 }
59533
59534+#ifdef CONFIG_PAX_REFCOUNT
59535+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59536+{
59537+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59538+
59539+ atomic64_inc_unchecked(v);
59540+}
59541+#endif
59542+
59543 static inline void atomic_long_dec(atomic_long_t *l)
59544 {
59545 atomic64_t *v = (atomic64_t *)l;
59546@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
59547 atomic64_dec(v);
59548 }
59549
59550+#ifdef CONFIG_PAX_REFCOUNT
59551+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59552+{
59553+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59554+
59555+ atomic64_dec_unchecked(v);
59556+}
59557+#endif
59558+
59559 static inline void atomic_long_add(long i, atomic_long_t *l)
59560 {
59561 atomic64_t *v = (atomic64_t *)l;
59562@@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
59563 atomic64_add(i, v);
59564 }
59565
59566+#ifdef CONFIG_PAX_REFCOUNT
59567+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59568+{
59569+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59570+
59571+ atomic64_add_unchecked(i, v);
59572+}
59573+#endif
59574+
59575 static inline void atomic_long_sub(long i, atomic_long_t *l)
59576 {
59577 atomic64_t *v = (atomic64_t *)l;
59578@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
59579 atomic64_sub(i, v);
59580 }
59581
59582+#ifdef CONFIG_PAX_REFCOUNT
59583+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
59584+{
59585+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59586+
59587+ atomic64_sub_unchecked(i, v);
59588+}
59589+#endif
59590+
59591 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
59592 {
59593 atomic64_t *v = (atomic64_t *)l;
59594@@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
59595 return (long)atomic64_inc_return(v);
59596 }
59597
59598+#ifdef CONFIG_PAX_REFCOUNT
59599+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59600+{
59601+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59602+
59603+ return (long)atomic64_inc_return_unchecked(v);
59604+}
59605+#endif
59606+
59607 static inline long atomic_long_dec_return(atomic_long_t *l)
59608 {
59609 atomic64_t *v = (atomic64_t *)l;
59610@@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
59611
59612 typedef atomic_t atomic_long_t;
59613
59614+#ifdef CONFIG_PAX_REFCOUNT
59615+typedef atomic_unchecked_t atomic_long_unchecked_t;
59616+#else
59617+typedef atomic_t atomic_long_unchecked_t;
59618+#endif
59619+
59620 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
59621 static inline long atomic_long_read(atomic_long_t *l)
59622 {
59623@@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
59624 return (long)atomic_read(v);
59625 }
59626
59627+#ifdef CONFIG_PAX_REFCOUNT
59628+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59629+{
59630+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59631+
59632+ return (long)atomic_read_unchecked(v);
59633+}
59634+#endif
59635+
59636 static inline void atomic_long_set(atomic_long_t *l, long i)
59637 {
59638 atomic_t *v = (atomic_t *)l;
59639@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
59640 atomic_set(v, i);
59641 }
59642
59643+#ifdef CONFIG_PAX_REFCOUNT
59644+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59645+{
59646+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59647+
59648+ atomic_set_unchecked(v, i);
59649+}
59650+#endif
59651+
59652 static inline void atomic_long_inc(atomic_long_t *l)
59653 {
59654 atomic_t *v = (atomic_t *)l;
59655@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
59656 atomic_inc(v);
59657 }
59658
59659+#ifdef CONFIG_PAX_REFCOUNT
59660+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59661+{
59662+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59663+
59664+ atomic_inc_unchecked(v);
59665+}
59666+#endif
59667+
59668 static inline void atomic_long_dec(atomic_long_t *l)
59669 {
59670 atomic_t *v = (atomic_t *)l;
59671@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
59672 atomic_dec(v);
59673 }
59674
59675+#ifdef CONFIG_PAX_REFCOUNT
59676+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59677+{
59678+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59679+
59680+ atomic_dec_unchecked(v);
59681+}
59682+#endif
59683+
59684 static inline void atomic_long_add(long i, atomic_long_t *l)
59685 {
59686 atomic_t *v = (atomic_t *)l;
59687@@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
59688 atomic_add(i, v);
59689 }
59690
59691+#ifdef CONFIG_PAX_REFCOUNT
59692+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59693+{
59694+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59695+
59696+ atomic_add_unchecked(i, v);
59697+}
59698+#endif
59699+
59700 static inline void atomic_long_sub(long i, atomic_long_t *l)
59701 {
59702 atomic_t *v = (atomic_t *)l;
59703@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
59704 atomic_sub(i, v);
59705 }
59706
59707+#ifdef CONFIG_PAX_REFCOUNT
59708+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
59709+{
59710+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59711+
59712+ atomic_sub_unchecked(i, v);
59713+}
59714+#endif
59715+
59716 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
59717 {
59718 atomic_t *v = (atomic_t *)l;
59719@@ -232,6 +361,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
59720 return (long)atomic_inc_return(v);
59721 }
59722
59723+#ifdef CONFIG_PAX_REFCOUNT
59724+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59725+{
59726+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59727+
59728+ return (long)atomic_inc_return_unchecked(v);
59729+}
59730+#endif
59731+
59732 static inline long atomic_long_dec_return(atomic_long_t *l)
59733 {
59734 atomic_t *v = (atomic_t *)l;
59735@@ -255,4 +393,49 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
59736
59737 #endif /* BITS_PER_LONG == 64 */
59738
59739+#ifdef CONFIG_PAX_REFCOUNT
59740+static inline void pax_refcount_needs_these_functions(void)
59741+{
59742+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
59743+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
59744+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
59745+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
59746+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
59747+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
59748+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
59749+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
59750+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
59751+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
59752+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
59753+
59754+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
59755+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
59756+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
59757+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
59758+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
59759+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
59760+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
59761+}
59762+#else
59763+#define atomic_read_unchecked(v) atomic_read(v)
59764+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
59765+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
59766+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
59767+#define atomic_inc_unchecked(v) atomic_inc(v)
59768+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
59769+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
59770+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
59771+#define atomic_dec_unchecked(v) atomic_dec(v)
59772+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
59773+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
59774+
59775+#define atomic_long_read_unchecked(v) atomic_long_read(v)
59776+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
59777+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
59778+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
59779+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
59780+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
59781+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
59782+#endif
59783+
59784 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
59785diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
59786index b18ce4f..2ee2843 100644
59787--- a/include/asm-generic/atomic64.h
59788+++ b/include/asm-generic/atomic64.h
59789@@ -16,6 +16,8 @@ typedef struct {
59790 long long counter;
59791 } atomic64_t;
59792
59793+typedef atomic64_t atomic64_unchecked_t;
59794+
59795 #define ATOMIC64_INIT(i) { (i) }
59796
59797 extern long long atomic64_read(const atomic64_t *v);
59798@@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
59799 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
59800 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
59801
59802+#define atomic64_read_unchecked(v) atomic64_read(v)
59803+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
59804+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
59805+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
59806+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
59807+#define atomic64_inc_unchecked(v) atomic64_inc(v)
59808+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
59809+#define atomic64_dec_unchecked(v) atomic64_dec(v)
59810+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
59811+
59812 #endif /* _ASM_GENERIC_ATOMIC64_H */
59813diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
59814index 1bfcfe5..e04c5c9 100644
59815--- a/include/asm-generic/cache.h
59816+++ b/include/asm-generic/cache.h
59817@@ -6,7 +6,7 @@
59818 * cache lines need to provide their own cache.h.
59819 */
59820
59821-#define L1_CACHE_SHIFT 5
59822-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
59823+#define L1_CACHE_SHIFT 5UL
59824+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
59825
59826 #endif /* __ASM_GENERIC_CACHE_H */
59827diff --git a/include/asm-generic/int-l64.h b/include/asm-generic/int-l64.h
59828index 1ca3efc..e3dc852 100644
59829--- a/include/asm-generic/int-l64.h
59830+++ b/include/asm-generic/int-l64.h
59831@@ -46,6 +46,8 @@ typedef unsigned int u32;
59832 typedef signed long s64;
59833 typedef unsigned long u64;
59834
59835+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
59836+
59837 #define S8_C(x) x
59838 #define U8_C(x) x ## U
59839 #define S16_C(x) x
59840diff --git a/include/asm-generic/int-ll64.h b/include/asm-generic/int-ll64.h
59841index f394147..b6152b9 100644
59842--- a/include/asm-generic/int-ll64.h
59843+++ b/include/asm-generic/int-ll64.h
59844@@ -51,6 +51,8 @@ typedef unsigned int u32;
59845 typedef signed long long s64;
59846 typedef unsigned long long u64;
59847
59848+typedef unsigned long long intoverflow_t;
59849+
59850 #define S8_C(x) x
59851 #define U8_C(x) x ## U
59852 #define S16_C(x) x
59853diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
59854index 0232ccb..13d9165 100644
59855--- a/include/asm-generic/kmap_types.h
59856+++ b/include/asm-generic/kmap_types.h
59857@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
59858 KMAP_D(17) KM_NMI,
59859 KMAP_D(18) KM_NMI_PTE,
59860 KMAP_D(19) KM_KDB,
59861+KMAP_D(20) KM_CLEARPAGE,
59862 /*
59863 * Remember to update debug_kmap_atomic() when adding new kmap types!
59864 */
59865-KMAP_D(20) KM_TYPE_NR
59866+KMAP_D(21) KM_TYPE_NR
59867 };
59868
59869 #undef KMAP_D
59870diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
59871index 725612b..9cc513a 100644
59872--- a/include/asm-generic/pgtable-nopmd.h
59873+++ b/include/asm-generic/pgtable-nopmd.h
59874@@ -1,14 +1,19 @@
59875 #ifndef _PGTABLE_NOPMD_H
59876 #define _PGTABLE_NOPMD_H
59877
59878-#ifndef __ASSEMBLY__
59879-
59880 #include <asm-generic/pgtable-nopud.h>
59881
59882-struct mm_struct;
59883-
59884 #define __PAGETABLE_PMD_FOLDED
59885
59886+#define PMD_SHIFT PUD_SHIFT
59887+#define PTRS_PER_PMD 1
59888+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
59889+#define PMD_MASK (~(PMD_SIZE-1))
59890+
59891+#ifndef __ASSEMBLY__
59892+
59893+struct mm_struct;
59894+
59895 /*
59896 * Having the pmd type consist of a pud gets the size right, and allows
59897 * us to conceptually access the pud entry that this pmd is folded into
59898@@ -16,11 +21,6 @@ struct mm_struct;
59899 */
59900 typedef struct { pud_t pud; } pmd_t;
59901
59902-#define PMD_SHIFT PUD_SHIFT
59903-#define PTRS_PER_PMD 1
59904-#define PMD_SIZE (1UL << PMD_SHIFT)
59905-#define PMD_MASK (~(PMD_SIZE-1))
59906-
59907 /*
59908 * The "pud_xxx()" functions here are trivial for a folded two-level
59909 * setup: the pmd is never bad, and a pmd always exists (as it's folded
59910diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
59911index 810431d..ccc3638 100644
59912--- a/include/asm-generic/pgtable-nopud.h
59913+++ b/include/asm-generic/pgtable-nopud.h
59914@@ -1,10 +1,15 @@
59915 #ifndef _PGTABLE_NOPUD_H
59916 #define _PGTABLE_NOPUD_H
59917
59918-#ifndef __ASSEMBLY__
59919-
59920 #define __PAGETABLE_PUD_FOLDED
59921
59922+#define PUD_SHIFT PGDIR_SHIFT
59923+#define PTRS_PER_PUD 1
59924+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
59925+#define PUD_MASK (~(PUD_SIZE-1))
59926+
59927+#ifndef __ASSEMBLY__
59928+
59929 /*
59930 * Having the pud type consist of a pgd gets the size right, and allows
59931 * us to conceptually access the pgd entry that this pud is folded into
59932@@ -12,11 +17,6 @@
59933 */
59934 typedef struct { pgd_t pgd; } pud_t;
59935
59936-#define PUD_SHIFT PGDIR_SHIFT
59937-#define PTRS_PER_PUD 1
59938-#define PUD_SIZE (1UL << PUD_SHIFT)
59939-#define PUD_MASK (~(PUD_SIZE-1))
59940-
59941 /*
59942 * The "pgd_xxx()" functions here are trivial for a folded two-level
59943 * setup: the pud is never bad, and a pud always exists (as it's folded
59944diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
59945index 76bff2b..c7a14e2 100644
59946--- a/include/asm-generic/pgtable.h
59947+++ b/include/asm-generic/pgtable.h
59948@@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd)
59949 #endif /* __HAVE_ARCH_PMD_WRITE */
59950 #endif
59951
59952+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
59953+static inline unsigned long pax_open_kernel(void) { return 0; }
59954+#endif
59955+
59956+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
59957+static inline unsigned long pax_close_kernel(void) { return 0; }
59958+#endif
59959+
59960 #endif /* !__ASSEMBLY__ */
59961
59962 #endif /* _ASM_GENERIC_PGTABLE_H */
59963diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
59964index db22d13..1f2e3e1 100644
59965--- a/include/asm-generic/vmlinux.lds.h
59966+++ b/include/asm-generic/vmlinux.lds.h
59967@@ -217,6 +217,7 @@
59968 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
59969 VMLINUX_SYMBOL(__start_rodata) = .; \
59970 *(.rodata) *(.rodata.*) \
59971+ *(.data..read_only) \
59972 *(__vermagic) /* Kernel version magic */ \
59973 . = ALIGN(8); \
59974 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
59975@@ -723,17 +724,18 @@
59976 * section in the linker script will go there too. @phdr should have
59977 * a leading colon.
59978 *
59979- * Note that this macros defines __per_cpu_load as an absolute symbol.
59980+ * Note that this macros defines per_cpu_load as an absolute symbol.
59981 * If there is no need to put the percpu section at a predetermined
59982 * address, use PERCPU_SECTION.
59983 */
59984 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
59985- VMLINUX_SYMBOL(__per_cpu_load) = .; \
59986- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
59987+ per_cpu_load = .; \
59988+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
59989 - LOAD_OFFSET) { \
59990+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
59991 PERCPU_INPUT(cacheline) \
59992 } phdr \
59993- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
59994+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
59995
59996 /**
59997 * PERCPU_SECTION - define output section for percpu area, simple version
59998diff --git a/include/drm/drmP.h b/include/drm/drmP.h
59999index 9b7c2bb..76b7d1e 100644
60000--- a/include/drm/drmP.h
60001+++ b/include/drm/drmP.h
60002@@ -73,6 +73,7 @@
60003 #include <linux/workqueue.h>
60004 #include <linux/poll.h>
60005 #include <asm/pgalloc.h>
60006+#include <asm/local.h>
60007 #include "drm.h"
60008
60009 #include <linux/idr.h>
60010@@ -1035,7 +1036,7 @@ struct drm_device {
60011
60012 /** \name Usage Counters */
60013 /*@{ */
60014- int open_count; /**< Outstanding files open */
60015+ local_t open_count; /**< Outstanding files open */
60016 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
60017 atomic_t vma_count; /**< Outstanding vma areas open */
60018 int buf_use; /**< Buffers in use -- cannot alloc */
60019@@ -1046,7 +1047,7 @@ struct drm_device {
60020 /*@{ */
60021 unsigned long counters;
60022 enum drm_stat_type types[15];
60023- atomic_t counts[15];
60024+ atomic_unchecked_t counts[15];
60025 /*@} */
60026
60027 struct list_head filelist;
60028diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
60029index 73b0712..0b7ef2f 100644
60030--- a/include/drm/drm_crtc_helper.h
60031+++ b/include/drm/drm_crtc_helper.h
60032@@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
60033
60034 /* disable crtc when not in use - more explicit than dpms off */
60035 void (*disable)(struct drm_crtc *crtc);
60036-};
60037+} __no_const;
60038
60039 struct drm_encoder_helper_funcs {
60040 void (*dpms)(struct drm_encoder *encoder, int mode);
60041@@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
60042 struct drm_connector *connector);
60043 /* disable encoder when not in use - more explicit than dpms off */
60044 void (*disable)(struct drm_encoder *encoder);
60045-};
60046+} __no_const;
60047
60048 struct drm_connector_helper_funcs {
60049 int (*get_modes)(struct drm_connector *connector);
60050diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
60051index 26c1f78..6722682 100644
60052--- a/include/drm/ttm/ttm_memory.h
60053+++ b/include/drm/ttm/ttm_memory.h
60054@@ -47,7 +47,7 @@
60055
60056 struct ttm_mem_shrink {
60057 int (*do_shrink) (struct ttm_mem_shrink *);
60058-};
60059+} __no_const;
60060
60061 /**
60062 * struct ttm_mem_global - Global memory accounting structure.
60063diff --git a/include/linux/a.out.h b/include/linux/a.out.h
60064index e86dfca..40cc55f 100644
60065--- a/include/linux/a.out.h
60066+++ b/include/linux/a.out.h
60067@@ -39,6 +39,14 @@ enum machine_type {
60068 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
60069 };
60070
60071+/* Constants for the N_FLAGS field */
60072+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60073+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
60074+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
60075+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
60076+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60077+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60078+
60079 #if !defined (N_MAGIC)
60080 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
60081 #endif
60082diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
60083index 49a83ca..df96b54 100644
60084--- a/include/linux/atmdev.h
60085+++ b/include/linux/atmdev.h
60086@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
60087 #endif
60088
60089 struct k_atm_aal_stats {
60090-#define __HANDLE_ITEM(i) atomic_t i
60091+#define __HANDLE_ITEM(i) atomic_unchecked_t i
60092 __AAL_STAT_ITEMS
60093 #undef __HANDLE_ITEM
60094 };
60095diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
60096index fd88a39..f4d0bad 100644
60097--- a/include/linux/binfmts.h
60098+++ b/include/linux/binfmts.h
60099@@ -88,6 +88,7 @@ struct linux_binfmt {
60100 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
60101 int (*load_shlib)(struct file *);
60102 int (*core_dump)(struct coredump_params *cprm);
60103+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
60104 unsigned long min_coredump; /* minimal dump size */
60105 };
60106
60107diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
60108index 7fbaa91..5e6a460 100644
60109--- a/include/linux/blkdev.h
60110+++ b/include/linux/blkdev.h
60111@@ -1321,7 +1321,7 @@ struct block_device_operations {
60112 /* this callback is with swap_lock and sometimes page table lock held */
60113 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
60114 struct module *owner;
60115-};
60116+} __do_const;
60117
60118 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
60119 unsigned long);
60120diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
60121index 8e9e4bc..88bd457 100644
60122--- a/include/linux/blktrace_api.h
60123+++ b/include/linux/blktrace_api.h
60124@@ -162,7 +162,7 @@ struct blk_trace {
60125 struct dentry *dir;
60126 struct dentry *dropped_file;
60127 struct dentry *msg_file;
60128- atomic_t dropped;
60129+ atomic_unchecked_t dropped;
60130 };
60131
60132 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
60133diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
60134index 83195fb..0b0f77d 100644
60135--- a/include/linux/byteorder/little_endian.h
60136+++ b/include/linux/byteorder/little_endian.h
60137@@ -42,51 +42,51 @@
60138
60139 static inline __le64 __cpu_to_le64p(const __u64 *p)
60140 {
60141- return (__force __le64)*p;
60142+ return (__force const __le64)*p;
60143 }
60144 static inline __u64 __le64_to_cpup(const __le64 *p)
60145 {
60146- return (__force __u64)*p;
60147+ return (__force const __u64)*p;
60148 }
60149 static inline __le32 __cpu_to_le32p(const __u32 *p)
60150 {
60151- return (__force __le32)*p;
60152+ return (__force const __le32)*p;
60153 }
60154 static inline __u32 __le32_to_cpup(const __le32 *p)
60155 {
60156- return (__force __u32)*p;
60157+ return (__force const __u32)*p;
60158 }
60159 static inline __le16 __cpu_to_le16p(const __u16 *p)
60160 {
60161- return (__force __le16)*p;
60162+ return (__force const __le16)*p;
60163 }
60164 static inline __u16 __le16_to_cpup(const __le16 *p)
60165 {
60166- return (__force __u16)*p;
60167+ return (__force const __u16)*p;
60168 }
60169 static inline __be64 __cpu_to_be64p(const __u64 *p)
60170 {
60171- return (__force __be64)__swab64p(p);
60172+ return (__force const __be64)__swab64p(p);
60173 }
60174 static inline __u64 __be64_to_cpup(const __be64 *p)
60175 {
60176- return __swab64p((__u64 *)p);
60177+ return __swab64p((const __u64 *)p);
60178 }
60179 static inline __be32 __cpu_to_be32p(const __u32 *p)
60180 {
60181- return (__force __be32)__swab32p(p);
60182+ return (__force const __be32)__swab32p(p);
60183 }
60184 static inline __u32 __be32_to_cpup(const __be32 *p)
60185 {
60186- return __swab32p((__u32 *)p);
60187+ return __swab32p((const __u32 *)p);
60188 }
60189 static inline __be16 __cpu_to_be16p(const __u16 *p)
60190 {
60191- return (__force __be16)__swab16p(p);
60192+ return (__force const __be16)__swab16p(p);
60193 }
60194 static inline __u16 __be16_to_cpup(const __be16 *p)
60195 {
60196- return __swab16p((__u16 *)p);
60197+ return __swab16p((const __u16 *)p);
60198 }
60199 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
60200 #define __le64_to_cpus(x) do { (void)(x); } while (0)
60201diff --git a/include/linux/cache.h b/include/linux/cache.h
60202index 4c57065..4307975 100644
60203--- a/include/linux/cache.h
60204+++ b/include/linux/cache.h
60205@@ -16,6 +16,10 @@
60206 #define __read_mostly
60207 #endif
60208
60209+#ifndef __read_only
60210+#define __read_only __read_mostly
60211+#endif
60212+
60213 #ifndef ____cacheline_aligned
60214 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
60215 #endif
60216diff --git a/include/linux/capability.h b/include/linux/capability.h
60217index c421123..e343179 100644
60218--- a/include/linux/capability.h
60219+++ b/include/linux/capability.h
60220@@ -547,6 +547,9 @@ extern bool capable(int cap);
60221 extern bool ns_capable(struct user_namespace *ns, int cap);
60222 extern bool task_ns_capable(struct task_struct *t, int cap);
60223 extern bool nsown_capable(int cap);
60224+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
60225+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
60226+extern bool capable_nolog(int cap);
60227
60228 /* audit system wants to get cap info from files as well */
60229 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
60230diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
60231index 04ffb2e..6799180 100644
60232--- a/include/linux/cleancache.h
60233+++ b/include/linux/cleancache.h
60234@@ -31,7 +31,7 @@ struct cleancache_ops {
60235 void (*flush_page)(int, struct cleancache_filekey, pgoff_t);
60236 void (*flush_inode)(int, struct cleancache_filekey);
60237 void (*flush_fs)(int);
60238-};
60239+} __no_const;
60240
60241 extern struct cleancache_ops
60242 cleancache_register_ops(struct cleancache_ops *ops);
60243diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
60244index dfadc96..c0e70c1 100644
60245--- a/include/linux/compiler-gcc4.h
60246+++ b/include/linux/compiler-gcc4.h
60247@@ -31,6 +31,12 @@
60248
60249
60250 #if __GNUC_MINOR__ >= 5
60251+
60252+#ifdef CONSTIFY_PLUGIN
60253+#define __no_const __attribute__((no_const))
60254+#define __do_const __attribute__((do_const))
60255+#endif
60256+
60257 /*
60258 * Mark a position in code as unreachable. This can be used to
60259 * suppress control flow warnings after asm blocks that transfer
60260@@ -46,6 +52,11 @@
60261 #define __noclone __attribute__((__noclone__))
60262
60263 #endif
60264+
60265+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
60266+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
60267+#define __bos0(ptr) __bos((ptr), 0)
60268+#define __bos1(ptr) __bos((ptr), 1)
60269 #endif
60270
60271 #if __GNUC_MINOR__ > 0
60272diff --git a/include/linux/compiler.h b/include/linux/compiler.h
60273index 320d6c9..8573a1c 100644
60274--- a/include/linux/compiler.h
60275+++ b/include/linux/compiler.h
60276@@ -5,31 +5,62 @@
60277
60278 #ifdef __CHECKER__
60279 # define __user __attribute__((noderef, address_space(1)))
60280+# define __force_user __force __user
60281 # define __kernel __attribute__((address_space(0)))
60282+# define __force_kernel __force __kernel
60283 # define __safe __attribute__((safe))
60284 # define __force __attribute__((force))
60285 # define __nocast __attribute__((nocast))
60286 # define __iomem __attribute__((noderef, address_space(2)))
60287+# define __force_iomem __force __iomem
60288 # define __acquires(x) __attribute__((context(x,0,1)))
60289 # define __releases(x) __attribute__((context(x,1,0)))
60290 # define __acquire(x) __context__(x,1)
60291 # define __release(x) __context__(x,-1)
60292 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
60293 # define __percpu __attribute__((noderef, address_space(3)))
60294+# define __force_percpu __force __percpu
60295 #ifdef CONFIG_SPARSE_RCU_POINTER
60296 # define __rcu __attribute__((noderef, address_space(4)))
60297+# define __force_rcu __force __rcu
60298 #else
60299 # define __rcu
60300+# define __force_rcu
60301 #endif
60302 extern void __chk_user_ptr(const volatile void __user *);
60303 extern void __chk_io_ptr(const volatile void __iomem *);
60304+#elif defined(CHECKER_PLUGIN)
60305+//# define __user
60306+//# define __force_user
60307+//# define __kernel
60308+//# define __force_kernel
60309+# define __safe
60310+# define __force
60311+# define __nocast
60312+# define __iomem
60313+# define __force_iomem
60314+# define __chk_user_ptr(x) (void)0
60315+# define __chk_io_ptr(x) (void)0
60316+# define __builtin_warning(x, y...) (1)
60317+# define __acquires(x)
60318+# define __releases(x)
60319+# define __acquire(x) (void)0
60320+# define __release(x) (void)0
60321+# define __cond_lock(x,c) (c)
60322+# define __percpu
60323+# define __force_percpu
60324+# define __rcu
60325+# define __force_rcu
60326 #else
60327 # define __user
60328+# define __force_user
60329 # define __kernel
60330+# define __force_kernel
60331 # define __safe
60332 # define __force
60333 # define __nocast
60334 # define __iomem
60335+# define __force_iomem
60336 # define __chk_user_ptr(x) (void)0
60337 # define __chk_io_ptr(x) (void)0
60338 # define __builtin_warning(x, y...) (1)
60339@@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile void __iomem *);
60340 # define __release(x) (void)0
60341 # define __cond_lock(x,c) (c)
60342 # define __percpu
60343+# define __force_percpu
60344 # define __rcu
60345+# define __force_rcu
60346 #endif
60347
60348 #ifdef __KERNEL__
60349@@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60350 # define __attribute_const__ /* unimplemented */
60351 #endif
60352
60353+#ifndef __no_const
60354+# define __no_const
60355+#endif
60356+
60357+#ifndef __do_const
60358+# define __do_const
60359+#endif
60360+
60361 /*
60362 * Tell gcc if a function is cold. The compiler will assume any path
60363 * directly leading to the call is unlikely.
60364@@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60365 #define __cold
60366 #endif
60367
60368+#ifndef __alloc_size
60369+#define __alloc_size(...)
60370+#endif
60371+
60372+#ifndef __bos
60373+#define __bos(ptr, arg)
60374+#endif
60375+
60376+#ifndef __bos0
60377+#define __bos0(ptr)
60378+#endif
60379+
60380+#ifndef __bos1
60381+#define __bos1(ptr)
60382+#endif
60383+
60384 /* Simple shorthand for a section definition */
60385 #ifndef __section
60386 # define __section(S) __attribute__ ((__section__(#S)))
60387@@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60388 * use is to mediate communication between process-level code and irq/NMI
60389 * handlers, all running on the same CPU.
60390 */
60391-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
60392+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
60393+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
60394
60395 #endif /* __LINUX_COMPILER_H */
60396diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
60397index e9eaec5..bfeb9bb 100644
60398--- a/include/linux/cpuset.h
60399+++ b/include/linux/cpuset.h
60400@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void)
60401 * nodemask.
60402 */
60403 smp_mb();
60404- --ACCESS_ONCE(current->mems_allowed_change_disable);
60405+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
60406 }
60407
60408 static inline void set_mems_allowed(nodemask_t nodemask)
60409diff --git a/include/linux/crypto.h b/include/linux/crypto.h
60410index e5e468e..f079672 100644
60411--- a/include/linux/crypto.h
60412+++ b/include/linux/crypto.h
60413@@ -361,7 +361,7 @@ struct cipher_tfm {
60414 const u8 *key, unsigned int keylen);
60415 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60416 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60417-};
60418+} __no_const;
60419
60420 struct hash_tfm {
60421 int (*init)(struct hash_desc *desc);
60422@@ -382,13 +382,13 @@ struct compress_tfm {
60423 int (*cot_decompress)(struct crypto_tfm *tfm,
60424 const u8 *src, unsigned int slen,
60425 u8 *dst, unsigned int *dlen);
60426-};
60427+} __no_const;
60428
60429 struct rng_tfm {
60430 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
60431 unsigned int dlen);
60432 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
60433-};
60434+} __no_const;
60435
60436 #define crt_ablkcipher crt_u.ablkcipher
60437 #define crt_aead crt_u.aead
60438diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
60439index 7925bf0..d5143d2 100644
60440--- a/include/linux/decompress/mm.h
60441+++ b/include/linux/decompress/mm.h
60442@@ -77,7 +77,7 @@ static void free(void *where)
60443 * warnings when not needed (indeed large_malloc / large_free are not
60444 * needed by inflate */
60445
60446-#define malloc(a) kmalloc(a, GFP_KERNEL)
60447+#define malloc(a) kmalloc((a), GFP_KERNEL)
60448 #define free(a) kfree(a)
60449
60450 #define large_malloc(a) vmalloc(a)
60451diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
60452index 347fdc3..cd01657 100644
60453--- a/include/linux/dma-mapping.h
60454+++ b/include/linux/dma-mapping.h
60455@@ -42,7 +42,7 @@ struct dma_map_ops {
60456 int (*dma_supported)(struct device *dev, u64 mask);
60457 int (*set_dma_mask)(struct device *dev, u64 mask);
60458 int is_phys;
60459-};
60460+} __do_const;
60461
60462 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
60463
60464diff --git a/include/linux/efi.h b/include/linux/efi.h
60465index 2362a0b..cfaf8fcc 100644
60466--- a/include/linux/efi.h
60467+++ b/include/linux/efi.h
60468@@ -446,7 +446,7 @@ struct efivar_operations {
60469 efi_get_variable_t *get_variable;
60470 efi_get_next_variable_t *get_next_variable;
60471 efi_set_variable_t *set_variable;
60472-};
60473+} __no_const;
60474
60475 struct efivars {
60476 /*
60477diff --git a/include/linux/elf.h b/include/linux/elf.h
60478index 110821c..cb14c08 100644
60479--- a/include/linux/elf.h
60480+++ b/include/linux/elf.h
60481@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
60482 #define PT_GNU_EH_FRAME 0x6474e550
60483
60484 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
60485+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
60486+
60487+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
60488+
60489+/* Constants for the e_flags field */
60490+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60491+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
60492+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
60493+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
60494+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60495+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60496
60497 /*
60498 * Extended Numbering
60499@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
60500 #define DT_DEBUG 21
60501 #define DT_TEXTREL 22
60502 #define DT_JMPREL 23
60503+#define DT_FLAGS 30
60504+ #define DF_TEXTREL 0x00000004
60505 #define DT_ENCODING 32
60506 #define OLD_DT_LOOS 0x60000000
60507 #define DT_LOOS 0x6000000d
60508@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
60509 #define PF_W 0x2
60510 #define PF_X 0x1
60511
60512+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
60513+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
60514+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
60515+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
60516+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
60517+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
60518+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
60519+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
60520+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
60521+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
60522+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
60523+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
60524+
60525 typedef struct elf32_phdr{
60526 Elf32_Word p_type;
60527 Elf32_Off p_offset;
60528@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
60529 #define EI_OSABI 7
60530 #define EI_PAD 8
60531
60532+#define EI_PAX 14
60533+
60534 #define ELFMAG0 0x7f /* EI_MAG */
60535 #define ELFMAG1 'E'
60536 #define ELFMAG2 'L'
60537@@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC [];
60538 #define elf_note elf32_note
60539 #define elf_addr_t Elf32_Off
60540 #define Elf_Half Elf32_Half
60541+#define elf_dyn Elf32_Dyn
60542
60543 #else
60544
60545@@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC [];
60546 #define elf_note elf64_note
60547 #define elf_addr_t Elf64_Off
60548 #define Elf_Half Elf64_Half
60549+#define elf_dyn Elf64_Dyn
60550
60551 #endif
60552
60553diff --git a/include/linux/filter.h b/include/linux/filter.h
60554index 741956f..f02f482 100644
60555--- a/include/linux/filter.h
60556+++ b/include/linux/filter.h
60557@@ -134,6 +134,7 @@ struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
60558
60559 struct sk_buff;
60560 struct sock;
60561+struct bpf_jit_work;
60562
60563 struct sk_filter
60564 {
60565@@ -141,6 +142,9 @@ struct sk_filter
60566 unsigned int len; /* Number of filter blocks */
60567 unsigned int (*bpf_func)(const struct sk_buff *skb,
60568 const struct sock_filter *filter);
60569+#ifdef CONFIG_BPF_JIT
60570+ struct bpf_jit_work *work;
60571+#endif
60572 struct rcu_head rcu;
60573 struct sock_filter insns[0];
60574 };
60575diff --git a/include/linux/firewire.h b/include/linux/firewire.h
60576index 84ccf8e..2e9b14c 100644
60577--- a/include/linux/firewire.h
60578+++ b/include/linux/firewire.h
60579@@ -428,7 +428,7 @@ struct fw_iso_context {
60580 union {
60581 fw_iso_callback_t sc;
60582 fw_iso_mc_callback_t mc;
60583- } callback;
60584+ } __no_const callback;
60585 void *callback_data;
60586 };
60587
60588diff --git a/include/linux/fs.h b/include/linux/fs.h
60589index cf7bc25..0d2babf 100644
60590--- a/include/linux/fs.h
60591+++ b/include/linux/fs.h
60592@@ -1588,7 +1588,8 @@ struct file_operations {
60593 int (*setlease)(struct file *, long, struct file_lock **);
60594 long (*fallocate)(struct file *file, int mode, loff_t offset,
60595 loff_t len);
60596-};
60597+} __do_const;
60598+typedef struct file_operations __no_const file_operations_no_const;
60599
60600 struct inode_operations {
60601 struct dentry * (*lookup) (struct inode *,struct dentry *, struct nameidata *);
60602diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
60603index 003dc0f..3c4ea97 100644
60604--- a/include/linux/fs_struct.h
60605+++ b/include/linux/fs_struct.h
60606@@ -6,7 +6,7 @@
60607 #include <linux/seqlock.h>
60608
60609 struct fs_struct {
60610- int users;
60611+ atomic_t users;
60612 spinlock_t lock;
60613 seqcount_t seq;
60614 int umask;
60615diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
60616index af095b5..cf1220c 100644
60617--- a/include/linux/fscache-cache.h
60618+++ b/include/linux/fscache-cache.h
60619@@ -102,7 +102,7 @@ struct fscache_operation {
60620 fscache_operation_release_t release;
60621 };
60622
60623-extern atomic_t fscache_op_debug_id;
60624+extern atomic_unchecked_t fscache_op_debug_id;
60625 extern void fscache_op_work_func(struct work_struct *work);
60626
60627 extern void fscache_enqueue_operation(struct fscache_operation *);
60628@@ -122,7 +122,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
60629 {
60630 INIT_WORK(&op->work, fscache_op_work_func);
60631 atomic_set(&op->usage, 1);
60632- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
60633+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
60634 op->processor = processor;
60635 op->release = release;
60636 INIT_LIST_HEAD(&op->pend_link);
60637diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
60638index 2a53f10..0187fdf 100644
60639--- a/include/linux/fsnotify.h
60640+++ b/include/linux/fsnotify.h
60641@@ -314,7 +314,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
60642 */
60643 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
60644 {
60645- return kstrdup(name, GFP_KERNEL);
60646+ return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
60647 }
60648
60649 /*
60650diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
60651index 96efa67..1261547 100644
60652--- a/include/linux/ftrace_event.h
60653+++ b/include/linux/ftrace_event.h
60654@@ -97,7 +97,7 @@ struct trace_event_functions {
60655 trace_print_func raw;
60656 trace_print_func hex;
60657 trace_print_func binary;
60658-};
60659+} __no_const;
60660
60661 struct trace_event {
60662 struct hlist_node node;
60663@@ -252,7 +252,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
60664 extern int trace_add_event_call(struct ftrace_event_call *call);
60665 extern void trace_remove_event_call(struct ftrace_event_call *call);
60666
60667-#define is_signed_type(type) (((type)(-1)) < 0)
60668+#define is_signed_type(type) (((type)(-1)) < (type)1)
60669
60670 int trace_set_clr_event(const char *system, const char *event, int set);
60671
60672diff --git a/include/linux/genhd.h b/include/linux/genhd.h
60673index 02fa469..a15f279 100644
60674--- a/include/linux/genhd.h
60675+++ b/include/linux/genhd.h
60676@@ -184,7 +184,7 @@ struct gendisk {
60677 struct kobject *slave_dir;
60678
60679 struct timer_rand_state *random;
60680- atomic_t sync_io; /* RAID */
60681+ atomic_unchecked_t sync_io; /* RAID */
60682 struct disk_events *ev;
60683 #ifdef CONFIG_BLK_DEV_INTEGRITY
60684 struct blk_integrity *integrity;
60685diff --git a/include/linux/gracl.h b/include/linux/gracl.h
60686new file mode 100644
60687index 0000000..0dc3943
60688--- /dev/null
60689+++ b/include/linux/gracl.h
60690@@ -0,0 +1,317 @@
60691+#ifndef GR_ACL_H
60692+#define GR_ACL_H
60693+
60694+#include <linux/grdefs.h>
60695+#include <linux/resource.h>
60696+#include <linux/capability.h>
60697+#include <linux/dcache.h>
60698+#include <asm/resource.h>
60699+
60700+/* Major status information */
60701+
60702+#define GR_VERSION "grsecurity 2.2.2"
60703+#define GRSECURITY_VERSION 0x2202
60704+
60705+enum {
60706+ GR_SHUTDOWN = 0,
60707+ GR_ENABLE = 1,
60708+ GR_SPROLE = 2,
60709+ GR_RELOAD = 3,
60710+ GR_SEGVMOD = 4,
60711+ GR_STATUS = 5,
60712+ GR_UNSPROLE = 6,
60713+ GR_PASSSET = 7,
60714+ GR_SPROLEPAM = 8,
60715+};
60716+
60717+/* Password setup definitions
60718+ * kernel/grhash.c */
60719+enum {
60720+ GR_PW_LEN = 128,
60721+ GR_SALT_LEN = 16,
60722+ GR_SHA_LEN = 32,
60723+};
60724+
60725+enum {
60726+ GR_SPROLE_LEN = 64,
60727+};
60728+
60729+enum {
60730+ GR_NO_GLOB = 0,
60731+ GR_REG_GLOB,
60732+ GR_CREATE_GLOB
60733+};
60734+
60735+#define GR_NLIMITS 32
60736+
60737+/* Begin Data Structures */
60738+
60739+struct sprole_pw {
60740+ unsigned char *rolename;
60741+ unsigned char salt[GR_SALT_LEN];
60742+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
60743+};
60744+
60745+struct name_entry {
60746+ __u32 key;
60747+ ino_t inode;
60748+ dev_t device;
60749+ char *name;
60750+ __u16 len;
60751+ __u8 deleted;
60752+ struct name_entry *prev;
60753+ struct name_entry *next;
60754+};
60755+
60756+struct inodev_entry {
60757+ struct name_entry *nentry;
60758+ struct inodev_entry *prev;
60759+ struct inodev_entry *next;
60760+};
60761+
60762+struct acl_role_db {
60763+ struct acl_role_label **r_hash;
60764+ __u32 r_size;
60765+};
60766+
60767+struct inodev_db {
60768+ struct inodev_entry **i_hash;
60769+ __u32 i_size;
60770+};
60771+
60772+struct name_db {
60773+ struct name_entry **n_hash;
60774+ __u32 n_size;
60775+};
60776+
60777+struct crash_uid {
60778+ uid_t uid;
60779+ unsigned long expires;
60780+};
60781+
60782+struct gr_hash_struct {
60783+ void **table;
60784+ void **nametable;
60785+ void *first;
60786+ __u32 table_size;
60787+ __u32 used_size;
60788+ int type;
60789+};
60790+
60791+/* Userspace Grsecurity ACL data structures */
60792+
60793+struct acl_subject_label {
60794+ char *filename;
60795+ ino_t inode;
60796+ dev_t device;
60797+ __u32 mode;
60798+ kernel_cap_t cap_mask;
60799+ kernel_cap_t cap_lower;
60800+ kernel_cap_t cap_invert_audit;
60801+
60802+ struct rlimit res[GR_NLIMITS];
60803+ __u32 resmask;
60804+
60805+ __u8 user_trans_type;
60806+ __u8 group_trans_type;
60807+ uid_t *user_transitions;
60808+ gid_t *group_transitions;
60809+ __u16 user_trans_num;
60810+ __u16 group_trans_num;
60811+
60812+ __u32 sock_families[2];
60813+ __u32 ip_proto[8];
60814+ __u32 ip_type;
60815+ struct acl_ip_label **ips;
60816+ __u32 ip_num;
60817+ __u32 inaddr_any_override;
60818+
60819+ __u32 crashes;
60820+ unsigned long expires;
60821+
60822+ struct acl_subject_label *parent_subject;
60823+ struct gr_hash_struct *hash;
60824+ struct acl_subject_label *prev;
60825+ struct acl_subject_label *next;
60826+
60827+ struct acl_object_label **obj_hash;
60828+ __u32 obj_hash_size;
60829+ __u16 pax_flags;
60830+};
60831+
60832+struct role_allowed_ip {
60833+ __u32 addr;
60834+ __u32 netmask;
60835+
60836+ struct role_allowed_ip *prev;
60837+ struct role_allowed_ip *next;
60838+};
60839+
60840+struct role_transition {
60841+ char *rolename;
60842+
60843+ struct role_transition *prev;
60844+ struct role_transition *next;
60845+};
60846+
60847+struct acl_role_label {
60848+ char *rolename;
60849+ uid_t uidgid;
60850+ __u16 roletype;
60851+
60852+ __u16 auth_attempts;
60853+ unsigned long expires;
60854+
60855+ struct acl_subject_label *root_label;
60856+ struct gr_hash_struct *hash;
60857+
60858+ struct acl_role_label *prev;
60859+ struct acl_role_label *next;
60860+
60861+ struct role_transition *transitions;
60862+ struct role_allowed_ip *allowed_ips;
60863+ uid_t *domain_children;
60864+ __u16 domain_child_num;
60865+
60866+ struct acl_subject_label **subj_hash;
60867+ __u32 subj_hash_size;
60868+};
60869+
60870+struct user_acl_role_db {
60871+ struct acl_role_label **r_table;
60872+ __u32 num_pointers; /* Number of allocations to track */
60873+ __u32 num_roles; /* Number of roles */
60874+ __u32 num_domain_children; /* Number of domain children */
60875+ __u32 num_subjects; /* Number of subjects */
60876+ __u32 num_objects; /* Number of objects */
60877+};
60878+
60879+struct acl_object_label {
60880+ char *filename;
60881+ ino_t inode;
60882+ dev_t device;
60883+ __u32 mode;
60884+
60885+ struct acl_subject_label *nested;
60886+ struct acl_object_label *globbed;
60887+
60888+ /* next two structures not used */
60889+
60890+ struct acl_object_label *prev;
60891+ struct acl_object_label *next;
60892+};
60893+
60894+struct acl_ip_label {
60895+ char *iface;
60896+ __u32 addr;
60897+ __u32 netmask;
60898+ __u16 low, high;
60899+ __u8 mode;
60900+ __u32 type;
60901+ __u32 proto[8];
60902+
60903+ /* next two structures not used */
60904+
60905+ struct acl_ip_label *prev;
60906+ struct acl_ip_label *next;
60907+};
60908+
60909+struct gr_arg {
60910+ struct user_acl_role_db role_db;
60911+ unsigned char pw[GR_PW_LEN];
60912+ unsigned char salt[GR_SALT_LEN];
60913+ unsigned char sum[GR_SHA_LEN];
60914+ unsigned char sp_role[GR_SPROLE_LEN];
60915+ struct sprole_pw *sprole_pws;
60916+ dev_t segv_device;
60917+ ino_t segv_inode;
60918+ uid_t segv_uid;
60919+ __u16 num_sprole_pws;
60920+ __u16 mode;
60921+};
60922+
60923+struct gr_arg_wrapper {
60924+ struct gr_arg *arg;
60925+ __u32 version;
60926+ __u32 size;
60927+};
60928+
60929+struct subject_map {
60930+ struct acl_subject_label *user;
60931+ struct acl_subject_label *kernel;
60932+ struct subject_map *prev;
60933+ struct subject_map *next;
60934+};
60935+
60936+struct acl_subj_map_db {
60937+ struct subject_map **s_hash;
60938+ __u32 s_size;
60939+};
60940+
60941+/* End Data Structures Section */
60942+
60943+/* Hash functions generated by empirical testing by Brad Spengler
60944+ Makes good use of the low bits of the inode. Generally 0-1 times
60945+ in loop for successful match. 0-3 for unsuccessful match.
60946+ Shift/add algorithm with modulus of table size and an XOR*/
60947+
60948+static __inline__ unsigned int
60949+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
60950+{
60951+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
60952+}
60953+
60954+ static __inline__ unsigned int
60955+shash(const struct acl_subject_label *userp, const unsigned int sz)
60956+{
60957+ return ((const unsigned long)userp % sz);
60958+}
60959+
60960+static __inline__ unsigned int
60961+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
60962+{
60963+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
60964+}
60965+
60966+static __inline__ unsigned int
60967+nhash(const char *name, const __u16 len, const unsigned int sz)
60968+{
60969+ return full_name_hash((const unsigned char *)name, len) % sz;
60970+}
60971+
60972+#define FOR_EACH_ROLE_START(role) \
60973+ role = role_list; \
60974+ while (role) {
60975+
60976+#define FOR_EACH_ROLE_END(role) \
60977+ role = role->prev; \
60978+ }
60979+
60980+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
60981+ subj = NULL; \
60982+ iter = 0; \
60983+ while (iter < role->subj_hash_size) { \
60984+ if (subj == NULL) \
60985+ subj = role->subj_hash[iter]; \
60986+ if (subj == NULL) { \
60987+ iter++; \
60988+ continue; \
60989+ }
60990+
60991+#define FOR_EACH_SUBJECT_END(subj,iter) \
60992+ subj = subj->next; \
60993+ if (subj == NULL) \
60994+ iter++; \
60995+ }
60996+
60997+
60998+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
60999+ subj = role->hash->first; \
61000+ while (subj != NULL) {
61001+
61002+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
61003+ subj = subj->next; \
61004+ }
61005+
61006+#endif
61007+
61008diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
61009new file mode 100644
61010index 0000000..323ecf2
61011--- /dev/null
61012+++ b/include/linux/gralloc.h
61013@@ -0,0 +1,9 @@
61014+#ifndef __GRALLOC_H
61015+#define __GRALLOC_H
61016+
61017+void acl_free_all(void);
61018+int acl_alloc_stack_init(unsigned long size);
61019+void *acl_alloc(unsigned long len);
61020+void *acl_alloc_num(unsigned long num, unsigned long len);
61021+
61022+#endif
61023diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
61024new file mode 100644
61025index 0000000..b30e9bc
61026--- /dev/null
61027+++ b/include/linux/grdefs.h
61028@@ -0,0 +1,140 @@
61029+#ifndef GRDEFS_H
61030+#define GRDEFS_H
61031+
61032+/* Begin grsecurity status declarations */
61033+
61034+enum {
61035+ GR_READY = 0x01,
61036+ GR_STATUS_INIT = 0x00 // disabled state
61037+};
61038+
61039+/* Begin ACL declarations */
61040+
61041+/* Role flags */
61042+
61043+enum {
61044+ GR_ROLE_USER = 0x0001,
61045+ GR_ROLE_GROUP = 0x0002,
61046+ GR_ROLE_DEFAULT = 0x0004,
61047+ GR_ROLE_SPECIAL = 0x0008,
61048+ GR_ROLE_AUTH = 0x0010,
61049+ GR_ROLE_NOPW = 0x0020,
61050+ GR_ROLE_GOD = 0x0040,
61051+ GR_ROLE_LEARN = 0x0080,
61052+ GR_ROLE_TPE = 0x0100,
61053+ GR_ROLE_DOMAIN = 0x0200,
61054+ GR_ROLE_PAM = 0x0400,
61055+ GR_ROLE_PERSIST = 0x0800
61056+};
61057+
61058+/* ACL Subject and Object mode flags */
61059+enum {
61060+ GR_DELETED = 0x80000000
61061+};
61062+
61063+/* ACL Object-only mode flags */
61064+enum {
61065+ GR_READ = 0x00000001,
61066+ GR_APPEND = 0x00000002,
61067+ GR_WRITE = 0x00000004,
61068+ GR_EXEC = 0x00000008,
61069+ GR_FIND = 0x00000010,
61070+ GR_INHERIT = 0x00000020,
61071+ GR_SETID = 0x00000040,
61072+ GR_CREATE = 0x00000080,
61073+ GR_DELETE = 0x00000100,
61074+ GR_LINK = 0x00000200,
61075+ GR_AUDIT_READ = 0x00000400,
61076+ GR_AUDIT_APPEND = 0x00000800,
61077+ GR_AUDIT_WRITE = 0x00001000,
61078+ GR_AUDIT_EXEC = 0x00002000,
61079+ GR_AUDIT_FIND = 0x00004000,
61080+ GR_AUDIT_INHERIT= 0x00008000,
61081+ GR_AUDIT_SETID = 0x00010000,
61082+ GR_AUDIT_CREATE = 0x00020000,
61083+ GR_AUDIT_DELETE = 0x00040000,
61084+ GR_AUDIT_LINK = 0x00080000,
61085+ GR_PTRACERD = 0x00100000,
61086+ GR_NOPTRACE = 0x00200000,
61087+ GR_SUPPRESS = 0x00400000,
61088+ GR_NOLEARN = 0x00800000,
61089+ GR_INIT_TRANSFER= 0x01000000
61090+};
61091+
61092+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
61093+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
61094+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
61095+
61096+/* ACL subject-only mode flags */
61097+enum {
61098+ GR_KILL = 0x00000001,
61099+ GR_VIEW = 0x00000002,
61100+ GR_PROTECTED = 0x00000004,
61101+ GR_LEARN = 0x00000008,
61102+ GR_OVERRIDE = 0x00000010,
61103+ /* just a placeholder, this mode is only used in userspace */
61104+ GR_DUMMY = 0x00000020,
61105+ GR_PROTSHM = 0x00000040,
61106+ GR_KILLPROC = 0x00000080,
61107+ GR_KILLIPPROC = 0x00000100,
61108+ /* just a placeholder, this mode is only used in userspace */
61109+ GR_NOTROJAN = 0x00000200,
61110+ GR_PROTPROCFD = 0x00000400,
61111+ GR_PROCACCT = 0x00000800,
61112+ GR_RELAXPTRACE = 0x00001000,
61113+ GR_NESTED = 0x00002000,
61114+ GR_INHERITLEARN = 0x00004000,
61115+ GR_PROCFIND = 0x00008000,
61116+ GR_POVERRIDE = 0x00010000,
61117+ GR_KERNELAUTH = 0x00020000,
61118+ GR_ATSECURE = 0x00040000,
61119+ GR_SHMEXEC = 0x00080000
61120+};
61121+
61122+enum {
61123+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
61124+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
61125+ GR_PAX_ENABLE_MPROTECT = 0x0004,
61126+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
61127+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
61128+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
61129+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
61130+ GR_PAX_DISABLE_MPROTECT = 0x0400,
61131+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
61132+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
61133+};
61134+
61135+enum {
61136+ GR_ID_USER = 0x01,
61137+ GR_ID_GROUP = 0x02,
61138+};
61139+
61140+enum {
61141+ GR_ID_ALLOW = 0x01,
61142+ GR_ID_DENY = 0x02,
61143+};
61144+
61145+#define GR_CRASH_RES 31
61146+#define GR_UIDTABLE_MAX 500
61147+
61148+/* begin resource learning section */
61149+enum {
61150+ GR_RLIM_CPU_BUMP = 60,
61151+ GR_RLIM_FSIZE_BUMP = 50000,
61152+ GR_RLIM_DATA_BUMP = 10000,
61153+ GR_RLIM_STACK_BUMP = 1000,
61154+ GR_RLIM_CORE_BUMP = 10000,
61155+ GR_RLIM_RSS_BUMP = 500000,
61156+ GR_RLIM_NPROC_BUMP = 1,
61157+ GR_RLIM_NOFILE_BUMP = 5,
61158+ GR_RLIM_MEMLOCK_BUMP = 50000,
61159+ GR_RLIM_AS_BUMP = 500000,
61160+ GR_RLIM_LOCKS_BUMP = 2,
61161+ GR_RLIM_SIGPENDING_BUMP = 5,
61162+ GR_RLIM_MSGQUEUE_BUMP = 10000,
61163+ GR_RLIM_NICE_BUMP = 1,
61164+ GR_RLIM_RTPRIO_BUMP = 1,
61165+ GR_RLIM_RTTIME_BUMP = 1000000
61166+};
61167+
61168+#endif
61169diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
61170new file mode 100644
61171index 0000000..60cda84
61172--- /dev/null
61173+++ b/include/linux/grinternal.h
61174@@ -0,0 +1,220 @@
61175+#ifndef __GRINTERNAL_H
61176+#define __GRINTERNAL_H
61177+
61178+#ifdef CONFIG_GRKERNSEC
61179+
61180+#include <linux/fs.h>
61181+#include <linux/mnt_namespace.h>
61182+#include <linux/nsproxy.h>
61183+#include <linux/gracl.h>
61184+#include <linux/grdefs.h>
61185+#include <linux/grmsg.h>
61186+
61187+void gr_add_learn_entry(const char *fmt, ...)
61188+ __attribute__ ((format (printf, 1, 2)));
61189+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
61190+ const struct vfsmount *mnt);
61191+__u32 gr_check_create(const struct dentry *new_dentry,
61192+ const struct dentry *parent,
61193+ const struct vfsmount *mnt, const __u32 mode);
61194+int gr_check_protected_task(const struct task_struct *task);
61195+__u32 to_gr_audit(const __u32 reqmode);
61196+int gr_set_acls(const int type);
61197+int gr_apply_subject_to_task(struct task_struct *task);
61198+int gr_acl_is_enabled(void);
61199+char gr_roletype_to_char(void);
61200+
61201+void gr_handle_alertkill(struct task_struct *task);
61202+char *gr_to_filename(const struct dentry *dentry,
61203+ const struct vfsmount *mnt);
61204+char *gr_to_filename1(const struct dentry *dentry,
61205+ const struct vfsmount *mnt);
61206+char *gr_to_filename2(const struct dentry *dentry,
61207+ const struct vfsmount *mnt);
61208+char *gr_to_filename3(const struct dentry *dentry,
61209+ const struct vfsmount *mnt);
61210+
61211+extern int grsec_enable_harden_ptrace;
61212+extern int grsec_enable_link;
61213+extern int grsec_enable_fifo;
61214+extern int grsec_enable_execve;
61215+extern int grsec_enable_shm;
61216+extern int grsec_enable_execlog;
61217+extern int grsec_enable_signal;
61218+extern int grsec_enable_audit_ptrace;
61219+extern int grsec_enable_forkfail;
61220+extern int grsec_enable_time;
61221+extern int grsec_enable_rofs;
61222+extern int grsec_enable_chroot_shmat;
61223+extern int grsec_enable_chroot_mount;
61224+extern int grsec_enable_chroot_double;
61225+extern int grsec_enable_chroot_pivot;
61226+extern int grsec_enable_chroot_chdir;
61227+extern int grsec_enable_chroot_chmod;
61228+extern int grsec_enable_chroot_mknod;
61229+extern int grsec_enable_chroot_fchdir;
61230+extern int grsec_enable_chroot_nice;
61231+extern int grsec_enable_chroot_execlog;
61232+extern int grsec_enable_chroot_caps;
61233+extern int grsec_enable_chroot_sysctl;
61234+extern int grsec_enable_chroot_unix;
61235+extern int grsec_enable_tpe;
61236+extern int grsec_tpe_gid;
61237+extern int grsec_enable_tpe_all;
61238+extern int grsec_enable_tpe_invert;
61239+extern int grsec_enable_socket_all;
61240+extern int grsec_socket_all_gid;
61241+extern int grsec_enable_socket_client;
61242+extern int grsec_socket_client_gid;
61243+extern int grsec_enable_socket_server;
61244+extern int grsec_socket_server_gid;
61245+extern int grsec_audit_gid;
61246+extern int grsec_enable_group;
61247+extern int grsec_enable_audit_textrel;
61248+extern int grsec_enable_log_rwxmaps;
61249+extern int grsec_enable_mount;
61250+extern int grsec_enable_chdir;
61251+extern int grsec_resource_logging;
61252+extern int grsec_enable_blackhole;
61253+extern int grsec_lastack_retries;
61254+extern int grsec_enable_brute;
61255+extern int grsec_lock;
61256+
61257+extern spinlock_t grsec_alert_lock;
61258+extern unsigned long grsec_alert_wtime;
61259+extern unsigned long grsec_alert_fyet;
61260+
61261+extern spinlock_t grsec_audit_lock;
61262+
61263+extern rwlock_t grsec_exec_file_lock;
61264+
61265+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
61266+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
61267+ (tsk)->exec_file->f_vfsmnt) : "/")
61268+
61269+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
61270+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
61271+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61272+
61273+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
61274+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
61275+ (tsk)->exec_file->f_vfsmnt) : "/")
61276+
61277+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
61278+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
61279+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61280+
61281+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
61282+
61283+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
61284+
61285+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
61286+ (task)->pid, (cred)->uid, \
61287+ (cred)->euid, (cred)->gid, (cred)->egid, \
61288+ gr_parent_task_fullpath(task), \
61289+ (task)->real_parent->comm, (task)->real_parent->pid, \
61290+ (pcred)->uid, (pcred)->euid, \
61291+ (pcred)->gid, (pcred)->egid
61292+
61293+#define GR_CHROOT_CAPS {{ \
61294+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
61295+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
61296+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
61297+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
61298+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
61299+ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
61300+ CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
61301+
61302+#define security_learn(normal_msg,args...) \
61303+({ \
61304+ read_lock(&grsec_exec_file_lock); \
61305+ gr_add_learn_entry(normal_msg "\n", ## args); \
61306+ read_unlock(&grsec_exec_file_lock); \
61307+})
61308+
61309+enum {
61310+ GR_DO_AUDIT,
61311+ GR_DONT_AUDIT,
61312+ /* used for non-audit messages that we shouldn't kill the task on */
61313+ GR_DONT_AUDIT_GOOD
61314+};
61315+
61316+enum {
61317+ GR_TTYSNIFF,
61318+ GR_RBAC,
61319+ GR_RBAC_STR,
61320+ GR_STR_RBAC,
61321+ GR_RBAC_MODE2,
61322+ GR_RBAC_MODE3,
61323+ GR_FILENAME,
61324+ GR_SYSCTL_HIDDEN,
61325+ GR_NOARGS,
61326+ GR_ONE_INT,
61327+ GR_ONE_INT_TWO_STR,
61328+ GR_ONE_STR,
61329+ GR_STR_INT,
61330+ GR_TWO_STR_INT,
61331+ GR_TWO_INT,
61332+ GR_TWO_U64,
61333+ GR_THREE_INT,
61334+ GR_FIVE_INT_TWO_STR,
61335+ GR_TWO_STR,
61336+ GR_THREE_STR,
61337+ GR_FOUR_STR,
61338+ GR_STR_FILENAME,
61339+ GR_FILENAME_STR,
61340+ GR_FILENAME_TWO_INT,
61341+ GR_FILENAME_TWO_INT_STR,
61342+ GR_TEXTREL,
61343+ GR_PTRACE,
61344+ GR_RESOURCE,
61345+ GR_CAP,
61346+ GR_SIG,
61347+ GR_SIG2,
61348+ GR_CRASH1,
61349+ GR_CRASH2,
61350+ GR_PSACCT,
61351+ GR_RWXMAP
61352+};
61353+
61354+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
61355+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
61356+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
61357+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
61358+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
61359+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
61360+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
61361+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
61362+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
61363+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
61364+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
61365+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
61366+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
61367+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
61368+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
61369+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
61370+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
61371+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
61372+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
61373+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
61374+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
61375+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
61376+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
61377+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
61378+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
61379+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
61380+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
61381+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
61382+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
61383+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
61384+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
61385+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
61386+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
61387+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
61388+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
61389+
61390+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
61391+
61392+#endif
61393+
61394+#endif
61395diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
61396new file mode 100644
61397index 0000000..9d5fd4a
61398--- /dev/null
61399+++ b/include/linux/grmsg.h
61400@@ -0,0 +1,108 @@
61401+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
61402+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
61403+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
61404+#define GR_STOPMOD_MSG "denied modification of module state by "
61405+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
61406+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
61407+#define GR_IOPERM_MSG "denied use of ioperm() by "
61408+#define GR_IOPL_MSG "denied use of iopl() by "
61409+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
61410+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
61411+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
61412+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
61413+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
61414+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
61415+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
61416+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
61417+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
61418+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
61419+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
61420+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
61421+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
61422+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
61423+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
61424+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
61425+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
61426+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
61427+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
61428+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
61429+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
61430+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
61431+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
61432+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
61433+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
61434+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
61435+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
61436+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
61437+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
61438+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
61439+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
61440+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
61441+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
61442+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
61443+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
61444+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
61445+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
61446+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
61447+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
61448+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
61449+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
61450+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
61451+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
61452+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
61453+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
61454+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
61455+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
61456+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
61457+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
61458+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
61459+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
61460+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
61461+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
61462+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
61463+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
61464+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
61465+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
61466+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
61467+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
61468+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
61469+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
61470+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
61471+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
61472+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
61473+#define GR_FAILFORK_MSG "failed fork with errno %s by "
61474+#define GR_NICE_CHROOT_MSG "denied priority change by "
61475+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
61476+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
61477+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
61478+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
61479+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
61480+#define GR_TIME_MSG "time set by "
61481+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
61482+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
61483+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
61484+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
61485+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
61486+#define GR_BIND_MSG "denied bind() by "
61487+#define GR_CONNECT_MSG "denied connect() by "
61488+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
61489+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
61490+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
61491+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
61492+#define GR_CAP_ACL_MSG "use of %s denied for "
61493+#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
61494+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
61495+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
61496+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
61497+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
61498+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
61499+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
61500+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
61501+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
61502+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
61503+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
61504+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
61505+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
61506+#define GR_VM86_MSG "denied use of vm86 by "
61507+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
61508+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
61509diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
61510new file mode 100644
61511index 0000000..4620f36
61512--- /dev/null
61513+++ b/include/linux/grsecurity.h
61514@@ -0,0 +1,231 @@
61515+#ifndef GR_SECURITY_H
61516+#define GR_SECURITY_H
61517+#include <linux/fs.h>
61518+#include <linux/fs_struct.h>
61519+#include <linux/binfmts.h>
61520+#include <linux/gracl.h>
61521+
61522+/* notify of brain-dead configs */
61523+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
61524+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
61525+#endif
61526+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
61527+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
61528+#endif
61529+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61530+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61531+#endif
61532+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61533+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61534+#endif
61535+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
61536+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
61537+#endif
61538+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
61539+#error "CONFIG_PAX enabled, but no PaX options are enabled."
61540+#endif
61541+
61542+#include <linux/compat.h>
61543+
61544+struct user_arg_ptr {
61545+#ifdef CONFIG_COMPAT
61546+ bool is_compat;
61547+#endif
61548+ union {
61549+ const char __user *const __user *native;
61550+#ifdef CONFIG_COMPAT
61551+ compat_uptr_t __user *compat;
61552+#endif
61553+ } ptr;
61554+};
61555+
61556+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
61557+void gr_handle_brute_check(void);
61558+void gr_handle_kernel_exploit(void);
61559+int gr_process_user_ban(void);
61560+
61561+char gr_roletype_to_char(void);
61562+
61563+int gr_acl_enable_at_secure(void);
61564+
61565+int gr_check_user_change(int real, int effective, int fs);
61566+int gr_check_group_change(int real, int effective, int fs);
61567+
61568+void gr_del_task_from_ip_table(struct task_struct *p);
61569+
61570+int gr_pid_is_chrooted(struct task_struct *p);
61571+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
61572+int gr_handle_chroot_nice(void);
61573+int gr_handle_chroot_sysctl(const int op);
61574+int gr_handle_chroot_setpriority(struct task_struct *p,
61575+ const int niceval);
61576+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
61577+int gr_handle_chroot_chroot(const struct dentry *dentry,
61578+ const struct vfsmount *mnt);
61579+void gr_handle_chroot_chdir(struct path *path);
61580+int gr_handle_chroot_chmod(const struct dentry *dentry,
61581+ const struct vfsmount *mnt, const int mode);
61582+int gr_handle_chroot_mknod(const struct dentry *dentry,
61583+ const struct vfsmount *mnt, const int mode);
61584+int gr_handle_chroot_mount(const struct dentry *dentry,
61585+ const struct vfsmount *mnt,
61586+ const char *dev_name);
61587+int gr_handle_chroot_pivot(void);
61588+int gr_handle_chroot_unix(const pid_t pid);
61589+
61590+int gr_handle_rawio(const struct inode *inode);
61591+
61592+void gr_handle_ioperm(void);
61593+void gr_handle_iopl(void);
61594+
61595+int gr_tpe_allow(const struct file *file);
61596+
61597+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
61598+void gr_clear_chroot_entries(struct task_struct *task);
61599+
61600+void gr_log_forkfail(const int retval);
61601+void gr_log_timechange(void);
61602+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
61603+void gr_log_chdir(const struct dentry *dentry,
61604+ const struct vfsmount *mnt);
61605+void gr_log_chroot_exec(const struct dentry *dentry,
61606+ const struct vfsmount *mnt);
61607+void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
61608+void gr_log_remount(const char *devname, const int retval);
61609+void gr_log_unmount(const char *devname, const int retval);
61610+void gr_log_mount(const char *from, const char *to, const int retval);
61611+void gr_log_textrel(struct vm_area_struct *vma);
61612+void gr_log_rwxmmap(struct file *file);
61613+void gr_log_rwxmprotect(struct file *file);
61614+
61615+int gr_handle_follow_link(const struct inode *parent,
61616+ const struct inode *inode,
61617+ const struct dentry *dentry,
61618+ const struct vfsmount *mnt);
61619+int gr_handle_fifo(const struct dentry *dentry,
61620+ const struct vfsmount *mnt,
61621+ const struct dentry *dir, const int flag,
61622+ const int acc_mode);
61623+int gr_handle_hardlink(const struct dentry *dentry,
61624+ const struct vfsmount *mnt,
61625+ struct inode *inode,
61626+ const int mode, const char *to);
61627+
61628+int gr_is_capable(const int cap);
61629+int gr_is_capable_nolog(const int cap);
61630+void gr_learn_resource(const struct task_struct *task, const int limit,
61631+ const unsigned long wanted, const int gt);
61632+void gr_copy_label(struct task_struct *tsk);
61633+void gr_handle_crash(struct task_struct *task, const int sig);
61634+int gr_handle_signal(const struct task_struct *p, const int sig);
61635+int gr_check_crash_uid(const uid_t uid);
61636+int gr_check_protected_task(const struct task_struct *task);
61637+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
61638+int gr_acl_handle_mmap(const struct file *file,
61639+ const unsigned long prot);
61640+int gr_acl_handle_mprotect(const struct file *file,
61641+ const unsigned long prot);
61642+int gr_check_hidden_task(const struct task_struct *tsk);
61643+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
61644+ const struct vfsmount *mnt);
61645+__u32 gr_acl_handle_utime(const struct dentry *dentry,
61646+ const struct vfsmount *mnt);
61647+__u32 gr_acl_handle_access(const struct dentry *dentry,
61648+ const struct vfsmount *mnt, const int fmode);
61649+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
61650+ const struct vfsmount *mnt, mode_t mode);
61651+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
61652+ const struct vfsmount *mnt, mode_t mode);
61653+__u32 gr_acl_handle_chown(const struct dentry *dentry,
61654+ const struct vfsmount *mnt);
61655+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
61656+ const struct vfsmount *mnt);
61657+int gr_handle_ptrace(struct task_struct *task, const long request);
61658+int gr_handle_proc_ptrace(struct task_struct *task);
61659+__u32 gr_acl_handle_execve(const struct dentry *dentry,
61660+ const struct vfsmount *mnt);
61661+int gr_check_crash_exec(const struct file *filp);
61662+int gr_acl_is_enabled(void);
61663+void gr_set_kernel_label(struct task_struct *task);
61664+void gr_set_role_label(struct task_struct *task, const uid_t uid,
61665+ const gid_t gid);
61666+int gr_set_proc_label(const struct dentry *dentry,
61667+ const struct vfsmount *mnt,
61668+ const int unsafe_share);
61669+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
61670+ const struct vfsmount *mnt);
61671+__u32 gr_acl_handle_open(const struct dentry *dentry,
61672+ const struct vfsmount *mnt, int acc_mode);
61673+__u32 gr_acl_handle_creat(const struct dentry *dentry,
61674+ const struct dentry *p_dentry,
61675+ const struct vfsmount *p_mnt,
61676+ int open_flags, int acc_mode, const int imode);
61677+void gr_handle_create(const struct dentry *dentry,
61678+ const struct vfsmount *mnt);
61679+void gr_handle_proc_create(const struct dentry *dentry,
61680+ const struct inode *inode);
61681+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
61682+ const struct dentry *parent_dentry,
61683+ const struct vfsmount *parent_mnt,
61684+ const int mode);
61685+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
61686+ const struct dentry *parent_dentry,
61687+ const struct vfsmount *parent_mnt);
61688+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
61689+ const struct vfsmount *mnt);
61690+void gr_handle_delete(const ino_t ino, const dev_t dev);
61691+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
61692+ const struct vfsmount *mnt);
61693+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
61694+ const struct dentry *parent_dentry,
61695+ const struct vfsmount *parent_mnt,
61696+ const char *from);
61697+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
61698+ const struct dentry *parent_dentry,
61699+ const struct vfsmount *parent_mnt,
61700+ const struct dentry *old_dentry,
61701+ const struct vfsmount *old_mnt, const char *to);
61702+int gr_acl_handle_rename(struct dentry *new_dentry,
61703+ struct dentry *parent_dentry,
61704+ const struct vfsmount *parent_mnt,
61705+ struct dentry *old_dentry,
61706+ struct inode *old_parent_inode,
61707+ struct vfsmount *old_mnt, const char *newname);
61708+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
61709+ struct dentry *old_dentry,
61710+ struct dentry *new_dentry,
61711+ struct vfsmount *mnt, const __u8 replace);
61712+__u32 gr_check_link(const struct dentry *new_dentry,
61713+ const struct dentry *parent_dentry,
61714+ const struct vfsmount *parent_mnt,
61715+ const struct dentry *old_dentry,
61716+ const struct vfsmount *old_mnt);
61717+int gr_acl_handle_filldir(const struct file *file, const char *name,
61718+ const unsigned int namelen, const ino_t ino);
61719+
61720+__u32 gr_acl_handle_unix(const struct dentry *dentry,
61721+ const struct vfsmount *mnt);
61722+void gr_acl_handle_exit(void);
61723+void gr_acl_handle_psacct(struct task_struct *task, const long code);
61724+int gr_acl_handle_procpidmem(const struct task_struct *task);
61725+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
61726+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
61727+void gr_audit_ptrace(struct task_struct *task);
61728+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
61729+
61730+#ifdef CONFIG_GRKERNSEC
61731+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
61732+void gr_handle_vm86(void);
61733+void gr_handle_mem_readwrite(u64 from, u64 to);
61734+
61735+extern int grsec_enable_dmesg;
61736+extern int grsec_disable_privio;
61737+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
61738+extern int grsec_enable_chroot_findtask;
61739+#endif
61740+#ifdef CONFIG_GRKERNSEC_SETXID
61741+extern int grsec_enable_setxid;
61742+#endif
61743+#endif
61744+
61745+#endif
61746diff --git a/include/linux/grsock.h b/include/linux/grsock.h
61747new file mode 100644
61748index 0000000..e7ffaaf
61749--- /dev/null
61750+++ b/include/linux/grsock.h
61751@@ -0,0 +1,19 @@
61752+#ifndef __GRSOCK_H
61753+#define __GRSOCK_H
61754+
61755+extern void gr_attach_curr_ip(const struct sock *sk);
61756+extern int gr_handle_sock_all(const int family, const int type,
61757+ const int protocol);
61758+extern int gr_handle_sock_server(const struct sockaddr *sck);
61759+extern int gr_handle_sock_server_other(const struct sock *sck);
61760+extern int gr_handle_sock_client(const struct sockaddr *sck);
61761+extern int gr_search_connect(struct socket * sock,
61762+ struct sockaddr_in * addr);
61763+extern int gr_search_bind(struct socket * sock,
61764+ struct sockaddr_in * addr);
61765+extern int gr_search_listen(struct socket * sock);
61766+extern int gr_search_accept(struct socket * sock);
61767+extern int gr_search_socket(const int domain, const int type,
61768+ const int protocol);
61769+
61770+#endif
61771diff --git a/include/linux/hid.h b/include/linux/hid.h
61772index 9cf8e7a..5ec94d0 100644
61773--- a/include/linux/hid.h
61774+++ b/include/linux/hid.h
61775@@ -676,7 +676,7 @@ struct hid_ll_driver {
61776 unsigned int code, int value);
61777
61778 int (*parse)(struct hid_device *hdev);
61779-};
61780+} __no_const;
61781
61782 #define PM_HINT_FULLON 1<<5
61783 #define PM_HINT_NORMAL 1<<1
61784diff --git a/include/linux/highmem.h b/include/linux/highmem.h
61785index 3a93f73..b19d0b3 100644
61786--- a/include/linux/highmem.h
61787+++ b/include/linux/highmem.h
61788@@ -185,6 +185,18 @@ static inline void clear_highpage(struct page *page)
61789 kunmap_atomic(kaddr, KM_USER0);
61790 }
61791
61792+static inline void sanitize_highpage(struct page *page)
61793+{
61794+ void *kaddr;
61795+ unsigned long flags;
61796+
61797+ local_irq_save(flags);
61798+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
61799+ clear_page(kaddr);
61800+ kunmap_atomic(kaddr, KM_CLEARPAGE);
61801+ local_irq_restore(flags);
61802+}
61803+
61804 static inline void zero_user_segments(struct page *page,
61805 unsigned start1, unsigned end1,
61806 unsigned start2, unsigned end2)
61807diff --git a/include/linux/i2c.h b/include/linux/i2c.h
61808index a6c652e..1f5878f 100644
61809--- a/include/linux/i2c.h
61810+++ b/include/linux/i2c.h
61811@@ -346,6 +346,7 @@ struct i2c_algorithm {
61812 /* To determine what the adapter supports */
61813 u32 (*functionality) (struct i2c_adapter *);
61814 };
61815+typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
61816
61817 /*
61818 * i2c_adapter is the structure used to identify a physical i2c bus along
61819diff --git a/include/linux/i2o.h b/include/linux/i2o.h
61820index a6deef4..c56a7f2 100644
61821--- a/include/linux/i2o.h
61822+++ b/include/linux/i2o.h
61823@@ -564,7 +564,7 @@ struct i2o_controller {
61824 struct i2o_device *exec; /* Executive */
61825 #if BITS_PER_LONG == 64
61826 spinlock_t context_list_lock; /* lock for context_list */
61827- atomic_t context_list_counter; /* needed for unique contexts */
61828+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
61829 struct list_head context_list; /* list of context id's
61830 and pointers */
61831 #endif
61832diff --git a/include/linux/init.h b/include/linux/init.h
61833index 9146f39..885354d 100644
61834--- a/include/linux/init.h
61835+++ b/include/linux/init.h
61836@@ -293,13 +293,13 @@ void __init parse_early_options(char *cmdline);
61837
61838 /* Each module must use one module_init(). */
61839 #define module_init(initfn) \
61840- static inline initcall_t __inittest(void) \
61841+ static inline __used initcall_t __inittest(void) \
61842 { return initfn; } \
61843 int init_module(void) __attribute__((alias(#initfn)));
61844
61845 /* This is only required if you want to be unloadable. */
61846 #define module_exit(exitfn) \
61847- static inline exitcall_t __exittest(void) \
61848+ static inline __used exitcall_t __exittest(void) \
61849 { return exitfn; } \
61850 void cleanup_module(void) __attribute__((alias(#exitfn)));
61851
61852diff --git a/include/linux/init_task.h b/include/linux/init_task.h
61853index d14e058..4162929 100644
61854--- a/include/linux/init_task.h
61855+++ b/include/linux/init_task.h
61856@@ -126,6 +126,12 @@ extern struct cred init_cred;
61857 # define INIT_PERF_EVENTS(tsk)
61858 #endif
61859
61860+#ifdef CONFIG_X86
61861+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
61862+#else
61863+#define INIT_TASK_THREAD_INFO
61864+#endif
61865+
61866 /*
61867 * INIT_TASK is used to set up the first task table, touch at
61868 * your own risk!. Base=0, limit=0x1fffff (=2MB)
61869@@ -164,6 +170,7 @@ extern struct cred init_cred;
61870 RCU_INIT_POINTER(.cred, &init_cred), \
61871 .comm = "swapper", \
61872 .thread = INIT_THREAD, \
61873+ INIT_TASK_THREAD_INFO \
61874 .fs = &init_fs, \
61875 .files = &init_files, \
61876 .signal = &init_signals, \
61877diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
61878index 9310c69..6ebb244 100644
61879--- a/include/linux/intel-iommu.h
61880+++ b/include/linux/intel-iommu.h
61881@@ -296,7 +296,7 @@ struct iommu_flush {
61882 u8 fm, u64 type);
61883 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
61884 unsigned int size_order, u64 type);
61885-};
61886+} __no_const;
61887
61888 enum {
61889 SR_DMAR_FECTL_REG,
61890diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
61891index f51a81b..adfcb44 100644
61892--- a/include/linux/interrupt.h
61893+++ b/include/linux/interrupt.h
61894@@ -425,7 +425,7 @@ enum
61895 /* map softirq index to softirq name. update 'softirq_to_name' in
61896 * kernel/softirq.c when adding a new softirq.
61897 */
61898-extern char *softirq_to_name[NR_SOFTIRQS];
61899+extern const char * const softirq_to_name[NR_SOFTIRQS];
61900
61901 /* softirq mask and active fields moved to irq_cpustat_t in
61902 * asm/hardirq.h to get better cache usage. KAO
61903@@ -433,12 +433,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
61904
61905 struct softirq_action
61906 {
61907- void (*action)(struct softirq_action *);
61908+ void (*action)(void);
61909 };
61910
61911 asmlinkage void do_softirq(void);
61912 asmlinkage void __do_softirq(void);
61913-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
61914+extern void open_softirq(int nr, void (*action)(void));
61915 extern void softirq_init(void);
61916 static inline void __raise_softirq_irqoff(unsigned int nr)
61917 {
61918diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
61919index 0df513b..fe901a2 100644
61920--- a/include/linux/kallsyms.h
61921+++ b/include/linux/kallsyms.h
61922@@ -15,7 +15,8 @@
61923
61924 struct module;
61925
61926-#ifdef CONFIG_KALLSYMS
61927+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
61928+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
61929 /* Lookup the address for a symbol. Returns 0 if not found. */
61930 unsigned long kallsyms_lookup_name(const char *name);
61931
61932@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
61933 /* Stupid that this does nothing, but I didn't create this mess. */
61934 #define __print_symbol(fmt, addr)
61935 #endif /*CONFIG_KALLSYMS*/
61936+#else /* when included by kallsyms.c, vsnprintf.c, or
61937+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
61938+extern void __print_symbol(const char *fmt, unsigned long address);
61939+extern int sprint_backtrace(char *buffer, unsigned long address);
61940+extern int sprint_symbol(char *buffer, unsigned long address);
61941+const char *kallsyms_lookup(unsigned long addr,
61942+ unsigned long *symbolsize,
61943+ unsigned long *offset,
61944+ char **modname, char *namebuf);
61945+#endif
61946
61947 /* This macro allows us to keep printk typechecking */
61948 static void __check_printsym_format(const char *fmt, ...)
61949diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
61950index fa39183..40160be 100644
61951--- a/include/linux/kgdb.h
61952+++ b/include/linux/kgdb.h
61953@@ -53,7 +53,7 @@ extern int kgdb_connected;
61954 extern int kgdb_io_module_registered;
61955
61956 extern atomic_t kgdb_setting_breakpoint;
61957-extern atomic_t kgdb_cpu_doing_single_step;
61958+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
61959
61960 extern struct task_struct *kgdb_usethread;
61961 extern struct task_struct *kgdb_contthread;
61962@@ -251,7 +251,7 @@ struct kgdb_arch {
61963 void (*disable_hw_break)(struct pt_regs *regs);
61964 void (*remove_all_hw_break)(void);
61965 void (*correct_hw_break)(void);
61966-};
61967+} __do_const;
61968
61969 /**
61970 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
61971@@ -276,7 +276,7 @@ struct kgdb_io {
61972 void (*pre_exception) (void);
61973 void (*post_exception) (void);
61974 int is_console;
61975-};
61976+} __do_const;
61977
61978 extern struct kgdb_arch arch_kgdb_ops;
61979
61980diff --git a/include/linux/kmod.h b/include/linux/kmod.h
61981index 0da38cf..d23f05f 100644
61982--- a/include/linux/kmod.h
61983+++ b/include/linux/kmod.h
61984@@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */
61985 * usually useless though. */
61986 extern int __request_module(bool wait, const char *name, ...) \
61987 __attribute__((format(printf, 2, 3)));
61988+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
61989+ __attribute__((format(printf, 3, 4)));
61990 #define request_module(mod...) __request_module(true, mod)
61991 #define request_module_nowait(mod...) __request_module(false, mod)
61992 #define try_then_request_module(x, mod...) \
61993diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
61994index eabb21a..3f030f4 100644
61995--- a/include/linux/kvm_host.h
61996+++ b/include/linux/kvm_host.h
61997@@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
61998 void vcpu_load(struct kvm_vcpu *vcpu);
61999 void vcpu_put(struct kvm_vcpu *vcpu);
62000
62001-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62002+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62003 struct module *module);
62004 void kvm_exit(void);
62005
62006@@ -454,7 +454,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
62007 struct kvm_guest_debug *dbg);
62008 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
62009
62010-int kvm_arch_init(void *opaque);
62011+int kvm_arch_init(const void *opaque);
62012 void kvm_arch_exit(void);
62013
62014 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
62015diff --git a/include/linux/libata.h b/include/linux/libata.h
62016index efd6f98..5f5fd37 100644
62017--- a/include/linux/libata.h
62018+++ b/include/linux/libata.h
62019@@ -909,7 +909,7 @@ struct ata_port_operations {
62020 * fields must be pointers.
62021 */
62022 const struct ata_port_operations *inherits;
62023-};
62024+} __do_const;
62025
62026 struct ata_port_info {
62027 unsigned long flags;
62028diff --git a/include/linux/mca.h b/include/linux/mca.h
62029index 3797270..7765ede 100644
62030--- a/include/linux/mca.h
62031+++ b/include/linux/mca.h
62032@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
62033 int region);
62034 void * (*mca_transform_memory)(struct mca_device *,
62035 void *memory);
62036-};
62037+} __no_const;
62038
62039 struct mca_bus {
62040 u64 default_dma_mask;
62041diff --git a/include/linux/memory.h b/include/linux/memory.h
62042index 935699b..11042cc 100644
62043--- a/include/linux/memory.h
62044+++ b/include/linux/memory.h
62045@@ -144,7 +144,7 @@ struct memory_accessor {
62046 size_t count);
62047 ssize_t (*write)(struct memory_accessor *, const char *buf,
62048 off_t offset, size_t count);
62049-};
62050+} __no_const;
62051
62052 /*
62053 * Kernel text modification mutex, used for code patching. Users of this lock
62054diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
62055index 896b5e4..1159ad0 100644
62056--- a/include/linux/mfd/abx500.h
62057+++ b/include/linux/mfd/abx500.h
62058@@ -234,6 +234,7 @@ struct abx500_ops {
62059 int (*event_registers_startup_state_get) (struct device *, u8 *);
62060 int (*startup_irq_enabled) (struct device *, unsigned int);
62061 };
62062+typedef struct abx500_ops __no_const abx500_ops_no_const;
62063
62064 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
62065 void abx500_remove_ops(struct device *dev);
62066diff --git a/include/linux/mm.h b/include/linux/mm.h
62067index fedc5f0..7cedb6d 100644
62068--- a/include/linux/mm.h
62069+++ b/include/linux/mm.h
62070@@ -114,7 +114,14 @@ extern unsigned int kobjsize(const void *objp);
62071
62072 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
62073 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
62074+
62075+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
62076+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
62077+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
62078+#else
62079 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
62080+#endif
62081+
62082 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
62083 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
62084
62085@@ -1011,34 +1018,6 @@ int set_page_dirty(struct page *page);
62086 int set_page_dirty_lock(struct page *page);
62087 int clear_page_dirty_for_io(struct page *page);
62088
62089-/* Is the vma a continuation of the stack vma above it? */
62090-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
62091-{
62092- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
62093-}
62094-
62095-static inline int stack_guard_page_start(struct vm_area_struct *vma,
62096- unsigned long addr)
62097-{
62098- return (vma->vm_flags & VM_GROWSDOWN) &&
62099- (vma->vm_start == addr) &&
62100- !vma_growsdown(vma->vm_prev, addr);
62101-}
62102-
62103-/* Is the vma a continuation of the stack vma below it? */
62104-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
62105-{
62106- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
62107-}
62108-
62109-static inline int stack_guard_page_end(struct vm_area_struct *vma,
62110- unsigned long addr)
62111-{
62112- return (vma->vm_flags & VM_GROWSUP) &&
62113- (vma->vm_end == addr) &&
62114- !vma_growsup(vma->vm_next, addr);
62115-}
62116-
62117 extern unsigned long move_page_tables(struct vm_area_struct *vma,
62118 unsigned long old_addr, struct vm_area_struct *new_vma,
62119 unsigned long new_addr, unsigned long len);
62120@@ -1133,6 +1112,15 @@ static inline void sync_mm_rss(struct task_struct *task, struct mm_struct *mm)
62121 }
62122 #endif
62123
62124+#ifdef CONFIG_MMU
62125+pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
62126+#else
62127+static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
62128+{
62129+ return __pgprot(0);
62130+}
62131+#endif
62132+
62133 int vma_wants_writenotify(struct vm_area_struct *vma);
62134
62135 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
62136@@ -1417,6 +1405,7 @@ out:
62137 }
62138
62139 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
62140+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
62141
62142 extern unsigned long do_brk(unsigned long, unsigned long);
62143
62144@@ -1474,6 +1463,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
62145 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
62146 struct vm_area_struct **pprev);
62147
62148+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
62149+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
62150+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
62151+
62152 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
62153 NULL if none. Assume start_addr < end_addr. */
62154 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
62155@@ -1490,15 +1483,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
62156 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
62157 }
62158
62159-#ifdef CONFIG_MMU
62160-pgprot_t vm_get_page_prot(unsigned long vm_flags);
62161-#else
62162-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
62163-{
62164- return __pgprot(0);
62165-}
62166-#endif
62167-
62168 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
62169 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
62170 unsigned long pfn, unsigned long size, pgprot_t);
62171@@ -1612,7 +1596,7 @@ extern int unpoison_memory(unsigned long pfn);
62172 extern int sysctl_memory_failure_early_kill;
62173 extern int sysctl_memory_failure_recovery;
62174 extern void shake_page(struct page *p, int access);
62175-extern atomic_long_t mce_bad_pages;
62176+extern atomic_long_unchecked_t mce_bad_pages;
62177 extern int soft_offline_page(struct page *page, int flags);
62178
62179 extern void dump_page(struct page *page);
62180@@ -1626,5 +1610,11 @@ extern void copy_user_huge_page(struct page *dst, struct page *src,
62181 unsigned int pages_per_huge_page);
62182 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
62183
62184+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
62185+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
62186+#else
62187+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
62188+#endif
62189+
62190 #endif /* __KERNEL__ */
62191 #endif /* _LINUX_MM_H */
62192diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
62193index 10a2f62..c8fa287 100644
62194--- a/include/linux/mm_types.h
62195+++ b/include/linux/mm_types.h
62196@@ -230,6 +230,8 @@ struct vm_area_struct {
62197 #ifdef CONFIG_NUMA
62198 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
62199 #endif
62200+
62201+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
62202 };
62203
62204 struct core_thread {
62205@@ -362,6 +364,24 @@ struct mm_struct {
62206 #ifdef CONFIG_CPUMASK_OFFSTACK
62207 struct cpumask cpumask_allocation;
62208 #endif
62209+
62210+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62211+ unsigned long pax_flags;
62212+#endif
62213+
62214+#ifdef CONFIG_PAX_DLRESOLVE
62215+ unsigned long call_dl_resolve;
62216+#endif
62217+
62218+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
62219+ unsigned long call_syscall;
62220+#endif
62221+
62222+#ifdef CONFIG_PAX_ASLR
62223+ unsigned long delta_mmap; /* randomized offset */
62224+ unsigned long delta_stack; /* randomized offset */
62225+#endif
62226+
62227 };
62228
62229 static inline void mm_init_cpumask(struct mm_struct *mm)
62230diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
62231index 1d1b1e1..2a13c78 100644
62232--- a/include/linux/mmu_notifier.h
62233+++ b/include/linux/mmu_notifier.h
62234@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
62235 */
62236 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
62237 ({ \
62238- pte_t __pte; \
62239+ pte_t ___pte; \
62240 struct vm_area_struct *___vma = __vma; \
62241 unsigned long ___address = __address; \
62242- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
62243+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
62244 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
62245- __pte; \
62246+ ___pte; \
62247 })
62248
62249 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
62250diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
62251index be1ac8d..26868ce 100644
62252--- a/include/linux/mmzone.h
62253+++ b/include/linux/mmzone.h
62254@@ -356,7 +356,7 @@ struct zone {
62255 unsigned long flags; /* zone flags, see below */
62256
62257 /* Zone statistics */
62258- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62259+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62260
62261 /*
62262 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
62263diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
62264index ae28e93..1ac2233 100644
62265--- a/include/linux/mod_devicetable.h
62266+++ b/include/linux/mod_devicetable.h
62267@@ -12,7 +12,7 @@
62268 typedef unsigned long kernel_ulong_t;
62269 #endif
62270
62271-#define PCI_ANY_ID (~0)
62272+#define PCI_ANY_ID ((__u16)~0)
62273
62274 struct pci_device_id {
62275 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
62276@@ -131,7 +131,7 @@ struct usb_device_id {
62277 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
62278 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
62279
62280-#define HID_ANY_ID (~0)
62281+#define HID_ANY_ID (~0U)
62282
62283 struct hid_device_id {
62284 __u16 bus;
62285diff --git a/include/linux/module.h b/include/linux/module.h
62286index 1c30087..fc2a442 100644
62287--- a/include/linux/module.h
62288+++ b/include/linux/module.h
62289@@ -16,6 +16,7 @@
62290 #include <linux/kobject.h>
62291 #include <linux/moduleparam.h>
62292 #include <linux/tracepoint.h>
62293+#include <linux/fs.h>
62294
62295 #include <linux/percpu.h>
62296 #include <asm/module.h>
62297@@ -327,19 +328,16 @@ struct module
62298 int (*init)(void);
62299
62300 /* If this is non-NULL, vfree after init() returns */
62301- void *module_init;
62302+ void *module_init_rx, *module_init_rw;
62303
62304 /* Here is the actual code + data, vfree'd on unload. */
62305- void *module_core;
62306+ void *module_core_rx, *module_core_rw;
62307
62308 /* Here are the sizes of the init and core sections */
62309- unsigned int init_size, core_size;
62310+ unsigned int init_size_rw, core_size_rw;
62311
62312 /* The size of the executable code in each section. */
62313- unsigned int init_text_size, core_text_size;
62314-
62315- /* Size of RO sections of the module (text+rodata) */
62316- unsigned int init_ro_size, core_ro_size;
62317+ unsigned int init_size_rx, core_size_rx;
62318
62319 /* Arch-specific module values */
62320 struct mod_arch_specific arch;
62321@@ -395,6 +393,10 @@ struct module
62322 #ifdef CONFIG_EVENT_TRACING
62323 struct ftrace_event_call **trace_events;
62324 unsigned int num_trace_events;
62325+ struct file_operations trace_id;
62326+ struct file_operations trace_enable;
62327+ struct file_operations trace_format;
62328+ struct file_operations trace_filter;
62329 #endif
62330 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
62331 unsigned int num_ftrace_callsites;
62332@@ -445,16 +447,46 @@ bool is_module_address(unsigned long addr);
62333 bool is_module_percpu_address(unsigned long addr);
62334 bool is_module_text_address(unsigned long addr);
62335
62336+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
62337+{
62338+
62339+#ifdef CONFIG_PAX_KERNEXEC
62340+ if (ktla_ktva(addr) >= (unsigned long)start &&
62341+ ktla_ktva(addr) < (unsigned long)start + size)
62342+ return 1;
62343+#endif
62344+
62345+ return ((void *)addr >= start && (void *)addr < start + size);
62346+}
62347+
62348+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
62349+{
62350+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
62351+}
62352+
62353+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
62354+{
62355+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
62356+}
62357+
62358+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
62359+{
62360+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
62361+}
62362+
62363+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
62364+{
62365+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
62366+}
62367+
62368 static inline int within_module_core(unsigned long addr, struct module *mod)
62369 {
62370- return (unsigned long)mod->module_core <= addr &&
62371- addr < (unsigned long)mod->module_core + mod->core_size;
62372+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
62373 }
62374
62375 static inline int within_module_init(unsigned long addr, struct module *mod)
62376 {
62377- return (unsigned long)mod->module_init <= addr &&
62378- addr < (unsigned long)mod->module_init + mod->init_size;
62379+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
62380 }
62381
62382 /* Search for module by name: must hold module_mutex. */
62383diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
62384index b2be02e..6a9fdb1 100644
62385--- a/include/linux/moduleloader.h
62386+++ b/include/linux/moduleloader.h
62387@@ -25,9 +25,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
62388 sections. Returns NULL on failure. */
62389 void *module_alloc(unsigned long size);
62390
62391+#ifdef CONFIG_PAX_KERNEXEC
62392+void *module_alloc_exec(unsigned long size);
62393+#else
62394+#define module_alloc_exec(x) module_alloc(x)
62395+#endif
62396+
62397 /* Free memory returned from module_alloc. */
62398 void module_free(struct module *mod, void *module_region);
62399
62400+#ifdef CONFIG_PAX_KERNEXEC
62401+void module_free_exec(struct module *mod, void *module_region);
62402+#else
62403+#define module_free_exec(x, y) module_free((x), (y))
62404+#endif
62405+
62406 /* Apply the given relocation to the (simplified) ELF. Return -error
62407 or 0. */
62408 int apply_relocate(Elf_Shdr *sechdrs,
62409diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
62410index ddaae98..3c70938 100644
62411--- a/include/linux/moduleparam.h
62412+++ b/include/linux/moduleparam.h
62413@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock(void)
62414 * @len is usually just sizeof(string).
62415 */
62416 #define module_param_string(name, string, len, perm) \
62417- static const struct kparam_string __param_string_##name \
62418+ static const struct kparam_string __param_string_##name __used \
62419 = { len, string }; \
62420 __module_param_call(MODULE_PARAM_PREFIX, name, \
62421 &param_ops_string, \
62422@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
62423 * module_param_named() for why this might be necessary.
62424 */
62425 #define module_param_array_named(name, array, type, nump, perm) \
62426- static const struct kparam_array __param_arr_##name \
62427+ static const struct kparam_array __param_arr_##name __used \
62428 = { .max = ARRAY_SIZE(array), .num = nump, \
62429 .ops = &param_ops_##type, \
62430 .elemsize = sizeof(array[0]), .elem = array }; \
62431diff --git a/include/linux/namei.h b/include/linux/namei.h
62432index ffc0213..2c1f2cb 100644
62433--- a/include/linux/namei.h
62434+++ b/include/linux/namei.h
62435@@ -24,7 +24,7 @@ struct nameidata {
62436 unsigned seq;
62437 int last_type;
62438 unsigned depth;
62439- char *saved_names[MAX_NESTED_LINKS + 1];
62440+ const char *saved_names[MAX_NESTED_LINKS + 1];
62441
62442 /* Intent data */
62443 union {
62444@@ -94,12 +94,12 @@ extern int follow_up(struct path *);
62445 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
62446 extern void unlock_rename(struct dentry *, struct dentry *);
62447
62448-static inline void nd_set_link(struct nameidata *nd, char *path)
62449+static inline void nd_set_link(struct nameidata *nd, const char *path)
62450 {
62451 nd->saved_names[nd->depth] = path;
62452 }
62453
62454-static inline char *nd_get_link(struct nameidata *nd)
62455+static inline const char *nd_get_link(const struct nameidata *nd)
62456 {
62457 return nd->saved_names[nd->depth];
62458 }
62459diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
62460index ddee79b..67af106 100644
62461--- a/include/linux/netdevice.h
62462+++ b/include/linux/netdevice.h
62463@@ -944,6 +944,7 @@ struct net_device_ops {
62464 int (*ndo_set_features)(struct net_device *dev,
62465 u32 features);
62466 };
62467+typedef struct net_device_ops __no_const net_device_ops_no_const;
62468
62469 /*
62470 * The DEVICE structure.
62471diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
62472new file mode 100644
62473index 0000000..33f4af8
62474--- /dev/null
62475+++ b/include/linux/netfilter/xt_gradm.h
62476@@ -0,0 +1,9 @@
62477+#ifndef _LINUX_NETFILTER_XT_GRADM_H
62478+#define _LINUX_NETFILTER_XT_GRADM_H 1
62479+
62480+struct xt_gradm_mtinfo {
62481+ __u16 flags;
62482+ __u16 invflags;
62483+};
62484+
62485+#endif
62486diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
62487index c65a18a..0c05f3a 100644
62488--- a/include/linux/of_pdt.h
62489+++ b/include/linux/of_pdt.h
62490@@ -32,7 +32,7 @@ struct of_pdt_ops {
62491
62492 /* return 0 on success; fill in 'len' with number of bytes in path */
62493 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
62494-};
62495+} __no_const;
62496
62497 extern void *prom_early_alloc(unsigned long size);
62498
62499diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
62500index 49c8727..34d2ae1 100644
62501--- a/include/linux/oprofile.h
62502+++ b/include/linux/oprofile.h
62503@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
62504 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
62505 char const * name, ulong * val);
62506
62507-/** Create a file for read-only access to an atomic_t. */
62508+/** Create a file for read-only access to an atomic_unchecked_t. */
62509 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
62510- char const * name, atomic_t * val);
62511+ char const * name, atomic_unchecked_t * val);
62512
62513 /** create a directory */
62514 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
62515diff --git a/include/linux/padata.h b/include/linux/padata.h
62516index 4633b2f..988bc08 100644
62517--- a/include/linux/padata.h
62518+++ b/include/linux/padata.h
62519@@ -129,7 +129,7 @@ struct parallel_data {
62520 struct padata_instance *pinst;
62521 struct padata_parallel_queue __percpu *pqueue;
62522 struct padata_serial_queue __percpu *squeue;
62523- atomic_t seq_nr;
62524+ atomic_unchecked_t seq_nr;
62525 atomic_t reorder_objects;
62526 atomic_t refcnt;
62527 unsigned int max_seq_nr;
62528diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
62529index c816075..cd28c4d 100644
62530--- a/include/linux/perf_event.h
62531+++ b/include/linux/perf_event.h
62532@@ -745,8 +745,8 @@ struct perf_event {
62533
62534 enum perf_event_active_state state;
62535 unsigned int attach_state;
62536- local64_t count;
62537- atomic64_t child_count;
62538+ local64_t count; /* PaX: fix it one day */
62539+ atomic64_unchecked_t child_count;
62540
62541 /*
62542 * These are the total time in nanoseconds that the event
62543@@ -797,8 +797,8 @@ struct perf_event {
62544 * These accumulate total time (in nanoseconds) that children
62545 * events have been enabled and running, respectively.
62546 */
62547- atomic64_t child_total_time_enabled;
62548- atomic64_t child_total_time_running;
62549+ atomic64_unchecked_t child_total_time_enabled;
62550+ atomic64_unchecked_t child_total_time_running;
62551
62552 /*
62553 * Protect attach/detach and child_list:
62554diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
62555index 77257c9..51d473a 100644
62556--- a/include/linux/pipe_fs_i.h
62557+++ b/include/linux/pipe_fs_i.h
62558@@ -46,9 +46,9 @@ struct pipe_buffer {
62559 struct pipe_inode_info {
62560 wait_queue_head_t wait;
62561 unsigned int nrbufs, curbuf, buffers;
62562- unsigned int readers;
62563- unsigned int writers;
62564- unsigned int waiting_writers;
62565+ atomic_t readers;
62566+ atomic_t writers;
62567+ atomic_t waiting_writers;
62568 unsigned int r_counter;
62569 unsigned int w_counter;
62570 struct page *tmp_page;
62571diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
62572index daac05d..c6802ce 100644
62573--- a/include/linux/pm_runtime.h
62574+++ b/include/linux/pm_runtime.h
62575@@ -99,7 +99,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
62576
62577 static inline void pm_runtime_mark_last_busy(struct device *dev)
62578 {
62579- ACCESS_ONCE(dev->power.last_busy) = jiffies;
62580+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
62581 }
62582
62583 #else /* !CONFIG_PM_RUNTIME */
62584diff --git a/include/linux/poison.h b/include/linux/poison.h
62585index 79159de..f1233a9 100644
62586--- a/include/linux/poison.h
62587+++ b/include/linux/poison.h
62588@@ -19,8 +19,8 @@
62589 * under normal circumstances, used to verify that nobody uses
62590 * non-initialized list entries.
62591 */
62592-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
62593-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
62594+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
62595+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
62596
62597 /********** include/linux/timer.h **********/
62598 /*
62599diff --git a/include/linux/preempt.h b/include/linux/preempt.h
62600index 58969b2..ead129b 100644
62601--- a/include/linux/preempt.h
62602+++ b/include/linux/preempt.h
62603@@ -123,7 +123,7 @@ struct preempt_ops {
62604 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
62605 void (*sched_out)(struct preempt_notifier *notifier,
62606 struct task_struct *next);
62607-};
62608+} __no_const;
62609
62610 /**
62611 * preempt_notifier - key for installing preemption notifiers
62612diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
62613index 643b96c..ef55a9c 100644
62614--- a/include/linux/proc_fs.h
62615+++ b/include/linux/proc_fs.h
62616@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
62617 return proc_create_data(name, mode, parent, proc_fops, NULL);
62618 }
62619
62620+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
62621+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
62622+{
62623+#ifdef CONFIG_GRKERNSEC_PROC_USER
62624+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
62625+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62626+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
62627+#else
62628+ return proc_create_data(name, mode, parent, proc_fops, NULL);
62629+#endif
62630+}
62631+
62632+
62633 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
62634 mode_t mode, struct proc_dir_entry *base,
62635 read_proc_t *read_proc, void * data)
62636@@ -258,7 +271,7 @@ union proc_op {
62637 int (*proc_show)(struct seq_file *m,
62638 struct pid_namespace *ns, struct pid *pid,
62639 struct task_struct *task);
62640-};
62641+} __no_const;
62642
62643 struct ctl_table_header;
62644 struct ctl_table;
62645diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
62646index 800f113..af90cc8 100644
62647--- a/include/linux/ptrace.h
62648+++ b/include/linux/ptrace.h
62649@@ -129,10 +129,10 @@ extern void __ptrace_unlink(struct task_struct *child);
62650 extern void exit_ptrace(struct task_struct *tracer);
62651 #define PTRACE_MODE_READ 1
62652 #define PTRACE_MODE_ATTACH 2
62653-/* Returns 0 on success, -errno on denial. */
62654-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
62655 /* Returns true on success, false on denial. */
62656 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
62657+/* Returns true on success, false on denial. */
62658+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
62659
62660 static inline int ptrace_reparented(struct task_struct *child)
62661 {
62662diff --git a/include/linux/random.h b/include/linux/random.h
62663index d13059f..2eaafaa 100644
62664--- a/include/linux/random.h
62665+++ b/include/linux/random.h
62666@@ -69,12 +69,17 @@ void srandom32(u32 seed);
62667
62668 u32 prandom32(struct rnd_state *);
62669
62670+static inline unsigned long pax_get_random_long(void)
62671+{
62672+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
62673+}
62674+
62675 /*
62676 * Handle minimum values for seeds
62677 */
62678 static inline u32 __seed(u32 x, u32 m)
62679 {
62680- return (x < m) ? x + m : x;
62681+ return (x <= m) ? x + m + 1 : x;
62682 }
62683
62684 /**
62685diff --git a/include/linux/reboot.h b/include/linux/reboot.h
62686index e0879a7..a12f962 100644
62687--- a/include/linux/reboot.h
62688+++ b/include/linux/reboot.h
62689@@ -52,9 +52,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
62690 * Architecture-specific implementations of sys_reboot commands.
62691 */
62692
62693-extern void machine_restart(char *cmd);
62694-extern void machine_halt(void);
62695-extern void machine_power_off(void);
62696+extern void machine_restart(char *cmd) __noreturn;
62697+extern void machine_halt(void) __noreturn;
62698+extern void machine_power_off(void) __noreturn;
62699
62700 extern void machine_shutdown(void);
62701 struct pt_regs;
62702@@ -65,9 +65,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
62703 */
62704
62705 extern void kernel_restart_prepare(char *cmd);
62706-extern void kernel_restart(char *cmd);
62707-extern void kernel_halt(void);
62708-extern void kernel_power_off(void);
62709+extern void kernel_restart(char *cmd) __noreturn;
62710+extern void kernel_halt(void) __noreturn;
62711+extern void kernel_power_off(void) __noreturn;
62712
62713 extern int C_A_D; /* for sysctl */
62714 void ctrl_alt_del(void);
62715@@ -81,7 +81,7 @@ extern int orderly_poweroff(bool force);
62716 * Emergency restart, callable from an interrupt handler.
62717 */
62718
62719-extern void emergency_restart(void);
62720+extern void emergency_restart(void) __noreturn;
62721 #include <asm/emergency-restart.h>
62722
62723 #endif
62724diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
62725index 96d465f..b084e05 100644
62726--- a/include/linux/reiserfs_fs.h
62727+++ b/include/linux/reiserfs_fs.h
62728@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
62729 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
62730
62731 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
62732-#define get_generation(s) atomic_read (&fs_generation(s))
62733+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
62734 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
62735 #define __fs_changed(gen,s) (gen != get_generation (s))
62736 #define fs_changed(gen,s) \
62737diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
62738index 52c83b6..18ed7eb 100644
62739--- a/include/linux/reiserfs_fs_sb.h
62740+++ b/include/linux/reiserfs_fs_sb.h
62741@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
62742 /* Comment? -Hans */
62743 wait_queue_head_t s_wait;
62744 /* To be obsoleted soon by per buffer seals.. -Hans */
62745- atomic_t s_generation_counter; // increased by one every time the
62746+ atomic_unchecked_t s_generation_counter; // increased by one every time the
62747 // tree gets re-balanced
62748 unsigned long s_properties; /* File system properties. Currently holds
62749 on-disk FS format */
62750diff --git a/include/linux/relay.h b/include/linux/relay.h
62751index 14a86bc..17d0700 100644
62752--- a/include/linux/relay.h
62753+++ b/include/linux/relay.h
62754@@ -159,7 +159,7 @@ struct rchan_callbacks
62755 * The callback should return 0 if successful, negative if not.
62756 */
62757 int (*remove_buf_file)(struct dentry *dentry);
62758-};
62759+} __no_const;
62760
62761 /*
62762 * CONFIG_RELAY kernel API, kernel/relay.c
62763diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
62764index c6c6084..5bf1212 100644
62765--- a/include/linux/rfkill.h
62766+++ b/include/linux/rfkill.h
62767@@ -147,6 +147,7 @@ struct rfkill_ops {
62768 void (*query)(struct rfkill *rfkill, void *data);
62769 int (*set_block)(void *data, bool blocked);
62770 };
62771+typedef struct rfkill_ops __no_const rfkill_ops_no_const;
62772
62773 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
62774 /**
62775diff --git a/include/linux/rmap.h b/include/linux/rmap.h
62776index 2148b12..519b820 100644
62777--- a/include/linux/rmap.h
62778+++ b/include/linux/rmap.h
62779@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struct anon_vma *anon_vma)
62780 void anon_vma_init(void); /* create anon_vma_cachep */
62781 int anon_vma_prepare(struct vm_area_struct *);
62782 void unlink_anon_vmas(struct vm_area_struct *);
62783-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
62784-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
62785+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
62786+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
62787 void __anon_vma_link(struct vm_area_struct *);
62788
62789 static inline void anon_vma_merge(struct vm_area_struct *vma,
62790diff --git a/include/linux/sched.h b/include/linux/sched.h
62791index 41d0237..5a64056 100644
62792--- a/include/linux/sched.h
62793+++ b/include/linux/sched.h
62794@@ -100,6 +100,7 @@ struct bio_list;
62795 struct fs_struct;
62796 struct perf_event_context;
62797 struct blk_plug;
62798+struct linux_binprm;
62799
62800 /*
62801 * List of flags we want to share for kernel threads,
62802@@ -380,10 +381,13 @@ struct user_namespace;
62803 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
62804
62805 extern int sysctl_max_map_count;
62806+extern unsigned long sysctl_heap_stack_gap;
62807
62808 #include <linux/aio.h>
62809
62810 #ifdef CONFIG_MMU
62811+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
62812+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
62813 extern void arch_pick_mmap_layout(struct mm_struct *mm);
62814 extern unsigned long
62815 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
62816@@ -629,6 +633,17 @@ struct signal_struct {
62817 #ifdef CONFIG_TASKSTATS
62818 struct taskstats *stats;
62819 #endif
62820+
62821+#ifdef CONFIG_GRKERNSEC
62822+ u32 curr_ip;
62823+ u32 saved_ip;
62824+ u32 gr_saddr;
62825+ u32 gr_daddr;
62826+ u16 gr_sport;
62827+ u16 gr_dport;
62828+ u8 used_accept:1;
62829+#endif
62830+
62831 #ifdef CONFIG_AUDIT
62832 unsigned audit_tty;
62833 struct tty_audit_buf *tty_audit_buf;
62834@@ -710,6 +725,11 @@ struct user_struct {
62835 struct key *session_keyring; /* UID's default session keyring */
62836 #endif
62837
62838+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
62839+ unsigned int banned;
62840+ unsigned long ban_expires;
62841+#endif
62842+
62843 /* Hash table maintenance information */
62844 struct hlist_node uidhash_node;
62845 uid_t uid;
62846@@ -1340,8 +1360,8 @@ struct task_struct {
62847 struct list_head thread_group;
62848
62849 struct completion *vfork_done; /* for vfork() */
62850- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
62851- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62852+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
62853+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62854
62855 cputime_t utime, stime, utimescaled, stimescaled;
62856 cputime_t gtime;
62857@@ -1357,13 +1377,6 @@ struct task_struct {
62858 struct task_cputime cputime_expires;
62859 struct list_head cpu_timers[3];
62860
62861-/* process credentials */
62862- const struct cred __rcu *real_cred; /* objective and real subjective task
62863- * credentials (COW) */
62864- const struct cred __rcu *cred; /* effective (overridable) subjective task
62865- * credentials (COW) */
62866- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62867-
62868 char comm[TASK_COMM_LEN]; /* executable name excluding path
62869 - access with [gs]et_task_comm (which lock
62870 it with task_lock())
62871@@ -1380,8 +1393,16 @@ struct task_struct {
62872 #endif
62873 /* CPU-specific state of this task */
62874 struct thread_struct thread;
62875+/* thread_info moved to task_struct */
62876+#ifdef CONFIG_X86
62877+ struct thread_info tinfo;
62878+#endif
62879 /* filesystem information */
62880 struct fs_struct *fs;
62881+
62882+ const struct cred __rcu *cred; /* effective (overridable) subjective task
62883+ * credentials (COW) */
62884+
62885 /* open file information */
62886 struct files_struct *files;
62887 /* namespaces */
62888@@ -1428,6 +1449,11 @@ struct task_struct {
62889 struct rt_mutex_waiter *pi_blocked_on;
62890 #endif
62891
62892+/* process credentials */
62893+ const struct cred __rcu *real_cred; /* objective and real subjective task
62894+ * credentials (COW) */
62895+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62896+
62897 #ifdef CONFIG_DEBUG_MUTEXES
62898 /* mutex deadlock detection */
62899 struct mutex_waiter *blocked_on;
62900@@ -1537,6 +1563,21 @@ struct task_struct {
62901 unsigned long default_timer_slack_ns;
62902
62903 struct list_head *scm_work_list;
62904+
62905+#ifdef CONFIG_GRKERNSEC
62906+ /* grsecurity */
62907+ struct dentry *gr_chroot_dentry;
62908+ struct acl_subject_label *acl;
62909+ struct acl_role_label *role;
62910+ struct file *exec_file;
62911+ u16 acl_role_id;
62912+ /* is this the task that authenticated to the special role */
62913+ u8 acl_sp_role;
62914+ u8 is_writable;
62915+ u8 brute;
62916+ u8 gr_is_chrooted;
62917+#endif
62918+
62919 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
62920 /* Index of current stored address in ret_stack */
62921 int curr_ret_stack;
62922@@ -1571,6 +1612,57 @@ struct task_struct {
62923 #endif
62924 };
62925
62926+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
62927+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
62928+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
62929+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
62930+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
62931+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
62932+
62933+#ifdef CONFIG_PAX_SOFTMODE
62934+extern int pax_softmode;
62935+#endif
62936+
62937+extern int pax_check_flags(unsigned long *);
62938+
62939+/* if tsk != current then task_lock must be held on it */
62940+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62941+static inline unsigned long pax_get_flags(struct task_struct *tsk)
62942+{
62943+ if (likely(tsk->mm))
62944+ return tsk->mm->pax_flags;
62945+ else
62946+ return 0UL;
62947+}
62948+
62949+/* if tsk != current then task_lock must be held on it */
62950+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
62951+{
62952+ if (likely(tsk->mm)) {
62953+ tsk->mm->pax_flags = flags;
62954+ return 0;
62955+ }
62956+ return -EINVAL;
62957+}
62958+#endif
62959+
62960+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
62961+extern void pax_set_initial_flags(struct linux_binprm *bprm);
62962+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
62963+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
62964+#endif
62965+
62966+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
62967+extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
62968+extern void pax_report_refcount_overflow(struct pt_regs *regs);
62969+extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
62970+
62971+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
62972+extern void pax_track_stack(void);
62973+#else
62974+static inline void pax_track_stack(void) {}
62975+#endif
62976+
62977 /* Future-safe accessor for struct task_struct's cpus_allowed. */
62978 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
62979
62980@@ -2074,7 +2166,9 @@ void yield(void);
62981 extern struct exec_domain default_exec_domain;
62982
62983 union thread_union {
62984+#ifndef CONFIG_X86
62985 struct thread_info thread_info;
62986+#endif
62987 unsigned long stack[THREAD_SIZE/sizeof(long)];
62988 };
62989
62990@@ -2107,6 +2201,7 @@ extern struct pid_namespace init_pid_ns;
62991 */
62992
62993 extern struct task_struct *find_task_by_vpid(pid_t nr);
62994+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
62995 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
62996 struct pid_namespace *ns);
62997
62998@@ -2243,7 +2338,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
62999 extern void exit_itimers(struct signal_struct *);
63000 extern void flush_itimer_signals(void);
63001
63002-extern NORET_TYPE void do_group_exit(int);
63003+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
63004
63005 extern void daemonize(const char *, ...);
63006 extern int allow_signal(int);
63007@@ -2408,13 +2503,17 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
63008
63009 #endif
63010
63011-static inline int object_is_on_stack(void *obj)
63012+static inline int object_starts_on_stack(void *obj)
63013 {
63014- void *stack = task_stack_page(current);
63015+ const void *stack = task_stack_page(current);
63016
63017 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
63018 }
63019
63020+#ifdef CONFIG_PAX_USERCOPY
63021+extern int object_is_on_stack(const void *obj, unsigned long len);
63022+#endif
63023+
63024 extern void thread_info_cache_init(void);
63025
63026 #ifdef CONFIG_DEBUG_STACK_USAGE
63027diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
63028index 899fbb4..1cb4138 100644
63029--- a/include/linux/screen_info.h
63030+++ b/include/linux/screen_info.h
63031@@ -43,7 +43,8 @@ struct screen_info {
63032 __u16 pages; /* 0x32 */
63033 __u16 vesa_attributes; /* 0x34 */
63034 __u32 capabilities; /* 0x36 */
63035- __u8 _reserved[6]; /* 0x3a */
63036+ __u16 vesapm_size; /* 0x3a */
63037+ __u8 _reserved[4]; /* 0x3c */
63038 } __attribute__((packed));
63039
63040 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
63041diff --git a/include/linux/security.h b/include/linux/security.h
63042index ebd2a53..2d949ae 100644
63043--- a/include/linux/security.h
63044+++ b/include/linux/security.h
63045@@ -36,6 +36,7 @@
63046 #include <linux/key.h>
63047 #include <linux/xfrm.h>
63048 #include <linux/slab.h>
63049+#include <linux/grsecurity.h>
63050 #include <net/flow.h>
63051
63052 /* Maximum number of letters for an LSM name string */
63053diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
63054index be720cd..a0e1b94 100644
63055--- a/include/linux/seq_file.h
63056+++ b/include/linux/seq_file.h
63057@@ -33,6 +33,7 @@ struct seq_operations {
63058 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
63059 int (*show) (struct seq_file *m, void *v);
63060 };
63061+typedef struct seq_operations __no_const seq_operations_no_const;
63062
63063 #define SEQ_SKIP 1
63064
63065diff --git a/include/linux/shm.h b/include/linux/shm.h
63066index 92808b8..c28cac4 100644
63067--- a/include/linux/shm.h
63068+++ b/include/linux/shm.h
63069@@ -98,6 +98,10 @@ struct shmid_kernel /* private to the kernel */
63070
63071 /* The task created the shm object. NULL if the task is dead. */
63072 struct task_struct *shm_creator;
63073+#ifdef CONFIG_GRKERNSEC
63074+ time_t shm_createtime;
63075+ pid_t shm_lapid;
63076+#endif
63077 };
63078
63079 /* shm_mode upper byte flags */
63080diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
63081index 0f96646..cfb757a 100644
63082--- a/include/linux/skbuff.h
63083+++ b/include/linux/skbuff.h
63084@@ -610,7 +610,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
63085 */
63086 static inline int skb_queue_empty(const struct sk_buff_head *list)
63087 {
63088- return list->next == (struct sk_buff *)list;
63089+ return list->next == (const struct sk_buff *)list;
63090 }
63091
63092 /**
63093@@ -623,7 +623,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
63094 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63095 const struct sk_buff *skb)
63096 {
63097- return skb->next == (struct sk_buff *)list;
63098+ return skb->next == (const struct sk_buff *)list;
63099 }
63100
63101 /**
63102@@ -636,7 +636,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63103 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
63104 const struct sk_buff *skb)
63105 {
63106- return skb->prev == (struct sk_buff *)list;
63107+ return skb->prev == (const struct sk_buff *)list;
63108 }
63109
63110 /**
63111@@ -1458,7 +1458,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
63112 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
63113 */
63114 #ifndef NET_SKB_PAD
63115-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
63116+#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
63117 #endif
63118
63119 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
63120diff --git a/include/linux/slab.h b/include/linux/slab.h
63121index 573c809..e84c132 100644
63122--- a/include/linux/slab.h
63123+++ b/include/linux/slab.h
63124@@ -11,12 +11,20 @@
63125
63126 #include <linux/gfp.h>
63127 #include <linux/types.h>
63128+#include <linux/err.h>
63129
63130 /*
63131 * Flags to pass to kmem_cache_create().
63132 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
63133 */
63134 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
63135+
63136+#ifdef CONFIG_PAX_USERCOPY
63137+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
63138+#else
63139+#define SLAB_USERCOPY 0x00000000UL
63140+#endif
63141+
63142 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
63143 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
63144 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
63145@@ -87,10 +95,13 @@
63146 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
63147 * Both make kfree a no-op.
63148 */
63149-#define ZERO_SIZE_PTR ((void *)16)
63150+#define ZERO_SIZE_PTR \
63151+({ \
63152+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
63153+ (void *)(-MAX_ERRNO-1L); \
63154+})
63155
63156-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
63157- (unsigned long)ZERO_SIZE_PTR)
63158+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
63159
63160 /*
63161 * struct kmem_cache related prototypes
63162@@ -161,6 +172,7 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
63163 void kfree(const void *);
63164 void kzfree(const void *);
63165 size_t ksize(const void *);
63166+void check_object_size(const void *ptr, unsigned long n, bool to);
63167
63168 /*
63169 * Allocator specific definitions. These are mainly used to establish optimized
63170@@ -353,4 +365,59 @@ static inline void *kzalloc_node(size_t size, gfp_t flags, int node)
63171
63172 void __init kmem_cache_init_late(void);
63173
63174+#define kmalloc(x, y) \
63175+({ \
63176+ void *___retval; \
63177+ intoverflow_t ___x = (intoverflow_t)x; \
63178+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
63179+ ___retval = NULL; \
63180+ else \
63181+ ___retval = kmalloc((size_t)___x, (y)); \
63182+ ___retval; \
63183+})
63184+
63185+#define kmalloc_node(x, y, z) \
63186+({ \
63187+ void *___retval; \
63188+ intoverflow_t ___x = (intoverflow_t)x; \
63189+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
63190+ ___retval = NULL; \
63191+ else \
63192+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
63193+ ___retval; \
63194+})
63195+
63196+#define kzalloc(x, y) \
63197+({ \
63198+ void *___retval; \
63199+ intoverflow_t ___x = (intoverflow_t)x; \
63200+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
63201+ ___retval = NULL; \
63202+ else \
63203+ ___retval = kzalloc((size_t)___x, (y)); \
63204+ ___retval; \
63205+})
63206+
63207+#define __krealloc(x, y, z) \
63208+({ \
63209+ void *___retval; \
63210+ intoverflow_t ___y = (intoverflow_t)y; \
63211+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
63212+ ___retval = NULL; \
63213+ else \
63214+ ___retval = __krealloc((x), (size_t)___y, (z)); \
63215+ ___retval; \
63216+})
63217+
63218+#define krealloc(x, y, z) \
63219+({ \
63220+ void *___retval; \
63221+ intoverflow_t ___y = (intoverflow_t)y; \
63222+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
63223+ ___retval = NULL; \
63224+ else \
63225+ ___retval = krealloc((x), (size_t)___y, (z)); \
63226+ ___retval; \
63227+})
63228+
63229 #endif /* _LINUX_SLAB_H */
63230diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
63231index d00e0ba..1b3bf7b 100644
63232--- a/include/linux/slab_def.h
63233+++ b/include/linux/slab_def.h
63234@@ -68,10 +68,10 @@ struct kmem_cache {
63235 unsigned long node_allocs;
63236 unsigned long node_frees;
63237 unsigned long node_overflow;
63238- atomic_t allochit;
63239- atomic_t allocmiss;
63240- atomic_t freehit;
63241- atomic_t freemiss;
63242+ atomic_unchecked_t allochit;
63243+ atomic_unchecked_t allocmiss;
63244+ atomic_unchecked_t freehit;
63245+ atomic_unchecked_t freemiss;
63246
63247 /*
63248 * If debugging is enabled, then the allocator can add additional
63249diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
63250index f58d641..c56bf9c 100644
63251--- a/include/linux/slub_def.h
63252+++ b/include/linux/slub_def.h
63253@@ -85,7 +85,7 @@ struct kmem_cache {
63254 struct kmem_cache_order_objects max;
63255 struct kmem_cache_order_objects min;
63256 gfp_t allocflags; /* gfp flags to use on each alloc */
63257- int refcount; /* Refcount for slab cache destroy */
63258+ atomic_t refcount; /* Refcount for slab cache destroy */
63259 void (*ctor)(void *);
63260 int inuse; /* Offset to metadata */
63261 int align; /* Alignment */
63262@@ -211,7 +211,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
63263 }
63264
63265 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
63266-void *__kmalloc(size_t size, gfp_t flags);
63267+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
63268
63269 static __always_inline void *
63270 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
63271diff --git a/include/linux/sonet.h b/include/linux/sonet.h
63272index de8832d..0147b46 100644
63273--- a/include/linux/sonet.h
63274+++ b/include/linux/sonet.h
63275@@ -61,7 +61,7 @@ struct sonet_stats {
63276 #include <linux/atomic.h>
63277
63278 struct k_sonet_stats {
63279-#define __HANDLE_ITEM(i) atomic_t i
63280+#define __HANDLE_ITEM(i) atomic_unchecked_t i
63281 __SONET_ITEMS
63282 #undef __HANDLE_ITEM
63283 };
63284diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
63285index db7bcaf..1aca77e 100644
63286--- a/include/linux/sunrpc/clnt.h
63287+++ b/include/linux/sunrpc/clnt.h
63288@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
63289 {
63290 switch (sap->sa_family) {
63291 case AF_INET:
63292- return ntohs(((struct sockaddr_in *)sap)->sin_port);
63293+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
63294 case AF_INET6:
63295- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
63296+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
63297 }
63298 return 0;
63299 }
63300@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
63301 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
63302 const struct sockaddr *src)
63303 {
63304- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
63305+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
63306 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
63307
63308 dsin->sin_family = ssin->sin_family;
63309@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
63310 if (sa->sa_family != AF_INET6)
63311 return 0;
63312
63313- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
63314+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
63315 }
63316
63317 #endif /* __KERNEL__ */
63318diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
63319index e775689..9e206d9 100644
63320--- a/include/linux/sunrpc/sched.h
63321+++ b/include/linux/sunrpc/sched.h
63322@@ -105,6 +105,7 @@ struct rpc_call_ops {
63323 void (*rpc_call_done)(struct rpc_task *, void *);
63324 void (*rpc_release)(void *);
63325 };
63326+typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
63327
63328 struct rpc_task_setup {
63329 struct rpc_task *task;
63330diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
63331index c14fe86..393245e 100644
63332--- a/include/linux/sunrpc/svc_rdma.h
63333+++ b/include/linux/sunrpc/svc_rdma.h
63334@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
63335 extern unsigned int svcrdma_max_requests;
63336 extern unsigned int svcrdma_max_req_size;
63337
63338-extern atomic_t rdma_stat_recv;
63339-extern atomic_t rdma_stat_read;
63340-extern atomic_t rdma_stat_write;
63341-extern atomic_t rdma_stat_sq_starve;
63342-extern atomic_t rdma_stat_rq_starve;
63343-extern atomic_t rdma_stat_rq_poll;
63344-extern atomic_t rdma_stat_rq_prod;
63345-extern atomic_t rdma_stat_sq_poll;
63346-extern atomic_t rdma_stat_sq_prod;
63347+extern atomic_unchecked_t rdma_stat_recv;
63348+extern atomic_unchecked_t rdma_stat_read;
63349+extern atomic_unchecked_t rdma_stat_write;
63350+extern atomic_unchecked_t rdma_stat_sq_starve;
63351+extern atomic_unchecked_t rdma_stat_rq_starve;
63352+extern atomic_unchecked_t rdma_stat_rq_poll;
63353+extern atomic_unchecked_t rdma_stat_rq_prod;
63354+extern atomic_unchecked_t rdma_stat_sq_poll;
63355+extern atomic_unchecked_t rdma_stat_sq_prod;
63356
63357 #define RPCRDMA_VERSION 1
63358
63359diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
63360index 11684d9..0d245eb 100644
63361--- a/include/linux/sysctl.h
63362+++ b/include/linux/sysctl.h
63363@@ -155,7 +155,11 @@ enum
63364 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
63365 };
63366
63367-
63368+#ifdef CONFIG_PAX_SOFTMODE
63369+enum {
63370+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
63371+};
63372+#endif
63373
63374 /* CTL_VM names: */
63375 enum
63376@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
63377
63378 extern int proc_dostring(struct ctl_table *, int,
63379 void __user *, size_t *, loff_t *);
63380+extern int proc_dostring_modpriv(struct ctl_table *, int,
63381+ void __user *, size_t *, loff_t *);
63382 extern int proc_dointvec(struct ctl_table *, int,
63383 void __user *, size_t *, loff_t *);
63384 extern int proc_dointvec_minmax(struct ctl_table *, int,
63385diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
63386index ff7dc08..893e1bd 100644
63387--- a/include/linux/tty_ldisc.h
63388+++ b/include/linux/tty_ldisc.h
63389@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
63390
63391 struct module *owner;
63392
63393- int refcount;
63394+ atomic_t refcount;
63395 };
63396
63397 struct tty_ldisc {
63398diff --git a/include/linux/types.h b/include/linux/types.h
63399index 176da8c..e45e473 100644
63400--- a/include/linux/types.h
63401+++ b/include/linux/types.h
63402@@ -213,10 +213,26 @@ typedef struct {
63403 int counter;
63404 } atomic_t;
63405
63406+#ifdef CONFIG_PAX_REFCOUNT
63407+typedef struct {
63408+ int counter;
63409+} atomic_unchecked_t;
63410+#else
63411+typedef atomic_t atomic_unchecked_t;
63412+#endif
63413+
63414 #ifdef CONFIG_64BIT
63415 typedef struct {
63416 long counter;
63417 } atomic64_t;
63418+
63419+#ifdef CONFIG_PAX_REFCOUNT
63420+typedef struct {
63421+ long counter;
63422+} atomic64_unchecked_t;
63423+#else
63424+typedef atomic64_t atomic64_unchecked_t;
63425+#endif
63426 #endif
63427
63428 struct list_head {
63429diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
63430index 5ca0951..ab496a5 100644
63431--- a/include/linux/uaccess.h
63432+++ b/include/linux/uaccess.h
63433@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
63434 long ret; \
63435 mm_segment_t old_fs = get_fs(); \
63436 \
63437- set_fs(KERNEL_DS); \
63438 pagefault_disable(); \
63439- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
63440- pagefault_enable(); \
63441+ set_fs(KERNEL_DS); \
63442+ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
63443 set_fs(old_fs); \
63444+ pagefault_enable(); \
63445 ret; \
63446 })
63447
63448diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
63449index 99c1b4d..bb94261 100644
63450--- a/include/linux/unaligned/access_ok.h
63451+++ b/include/linux/unaligned/access_ok.h
63452@@ -6,32 +6,32 @@
63453
63454 static inline u16 get_unaligned_le16(const void *p)
63455 {
63456- return le16_to_cpup((__le16 *)p);
63457+ return le16_to_cpup((const __le16 *)p);
63458 }
63459
63460 static inline u32 get_unaligned_le32(const void *p)
63461 {
63462- return le32_to_cpup((__le32 *)p);
63463+ return le32_to_cpup((const __le32 *)p);
63464 }
63465
63466 static inline u64 get_unaligned_le64(const void *p)
63467 {
63468- return le64_to_cpup((__le64 *)p);
63469+ return le64_to_cpup((const __le64 *)p);
63470 }
63471
63472 static inline u16 get_unaligned_be16(const void *p)
63473 {
63474- return be16_to_cpup((__be16 *)p);
63475+ return be16_to_cpup((const __be16 *)p);
63476 }
63477
63478 static inline u32 get_unaligned_be32(const void *p)
63479 {
63480- return be32_to_cpup((__be32 *)p);
63481+ return be32_to_cpup((const __be32 *)p);
63482 }
63483
63484 static inline u64 get_unaligned_be64(const void *p)
63485 {
63486- return be64_to_cpup((__be64 *)p);
63487+ return be64_to_cpup((const __be64 *)p);
63488 }
63489
63490 static inline void put_unaligned_le16(u16 val, void *p)
63491diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
63492index cf97b5b..40ebc87 100644
63493--- a/include/linux/vermagic.h
63494+++ b/include/linux/vermagic.h
63495@@ -26,9 +26,35 @@
63496 #define MODULE_ARCH_VERMAGIC ""
63497 #endif
63498
63499+#ifdef CONFIG_PAX_REFCOUNT
63500+#define MODULE_PAX_REFCOUNT "REFCOUNT "
63501+#else
63502+#define MODULE_PAX_REFCOUNT ""
63503+#endif
63504+
63505+#ifdef CONSTIFY_PLUGIN
63506+#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
63507+#else
63508+#define MODULE_CONSTIFY_PLUGIN ""
63509+#endif
63510+
63511+#ifdef STACKLEAK_PLUGIN
63512+#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
63513+#else
63514+#define MODULE_STACKLEAK_PLUGIN ""
63515+#endif
63516+
63517+#ifdef CONFIG_GRKERNSEC
63518+#define MODULE_GRSEC "GRSEC "
63519+#else
63520+#define MODULE_GRSEC ""
63521+#endif
63522+
63523 #define VERMAGIC_STRING \
63524 UTS_RELEASE " " \
63525 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
63526 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
63527- MODULE_ARCH_VERMAGIC
63528+ MODULE_ARCH_VERMAGIC \
63529+ MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
63530+ MODULE_GRSEC
63531
63532diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
63533index 687fb11..b342358 100644
63534--- a/include/linux/vmalloc.h
63535+++ b/include/linux/vmalloc.h
63536@@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
63537 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
63538 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
63539 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
63540+
63541+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
63542+#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
63543+#endif
63544+
63545 /* bits [20..32] reserved for arch specific ioremap internals */
63546
63547 /*
63548@@ -156,4 +161,103 @@ pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms)
63549 # endif
63550 #endif
63551
63552+#define vmalloc(x) \
63553+({ \
63554+ void *___retval; \
63555+ intoverflow_t ___x = (intoverflow_t)x; \
63556+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
63557+ ___retval = NULL; \
63558+ else \
63559+ ___retval = vmalloc((unsigned long)___x); \
63560+ ___retval; \
63561+})
63562+
63563+#define vzalloc(x) \
63564+({ \
63565+ void *___retval; \
63566+ intoverflow_t ___x = (intoverflow_t)x; \
63567+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
63568+ ___retval = NULL; \
63569+ else \
63570+ ___retval = vzalloc((unsigned long)___x); \
63571+ ___retval; \
63572+})
63573+
63574+#define __vmalloc(x, y, z) \
63575+({ \
63576+ void *___retval; \
63577+ intoverflow_t ___x = (intoverflow_t)x; \
63578+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
63579+ ___retval = NULL; \
63580+ else \
63581+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
63582+ ___retval; \
63583+})
63584+
63585+#define vmalloc_user(x) \
63586+({ \
63587+ void *___retval; \
63588+ intoverflow_t ___x = (intoverflow_t)x; \
63589+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
63590+ ___retval = NULL; \
63591+ else \
63592+ ___retval = vmalloc_user((unsigned long)___x); \
63593+ ___retval; \
63594+})
63595+
63596+#define vmalloc_exec(x) \
63597+({ \
63598+ void *___retval; \
63599+ intoverflow_t ___x = (intoverflow_t)x; \
63600+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
63601+ ___retval = NULL; \
63602+ else \
63603+ ___retval = vmalloc_exec((unsigned long)___x); \
63604+ ___retval; \
63605+})
63606+
63607+#define vmalloc_node(x, y) \
63608+({ \
63609+ void *___retval; \
63610+ intoverflow_t ___x = (intoverflow_t)x; \
63611+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
63612+ ___retval = NULL; \
63613+ else \
63614+ ___retval = vmalloc_node((unsigned long)___x, (y));\
63615+ ___retval; \
63616+})
63617+
63618+#define vzalloc_node(x, y) \
63619+({ \
63620+ void *___retval; \
63621+ intoverflow_t ___x = (intoverflow_t)x; \
63622+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
63623+ ___retval = NULL; \
63624+ else \
63625+ ___retval = vzalloc_node((unsigned long)___x, (y));\
63626+ ___retval; \
63627+})
63628+
63629+#define vmalloc_32(x) \
63630+({ \
63631+ void *___retval; \
63632+ intoverflow_t ___x = (intoverflow_t)x; \
63633+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
63634+ ___retval = NULL; \
63635+ else \
63636+ ___retval = vmalloc_32((unsigned long)___x); \
63637+ ___retval; \
63638+})
63639+
63640+#define vmalloc_32_user(x) \
63641+({ \
63642+void *___retval; \
63643+ intoverflow_t ___x = (intoverflow_t)x; \
63644+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
63645+ ___retval = NULL; \
63646+ else \
63647+ ___retval = vmalloc_32_user((unsigned long)___x);\
63648+ ___retval; \
63649+})
63650+
63651 #endif /* _LINUX_VMALLOC_H */
63652diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
63653index 65efb92..137adbb 100644
63654--- a/include/linux/vmstat.h
63655+++ b/include/linux/vmstat.h
63656@@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(int cpu)
63657 /*
63658 * Zone based page accounting with per cpu differentials.
63659 */
63660-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63661+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63662
63663 static inline void zone_page_state_add(long x, struct zone *zone,
63664 enum zone_stat_item item)
63665 {
63666- atomic_long_add(x, &zone->vm_stat[item]);
63667- atomic_long_add(x, &vm_stat[item]);
63668+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
63669+ atomic_long_add_unchecked(x, &vm_stat[item]);
63670 }
63671
63672 static inline unsigned long global_page_state(enum zone_stat_item item)
63673 {
63674- long x = atomic_long_read(&vm_stat[item]);
63675+ long x = atomic_long_read_unchecked(&vm_stat[item]);
63676 #ifdef CONFIG_SMP
63677 if (x < 0)
63678 x = 0;
63679@@ -109,7 +109,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
63680 static inline unsigned long zone_page_state(struct zone *zone,
63681 enum zone_stat_item item)
63682 {
63683- long x = atomic_long_read(&zone->vm_stat[item]);
63684+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63685 #ifdef CONFIG_SMP
63686 if (x < 0)
63687 x = 0;
63688@@ -126,7 +126,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
63689 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
63690 enum zone_stat_item item)
63691 {
63692- long x = atomic_long_read(&zone->vm_stat[item]);
63693+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63694
63695 #ifdef CONFIG_SMP
63696 int cpu;
63697@@ -221,8 +221,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
63698
63699 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
63700 {
63701- atomic_long_inc(&zone->vm_stat[item]);
63702- atomic_long_inc(&vm_stat[item]);
63703+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
63704+ atomic_long_inc_unchecked(&vm_stat[item]);
63705 }
63706
63707 static inline void __inc_zone_page_state(struct page *page,
63708@@ -233,8 +233,8 @@ static inline void __inc_zone_page_state(struct page *page,
63709
63710 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
63711 {
63712- atomic_long_dec(&zone->vm_stat[item]);
63713- atomic_long_dec(&vm_stat[item]);
63714+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
63715+ atomic_long_dec_unchecked(&vm_stat[item]);
63716 }
63717
63718 static inline void __dec_zone_page_state(struct page *page,
63719diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
63720index 4aeff96..b378cdc 100644
63721--- a/include/media/saa7146_vv.h
63722+++ b/include/media/saa7146_vv.h
63723@@ -163,7 +163,7 @@ struct saa7146_ext_vv
63724 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
63725
63726 /* the extension can override this */
63727- struct v4l2_ioctl_ops ops;
63728+ v4l2_ioctl_ops_no_const ops;
63729 /* pointer to the saa7146 core ops */
63730 const struct v4l2_ioctl_ops *core_ops;
63731
63732diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
63733index c7c40f1..4f01585 100644
63734--- a/include/media/v4l2-dev.h
63735+++ b/include/media/v4l2-dev.h
63736@@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_state *global, enum v4l2_priority local);
63737
63738
63739 struct v4l2_file_operations {
63740- struct module *owner;
63741+ struct module * const owner;
63742 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
63743 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
63744 unsigned int (*poll) (struct file *, struct poll_table_struct *);
63745@@ -68,6 +68,7 @@ struct v4l2_file_operations {
63746 int (*open) (struct file *);
63747 int (*release) (struct file *);
63748 };
63749+typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
63750
63751 /*
63752 * Newer version of video_device, handled by videodev2.c
63753diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
63754index dd9f1e7..8c4dd86 100644
63755--- a/include/media/v4l2-ioctl.h
63756+++ b/include/media/v4l2-ioctl.h
63757@@ -272,7 +272,7 @@ struct v4l2_ioctl_ops {
63758 long (*vidioc_default) (struct file *file, void *fh,
63759 bool valid_prio, int cmd, void *arg);
63760 };
63761-
63762+typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
63763
63764 /* v4l debugging and diagnostics */
63765
63766diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
63767index c5dedd8..a93b07b 100644
63768--- a/include/net/caif/caif_hsi.h
63769+++ b/include/net/caif/caif_hsi.h
63770@@ -94,7 +94,7 @@ struct cfhsi_drv {
63771 void (*rx_done_cb) (struct cfhsi_drv *drv);
63772 void (*wake_up_cb) (struct cfhsi_drv *drv);
63773 void (*wake_down_cb) (struct cfhsi_drv *drv);
63774-};
63775+} __no_const;
63776
63777 /* Structure implemented by HSI device. */
63778 struct cfhsi_dev {
63779diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
63780index 9e5425b..8136ffc 100644
63781--- a/include/net/caif/cfctrl.h
63782+++ b/include/net/caif/cfctrl.h
63783@@ -52,7 +52,7 @@ struct cfctrl_rsp {
63784 void (*radioset_rsp)(void);
63785 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
63786 struct cflayer *client_layer);
63787-};
63788+} __no_const;
63789
63790 /* Link Setup Parameters for CAIF-Links. */
63791 struct cfctrl_link_param {
63792@@ -101,8 +101,8 @@ struct cfctrl_request_info {
63793 struct cfctrl {
63794 struct cfsrvl serv;
63795 struct cfctrl_rsp res;
63796- atomic_t req_seq_no;
63797- atomic_t rsp_seq_no;
63798+ atomic_unchecked_t req_seq_no;
63799+ atomic_unchecked_t rsp_seq_no;
63800 struct list_head list;
63801 /* Protects from simultaneous access to first_req list */
63802 spinlock_t info_list_lock;
63803diff --git a/include/net/flow.h b/include/net/flow.h
63804index a094477..bc91db1 100644
63805--- a/include/net/flow.h
63806+++ b/include/net/flow.h
63807@@ -207,6 +207,6 @@ extern struct flow_cache_object *flow_cache_lookup(
63808 u8 dir, flow_resolve_t resolver, void *ctx);
63809
63810 extern void flow_cache_flush(void);
63811-extern atomic_t flow_cache_genid;
63812+extern atomic_unchecked_t flow_cache_genid;
63813
63814 #endif
63815diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
63816index e9ff3fc..9d3e5c7 100644
63817--- a/include/net/inetpeer.h
63818+++ b/include/net/inetpeer.h
63819@@ -48,8 +48,8 @@ struct inet_peer {
63820 */
63821 union {
63822 struct {
63823- atomic_t rid; /* Frag reception counter */
63824- atomic_t ip_id_count; /* IP ID for the next packet */
63825+ atomic_unchecked_t rid; /* Frag reception counter */
63826+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
63827 __u32 tcp_ts;
63828 __u32 tcp_ts_stamp;
63829 };
63830@@ -113,11 +113,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
63831 more++;
63832 inet_peer_refcheck(p);
63833 do {
63834- old = atomic_read(&p->ip_id_count);
63835+ old = atomic_read_unchecked(&p->ip_id_count);
63836 new = old + more;
63837 if (!new)
63838 new = 1;
63839- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
63840+ } while (atomic_cmpxchg_unchecked(&p->ip_id_count, old, new) != old);
63841 return new;
63842 }
63843
63844diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
63845index 10422ef..662570f 100644
63846--- a/include/net/ip_fib.h
63847+++ b/include/net/ip_fib.h
63848@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
63849
63850 #define FIB_RES_SADDR(net, res) \
63851 ((FIB_RES_NH(res).nh_saddr_genid == \
63852- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
63853+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
63854 FIB_RES_NH(res).nh_saddr : \
63855 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
63856 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
63857diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
63858index 8fa4430..05dd772 100644
63859--- a/include/net/ip_vs.h
63860+++ b/include/net/ip_vs.h
63861@@ -509,7 +509,7 @@ struct ip_vs_conn {
63862 struct ip_vs_conn *control; /* Master control connection */
63863 atomic_t n_control; /* Number of controlled ones */
63864 struct ip_vs_dest *dest; /* real server */
63865- atomic_t in_pkts; /* incoming packet counter */
63866+ atomic_unchecked_t in_pkts; /* incoming packet counter */
63867
63868 /* packet transmitter for different forwarding methods. If it
63869 mangles the packet, it must return NF_DROP or better NF_STOLEN,
63870@@ -647,7 +647,7 @@ struct ip_vs_dest {
63871 __be16 port; /* port number of the server */
63872 union nf_inet_addr addr; /* IP address of the server */
63873 volatile unsigned flags; /* dest status flags */
63874- atomic_t conn_flags; /* flags to copy to conn */
63875+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
63876 atomic_t weight; /* server weight */
63877
63878 atomic_t refcnt; /* reference counter */
63879diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
63880index 69b610a..fe3962c 100644
63881--- a/include/net/irda/ircomm_core.h
63882+++ b/include/net/irda/ircomm_core.h
63883@@ -51,7 +51,7 @@ typedef struct {
63884 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
63885 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
63886 struct ircomm_info *);
63887-} call_t;
63888+} __no_const call_t;
63889
63890 struct ircomm_cb {
63891 irda_queue_t queue;
63892diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
63893index 59ba38bc..d515662 100644
63894--- a/include/net/irda/ircomm_tty.h
63895+++ b/include/net/irda/ircomm_tty.h
63896@@ -35,6 +35,7 @@
63897 #include <linux/termios.h>
63898 #include <linux/timer.h>
63899 #include <linux/tty.h> /* struct tty_struct */
63900+#include <asm/local.h>
63901
63902 #include <net/irda/irias_object.h>
63903 #include <net/irda/ircomm_core.h>
63904@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
63905 unsigned short close_delay;
63906 unsigned short closing_wait; /* time to wait before closing */
63907
63908- int open_count;
63909- int blocked_open; /* # of blocked opens */
63910+ local_t open_count;
63911+ local_t blocked_open; /* # of blocked opens */
63912
63913 /* Protect concurent access to :
63914 * o self->open_count
63915diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
63916index f82a1e8..82d81e8 100644
63917--- a/include/net/iucv/af_iucv.h
63918+++ b/include/net/iucv/af_iucv.h
63919@@ -87,7 +87,7 @@ struct iucv_sock {
63920 struct iucv_sock_list {
63921 struct hlist_head head;
63922 rwlock_t lock;
63923- atomic_t autobind_name;
63924+ atomic_unchecked_t autobind_name;
63925 };
63926
63927 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
63928diff --git a/include/net/lapb.h b/include/net/lapb.h
63929index 96cb5dd..25e8d4f 100644
63930--- a/include/net/lapb.h
63931+++ b/include/net/lapb.h
63932@@ -95,7 +95,7 @@ struct lapb_cb {
63933 struct sk_buff_head write_queue;
63934 struct sk_buff_head ack_queue;
63935 unsigned char window;
63936- struct lapb_register_struct callbacks;
63937+ struct lapb_register_struct *callbacks;
63938
63939 /* FRMR control information */
63940 struct lapb_frame frmr_data;
63941diff --git a/include/net/neighbour.h b/include/net/neighbour.h
63942index 2720884..3aa5c25 100644
63943--- a/include/net/neighbour.h
63944+++ b/include/net/neighbour.h
63945@@ -122,7 +122,7 @@ struct neigh_ops {
63946 void (*error_report)(struct neighbour *, struct sk_buff *);
63947 int (*output)(struct neighbour *, struct sk_buff *);
63948 int (*connected_output)(struct neighbour *, struct sk_buff *);
63949-};
63950+} __do_const;
63951
63952 struct pneigh_entry {
63953 struct pneigh_entry *next;
63954diff --git a/include/net/netlink.h b/include/net/netlink.h
63955index 98c1854..d4add7b 100644
63956--- a/include/net/netlink.h
63957+++ b/include/net/netlink.h
63958@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
63959 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
63960 {
63961 if (mark)
63962- skb_trim(skb, (unsigned char *) mark - skb->data);
63963+ skb_trim(skb, (const unsigned char *) mark - skb->data);
63964 }
63965
63966 /**
63967diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
63968index d786b4f..4c3dd41 100644
63969--- a/include/net/netns/ipv4.h
63970+++ b/include/net/netns/ipv4.h
63971@@ -56,8 +56,8 @@ struct netns_ipv4 {
63972
63973 unsigned int sysctl_ping_group_range[2];
63974
63975- atomic_t rt_genid;
63976- atomic_t dev_addr_genid;
63977+ atomic_unchecked_t rt_genid;
63978+ atomic_unchecked_t dev_addr_genid;
63979
63980 #ifdef CONFIG_IP_MROUTE
63981 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
63982diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
63983index 6a72a58..e6a127d 100644
63984--- a/include/net/sctp/sctp.h
63985+++ b/include/net/sctp/sctp.h
63986@@ -318,9 +318,9 @@ do { \
63987
63988 #else /* SCTP_DEBUG */
63989
63990-#define SCTP_DEBUG_PRINTK(whatever...)
63991-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
63992-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
63993+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
63994+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
63995+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
63996 #define SCTP_ENABLE_DEBUG
63997 #define SCTP_DISABLE_DEBUG
63998 #define SCTP_ASSERT(expr, str, func)
63999diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
64000index f7d9c3f..ec86952 100644
64001--- a/include/net/sctp/structs.h
64002+++ b/include/net/sctp/structs.h
64003@@ -241,6 +241,9 @@ extern struct sctp_globals {
64004 * bits is an indicator of when to send and window update SACK.
64005 */
64006 int rwnd_update_shift;
64007+
64008+ /* Threshold for autoclose timeout, in seconds. */
64009+ unsigned long max_autoclose;
64010 } sctp_globals;
64011
64012 #define sctp_rto_initial (sctp_globals.rto_initial)
64013@@ -281,6 +284,7 @@ extern struct sctp_globals {
64014 #define sctp_auth_enable (sctp_globals.auth_enable)
64015 #define sctp_checksum_disable (sctp_globals.checksum_disable)
64016 #define sctp_rwnd_upd_shift (sctp_globals.rwnd_update_shift)
64017+#define sctp_max_autoclose (sctp_globals.max_autoclose)
64018
64019 /* SCTP Socket type: UDP or TCP style. */
64020 typedef enum {
64021diff --git a/include/net/sock.h b/include/net/sock.h
64022index 8e4062f..77b041e 100644
64023--- a/include/net/sock.h
64024+++ b/include/net/sock.h
64025@@ -278,7 +278,7 @@ struct sock {
64026 #ifdef CONFIG_RPS
64027 __u32 sk_rxhash;
64028 #endif
64029- atomic_t sk_drops;
64030+ atomic_unchecked_t sk_drops;
64031 int sk_rcvbuf;
64032
64033 struct sk_filter __rcu *sk_filter;
64034@@ -1391,7 +1391,7 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
64035 }
64036
64037 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
64038- char __user *from, char *to,
64039+ char __user *from, unsigned char *to,
64040 int copy, int offset)
64041 {
64042 if (skb->ip_summed == CHECKSUM_NONE) {
64043diff --git a/include/net/tcp.h b/include/net/tcp.h
64044index acc620a..f4d99c6 100644
64045--- a/include/net/tcp.h
64046+++ b/include/net/tcp.h
64047@@ -1401,8 +1401,8 @@ enum tcp_seq_states {
64048 struct tcp_seq_afinfo {
64049 char *name;
64050 sa_family_t family;
64051- struct file_operations seq_fops;
64052- struct seq_operations seq_ops;
64053+ file_operations_no_const seq_fops;
64054+ seq_operations_no_const seq_ops;
64055 };
64056
64057 struct tcp_iter_state {
64058diff --git a/include/net/udp.h b/include/net/udp.h
64059index 67ea6fc..e42aee8 100644
64060--- a/include/net/udp.h
64061+++ b/include/net/udp.h
64062@@ -234,8 +234,8 @@ struct udp_seq_afinfo {
64063 char *name;
64064 sa_family_t family;
64065 struct udp_table *udp_table;
64066- struct file_operations seq_fops;
64067- struct seq_operations seq_ops;
64068+ file_operations_no_const seq_fops;
64069+ seq_operations_no_const seq_ops;
64070 };
64071
64072 struct udp_iter_state {
64073diff --git a/include/net/xfrm.h b/include/net/xfrm.h
64074index b203e14..1df3991 100644
64075--- a/include/net/xfrm.h
64076+++ b/include/net/xfrm.h
64077@@ -505,7 +505,7 @@ struct xfrm_policy {
64078 struct timer_list timer;
64079
64080 struct flow_cache_object flo;
64081- atomic_t genid;
64082+ atomic_unchecked_t genid;
64083 u32 priority;
64084 u32 index;
64085 struct xfrm_mark mark;
64086diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
64087index 2d0191c..a55797d 100644
64088--- a/include/rdma/iw_cm.h
64089+++ b/include/rdma/iw_cm.h
64090@@ -120,7 +120,7 @@ struct iw_cm_verbs {
64091 int backlog);
64092
64093 int (*destroy_listen)(struct iw_cm_id *cm_id);
64094-};
64095+} __no_const;
64096
64097 /**
64098 * iw_create_cm_id - Create an IW CM identifier.
64099diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
64100index 7d96829..4ba78d3 100644
64101--- a/include/scsi/libfc.h
64102+++ b/include/scsi/libfc.h
64103@@ -758,6 +758,7 @@ struct libfc_function_template {
64104 */
64105 void (*disc_stop_final) (struct fc_lport *);
64106 };
64107+typedef struct libfc_function_template __no_const libfc_function_template_no_const;
64108
64109 /**
64110 * struct fc_disc - Discovery context
64111@@ -861,7 +862,7 @@ struct fc_lport {
64112 struct fc_vport *vport;
64113
64114 /* Operational Information */
64115- struct libfc_function_template tt;
64116+ libfc_function_template_no_const tt;
64117 u8 link_up;
64118 u8 qfull;
64119 enum fc_lport_state state;
64120diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
64121index d371c3c..e228a8c 100644
64122--- a/include/scsi/scsi_device.h
64123+++ b/include/scsi/scsi_device.h
64124@@ -161,9 +161,9 @@ struct scsi_device {
64125 unsigned int max_device_blocked; /* what device_blocked counts down from */
64126 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
64127
64128- atomic_t iorequest_cnt;
64129- atomic_t iodone_cnt;
64130- atomic_t ioerr_cnt;
64131+ atomic_unchecked_t iorequest_cnt;
64132+ atomic_unchecked_t iodone_cnt;
64133+ atomic_unchecked_t ioerr_cnt;
64134
64135 struct device sdev_gendev,
64136 sdev_dev;
64137diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
64138index 2a65167..91e01f8 100644
64139--- a/include/scsi/scsi_transport_fc.h
64140+++ b/include/scsi/scsi_transport_fc.h
64141@@ -711,7 +711,7 @@ struct fc_function_template {
64142 unsigned long show_host_system_hostname:1;
64143
64144 unsigned long disable_target_scan:1;
64145-};
64146+} __do_const;
64147
64148
64149 /**
64150diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
64151index 030b87c..98a6954 100644
64152--- a/include/sound/ak4xxx-adda.h
64153+++ b/include/sound/ak4xxx-adda.h
64154@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
64155 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
64156 unsigned char val);
64157 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
64158-};
64159+} __no_const;
64160
64161 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
64162
64163diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
64164index 8c05e47..2b5df97 100644
64165--- a/include/sound/hwdep.h
64166+++ b/include/sound/hwdep.h
64167@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
64168 struct snd_hwdep_dsp_status *status);
64169 int (*dsp_load)(struct snd_hwdep *hw,
64170 struct snd_hwdep_dsp_image *image);
64171-};
64172+} __no_const;
64173
64174 struct snd_hwdep {
64175 struct snd_card *card;
64176diff --git a/include/sound/info.h b/include/sound/info.h
64177index 4e94cf1..76748b1 100644
64178--- a/include/sound/info.h
64179+++ b/include/sound/info.h
64180@@ -44,7 +44,7 @@ struct snd_info_entry_text {
64181 struct snd_info_buffer *buffer);
64182 void (*write)(struct snd_info_entry *entry,
64183 struct snd_info_buffer *buffer);
64184-};
64185+} __no_const;
64186
64187 struct snd_info_entry_ops {
64188 int (*open)(struct snd_info_entry *entry,
64189diff --git a/include/sound/pcm.h b/include/sound/pcm.h
64190index 57e71fa..a2c7534 100644
64191--- a/include/sound/pcm.h
64192+++ b/include/sound/pcm.h
64193@@ -81,6 +81,7 @@ struct snd_pcm_ops {
64194 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
64195 int (*ack)(struct snd_pcm_substream *substream);
64196 };
64197+typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
64198
64199 /*
64200 *
64201diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
64202index af1b49e..a5d55a5 100644
64203--- a/include/sound/sb16_csp.h
64204+++ b/include/sound/sb16_csp.h
64205@@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
64206 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
64207 int (*csp_stop) (struct snd_sb_csp * p);
64208 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
64209-};
64210+} __no_const;
64211
64212 /*
64213 * CSP private data
64214diff --git a/include/sound/soc.h b/include/sound/soc.h
64215index aa19f5a..a5b8208 100644
64216--- a/include/sound/soc.h
64217+++ b/include/sound/soc.h
64218@@ -676,7 +676,7 @@ struct snd_soc_platform_driver {
64219 /* platform IO - used for platform DAPM */
64220 unsigned int (*read)(struct snd_soc_platform *, unsigned int);
64221 int (*write)(struct snd_soc_platform *, unsigned int, unsigned int);
64222-};
64223+} __do_const;
64224
64225 struct snd_soc_platform {
64226 const char *name;
64227diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
64228index 444cd6b..3327cc5 100644
64229--- a/include/sound/ymfpci.h
64230+++ b/include/sound/ymfpci.h
64231@@ -358,7 +358,7 @@ struct snd_ymfpci {
64232 spinlock_t reg_lock;
64233 spinlock_t voice_lock;
64234 wait_queue_head_t interrupt_sleep;
64235- atomic_t interrupt_sleep_count;
64236+ atomic_unchecked_t interrupt_sleep_count;
64237 struct snd_info_entry *proc_entry;
64238 const struct firmware *dsp_microcode;
64239 const struct firmware *controller_microcode;
64240diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
64241index 2704065..e10f3ef 100644
64242--- a/include/target/target_core_base.h
64243+++ b/include/target/target_core_base.h
64244@@ -356,7 +356,7 @@ struct t10_reservation_ops {
64245 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
64246 int (*t10_pr_register)(struct se_cmd *);
64247 int (*t10_pr_clear)(struct se_cmd *);
64248-};
64249+} __no_const;
64250
64251 struct t10_reservation {
64252 /* Reservation effects all target ports */
64253@@ -496,8 +496,8 @@ struct se_cmd {
64254 atomic_t t_task_cdbs_left;
64255 atomic_t t_task_cdbs_ex_left;
64256 atomic_t t_task_cdbs_timeout_left;
64257- atomic_t t_task_cdbs_sent;
64258- atomic_t t_transport_aborted;
64259+ atomic_unchecked_t t_task_cdbs_sent;
64260+ atomic_unchecked_t t_transport_aborted;
64261 atomic_t t_transport_active;
64262 atomic_t t_transport_complete;
64263 atomic_t t_transport_queue_active;
64264@@ -744,7 +744,7 @@ struct se_device {
64265 atomic_t active_cmds;
64266 atomic_t simple_cmds;
64267 atomic_t depth_left;
64268- atomic_t dev_ordered_id;
64269+ atomic_unchecked_t dev_ordered_id;
64270 atomic_t dev_tur_active;
64271 atomic_t execute_tasks;
64272 atomic_t dev_status_thr_count;
64273diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
64274index 1c09820..7f5ec79 100644
64275--- a/include/trace/events/irq.h
64276+++ b/include/trace/events/irq.h
64277@@ -36,7 +36,7 @@ struct softirq_action;
64278 */
64279 TRACE_EVENT(irq_handler_entry,
64280
64281- TP_PROTO(int irq, struct irqaction *action),
64282+ TP_PROTO(int irq, const struct irqaction *action),
64283
64284 TP_ARGS(irq, action),
64285
64286@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
64287 */
64288 TRACE_EVENT(irq_handler_exit,
64289
64290- TP_PROTO(int irq, struct irqaction *action, int ret),
64291+ TP_PROTO(int irq, const struct irqaction *action, int ret),
64292
64293 TP_ARGS(irq, action, ret),
64294
64295diff --git a/include/video/udlfb.h b/include/video/udlfb.h
64296index 69d485a..dd0bee7 100644
64297--- a/include/video/udlfb.h
64298+++ b/include/video/udlfb.h
64299@@ -51,10 +51,10 @@ struct dlfb_data {
64300 int base8;
64301 u32 pseudo_palette[256];
64302 /* blit-only rendering path metrics, exposed through sysfs */
64303- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
64304- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
64305- atomic_t bytes_sent; /* to usb, after compression including overhead */
64306- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
64307+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
64308+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
64309+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
64310+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
64311 };
64312
64313 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
64314diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
64315index 0993a22..32ba2fe 100644
64316--- a/include/video/uvesafb.h
64317+++ b/include/video/uvesafb.h
64318@@ -177,6 +177,7 @@ struct uvesafb_par {
64319 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
64320 u8 pmi_setpal; /* PMI for palette changes */
64321 u16 *pmi_base; /* protected mode interface location */
64322+ u8 *pmi_code; /* protected mode code location */
64323 void *pmi_start;
64324 void *pmi_pal;
64325 u8 *vbe_state_orig; /*
64326diff --git a/init/Kconfig b/init/Kconfig
64327index d627783..693a9f3 100644
64328--- a/init/Kconfig
64329+++ b/init/Kconfig
64330@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
64331
64332 config COMPAT_BRK
64333 bool "Disable heap randomization"
64334- default y
64335+ default n
64336 help
64337 Randomizing heap placement makes heap exploits harder, but it
64338 also breaks ancient binaries (including anything libc5 based).
64339diff --git a/init/do_mounts.c b/init/do_mounts.c
64340index c0851a8..4f8977d 100644
64341--- a/init/do_mounts.c
64342+++ b/init/do_mounts.c
64343@@ -287,11 +287,11 @@ static void __init get_fs_names(char *page)
64344
64345 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
64346 {
64347- int err = sys_mount(name, "/root", fs, flags, data);
64348+ int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
64349 if (err)
64350 return err;
64351
64352- sys_chdir((const char __user __force *)"/root");
64353+ sys_chdir((const char __force_user*)"/root");
64354 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
64355 printk(KERN_INFO
64356 "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
64357@@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...)
64358 va_start(args, fmt);
64359 vsprintf(buf, fmt, args);
64360 va_end(args);
64361- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
64362+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
64363 if (fd >= 0) {
64364 sys_ioctl(fd, FDEJECT, 0);
64365 sys_close(fd);
64366 }
64367 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
64368- fd = sys_open("/dev/console", O_RDWR, 0);
64369+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
64370 if (fd >= 0) {
64371 sys_ioctl(fd, TCGETS, (long)&termios);
64372 termios.c_lflag &= ~ICANON;
64373 sys_ioctl(fd, TCSETSF, (long)&termios);
64374- sys_read(fd, &c, 1);
64375+ sys_read(fd, (char __user *)&c, 1);
64376 termios.c_lflag |= ICANON;
64377 sys_ioctl(fd, TCSETSF, (long)&termios);
64378 sys_close(fd);
64379@@ -488,6 +488,6 @@ void __init prepare_namespace(void)
64380 mount_root();
64381 out:
64382 devtmpfs_mount("dev");
64383- sys_mount(".", "/", NULL, MS_MOVE, NULL);
64384- sys_chroot((const char __user __force *)".");
64385+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
64386+ sys_chroot((const char __force_user *)".");
64387 }
64388diff --git a/init/do_mounts.h b/init/do_mounts.h
64389index f5b978a..69dbfe8 100644
64390--- a/init/do_mounts.h
64391+++ b/init/do_mounts.h
64392@@ -15,15 +15,15 @@ extern int root_mountflags;
64393
64394 static inline int create_dev(char *name, dev_t dev)
64395 {
64396- sys_unlink(name);
64397- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
64398+ sys_unlink((char __force_user *)name);
64399+ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
64400 }
64401
64402 #if BITS_PER_LONG == 32
64403 static inline u32 bstat(char *name)
64404 {
64405 struct stat64 stat;
64406- if (sys_stat64(name, &stat) != 0)
64407+ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
64408 return 0;
64409 if (!S_ISBLK(stat.st_mode))
64410 return 0;
64411@@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
64412 static inline u32 bstat(char *name)
64413 {
64414 struct stat stat;
64415- if (sys_newstat(name, &stat) != 0)
64416+ if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
64417 return 0;
64418 if (!S_ISBLK(stat.st_mode))
64419 return 0;
64420diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
64421index 3098a38..253064e 100644
64422--- a/init/do_mounts_initrd.c
64423+++ b/init/do_mounts_initrd.c
64424@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
64425 create_dev("/dev/root.old", Root_RAM0);
64426 /* mount initrd on rootfs' /root */
64427 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
64428- sys_mkdir("/old", 0700);
64429- root_fd = sys_open("/", 0, 0);
64430- old_fd = sys_open("/old", 0, 0);
64431+ sys_mkdir((const char __force_user *)"/old", 0700);
64432+ root_fd = sys_open((const char __force_user *)"/", 0, 0);
64433+ old_fd = sys_open((const char __force_user *)"/old", 0, 0);
64434 /* move initrd over / and chdir/chroot in initrd root */
64435- sys_chdir("/root");
64436- sys_mount(".", "/", NULL, MS_MOVE, NULL);
64437- sys_chroot(".");
64438+ sys_chdir((const char __force_user *)"/root");
64439+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
64440+ sys_chroot((const char __force_user *)".");
64441
64442 /*
64443 * In case that a resume from disk is carried out by linuxrc or one of
64444@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
64445
64446 /* move initrd to rootfs' /old */
64447 sys_fchdir(old_fd);
64448- sys_mount("/", ".", NULL, MS_MOVE, NULL);
64449+ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
64450 /* switch root and cwd back to / of rootfs */
64451 sys_fchdir(root_fd);
64452- sys_chroot(".");
64453+ sys_chroot((const char __force_user *)".");
64454 sys_close(old_fd);
64455 sys_close(root_fd);
64456
64457 if (new_decode_dev(real_root_dev) == Root_RAM0) {
64458- sys_chdir("/old");
64459+ sys_chdir((const char __force_user *)"/old");
64460 return;
64461 }
64462
64463@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
64464 mount_root();
64465
64466 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
64467- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
64468+ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
64469 if (!error)
64470 printk("okay\n");
64471 else {
64472- int fd = sys_open("/dev/root.old", O_RDWR, 0);
64473+ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
64474 if (error == -ENOENT)
64475 printk("/initrd does not exist. Ignored.\n");
64476 else
64477 printk("failed\n");
64478 printk(KERN_NOTICE "Unmounting old root\n");
64479- sys_umount("/old", MNT_DETACH);
64480+ sys_umount((char __force_user *)"/old", MNT_DETACH);
64481 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
64482 if (fd < 0) {
64483 error = fd;
64484@@ -116,11 +116,11 @@ int __init initrd_load(void)
64485 * mounted in the normal path.
64486 */
64487 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
64488- sys_unlink("/initrd.image");
64489+ sys_unlink((const char __force_user *)"/initrd.image");
64490 handle_initrd();
64491 return 1;
64492 }
64493 }
64494- sys_unlink("/initrd.image");
64495+ sys_unlink((const char __force_user *)"/initrd.image");
64496 return 0;
64497 }
64498diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
64499index 32c4799..c27ee74 100644
64500--- a/init/do_mounts_md.c
64501+++ b/init/do_mounts_md.c
64502@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
64503 partitioned ? "_d" : "", minor,
64504 md_setup_args[ent].device_names);
64505
64506- fd = sys_open(name, 0, 0);
64507+ fd = sys_open((char __force_user *)name, 0, 0);
64508 if (fd < 0) {
64509 printk(KERN_ERR "md: open failed - cannot start "
64510 "array %s\n", name);
64511@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
64512 * array without it
64513 */
64514 sys_close(fd);
64515- fd = sys_open(name, 0, 0);
64516+ fd = sys_open((char __force_user *)name, 0, 0);
64517 sys_ioctl(fd, BLKRRPART, 0);
64518 }
64519 sys_close(fd);
64520@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
64521
64522 wait_for_device_probe();
64523
64524- fd = sys_open((const char __user __force *) "/dev/md0", 0, 0);
64525+ fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
64526 if (fd >= 0) {
64527 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
64528 sys_close(fd);
64529diff --git a/init/initramfs.c b/init/initramfs.c
64530index 2531811..040d4d4 100644
64531--- a/init/initramfs.c
64532+++ b/init/initramfs.c
64533@@ -74,7 +74,7 @@ static void __init free_hash(void)
64534 }
64535 }
64536
64537-static long __init do_utime(char __user *filename, time_t mtime)
64538+static long __init do_utime(__force char __user *filename, time_t mtime)
64539 {
64540 struct timespec t[2];
64541
64542@@ -109,7 +109,7 @@ static void __init dir_utime(void)
64543 struct dir_entry *de, *tmp;
64544 list_for_each_entry_safe(de, tmp, &dir_list, list) {
64545 list_del(&de->list);
64546- do_utime(de->name, de->mtime);
64547+ do_utime((char __force_user *)de->name, de->mtime);
64548 kfree(de->name);
64549 kfree(de);
64550 }
64551@@ -271,7 +271,7 @@ static int __init maybe_link(void)
64552 if (nlink >= 2) {
64553 char *old = find_link(major, minor, ino, mode, collected);
64554 if (old)
64555- return (sys_link(old, collected) < 0) ? -1 : 1;
64556+ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
64557 }
64558 return 0;
64559 }
64560@@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
64561 {
64562 struct stat st;
64563
64564- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
64565+ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
64566 if (S_ISDIR(st.st_mode))
64567- sys_rmdir(path);
64568+ sys_rmdir((char __force_user *)path);
64569 else
64570- sys_unlink(path);
64571+ sys_unlink((char __force_user *)path);
64572 }
64573 }
64574
64575@@ -305,7 +305,7 @@ static int __init do_name(void)
64576 int openflags = O_WRONLY|O_CREAT;
64577 if (ml != 1)
64578 openflags |= O_TRUNC;
64579- wfd = sys_open(collected, openflags, mode);
64580+ wfd = sys_open((char __force_user *)collected, openflags, mode);
64581
64582 if (wfd >= 0) {
64583 sys_fchown(wfd, uid, gid);
64584@@ -317,17 +317,17 @@ static int __init do_name(void)
64585 }
64586 }
64587 } else if (S_ISDIR(mode)) {
64588- sys_mkdir(collected, mode);
64589- sys_chown(collected, uid, gid);
64590- sys_chmod(collected, mode);
64591+ sys_mkdir((char __force_user *)collected, mode);
64592+ sys_chown((char __force_user *)collected, uid, gid);
64593+ sys_chmod((char __force_user *)collected, mode);
64594 dir_add(collected, mtime);
64595 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
64596 S_ISFIFO(mode) || S_ISSOCK(mode)) {
64597 if (maybe_link() == 0) {
64598- sys_mknod(collected, mode, rdev);
64599- sys_chown(collected, uid, gid);
64600- sys_chmod(collected, mode);
64601- do_utime(collected, mtime);
64602+ sys_mknod((char __force_user *)collected, mode, rdev);
64603+ sys_chown((char __force_user *)collected, uid, gid);
64604+ sys_chmod((char __force_user *)collected, mode);
64605+ do_utime((char __force_user *)collected, mtime);
64606 }
64607 }
64608 return 0;
64609@@ -336,15 +336,15 @@ static int __init do_name(void)
64610 static int __init do_copy(void)
64611 {
64612 if (count >= body_len) {
64613- sys_write(wfd, victim, body_len);
64614+ sys_write(wfd, (char __force_user *)victim, body_len);
64615 sys_close(wfd);
64616- do_utime(vcollected, mtime);
64617+ do_utime((char __force_user *)vcollected, mtime);
64618 kfree(vcollected);
64619 eat(body_len);
64620 state = SkipIt;
64621 return 0;
64622 } else {
64623- sys_write(wfd, victim, count);
64624+ sys_write(wfd, (char __force_user *)victim, count);
64625 body_len -= count;
64626 eat(count);
64627 return 1;
64628@@ -355,9 +355,9 @@ static int __init do_symlink(void)
64629 {
64630 collected[N_ALIGN(name_len) + body_len] = '\0';
64631 clean_path(collected, 0);
64632- sys_symlink(collected + N_ALIGN(name_len), collected);
64633- sys_lchown(collected, uid, gid);
64634- do_utime(collected, mtime);
64635+ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
64636+ sys_lchown((char __force_user *)collected, uid, gid);
64637+ do_utime((char __force_user *)collected, mtime);
64638 state = SkipIt;
64639 next_state = Reset;
64640 return 0;
64641diff --git a/init/main.c b/init/main.c
64642index 03b408d..5777f59 100644
64643--- a/init/main.c
64644+++ b/init/main.c
64645@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
64646 extern void tc_init(void);
64647 #endif
64648
64649+extern void grsecurity_init(void);
64650+
64651 /*
64652 * Debug helper: via this flag we know that we are in 'early bootup code'
64653 * where only the boot processor is running with IRQ disabled. This means
64654@@ -149,6 +151,49 @@ static int __init set_reset_devices(char *str)
64655
64656 __setup("reset_devices", set_reset_devices);
64657
64658+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
64659+extern char pax_enter_kernel_user[];
64660+extern char pax_exit_kernel_user[];
64661+extern pgdval_t clone_pgd_mask;
64662+#endif
64663+
64664+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
64665+static int __init setup_pax_nouderef(char *str)
64666+{
64667+#ifdef CONFIG_X86_32
64668+ unsigned int cpu;
64669+ struct desc_struct *gdt;
64670+
64671+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
64672+ gdt = get_cpu_gdt_table(cpu);
64673+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
64674+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
64675+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
64676+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
64677+ }
64678+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
64679+#else
64680+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
64681+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
64682+ clone_pgd_mask = ~(pgdval_t)0UL;
64683+#endif
64684+
64685+ return 0;
64686+}
64687+early_param("pax_nouderef", setup_pax_nouderef);
64688+#endif
64689+
64690+#ifdef CONFIG_PAX_SOFTMODE
64691+int pax_softmode;
64692+
64693+static int __init setup_pax_softmode(char *str)
64694+{
64695+ get_option(&str, &pax_softmode);
64696+ return 1;
64697+}
64698+__setup("pax_softmode=", setup_pax_softmode);
64699+#endif
64700+
64701 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
64702 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
64703 static const char *panic_later, *panic_param;
64704@@ -678,6 +723,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
64705 {
64706 int count = preempt_count();
64707 int ret;
64708+ const char *msg1 = "", *msg2 = "";
64709
64710 if (initcall_debug)
64711 ret = do_one_initcall_debug(fn);
64712@@ -690,15 +736,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
64713 sprintf(msgbuf, "error code %d ", ret);
64714
64715 if (preempt_count() != count) {
64716- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
64717+ msg1 = " preemption imbalance";
64718 preempt_count() = count;
64719 }
64720 if (irqs_disabled()) {
64721- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
64722+ msg2 = " disabled interrupts";
64723 local_irq_enable();
64724 }
64725- if (msgbuf[0]) {
64726- printk("initcall %pF returned with %s\n", fn, msgbuf);
64727+ if (msgbuf[0] || *msg1 || *msg2) {
64728+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
64729 }
64730
64731 return ret;
64732@@ -817,7 +863,7 @@ static int __init kernel_init(void * unused)
64733 do_basic_setup();
64734
64735 /* Open the /dev/console on the rootfs, this should never fail */
64736- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
64737+ if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
64738 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
64739
64740 (void) sys_dup(0);
64741@@ -830,11 +876,13 @@ static int __init kernel_init(void * unused)
64742 if (!ramdisk_execute_command)
64743 ramdisk_execute_command = "/init";
64744
64745- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
64746+ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
64747 ramdisk_execute_command = NULL;
64748 prepare_namespace();
64749 }
64750
64751+ grsecurity_init();
64752+
64753 /*
64754 * Ok, we have completed the initial bootup, and
64755 * we're essentially up and running. Get rid of the
64756diff --git a/ipc/mqueue.c b/ipc/mqueue.c
64757index ed049ea..6442f7f 100644
64758--- a/ipc/mqueue.c
64759+++ b/ipc/mqueue.c
64760@@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
64761 mq_bytes = (mq_msg_tblsz +
64762 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
64763
64764+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
64765 spin_lock(&mq_lock);
64766 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
64767 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
64768diff --git a/ipc/msg.c b/ipc/msg.c
64769index 7385de2..a8180e0 100644
64770--- a/ipc/msg.c
64771+++ b/ipc/msg.c
64772@@ -309,18 +309,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
64773 return security_msg_queue_associate(msq, msgflg);
64774 }
64775
64776+static struct ipc_ops msg_ops = {
64777+ .getnew = newque,
64778+ .associate = msg_security,
64779+ .more_checks = NULL
64780+};
64781+
64782 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
64783 {
64784 struct ipc_namespace *ns;
64785- struct ipc_ops msg_ops;
64786 struct ipc_params msg_params;
64787
64788 ns = current->nsproxy->ipc_ns;
64789
64790- msg_ops.getnew = newque;
64791- msg_ops.associate = msg_security;
64792- msg_ops.more_checks = NULL;
64793-
64794 msg_params.key = key;
64795 msg_params.flg = msgflg;
64796
64797diff --git a/ipc/sem.c b/ipc/sem.c
64798index c8e00f8..1135c4e 100644
64799--- a/ipc/sem.c
64800+++ b/ipc/sem.c
64801@@ -318,10 +318,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
64802 return 0;
64803 }
64804
64805+static struct ipc_ops sem_ops = {
64806+ .getnew = newary,
64807+ .associate = sem_security,
64808+ .more_checks = sem_more_checks
64809+};
64810+
64811 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64812 {
64813 struct ipc_namespace *ns;
64814- struct ipc_ops sem_ops;
64815 struct ipc_params sem_params;
64816
64817 ns = current->nsproxy->ipc_ns;
64818@@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64819 if (nsems < 0 || nsems > ns->sc_semmsl)
64820 return -EINVAL;
64821
64822- sem_ops.getnew = newary;
64823- sem_ops.associate = sem_security;
64824- sem_ops.more_checks = sem_more_checks;
64825-
64826 sem_params.key = key;
64827 sem_params.flg = semflg;
64828 sem_params.u.nsems = nsems;
64829@@ -848,6 +849,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
64830 int nsems;
64831 struct list_head tasks;
64832
64833+ pax_track_stack();
64834+
64835 sma = sem_lock_check(ns, semid);
64836 if (IS_ERR(sma))
64837 return PTR_ERR(sma);
64838@@ -1295,6 +1298,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
64839 struct ipc_namespace *ns;
64840 struct list_head tasks;
64841
64842+ pax_track_stack();
64843+
64844 ns = current->nsproxy->ipc_ns;
64845
64846 if (nsops < 1 || semid < 0)
64847diff --git a/ipc/shm.c b/ipc/shm.c
64848index 02ecf2c..c8f5627 100644
64849--- a/ipc/shm.c
64850+++ b/ipc/shm.c
64851@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
64852 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
64853 #endif
64854
64855+#ifdef CONFIG_GRKERNSEC
64856+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64857+ const time_t shm_createtime, const uid_t cuid,
64858+ const int shmid);
64859+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64860+ const time_t shm_createtime);
64861+#endif
64862+
64863 void shm_init_ns(struct ipc_namespace *ns)
64864 {
64865 ns->shm_ctlmax = SHMMAX;
64866@@ -508,6 +516,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
64867 shp->shm_lprid = 0;
64868 shp->shm_atim = shp->shm_dtim = 0;
64869 shp->shm_ctim = get_seconds();
64870+#ifdef CONFIG_GRKERNSEC
64871+ {
64872+ struct timespec timeval;
64873+ do_posix_clock_monotonic_gettime(&timeval);
64874+
64875+ shp->shm_createtime = timeval.tv_sec;
64876+ }
64877+#endif
64878 shp->shm_segsz = size;
64879 shp->shm_nattch = 0;
64880 shp->shm_file = file;
64881@@ -559,18 +575,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
64882 return 0;
64883 }
64884
64885+static struct ipc_ops shm_ops = {
64886+ .getnew = newseg,
64887+ .associate = shm_security,
64888+ .more_checks = shm_more_checks
64889+};
64890+
64891 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
64892 {
64893 struct ipc_namespace *ns;
64894- struct ipc_ops shm_ops;
64895 struct ipc_params shm_params;
64896
64897 ns = current->nsproxy->ipc_ns;
64898
64899- shm_ops.getnew = newseg;
64900- shm_ops.associate = shm_security;
64901- shm_ops.more_checks = shm_more_checks;
64902-
64903 shm_params.key = key;
64904 shm_params.flg = shmflg;
64905 shm_params.u.size = size;
64906@@ -870,8 +887,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
64907 case SHM_LOCK:
64908 case SHM_UNLOCK:
64909 {
64910- struct file *uninitialized_var(shm_file);
64911-
64912 lru_add_drain_all(); /* drain pagevecs to lru lists */
64913
64914 shp = shm_lock_check(ns, shmid);
64915@@ -1004,9 +1019,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
64916 if (err)
64917 goto out_unlock;
64918
64919+#ifdef CONFIG_GRKERNSEC
64920+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
64921+ shp->shm_perm.cuid, shmid) ||
64922+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
64923+ err = -EACCES;
64924+ goto out_unlock;
64925+ }
64926+#endif
64927+
64928 path = shp->shm_file->f_path;
64929 path_get(&path);
64930 shp->shm_nattch++;
64931+#ifdef CONFIG_GRKERNSEC
64932+ shp->shm_lapid = current->pid;
64933+#endif
64934 size = i_size_read(path.dentry->d_inode);
64935 shm_unlock(shp);
64936
64937diff --git a/kernel/acct.c b/kernel/acct.c
64938index fa7eb3d..7faf116 100644
64939--- a/kernel/acct.c
64940+++ b/kernel/acct.c
64941@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
64942 */
64943 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
64944 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
64945- file->f_op->write(file, (char *)&ac,
64946+ file->f_op->write(file, (char __force_user *)&ac,
64947 sizeof(acct_t), &file->f_pos);
64948 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
64949 set_fs(fs);
64950diff --git a/kernel/audit.c b/kernel/audit.c
64951index 0a1355c..dca420f 100644
64952--- a/kernel/audit.c
64953+++ b/kernel/audit.c
64954@@ -115,7 +115,7 @@ u32 audit_sig_sid = 0;
64955 3) suppressed due to audit_rate_limit
64956 4) suppressed due to audit_backlog_limit
64957 */
64958-static atomic_t audit_lost = ATOMIC_INIT(0);
64959+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
64960
64961 /* The netlink socket. */
64962 static struct sock *audit_sock;
64963@@ -237,7 +237,7 @@ void audit_log_lost(const char *message)
64964 unsigned long now;
64965 int print;
64966
64967- atomic_inc(&audit_lost);
64968+ atomic_inc_unchecked(&audit_lost);
64969
64970 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
64971
64972@@ -256,7 +256,7 @@ void audit_log_lost(const char *message)
64973 printk(KERN_WARNING
64974 "audit: audit_lost=%d audit_rate_limit=%d "
64975 "audit_backlog_limit=%d\n",
64976- atomic_read(&audit_lost),
64977+ atomic_read_unchecked(&audit_lost),
64978 audit_rate_limit,
64979 audit_backlog_limit);
64980 audit_panic(message);
64981@@ -689,7 +689,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
64982 status_set.pid = audit_pid;
64983 status_set.rate_limit = audit_rate_limit;
64984 status_set.backlog_limit = audit_backlog_limit;
64985- status_set.lost = atomic_read(&audit_lost);
64986+ status_set.lost = atomic_read_unchecked(&audit_lost);
64987 status_set.backlog = skb_queue_len(&audit_skb_queue);
64988 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
64989 &status_set, sizeof(status_set));
64990diff --git a/kernel/auditsc.c b/kernel/auditsc.c
64991index ce4b054..8139ed7 100644
64992--- a/kernel/auditsc.c
64993+++ b/kernel/auditsc.c
64994@@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
64995 }
64996
64997 /* global counter which is incremented every time something logs in */
64998-static atomic_t session_id = ATOMIC_INIT(0);
64999+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
65000
65001 /**
65002 * audit_set_loginuid - set a task's audit_context loginuid
65003@@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
65004 */
65005 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
65006 {
65007- unsigned int sessionid = atomic_inc_return(&session_id);
65008+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
65009 struct audit_context *context = task->audit_context;
65010
65011 if (context && context->in_syscall) {
65012diff --git a/kernel/capability.c b/kernel/capability.c
65013index 283c529..36ac81e 100644
65014--- a/kernel/capability.c
65015+++ b/kernel/capability.c
65016@@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
65017 * before modification is attempted and the application
65018 * fails.
65019 */
65020+ if (tocopy > ARRAY_SIZE(kdata))
65021+ return -EFAULT;
65022+
65023 if (copy_to_user(dataptr, kdata, tocopy
65024 * sizeof(struct __user_cap_data_struct))) {
65025 return -EFAULT;
65026@@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
65027 BUG();
65028 }
65029
65030- if (security_capable(ns, current_cred(), cap) == 0) {
65031+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
65032 current->flags |= PF_SUPERPRIV;
65033 return true;
65034 }
65035@@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *ns, int cap)
65036 }
65037 EXPORT_SYMBOL(ns_capable);
65038
65039+bool ns_capable_nolog(struct user_namespace *ns, int cap)
65040+{
65041+ if (unlikely(!cap_valid(cap))) {
65042+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
65043+ BUG();
65044+ }
65045+
65046+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
65047+ current->flags |= PF_SUPERPRIV;
65048+ return true;
65049+ }
65050+ return false;
65051+}
65052+EXPORT_SYMBOL(ns_capable_nolog);
65053+
65054+bool capable_nolog(int cap)
65055+{
65056+ return ns_capable_nolog(&init_user_ns, cap);
65057+}
65058+EXPORT_SYMBOL(capable_nolog);
65059+
65060 /**
65061 * task_ns_capable - Determine whether current task has a superior
65062 * capability targeted at a specific task's user namespace.
65063@@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct *t, int cap)
65064 }
65065 EXPORT_SYMBOL(task_ns_capable);
65066
65067+bool task_ns_capable_nolog(struct task_struct *t, int cap)
65068+{
65069+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
65070+}
65071+EXPORT_SYMBOL(task_ns_capable_nolog);
65072+
65073 /**
65074 * nsown_capable - Check superior capability to one's own user_ns
65075 * @cap: The capability in question
65076diff --git a/kernel/cgroup.c b/kernel/cgroup.c
65077index 1d2b6ce..87bf267 100644
65078--- a/kernel/cgroup.c
65079+++ b/kernel/cgroup.c
65080@@ -595,6 +595,8 @@ static struct css_set *find_css_set(
65081 struct hlist_head *hhead;
65082 struct cg_cgroup_link *link;
65083
65084+ pax_track_stack();
65085+
65086 /* First see if we already have a cgroup group that matches
65087 * the desired set */
65088 read_lock(&css_set_lock);
65089diff --git a/kernel/compat.c b/kernel/compat.c
65090index e2435ee..8e82199 100644
65091--- a/kernel/compat.c
65092+++ b/kernel/compat.c
65093@@ -13,6 +13,7 @@
65094
65095 #include <linux/linkage.h>
65096 #include <linux/compat.h>
65097+#include <linux/module.h>
65098 #include <linux/errno.h>
65099 #include <linux/time.h>
65100 #include <linux/signal.h>
65101@@ -167,7 +168,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
65102 mm_segment_t oldfs;
65103 long ret;
65104
65105- restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
65106+ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
65107 oldfs = get_fs();
65108 set_fs(KERNEL_DS);
65109 ret = hrtimer_nanosleep_restart(restart);
65110@@ -199,7 +200,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
65111 oldfs = get_fs();
65112 set_fs(KERNEL_DS);
65113 ret = hrtimer_nanosleep(&tu,
65114- rmtp ? (struct timespec __user *)&rmt : NULL,
65115+ rmtp ? (struct timespec __force_user *)&rmt : NULL,
65116 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
65117 set_fs(oldfs);
65118
65119@@ -308,7 +309,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
65120 mm_segment_t old_fs = get_fs();
65121
65122 set_fs(KERNEL_DS);
65123- ret = sys_sigpending((old_sigset_t __user *) &s);
65124+ ret = sys_sigpending((old_sigset_t __force_user *) &s);
65125 set_fs(old_fs);
65126 if (ret == 0)
65127 ret = put_user(s, set);
65128@@ -331,8 +332,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
65129 old_fs = get_fs();
65130 set_fs(KERNEL_DS);
65131 ret = sys_sigprocmask(how,
65132- set ? (old_sigset_t __user *) &s : NULL,
65133- oset ? (old_sigset_t __user *) &s : NULL);
65134+ set ? (old_sigset_t __force_user *) &s : NULL,
65135+ oset ? (old_sigset_t __force_user *) &s : NULL);
65136 set_fs(old_fs);
65137 if (ret == 0)
65138 if (oset)
65139@@ -369,7 +370,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
65140 mm_segment_t old_fs = get_fs();
65141
65142 set_fs(KERNEL_DS);
65143- ret = sys_old_getrlimit(resource, &r);
65144+ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
65145 set_fs(old_fs);
65146
65147 if (!ret) {
65148@@ -441,7 +442,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
65149 mm_segment_t old_fs = get_fs();
65150
65151 set_fs(KERNEL_DS);
65152- ret = sys_getrusage(who, (struct rusage __user *) &r);
65153+ ret = sys_getrusage(who, (struct rusage __force_user *) &r);
65154 set_fs(old_fs);
65155
65156 if (ret)
65157@@ -468,8 +469,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
65158 set_fs (KERNEL_DS);
65159 ret = sys_wait4(pid,
65160 (stat_addr ?
65161- (unsigned int __user *) &status : NULL),
65162- options, (struct rusage __user *) &r);
65163+ (unsigned int __force_user *) &status : NULL),
65164+ options, (struct rusage __force_user *) &r);
65165 set_fs (old_fs);
65166
65167 if (ret > 0) {
65168@@ -494,8 +495,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
65169 memset(&info, 0, sizeof(info));
65170
65171 set_fs(KERNEL_DS);
65172- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
65173- uru ? (struct rusage __user *)&ru : NULL);
65174+ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
65175+ uru ? (struct rusage __force_user *)&ru : NULL);
65176 set_fs(old_fs);
65177
65178 if ((ret < 0) || (info.si_signo == 0))
65179@@ -625,8 +626,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
65180 oldfs = get_fs();
65181 set_fs(KERNEL_DS);
65182 err = sys_timer_settime(timer_id, flags,
65183- (struct itimerspec __user *) &newts,
65184- (struct itimerspec __user *) &oldts);
65185+ (struct itimerspec __force_user *) &newts,
65186+ (struct itimerspec __force_user *) &oldts);
65187 set_fs(oldfs);
65188 if (!err && old && put_compat_itimerspec(old, &oldts))
65189 return -EFAULT;
65190@@ -643,7 +644,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
65191 oldfs = get_fs();
65192 set_fs(KERNEL_DS);
65193 err = sys_timer_gettime(timer_id,
65194- (struct itimerspec __user *) &ts);
65195+ (struct itimerspec __force_user *) &ts);
65196 set_fs(oldfs);
65197 if (!err && put_compat_itimerspec(setting, &ts))
65198 return -EFAULT;
65199@@ -662,7 +663,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
65200 oldfs = get_fs();
65201 set_fs(KERNEL_DS);
65202 err = sys_clock_settime(which_clock,
65203- (struct timespec __user *) &ts);
65204+ (struct timespec __force_user *) &ts);
65205 set_fs(oldfs);
65206 return err;
65207 }
65208@@ -677,7 +678,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
65209 oldfs = get_fs();
65210 set_fs(KERNEL_DS);
65211 err = sys_clock_gettime(which_clock,
65212- (struct timespec __user *) &ts);
65213+ (struct timespec __force_user *) &ts);
65214 set_fs(oldfs);
65215 if (!err && put_compat_timespec(&ts, tp))
65216 return -EFAULT;
65217@@ -697,7 +698,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
65218
65219 oldfs = get_fs();
65220 set_fs(KERNEL_DS);
65221- ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
65222+ ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
65223 set_fs(oldfs);
65224
65225 err = compat_put_timex(utp, &txc);
65226@@ -717,7 +718,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
65227 oldfs = get_fs();
65228 set_fs(KERNEL_DS);
65229 err = sys_clock_getres(which_clock,
65230- (struct timespec __user *) &ts);
65231+ (struct timespec __force_user *) &ts);
65232 set_fs(oldfs);
65233 if (!err && tp && put_compat_timespec(&ts, tp))
65234 return -EFAULT;
65235@@ -729,9 +730,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
65236 long err;
65237 mm_segment_t oldfs;
65238 struct timespec tu;
65239- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
65240+ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
65241
65242- restart->nanosleep.rmtp = (struct timespec __user *) &tu;
65243+ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
65244 oldfs = get_fs();
65245 set_fs(KERNEL_DS);
65246 err = clock_nanosleep_restart(restart);
65247@@ -763,8 +764,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
65248 oldfs = get_fs();
65249 set_fs(KERNEL_DS);
65250 err = sys_clock_nanosleep(which_clock, flags,
65251- (struct timespec __user *) &in,
65252- (struct timespec __user *) &out);
65253+ (struct timespec __force_user *) &in,
65254+ (struct timespec __force_user *) &out);
65255 set_fs(oldfs);
65256
65257 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
65258diff --git a/kernel/configs.c b/kernel/configs.c
65259index 42e8fa0..9e7406b 100644
65260--- a/kernel/configs.c
65261+++ b/kernel/configs.c
65262@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
65263 struct proc_dir_entry *entry;
65264
65265 /* create the current config file */
65266+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
65267+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
65268+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
65269+ &ikconfig_file_ops);
65270+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65271+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
65272+ &ikconfig_file_ops);
65273+#endif
65274+#else
65275 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
65276 &ikconfig_file_ops);
65277+#endif
65278+
65279 if (!entry)
65280 return -ENOMEM;
65281
65282diff --git a/kernel/cred.c b/kernel/cred.c
65283index 8ef31f5..d7d50d8 100644
65284--- a/kernel/cred.c
65285+++ b/kernel/cred.c
65286@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
65287 */
65288 void __put_cred(struct cred *cred)
65289 {
65290+ pax_track_stack();
65291+
65292 kdebug("__put_cred(%p{%d,%d})", cred,
65293 atomic_read(&cred->usage),
65294 read_cred_subscribers(cred));
65295@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
65296 {
65297 struct cred *cred;
65298
65299+ pax_track_stack();
65300+
65301 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
65302 atomic_read(&tsk->cred->usage),
65303 read_cred_subscribers(tsk->cred));
65304@@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct task_struct *task)
65305 {
65306 const struct cred *cred;
65307
65308+ pax_track_stack();
65309+
65310 rcu_read_lock();
65311
65312 do {
65313@@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
65314 {
65315 struct cred *new;
65316
65317+ pax_track_stack();
65318+
65319 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
65320 if (!new)
65321 return NULL;
65322@@ -281,12 +289,14 @@ error:
65323 *
65324 * Call commit_creds() or abort_creds() to clean up.
65325 */
65326-struct cred *prepare_creds(void)
65327+
65328+static struct cred *__prepare_creds(struct task_struct *task)
65329 {
65330- struct task_struct *task = current;
65331 const struct cred *old;
65332 struct cred *new;
65333
65334+ pax_track_stack();
65335+
65336 validate_process_creds();
65337
65338 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65339@@ -322,6 +332,11 @@ error:
65340 abort_creds(new);
65341 return NULL;
65342 }
65343+
65344+struct cred *prepare_creds(void)
65345+{
65346+ return __prepare_creds(current);
65347+}
65348 EXPORT_SYMBOL(prepare_creds);
65349
65350 /*
65351@@ -333,6 +348,8 @@ struct cred *prepare_exec_creds(void)
65352 struct thread_group_cred *tgcred = NULL;
65353 struct cred *new;
65354
65355+ pax_track_stack();
65356+
65357 #ifdef CONFIG_KEYS
65358 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
65359 if (!tgcred)
65360@@ -385,6 +402,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
65361 struct cred *new;
65362 int ret;
65363
65364+ pax_track_stack();
65365+
65366 if (
65367 #ifdef CONFIG_KEYS
65368 !p->cred->thread_keyring &&
65369@@ -470,11 +489,12 @@ error_put:
65370 * Always returns 0 thus allowing this function to be tail-called at the end
65371 * of, say, sys_setgid().
65372 */
65373-int commit_creds(struct cred *new)
65374+static int __commit_creds(struct task_struct *task, struct cred *new)
65375 {
65376- struct task_struct *task = current;
65377 const struct cred *old = task->real_cred;
65378
65379+ pax_track_stack();
65380+
65381 kdebug("commit_creds(%p{%d,%d})", new,
65382 atomic_read(&new->usage),
65383 read_cred_subscribers(new));
65384@@ -489,6 +509,8 @@ int commit_creds(struct cred *new)
65385
65386 get_cred(new); /* we will require a ref for the subj creds too */
65387
65388+ gr_set_role_label(task, new->uid, new->gid);
65389+
65390 /* dumpability changes */
65391 if (old->euid != new->euid ||
65392 old->egid != new->egid ||
65393@@ -538,6 +560,64 @@ int commit_creds(struct cred *new)
65394 put_cred(old);
65395 return 0;
65396 }
65397+
65398+int commit_creds(struct cred *new)
65399+{
65400+#ifdef CONFIG_GRKERNSEC_SETXID
65401+ struct task_struct *t;
65402+ struct cred *ncred;
65403+ const struct cred *old;
65404+
65405+ if (grsec_enable_setxid && !current_is_single_threaded() &&
65406+ !current_uid() && new->uid) {
65407+ rcu_read_lock();
65408+ read_lock(&tasklist_lock);
65409+ for (t = next_thread(current); t != current;
65410+ t = next_thread(t)) {
65411+ old = __task_cred(t);
65412+ if (old->uid)
65413+ continue;
65414+ ncred = __prepare_creds(t);
65415+ if (!ncred)
65416+ goto die;
65417+ // uids
65418+ ncred->uid = new->uid;
65419+ ncred->euid = new->euid;
65420+ ncred->suid = new->suid;
65421+ ncred->fsuid = new->fsuid;
65422+ // gids
65423+ ncred->gid = new->gid;
65424+ ncred->egid = new->egid;
65425+ ncred->sgid = new->sgid;
65426+ ncred->fsgid = new->fsgid;
65427+ // groups
65428+ if (set_groups(ncred, new->group_info) < 0) {
65429+ abort_creds(ncred);
65430+ goto die;
65431+ }
65432+ // caps
65433+ ncred->securebits = new->securebits;
65434+ ncred->cap_inheritable = new->cap_inheritable;
65435+ ncred->cap_permitted = new->cap_permitted;
65436+ ncred->cap_effective = new->cap_effective;
65437+ ncred->cap_bset = new->cap_bset;
65438+
65439+ __commit_creds(t, ncred);
65440+ }
65441+ read_unlock(&tasklist_lock);
65442+ rcu_read_unlock();
65443+ }
65444+#endif
65445+ return __commit_creds(current, new);
65446+#ifdef CONFIG_GRKERNSEC_SETXID
65447+die:
65448+ read_unlock(&tasklist_lock);
65449+ rcu_read_unlock();
65450+ abort_creds(new);
65451+ do_group_exit(SIGKILL);
65452+#endif
65453+}
65454+
65455 EXPORT_SYMBOL(commit_creds);
65456
65457 /**
65458@@ -549,6 +629,8 @@ EXPORT_SYMBOL(commit_creds);
65459 */
65460 void abort_creds(struct cred *new)
65461 {
65462+ pax_track_stack();
65463+
65464 kdebug("abort_creds(%p{%d,%d})", new,
65465 atomic_read(&new->usage),
65466 read_cred_subscribers(new));
65467@@ -572,6 +654,8 @@ const struct cred *override_creds(const struct cred *new)
65468 {
65469 const struct cred *old = current->cred;
65470
65471+ pax_track_stack();
65472+
65473 kdebug("override_creds(%p{%d,%d})", new,
65474 atomic_read(&new->usage),
65475 read_cred_subscribers(new));
65476@@ -601,6 +685,8 @@ void revert_creds(const struct cred *old)
65477 {
65478 const struct cred *override = current->cred;
65479
65480+ pax_track_stack();
65481+
65482 kdebug("revert_creds(%p{%d,%d})", old,
65483 atomic_read(&old->usage),
65484 read_cred_subscribers(old));
65485@@ -647,6 +733,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
65486 const struct cred *old;
65487 struct cred *new;
65488
65489+ pax_track_stack();
65490+
65491 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65492 if (!new)
65493 return NULL;
65494@@ -701,6 +789,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
65495 */
65496 int set_security_override(struct cred *new, u32 secid)
65497 {
65498+ pax_track_stack();
65499+
65500 return security_kernel_act_as(new, secid);
65501 }
65502 EXPORT_SYMBOL(set_security_override);
65503@@ -720,6 +810,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
65504 u32 secid;
65505 int ret;
65506
65507+ pax_track_stack();
65508+
65509 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
65510 if (ret < 0)
65511 return ret;
65512diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
65513index 0d7c087..01b8cef 100644
65514--- a/kernel/debug/debug_core.c
65515+++ b/kernel/debug/debug_core.c
65516@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
65517 */
65518 static atomic_t masters_in_kgdb;
65519 static atomic_t slaves_in_kgdb;
65520-static atomic_t kgdb_break_tasklet_var;
65521+static atomic_unchecked_t kgdb_break_tasklet_var;
65522 atomic_t kgdb_setting_breakpoint;
65523
65524 struct task_struct *kgdb_usethread;
65525@@ -129,7 +129,7 @@ int kgdb_single_step;
65526 static pid_t kgdb_sstep_pid;
65527
65528 /* to keep track of the CPU which is doing the single stepping*/
65529-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65530+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65531
65532 /*
65533 * If you are debugging a problem where roundup (the collection of
65534@@ -542,7 +542,7 @@ return_normal:
65535 * kernel will only try for the value of sstep_tries before
65536 * giving up and continuing on.
65537 */
65538- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
65539+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
65540 (kgdb_info[cpu].task &&
65541 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
65542 atomic_set(&kgdb_active, -1);
65543@@ -636,8 +636,8 @@ cpu_master_loop:
65544 }
65545
65546 kgdb_restore:
65547- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
65548- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
65549+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
65550+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
65551 if (kgdb_info[sstep_cpu].task)
65552 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
65553 else
65554@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(void)
65555 static void kgdb_tasklet_bpt(unsigned long ing)
65556 {
65557 kgdb_breakpoint();
65558- atomic_set(&kgdb_break_tasklet_var, 0);
65559+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
65560 }
65561
65562 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
65563
65564 void kgdb_schedule_breakpoint(void)
65565 {
65566- if (atomic_read(&kgdb_break_tasklet_var) ||
65567+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
65568 atomic_read(&kgdb_active) != -1 ||
65569 atomic_read(&kgdb_setting_breakpoint))
65570 return;
65571- atomic_inc(&kgdb_break_tasklet_var);
65572+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
65573 tasklet_schedule(&kgdb_tasklet_breakpoint);
65574 }
65575 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
65576diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
65577index 63786e7..0780cac 100644
65578--- a/kernel/debug/kdb/kdb_main.c
65579+++ b/kernel/debug/kdb/kdb_main.c
65580@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const char **argv)
65581 list_for_each_entry(mod, kdb_modules, list) {
65582
65583 kdb_printf("%-20s%8u 0x%p ", mod->name,
65584- mod->core_size, (void *)mod);
65585+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
65586 #ifdef CONFIG_MODULE_UNLOAD
65587 kdb_printf("%4d ", module_refcount(mod));
65588 #endif
65589@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const char **argv)
65590 kdb_printf(" (Loading)");
65591 else
65592 kdb_printf(" (Live)");
65593- kdb_printf(" 0x%p", mod->module_core);
65594+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
65595
65596 #ifdef CONFIG_MODULE_UNLOAD
65597 {
65598diff --git a/kernel/events/core.c b/kernel/events/core.c
65599index 0f85778..0d43716 100644
65600--- a/kernel/events/core.c
65601+++ b/kernel/events/core.c
65602@@ -172,7 +172,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
65603 return 0;
65604 }
65605
65606-static atomic64_t perf_event_id;
65607+static atomic64_unchecked_t perf_event_id;
65608
65609 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
65610 enum event_type_t event_type);
65611@@ -2535,7 +2535,7 @@ static void __perf_event_read(void *info)
65612
65613 static inline u64 perf_event_count(struct perf_event *event)
65614 {
65615- return local64_read(&event->count) + atomic64_read(&event->child_count);
65616+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
65617 }
65618
65619 static u64 perf_event_read(struct perf_event *event)
65620@@ -3060,9 +3060,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
65621 mutex_lock(&event->child_mutex);
65622 total += perf_event_read(event);
65623 *enabled += event->total_time_enabled +
65624- atomic64_read(&event->child_total_time_enabled);
65625+ atomic64_read_unchecked(&event->child_total_time_enabled);
65626 *running += event->total_time_running +
65627- atomic64_read(&event->child_total_time_running);
65628+ atomic64_read_unchecked(&event->child_total_time_running);
65629
65630 list_for_each_entry(child, &event->child_list, child_list) {
65631 total += perf_event_read(child);
65632@@ -3448,10 +3448,10 @@ void perf_event_update_userpage(struct perf_event *event)
65633 userpg->offset -= local64_read(&event->hw.prev_count);
65634
65635 userpg->time_enabled = enabled +
65636- atomic64_read(&event->child_total_time_enabled);
65637+ atomic64_read_unchecked(&event->child_total_time_enabled);
65638
65639 userpg->time_running = running +
65640- atomic64_read(&event->child_total_time_running);
65641+ atomic64_read_unchecked(&event->child_total_time_running);
65642
65643 barrier();
65644 ++userpg->lock;
65645@@ -3822,11 +3822,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
65646 values[n++] = perf_event_count(event);
65647 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
65648 values[n++] = enabled +
65649- atomic64_read(&event->child_total_time_enabled);
65650+ atomic64_read_unchecked(&event->child_total_time_enabled);
65651 }
65652 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
65653 values[n++] = running +
65654- atomic64_read(&event->child_total_time_running);
65655+ atomic64_read_unchecked(&event->child_total_time_running);
65656 }
65657 if (read_format & PERF_FORMAT_ID)
65658 values[n++] = primary_event_id(event);
65659@@ -4477,12 +4477,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
65660 * need to add enough zero bytes after the string to handle
65661 * the 64bit alignment we do later.
65662 */
65663- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
65664+ buf = kzalloc(PATH_MAX, GFP_KERNEL);
65665 if (!buf) {
65666 name = strncpy(tmp, "//enomem", sizeof(tmp));
65667 goto got_name;
65668 }
65669- name = d_path(&file->f_path, buf, PATH_MAX);
65670+ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
65671 if (IS_ERR(name)) {
65672 name = strncpy(tmp, "//toolong", sizeof(tmp));
65673 goto got_name;
65674@@ -5833,7 +5833,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
65675 event->parent = parent_event;
65676
65677 event->ns = get_pid_ns(current->nsproxy->pid_ns);
65678- event->id = atomic64_inc_return(&perf_event_id);
65679+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
65680
65681 event->state = PERF_EVENT_STATE_INACTIVE;
65682
65683@@ -6355,10 +6355,10 @@ static void sync_child_event(struct perf_event *child_event,
65684 /*
65685 * Add back the child's count to the parent's count:
65686 */
65687- atomic64_add(child_val, &parent_event->child_count);
65688- atomic64_add(child_event->total_time_enabled,
65689+ atomic64_add_unchecked(child_val, &parent_event->child_count);
65690+ atomic64_add_unchecked(child_event->total_time_enabled,
65691 &parent_event->child_total_time_enabled);
65692- atomic64_add(child_event->total_time_running,
65693+ atomic64_add_unchecked(child_event->total_time_running,
65694 &parent_event->child_total_time_running);
65695
65696 /*
65697diff --git a/kernel/exit.c b/kernel/exit.c
65698index 2913b35..4465c81 100644
65699--- a/kernel/exit.c
65700+++ b/kernel/exit.c
65701@@ -57,6 +57,10 @@
65702 #include <asm/pgtable.h>
65703 #include <asm/mmu_context.h>
65704
65705+#ifdef CONFIG_GRKERNSEC
65706+extern rwlock_t grsec_exec_file_lock;
65707+#endif
65708+
65709 static void exit_mm(struct task_struct * tsk);
65710
65711 static void __unhash_process(struct task_struct *p, bool group_dead)
65712@@ -168,6 +172,10 @@ void release_task(struct task_struct * p)
65713 struct task_struct *leader;
65714 int zap_leader;
65715 repeat:
65716+#ifdef CONFIG_NET
65717+ gr_del_task_from_ip_table(p);
65718+#endif
65719+
65720 /* don't need to get the RCU readlock here - the process is dead and
65721 * can't be modifying its own credentials. But shut RCU-lockdep up */
65722 rcu_read_lock();
65723@@ -380,7 +388,7 @@ int allow_signal(int sig)
65724 * know it'll be handled, so that they don't get converted to
65725 * SIGKILL or just silently dropped.
65726 */
65727- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
65728+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
65729 recalc_sigpending();
65730 spin_unlock_irq(&current->sighand->siglock);
65731 return 0;
65732@@ -416,6 +424,17 @@ void daemonize(const char *name, ...)
65733 vsnprintf(current->comm, sizeof(current->comm), name, args);
65734 va_end(args);
65735
65736+#ifdef CONFIG_GRKERNSEC
65737+ write_lock(&grsec_exec_file_lock);
65738+ if (current->exec_file) {
65739+ fput(current->exec_file);
65740+ current->exec_file = NULL;
65741+ }
65742+ write_unlock(&grsec_exec_file_lock);
65743+#endif
65744+
65745+ gr_set_kernel_label(current);
65746+
65747 /*
65748 * If we were started as result of loading a module, close all of the
65749 * user space pages. We don't need them, and if we didn't close them
65750@@ -895,6 +914,8 @@ NORET_TYPE void do_exit(long code)
65751 struct task_struct *tsk = current;
65752 int group_dead;
65753
65754+ set_fs(USER_DS);
65755+
65756 profile_task_exit(tsk);
65757
65758 WARN_ON(blk_needs_flush_plug(tsk));
65759@@ -911,7 +932,6 @@ NORET_TYPE void do_exit(long code)
65760 * mm_release()->clear_child_tid() from writing to a user-controlled
65761 * kernel address.
65762 */
65763- set_fs(USER_DS);
65764
65765 ptrace_event(PTRACE_EVENT_EXIT, code);
65766
65767@@ -973,6 +993,9 @@ NORET_TYPE void do_exit(long code)
65768 tsk->exit_code = code;
65769 taskstats_exit(tsk, group_dead);
65770
65771+ gr_acl_handle_psacct(tsk, code);
65772+ gr_acl_handle_exit();
65773+
65774 exit_mm(tsk);
65775
65776 if (group_dead)
65777diff --git a/kernel/fork.c b/kernel/fork.c
65778index 8e6b6f4..9dccf00 100644
65779--- a/kernel/fork.c
65780+++ b/kernel/fork.c
65781@@ -285,7 +285,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
65782 *stackend = STACK_END_MAGIC; /* for overflow detection */
65783
65784 #ifdef CONFIG_CC_STACKPROTECTOR
65785- tsk->stack_canary = get_random_int();
65786+ tsk->stack_canary = pax_get_random_long();
65787 #endif
65788
65789 /*
65790@@ -309,13 +309,77 @@ out:
65791 }
65792
65793 #ifdef CONFIG_MMU
65794+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
65795+{
65796+ struct vm_area_struct *tmp;
65797+ unsigned long charge;
65798+ struct mempolicy *pol;
65799+ struct file *file;
65800+
65801+ charge = 0;
65802+ if (mpnt->vm_flags & VM_ACCOUNT) {
65803+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
65804+ if (security_vm_enough_memory(len))
65805+ goto fail_nomem;
65806+ charge = len;
65807+ }
65808+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
65809+ if (!tmp)
65810+ goto fail_nomem;
65811+ *tmp = *mpnt;
65812+ tmp->vm_mm = mm;
65813+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
65814+ pol = mpol_dup(vma_policy(mpnt));
65815+ if (IS_ERR(pol))
65816+ goto fail_nomem_policy;
65817+ vma_set_policy(tmp, pol);
65818+ if (anon_vma_fork(tmp, mpnt))
65819+ goto fail_nomem_anon_vma_fork;
65820+ tmp->vm_flags &= ~VM_LOCKED;
65821+ tmp->vm_next = tmp->vm_prev = NULL;
65822+ tmp->vm_mirror = NULL;
65823+ file = tmp->vm_file;
65824+ if (file) {
65825+ struct inode *inode = file->f_path.dentry->d_inode;
65826+ struct address_space *mapping = file->f_mapping;
65827+
65828+ get_file(file);
65829+ if (tmp->vm_flags & VM_DENYWRITE)
65830+ atomic_dec(&inode->i_writecount);
65831+ mutex_lock(&mapping->i_mmap_mutex);
65832+ if (tmp->vm_flags & VM_SHARED)
65833+ mapping->i_mmap_writable++;
65834+ flush_dcache_mmap_lock(mapping);
65835+ /* insert tmp into the share list, just after mpnt */
65836+ vma_prio_tree_add(tmp, mpnt);
65837+ flush_dcache_mmap_unlock(mapping);
65838+ mutex_unlock(&mapping->i_mmap_mutex);
65839+ }
65840+
65841+ /*
65842+ * Clear hugetlb-related page reserves for children. This only
65843+ * affects MAP_PRIVATE mappings. Faults generated by the child
65844+ * are not guaranteed to succeed, even if read-only
65845+ */
65846+ if (is_vm_hugetlb_page(tmp))
65847+ reset_vma_resv_huge_pages(tmp);
65848+
65849+ return tmp;
65850+
65851+fail_nomem_anon_vma_fork:
65852+ mpol_put(pol);
65853+fail_nomem_policy:
65854+ kmem_cache_free(vm_area_cachep, tmp);
65855+fail_nomem:
65856+ vm_unacct_memory(charge);
65857+ return NULL;
65858+}
65859+
65860 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65861 {
65862 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
65863 struct rb_node **rb_link, *rb_parent;
65864 int retval;
65865- unsigned long charge;
65866- struct mempolicy *pol;
65867
65868 down_write(&oldmm->mmap_sem);
65869 flush_cache_dup_mm(oldmm);
65870@@ -327,8 +391,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65871 mm->locked_vm = 0;
65872 mm->mmap = NULL;
65873 mm->mmap_cache = NULL;
65874- mm->free_area_cache = oldmm->mmap_base;
65875- mm->cached_hole_size = ~0UL;
65876+ mm->free_area_cache = oldmm->free_area_cache;
65877+ mm->cached_hole_size = oldmm->cached_hole_size;
65878 mm->map_count = 0;
65879 cpumask_clear(mm_cpumask(mm));
65880 mm->mm_rb = RB_ROOT;
65881@@ -344,8 +408,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65882
65883 prev = NULL;
65884 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
65885- struct file *file;
65886-
65887 if (mpnt->vm_flags & VM_DONTCOPY) {
65888 long pages = vma_pages(mpnt);
65889 mm->total_vm -= pages;
65890@@ -353,53 +415,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65891 -pages);
65892 continue;
65893 }
65894- charge = 0;
65895- if (mpnt->vm_flags & VM_ACCOUNT) {
65896- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
65897- if (security_vm_enough_memory(len))
65898- goto fail_nomem;
65899- charge = len;
65900+ tmp = dup_vma(mm, mpnt);
65901+ if (!tmp) {
65902+ retval = -ENOMEM;
65903+ goto out;
65904 }
65905- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
65906- if (!tmp)
65907- goto fail_nomem;
65908- *tmp = *mpnt;
65909- INIT_LIST_HEAD(&tmp->anon_vma_chain);
65910- pol = mpol_dup(vma_policy(mpnt));
65911- retval = PTR_ERR(pol);
65912- if (IS_ERR(pol))
65913- goto fail_nomem_policy;
65914- vma_set_policy(tmp, pol);
65915- tmp->vm_mm = mm;
65916- if (anon_vma_fork(tmp, mpnt))
65917- goto fail_nomem_anon_vma_fork;
65918- tmp->vm_flags &= ~VM_LOCKED;
65919- tmp->vm_next = tmp->vm_prev = NULL;
65920- file = tmp->vm_file;
65921- if (file) {
65922- struct inode *inode = file->f_path.dentry->d_inode;
65923- struct address_space *mapping = file->f_mapping;
65924-
65925- get_file(file);
65926- if (tmp->vm_flags & VM_DENYWRITE)
65927- atomic_dec(&inode->i_writecount);
65928- mutex_lock(&mapping->i_mmap_mutex);
65929- if (tmp->vm_flags & VM_SHARED)
65930- mapping->i_mmap_writable++;
65931- flush_dcache_mmap_lock(mapping);
65932- /* insert tmp into the share list, just after mpnt */
65933- vma_prio_tree_add(tmp, mpnt);
65934- flush_dcache_mmap_unlock(mapping);
65935- mutex_unlock(&mapping->i_mmap_mutex);
65936- }
65937-
65938- /*
65939- * Clear hugetlb-related page reserves for children. This only
65940- * affects MAP_PRIVATE mappings. Faults generated by the child
65941- * are not guaranteed to succeed, even if read-only
65942- */
65943- if (is_vm_hugetlb_page(tmp))
65944- reset_vma_resv_huge_pages(tmp);
65945
65946 /*
65947 * Link in the new vma and copy the page table entries.
65948@@ -422,6 +442,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65949 if (retval)
65950 goto out;
65951 }
65952+
65953+#ifdef CONFIG_PAX_SEGMEXEC
65954+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
65955+ struct vm_area_struct *mpnt_m;
65956+
65957+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
65958+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
65959+
65960+ if (!mpnt->vm_mirror)
65961+ continue;
65962+
65963+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
65964+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
65965+ mpnt->vm_mirror = mpnt_m;
65966+ } else {
65967+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
65968+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
65969+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
65970+ mpnt->vm_mirror->vm_mirror = mpnt;
65971+ }
65972+ }
65973+ BUG_ON(mpnt_m);
65974+ }
65975+#endif
65976+
65977 /* a new mm has just been created */
65978 arch_dup_mmap(oldmm, mm);
65979 retval = 0;
65980@@ -430,14 +475,6 @@ out:
65981 flush_tlb_mm(oldmm);
65982 up_write(&oldmm->mmap_sem);
65983 return retval;
65984-fail_nomem_anon_vma_fork:
65985- mpol_put(pol);
65986-fail_nomem_policy:
65987- kmem_cache_free(vm_area_cachep, tmp);
65988-fail_nomem:
65989- retval = -ENOMEM;
65990- vm_unacct_memory(charge);
65991- goto out;
65992 }
65993
65994 static inline int mm_alloc_pgd(struct mm_struct *mm)
65995@@ -837,13 +874,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
65996 spin_unlock(&fs->lock);
65997 return -EAGAIN;
65998 }
65999- fs->users++;
66000+ atomic_inc(&fs->users);
66001 spin_unlock(&fs->lock);
66002 return 0;
66003 }
66004 tsk->fs = copy_fs_struct(fs);
66005 if (!tsk->fs)
66006 return -ENOMEM;
66007+ gr_set_chroot_entries(tsk, &tsk->fs->root);
66008 return 0;
66009 }
66010
66011@@ -1105,6 +1143,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
66012 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
66013 #endif
66014 retval = -EAGAIN;
66015+
66016+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
66017+
66018 if (atomic_read(&p->real_cred->user->processes) >=
66019 task_rlimit(p, RLIMIT_NPROC)) {
66020 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
66021@@ -1264,6 +1305,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
66022 if (clone_flags & CLONE_THREAD)
66023 p->tgid = current->tgid;
66024
66025+ gr_copy_label(p);
66026+
66027 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
66028 /*
66029 * Clear TID on mm_release()?
66030@@ -1428,6 +1471,8 @@ bad_fork_cleanup_count:
66031 bad_fork_free:
66032 free_task(p);
66033 fork_out:
66034+ gr_log_forkfail(retval);
66035+
66036 return ERR_PTR(retval);
66037 }
66038
66039@@ -1528,6 +1573,8 @@ long do_fork(unsigned long clone_flags,
66040 if (clone_flags & CLONE_PARENT_SETTID)
66041 put_user(nr, parent_tidptr);
66042
66043+ gr_handle_brute_check();
66044+
66045 if (clone_flags & CLONE_VFORK) {
66046 p->vfork_done = &vfork;
66047 init_completion(&vfork);
66048@@ -1637,7 +1684,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
66049 return 0;
66050
66051 /* don't need lock here; in the worst case we'll do useless copy */
66052- if (fs->users == 1)
66053+ if (atomic_read(&fs->users) == 1)
66054 return 0;
66055
66056 *new_fsp = copy_fs_struct(fs);
66057@@ -1726,7 +1773,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
66058 fs = current->fs;
66059 spin_lock(&fs->lock);
66060 current->fs = new_fs;
66061- if (--fs->users)
66062+ gr_set_chroot_entries(current, &current->fs->root);
66063+ if (atomic_dec_return(&fs->users))
66064 new_fs = NULL;
66065 else
66066 new_fs = fs;
66067diff --git a/kernel/futex.c b/kernel/futex.c
66068index 11cbe05..c5dab58 100644
66069--- a/kernel/futex.c
66070+++ b/kernel/futex.c
66071@@ -54,6 +54,7 @@
66072 #include <linux/mount.h>
66073 #include <linux/pagemap.h>
66074 #include <linux/syscalls.h>
66075+#include <linux/ptrace.h>
66076 #include <linux/signal.h>
66077 #include <linux/module.h>
66078 #include <linux/magic.h>
66079@@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
66080 struct page *page, *page_head;
66081 int err, ro = 0;
66082
66083+#ifdef CONFIG_PAX_SEGMEXEC
66084+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
66085+ return -EFAULT;
66086+#endif
66087+
66088 /*
66089 * The futex address must be "naturally" aligned.
66090 */
66091@@ -1863,6 +1869,8 @@ static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
66092 struct futex_q q = futex_q_init;
66093 int ret;
66094
66095+ pax_track_stack();
66096+
66097 if (!bitset)
66098 return -EINVAL;
66099 q.bitset = bitset;
66100@@ -2259,6 +2267,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
66101 struct futex_q q = futex_q_init;
66102 int res, ret;
66103
66104+ pax_track_stack();
66105+
66106 if (!bitset)
66107 return -EINVAL;
66108
66109@@ -2447,6 +2457,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
66110 if (!p)
66111 goto err_unlock;
66112 ret = -EPERM;
66113+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66114+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
66115+ goto err_unlock;
66116+#endif
66117 pcred = __task_cred(p);
66118 /* If victim is in different user_ns, then uids are not
66119 comparable, so we must have CAP_SYS_PTRACE */
66120@@ -2712,6 +2726,7 @@ static int __init futex_init(void)
66121 {
66122 u32 curval;
66123 int i;
66124+ mm_segment_t oldfs;
66125
66126 /*
66127 * This will fail and we want it. Some arch implementations do
66128@@ -2723,8 +2738,11 @@ static int __init futex_init(void)
66129 * implementation, the non-functional ones will return
66130 * -ENOSYS.
66131 */
66132+ oldfs = get_fs();
66133+ set_fs(USER_DS);
66134 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
66135 futex_cmpxchg_enabled = 1;
66136+ set_fs(oldfs);
66137
66138 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
66139 plist_head_init(&futex_queues[i].chain);
66140diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
66141index 5f9e689..582d46d 100644
66142--- a/kernel/futex_compat.c
66143+++ b/kernel/futex_compat.c
66144@@ -10,6 +10,7 @@
66145 #include <linux/compat.h>
66146 #include <linux/nsproxy.h>
66147 #include <linux/futex.h>
66148+#include <linux/ptrace.h>
66149
66150 #include <asm/uaccess.h>
66151
66152@@ -136,7 +137,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66153 {
66154 struct compat_robust_list_head __user *head;
66155 unsigned long ret;
66156- const struct cred *cred = current_cred(), *pcred;
66157+ const struct cred *cred = current_cred();
66158+ const struct cred *pcred;
66159
66160 if (!futex_cmpxchg_enabled)
66161 return -ENOSYS;
66162@@ -152,6 +154,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66163 if (!p)
66164 goto err_unlock;
66165 ret = -EPERM;
66166+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66167+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
66168+ goto err_unlock;
66169+#endif
66170 pcred = __task_cred(p);
66171 /* If victim is in different user_ns, then uids are not
66172 comparable, so we must have CAP_SYS_PTRACE */
66173diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
66174index 9b22d03..6295b62 100644
66175--- a/kernel/gcov/base.c
66176+++ b/kernel/gcov/base.c
66177@@ -102,11 +102,6 @@ void gcov_enable_events(void)
66178 }
66179
66180 #ifdef CONFIG_MODULES
66181-static inline int within(void *addr, void *start, unsigned long size)
66182-{
66183- return ((addr >= start) && (addr < start + size));
66184-}
66185-
66186 /* Update list and generate events when modules are unloaded. */
66187 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66188 void *data)
66189@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66190 prev = NULL;
66191 /* Remove entries located in module from linked list. */
66192 for (info = gcov_info_head; info; info = info->next) {
66193- if (within(info, mod->module_core, mod->core_size)) {
66194+ if (within_module_core_rw((unsigned long)info, mod)) {
66195 if (prev)
66196 prev->next = info->next;
66197 else
66198diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
66199index 2043c08..ec81a69 100644
66200--- a/kernel/hrtimer.c
66201+++ b/kernel/hrtimer.c
66202@@ -1393,7 +1393,7 @@ void hrtimer_peek_ahead_timers(void)
66203 local_irq_restore(flags);
66204 }
66205
66206-static void run_hrtimer_softirq(struct softirq_action *h)
66207+static void run_hrtimer_softirq(void)
66208 {
66209 hrtimer_peek_ahead_timers();
66210 }
66211diff --git a/kernel/jump_label.c b/kernel/jump_label.c
66212index e6f1f24..6c19597 100644
66213--- a/kernel/jump_label.c
66214+++ b/kernel/jump_label.c
66215@@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
66216
66217 size = (((unsigned long)stop - (unsigned long)start)
66218 / sizeof(struct jump_entry));
66219+ pax_open_kernel();
66220 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
66221+ pax_close_kernel();
66222 }
66223
66224 static void jump_label_update(struct jump_label_key *key, int enable);
66225@@ -298,10 +300,12 @@ static void jump_label_invalidate_module_init(struct module *mod)
66226 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
66227 struct jump_entry *iter;
66228
66229+ pax_open_kernel();
66230 for (iter = iter_start; iter < iter_stop; iter++) {
66231 if (within_module_init(iter->code, mod))
66232 iter->code = 0;
66233 }
66234+ pax_close_kernel();
66235 }
66236
66237 static int
66238diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
66239index 079f1d3..a407562 100644
66240--- a/kernel/kallsyms.c
66241+++ b/kernel/kallsyms.c
66242@@ -11,6 +11,9 @@
66243 * Changed the compression method from stem compression to "table lookup"
66244 * compression (see scripts/kallsyms.c for a more complete description)
66245 */
66246+#ifdef CONFIG_GRKERNSEC_HIDESYM
66247+#define __INCLUDED_BY_HIDESYM 1
66248+#endif
66249 #include <linux/kallsyms.h>
66250 #include <linux/module.h>
66251 #include <linux/init.h>
66252@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
66253
66254 static inline int is_kernel_inittext(unsigned long addr)
66255 {
66256+ if (system_state != SYSTEM_BOOTING)
66257+ return 0;
66258+
66259 if (addr >= (unsigned long)_sinittext
66260 && addr <= (unsigned long)_einittext)
66261 return 1;
66262 return 0;
66263 }
66264
66265+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66266+#ifdef CONFIG_MODULES
66267+static inline int is_module_text(unsigned long addr)
66268+{
66269+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
66270+ return 1;
66271+
66272+ addr = ktla_ktva(addr);
66273+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
66274+}
66275+#else
66276+static inline int is_module_text(unsigned long addr)
66277+{
66278+ return 0;
66279+}
66280+#endif
66281+#endif
66282+
66283 static inline int is_kernel_text(unsigned long addr)
66284 {
66285 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
66286@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigned long addr)
66287
66288 static inline int is_kernel(unsigned long addr)
66289 {
66290+
66291+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66292+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
66293+ return 1;
66294+
66295+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
66296+#else
66297 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
66298+#endif
66299+
66300 return 1;
66301 return in_gate_area_no_mm(addr);
66302 }
66303
66304 static int is_ksym_addr(unsigned long addr)
66305 {
66306+
66307+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66308+ if (is_module_text(addr))
66309+ return 0;
66310+#endif
66311+
66312 if (all_var)
66313 return is_kernel(addr);
66314
66315@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
66316
66317 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
66318 {
66319- iter->name[0] = '\0';
66320 iter->nameoff = get_symbol_offset(new_pos);
66321 iter->pos = new_pos;
66322 }
66323@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, void *p)
66324 {
66325 struct kallsym_iter *iter = m->private;
66326
66327+#ifdef CONFIG_GRKERNSEC_HIDESYM
66328+ if (current_uid())
66329+ return 0;
66330+#endif
66331+
66332 /* Some debugging symbols have no name. Ignore them. */
66333 if (!iter->name[0])
66334 return 0;
66335@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
66336 struct kallsym_iter *iter;
66337 int ret;
66338
66339- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
66340+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
66341 if (!iter)
66342 return -ENOMEM;
66343 reset_iter(iter, 0);
66344diff --git a/kernel/kexec.c b/kernel/kexec.c
66345index 296fbc8..84cb857 100644
66346--- a/kernel/kexec.c
66347+++ b/kernel/kexec.c
66348@@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
66349 unsigned long flags)
66350 {
66351 struct compat_kexec_segment in;
66352- struct kexec_segment out, __user *ksegments;
66353+ struct kexec_segment out;
66354+ struct kexec_segment __user *ksegments;
66355 unsigned long i, result;
66356
66357 /* Don't allow clients that don't understand the native
66358diff --git a/kernel/kmod.c b/kernel/kmod.c
66359index a4bea97..7a1ae9a 100644
66360--- a/kernel/kmod.c
66361+++ b/kernel/kmod.c
66362@@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
66363 * If module auto-loading support is disabled then this function
66364 * becomes a no-operation.
66365 */
66366-int __request_module(bool wait, const char *fmt, ...)
66367+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
66368 {
66369- va_list args;
66370 char module_name[MODULE_NAME_LEN];
66371 unsigned int max_modprobes;
66372 int ret;
66373- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
66374+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
66375 static char *envp[] = { "HOME=/",
66376 "TERM=linux",
66377 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
66378@@ -88,9 +87,7 @@ int __request_module(bool wait, const char *fmt, ...)
66379 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
66380 static int kmod_loop_msg;
66381
66382- va_start(args, fmt);
66383- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
66384- va_end(args);
66385+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
66386 if (ret >= MODULE_NAME_LEN)
66387 return -ENAMETOOLONG;
66388
66389@@ -98,6 +95,20 @@ int __request_module(bool wait, const char *fmt, ...)
66390 if (ret)
66391 return ret;
66392
66393+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66394+ if (!current_uid()) {
66395+ /* hack to workaround consolekit/udisks stupidity */
66396+ read_lock(&tasklist_lock);
66397+ if (!strcmp(current->comm, "mount") &&
66398+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
66399+ read_unlock(&tasklist_lock);
66400+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
66401+ return -EPERM;
66402+ }
66403+ read_unlock(&tasklist_lock);
66404+ }
66405+#endif
66406+
66407 /* If modprobe needs a service that is in a module, we get a recursive
66408 * loop. Limit the number of running kmod threads to max_threads/2 or
66409 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
66410@@ -133,6 +144,47 @@ int __request_module(bool wait, const char *fmt, ...)
66411 atomic_dec(&kmod_concurrent);
66412 return ret;
66413 }
66414+
66415+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
66416+{
66417+ va_list args;
66418+ int ret;
66419+
66420+ va_start(args, fmt);
66421+ ret = ____request_module(wait, module_param, fmt, args);
66422+ va_end(args);
66423+
66424+ return ret;
66425+}
66426+
66427+int __request_module(bool wait, const char *fmt, ...)
66428+{
66429+ va_list args;
66430+ int ret;
66431+
66432+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66433+ if (current_uid()) {
66434+ char module_param[MODULE_NAME_LEN];
66435+
66436+ memset(module_param, 0, sizeof(module_param));
66437+
66438+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
66439+
66440+ va_start(args, fmt);
66441+ ret = ____request_module(wait, module_param, fmt, args);
66442+ va_end(args);
66443+
66444+ return ret;
66445+ }
66446+#endif
66447+
66448+ va_start(args, fmt);
66449+ ret = ____request_module(wait, NULL, fmt, args);
66450+ va_end(args);
66451+
66452+ return ret;
66453+}
66454+
66455 EXPORT_SYMBOL(__request_module);
66456 #endif /* CONFIG_MODULES */
66457
66458@@ -222,7 +274,7 @@ static int wait_for_helper(void *data)
66459 *
66460 * Thus the __user pointer cast is valid here.
66461 */
66462- sys_wait4(pid, (int __user *)&ret, 0, NULL);
66463+ sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
66464
66465 /*
66466 * If ret is 0, either ____call_usermodehelper failed and the
66467diff --git a/kernel/kprobes.c b/kernel/kprobes.c
66468index b30fd54..11821ec 100644
66469--- a/kernel/kprobes.c
66470+++ b/kernel/kprobes.c
66471@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
66472 * kernel image and loaded module images reside. This is required
66473 * so x86_64 can correctly handle the %rip-relative fixups.
66474 */
66475- kip->insns = module_alloc(PAGE_SIZE);
66476+ kip->insns = module_alloc_exec(PAGE_SIZE);
66477 if (!kip->insns) {
66478 kfree(kip);
66479 return NULL;
66480@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
66481 */
66482 if (!list_is_singular(&kip->list)) {
66483 list_del(&kip->list);
66484- module_free(NULL, kip->insns);
66485+ module_free_exec(NULL, kip->insns);
66486 kfree(kip);
66487 }
66488 return 1;
66489@@ -1949,7 +1949,7 @@ static int __init init_kprobes(void)
66490 {
66491 int i, err = 0;
66492 unsigned long offset = 0, size = 0;
66493- char *modname, namebuf[128];
66494+ char *modname, namebuf[KSYM_NAME_LEN];
66495 const char *symbol_name;
66496 void *addr;
66497 struct kprobe_blackpoint *kb;
66498@@ -2075,7 +2075,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
66499 const char *sym = NULL;
66500 unsigned int i = *(loff_t *) v;
66501 unsigned long offset = 0;
66502- char *modname, namebuf[128];
66503+ char *modname, namebuf[KSYM_NAME_LEN];
66504
66505 head = &kprobe_table[i];
66506 preempt_disable();
66507diff --git a/kernel/lockdep.c b/kernel/lockdep.c
66508index 4479606..4036bea 100644
66509--- a/kernel/lockdep.c
66510+++ b/kernel/lockdep.c
66511@@ -584,6 +584,10 @@ static int static_obj(void *obj)
66512 end = (unsigned long) &_end,
66513 addr = (unsigned long) obj;
66514
66515+#ifdef CONFIG_PAX_KERNEXEC
66516+ start = ktla_ktva(start);
66517+#endif
66518+
66519 /*
66520 * static variable?
66521 */
66522@@ -719,6 +723,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
66523 if (!static_obj(lock->key)) {
66524 debug_locks_off();
66525 printk("INFO: trying to register non-static key.\n");
66526+ printk("lock:%pS key:%pS.\n", lock, lock->key);
66527 printk("the code is fine but needs lockdep annotation.\n");
66528 printk("turning off the locking correctness validator.\n");
66529 dump_stack();
66530@@ -2954,7 +2959,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
66531 if (!class)
66532 return 0;
66533 }
66534- atomic_inc((atomic_t *)&class->ops);
66535+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
66536 if (very_verbose(class)) {
66537 printk("\nacquire class [%p] %s", class->key, class->name);
66538 if (class->name_version > 1)
66539diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
66540index 71edd2f..e0542a5 100644
66541--- a/kernel/lockdep_proc.c
66542+++ b/kernel/lockdep_proc.c
66543@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
66544
66545 static void print_name(struct seq_file *m, struct lock_class *class)
66546 {
66547- char str[128];
66548+ char str[KSYM_NAME_LEN];
66549 const char *name = class->name;
66550
66551 if (!name) {
66552diff --git a/kernel/module.c b/kernel/module.c
66553index 04379f92..fba2faf 100644
66554--- a/kernel/module.c
66555+++ b/kernel/module.c
66556@@ -58,6 +58,7 @@
66557 #include <linux/jump_label.h>
66558 #include <linux/pfn.h>
66559 #include <linux/bsearch.h>
66560+#include <linux/grsecurity.h>
66561
66562 #define CREATE_TRACE_POINTS
66563 #include <trace/events/module.h>
66564@@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
66565
66566 /* Bounds of module allocation, for speeding __module_address.
66567 * Protected by module_mutex. */
66568-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
66569+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
66570+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
66571
66572 int register_module_notifier(struct notifier_block * nb)
66573 {
66574@@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
66575 return true;
66576
66577 list_for_each_entry_rcu(mod, &modules, list) {
66578- struct symsearch arr[] = {
66579+ struct symsearch modarr[] = {
66580 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
66581 NOT_GPL_ONLY, false },
66582 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
66583@@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
66584 #endif
66585 };
66586
66587- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
66588+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
66589 return true;
66590 }
66591 return false;
66592@@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu(struct module *mod)
66593 static int percpu_modalloc(struct module *mod,
66594 unsigned long size, unsigned long align)
66595 {
66596- if (align > PAGE_SIZE) {
66597+ if (align-1 >= PAGE_SIZE) {
66598 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
66599 mod->name, align, PAGE_SIZE);
66600 align = PAGE_SIZE;
66601@@ -1183,7 +1185,7 @@ resolve_symbol_wait(struct module *mod,
66602 */
66603 #ifdef CONFIG_SYSFS
66604
66605-#ifdef CONFIG_KALLSYMS
66606+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
66607 static inline bool sect_empty(const Elf_Shdr *sect)
66608 {
66609 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
66610@@ -1649,21 +1651,21 @@ static void set_section_ro_nx(void *base,
66611
66612 static void unset_module_core_ro_nx(struct module *mod)
66613 {
66614- set_page_attributes(mod->module_core + mod->core_text_size,
66615- mod->module_core + mod->core_size,
66616+ set_page_attributes(mod->module_core_rw,
66617+ mod->module_core_rw + mod->core_size_rw,
66618 set_memory_x);
66619- set_page_attributes(mod->module_core,
66620- mod->module_core + mod->core_ro_size,
66621+ set_page_attributes(mod->module_core_rx,
66622+ mod->module_core_rx + mod->core_size_rx,
66623 set_memory_rw);
66624 }
66625
66626 static void unset_module_init_ro_nx(struct module *mod)
66627 {
66628- set_page_attributes(mod->module_init + mod->init_text_size,
66629- mod->module_init + mod->init_size,
66630+ set_page_attributes(mod->module_init_rw,
66631+ mod->module_init_rw + mod->init_size_rw,
66632 set_memory_x);
66633- set_page_attributes(mod->module_init,
66634- mod->module_init + mod->init_ro_size,
66635+ set_page_attributes(mod->module_init_rx,
66636+ mod->module_init_rx + mod->init_size_rx,
66637 set_memory_rw);
66638 }
66639
66640@@ -1674,14 +1676,14 @@ void set_all_modules_text_rw(void)
66641
66642 mutex_lock(&module_mutex);
66643 list_for_each_entry_rcu(mod, &modules, list) {
66644- if ((mod->module_core) && (mod->core_text_size)) {
66645- set_page_attributes(mod->module_core,
66646- mod->module_core + mod->core_text_size,
66647+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
66648+ set_page_attributes(mod->module_core_rx,
66649+ mod->module_core_rx + mod->core_size_rx,
66650 set_memory_rw);
66651 }
66652- if ((mod->module_init) && (mod->init_text_size)) {
66653- set_page_attributes(mod->module_init,
66654- mod->module_init + mod->init_text_size,
66655+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
66656+ set_page_attributes(mod->module_init_rx,
66657+ mod->module_init_rx + mod->init_size_rx,
66658 set_memory_rw);
66659 }
66660 }
66661@@ -1695,14 +1697,14 @@ void set_all_modules_text_ro(void)
66662
66663 mutex_lock(&module_mutex);
66664 list_for_each_entry_rcu(mod, &modules, list) {
66665- if ((mod->module_core) && (mod->core_text_size)) {
66666- set_page_attributes(mod->module_core,
66667- mod->module_core + mod->core_text_size,
66668+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
66669+ set_page_attributes(mod->module_core_rx,
66670+ mod->module_core_rx + mod->core_size_rx,
66671 set_memory_ro);
66672 }
66673- if ((mod->module_init) && (mod->init_text_size)) {
66674- set_page_attributes(mod->module_init,
66675- mod->module_init + mod->init_text_size,
66676+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
66677+ set_page_attributes(mod->module_init_rx,
66678+ mod->module_init_rx + mod->init_size_rx,
66679 set_memory_ro);
66680 }
66681 }
66682@@ -1748,16 +1750,19 @@ static void free_module(struct module *mod)
66683
66684 /* This may be NULL, but that's OK */
66685 unset_module_init_ro_nx(mod);
66686- module_free(mod, mod->module_init);
66687+ module_free(mod, mod->module_init_rw);
66688+ module_free_exec(mod, mod->module_init_rx);
66689 kfree(mod->args);
66690 percpu_modfree(mod);
66691
66692 /* Free lock-classes: */
66693- lockdep_free_key_range(mod->module_core, mod->core_size);
66694+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
66695+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
66696
66697 /* Finally, free the core (containing the module structure) */
66698 unset_module_core_ro_nx(mod);
66699- module_free(mod, mod->module_core);
66700+ module_free_exec(mod, mod->module_core_rx);
66701+ module_free(mod, mod->module_core_rw);
66702
66703 #ifdef CONFIG_MPU
66704 update_protections(current->mm);
66705@@ -1826,10 +1831,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66706 unsigned int i;
66707 int ret = 0;
66708 const struct kernel_symbol *ksym;
66709+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66710+ int is_fs_load = 0;
66711+ int register_filesystem_found = 0;
66712+ char *p;
66713+
66714+ p = strstr(mod->args, "grsec_modharden_fs");
66715+ if (p) {
66716+ char *endptr = p + strlen("grsec_modharden_fs");
66717+ /* copy \0 as well */
66718+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
66719+ is_fs_load = 1;
66720+ }
66721+#endif
66722
66723 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
66724 const char *name = info->strtab + sym[i].st_name;
66725
66726+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66727+ /* it's a real shame this will never get ripped and copied
66728+ upstream! ;(
66729+ */
66730+ if (is_fs_load && !strcmp(name, "register_filesystem"))
66731+ register_filesystem_found = 1;
66732+#endif
66733+
66734 switch (sym[i].st_shndx) {
66735 case SHN_COMMON:
66736 /* We compiled with -fno-common. These are not
66737@@ -1850,7 +1876,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66738 ksym = resolve_symbol_wait(mod, info, name);
66739 /* Ok if resolved. */
66740 if (ksym && !IS_ERR(ksym)) {
66741+ pax_open_kernel();
66742 sym[i].st_value = ksym->value;
66743+ pax_close_kernel();
66744 break;
66745 }
66746
66747@@ -1869,11 +1897,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66748 secbase = (unsigned long)mod_percpu(mod);
66749 else
66750 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
66751+ pax_open_kernel();
66752 sym[i].st_value += secbase;
66753+ pax_close_kernel();
66754 break;
66755 }
66756 }
66757
66758+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66759+ if (is_fs_load && !register_filesystem_found) {
66760+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
66761+ ret = -EPERM;
66762+ }
66763+#endif
66764+
66765 return ret;
66766 }
66767
66768@@ -1977,22 +2014,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
66769 || s->sh_entsize != ~0UL
66770 || strstarts(sname, ".init"))
66771 continue;
66772- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
66773+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66774+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
66775+ else
66776+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
66777 DEBUGP("\t%s\n", name);
66778 }
66779- switch (m) {
66780- case 0: /* executable */
66781- mod->core_size = debug_align(mod->core_size);
66782- mod->core_text_size = mod->core_size;
66783- break;
66784- case 1: /* RO: text and ro-data */
66785- mod->core_size = debug_align(mod->core_size);
66786- mod->core_ro_size = mod->core_size;
66787- break;
66788- case 3: /* whole core */
66789- mod->core_size = debug_align(mod->core_size);
66790- break;
66791- }
66792 }
66793
66794 DEBUGP("Init section allocation order:\n");
66795@@ -2006,23 +2033,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
66796 || s->sh_entsize != ~0UL
66797 || !strstarts(sname, ".init"))
66798 continue;
66799- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
66800- | INIT_OFFSET_MASK);
66801+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66802+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
66803+ else
66804+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
66805+ s->sh_entsize |= INIT_OFFSET_MASK;
66806 DEBUGP("\t%s\n", sname);
66807 }
66808- switch (m) {
66809- case 0: /* executable */
66810- mod->init_size = debug_align(mod->init_size);
66811- mod->init_text_size = mod->init_size;
66812- break;
66813- case 1: /* RO: text and ro-data */
66814- mod->init_size = debug_align(mod->init_size);
66815- mod->init_ro_size = mod->init_size;
66816- break;
66817- case 3: /* whole init */
66818- mod->init_size = debug_align(mod->init_size);
66819- break;
66820- }
66821 }
66822 }
66823
66824@@ -2187,7 +2204,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
66825
66826 /* Put symbol section at end of init part of module. */
66827 symsect->sh_flags |= SHF_ALLOC;
66828- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
66829+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
66830 info->index.sym) | INIT_OFFSET_MASK;
66831 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
66832
66833@@ -2204,19 +2221,19 @@ static void layout_symtab(struct module *mod, struct load_info *info)
66834 }
66835
66836 /* Append room for core symbols at end of core part. */
66837- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
66838- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
66839+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
66840+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
66841
66842 /* Put string table section at end of init part of module. */
66843 strsect->sh_flags |= SHF_ALLOC;
66844- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
66845+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
66846 info->index.str) | INIT_OFFSET_MASK;
66847 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
66848
66849 /* Append room for core symbols' strings at end of core part. */
66850- info->stroffs = mod->core_size;
66851+ info->stroffs = mod->core_size_rx;
66852 __set_bit(0, info->strmap);
66853- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
66854+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
66855 }
66856
66857 static void add_kallsyms(struct module *mod, const struct load_info *info)
66858@@ -2232,11 +2249,13 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
66859 /* Make sure we get permanent strtab: don't use info->strtab. */
66860 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
66861
66862+ pax_open_kernel();
66863+
66864 /* Set types up while we still have access to sections. */
66865 for (i = 0; i < mod->num_symtab; i++)
66866 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
66867
66868- mod->core_symtab = dst = mod->module_core + info->symoffs;
66869+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
66870 src = mod->symtab;
66871 *dst = *src;
66872 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
66873@@ -2249,10 +2268,12 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
66874 }
66875 mod->core_num_syms = ndst;
66876
66877- mod->core_strtab = s = mod->module_core + info->stroffs;
66878+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
66879 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
66880 if (test_bit(i, info->strmap))
66881 *++s = mod->strtab[i];
66882+
66883+ pax_close_kernel();
66884 }
66885 #else
66886 static inline void layout_symtab(struct module *mod, struct load_info *info)
66887@@ -2286,17 +2307,33 @@ void * __weak module_alloc(unsigned long size)
66888 return size == 0 ? NULL : vmalloc_exec(size);
66889 }
66890
66891-static void *module_alloc_update_bounds(unsigned long size)
66892+static void *module_alloc_update_bounds_rw(unsigned long size)
66893 {
66894 void *ret = module_alloc(size);
66895
66896 if (ret) {
66897 mutex_lock(&module_mutex);
66898 /* Update module bounds. */
66899- if ((unsigned long)ret < module_addr_min)
66900- module_addr_min = (unsigned long)ret;
66901- if ((unsigned long)ret + size > module_addr_max)
66902- module_addr_max = (unsigned long)ret + size;
66903+ if ((unsigned long)ret < module_addr_min_rw)
66904+ module_addr_min_rw = (unsigned long)ret;
66905+ if ((unsigned long)ret + size > module_addr_max_rw)
66906+ module_addr_max_rw = (unsigned long)ret + size;
66907+ mutex_unlock(&module_mutex);
66908+ }
66909+ return ret;
66910+}
66911+
66912+static void *module_alloc_update_bounds_rx(unsigned long size)
66913+{
66914+ void *ret = module_alloc_exec(size);
66915+
66916+ if (ret) {
66917+ mutex_lock(&module_mutex);
66918+ /* Update module bounds. */
66919+ if ((unsigned long)ret < module_addr_min_rx)
66920+ module_addr_min_rx = (unsigned long)ret;
66921+ if ((unsigned long)ret + size > module_addr_max_rx)
66922+ module_addr_max_rx = (unsigned long)ret + size;
66923 mutex_unlock(&module_mutex);
66924 }
66925 return ret;
66926@@ -2474,8 +2511,14 @@ static struct module *setup_load_info(struct load_info *info)
66927 static int check_modinfo(struct module *mod, struct load_info *info)
66928 {
66929 const char *modmagic = get_modinfo(info, "vermagic");
66930+ const char *license = get_modinfo(info, "license");
66931 int err;
66932
66933+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
66934+ if (!license || !license_is_gpl_compatible(license))
66935+ return -ENOEXEC;
66936+#endif
66937+
66938 /* This is allowed: modprobe --force will invalidate it. */
66939 if (!modmagic) {
66940 err = try_to_force_load(mod, "bad vermagic");
66941@@ -2495,7 +2538,7 @@ static int check_modinfo(struct module *mod, struct load_info *info)
66942 }
66943
66944 /* Set up license info based on the info section */
66945- set_license(mod, get_modinfo(info, "license"));
66946+ set_license(mod, license);
66947
66948 return 0;
66949 }
66950@@ -2589,7 +2632,7 @@ static int move_module(struct module *mod, struct load_info *info)
66951 void *ptr;
66952
66953 /* Do the allocs. */
66954- ptr = module_alloc_update_bounds(mod->core_size);
66955+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
66956 /*
66957 * The pointer to this block is stored in the module structure
66958 * which is inside the block. Just mark it as not being a
66959@@ -2599,23 +2642,50 @@ static int move_module(struct module *mod, struct load_info *info)
66960 if (!ptr)
66961 return -ENOMEM;
66962
66963- memset(ptr, 0, mod->core_size);
66964- mod->module_core = ptr;
66965+ memset(ptr, 0, mod->core_size_rw);
66966+ mod->module_core_rw = ptr;
66967
66968- ptr = module_alloc_update_bounds(mod->init_size);
66969+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
66970 /*
66971 * The pointer to this block is stored in the module structure
66972 * which is inside the block. This block doesn't need to be
66973 * scanned as it contains data and code that will be freed
66974 * after the module is initialized.
66975 */
66976- kmemleak_ignore(ptr);
66977- if (!ptr && mod->init_size) {
66978- module_free(mod, mod->module_core);
66979+ kmemleak_not_leak(ptr);
66980+ if (!ptr && mod->init_size_rw) {
66981+ module_free(mod, mod->module_core_rw);
66982 return -ENOMEM;
66983 }
66984- memset(ptr, 0, mod->init_size);
66985- mod->module_init = ptr;
66986+ memset(ptr, 0, mod->init_size_rw);
66987+ mod->module_init_rw = ptr;
66988+
66989+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
66990+ kmemleak_not_leak(ptr);
66991+ if (!ptr) {
66992+ module_free(mod, mod->module_init_rw);
66993+ module_free(mod, mod->module_core_rw);
66994+ return -ENOMEM;
66995+ }
66996+
66997+ pax_open_kernel();
66998+ memset(ptr, 0, mod->core_size_rx);
66999+ pax_close_kernel();
67000+ mod->module_core_rx = ptr;
67001+
67002+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
67003+ kmemleak_not_leak(ptr);
67004+ if (!ptr && mod->init_size_rx) {
67005+ module_free_exec(mod, mod->module_core_rx);
67006+ module_free(mod, mod->module_init_rw);
67007+ module_free(mod, mod->module_core_rw);
67008+ return -ENOMEM;
67009+ }
67010+
67011+ pax_open_kernel();
67012+ memset(ptr, 0, mod->init_size_rx);
67013+ pax_close_kernel();
67014+ mod->module_init_rx = ptr;
67015
67016 /* Transfer each section which specifies SHF_ALLOC */
67017 DEBUGP("final section addresses:\n");
67018@@ -2626,16 +2696,45 @@ static int move_module(struct module *mod, struct load_info *info)
67019 if (!(shdr->sh_flags & SHF_ALLOC))
67020 continue;
67021
67022- if (shdr->sh_entsize & INIT_OFFSET_MASK)
67023- dest = mod->module_init
67024- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67025- else
67026- dest = mod->module_core + shdr->sh_entsize;
67027+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
67028+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
67029+ dest = mod->module_init_rw
67030+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67031+ else
67032+ dest = mod->module_init_rx
67033+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67034+ } else {
67035+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
67036+ dest = mod->module_core_rw + shdr->sh_entsize;
67037+ else
67038+ dest = mod->module_core_rx + shdr->sh_entsize;
67039+ }
67040+
67041+ if (shdr->sh_type != SHT_NOBITS) {
67042+
67043+#ifdef CONFIG_PAX_KERNEXEC
67044+#ifdef CONFIG_X86_64
67045+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
67046+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
67047+#endif
67048+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
67049+ pax_open_kernel();
67050+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
67051+ pax_close_kernel();
67052+ } else
67053+#endif
67054
67055- if (shdr->sh_type != SHT_NOBITS)
67056 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
67057+ }
67058 /* Update sh_addr to point to copy in image. */
67059- shdr->sh_addr = (unsigned long)dest;
67060+
67061+#ifdef CONFIG_PAX_KERNEXEC
67062+ if (shdr->sh_flags & SHF_EXECINSTR)
67063+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
67064+ else
67065+#endif
67066+
67067+ shdr->sh_addr = (unsigned long)dest;
67068 DEBUGP("\t0x%lx %s\n",
67069 shdr->sh_addr, info->secstrings + shdr->sh_name);
67070 }
67071@@ -2686,12 +2785,12 @@ static void flush_module_icache(const struct module *mod)
67072 * Do it before processing of module parameters, so the module
67073 * can provide parameter accessor functions of its own.
67074 */
67075- if (mod->module_init)
67076- flush_icache_range((unsigned long)mod->module_init,
67077- (unsigned long)mod->module_init
67078- + mod->init_size);
67079- flush_icache_range((unsigned long)mod->module_core,
67080- (unsigned long)mod->module_core + mod->core_size);
67081+ if (mod->module_init_rx)
67082+ flush_icache_range((unsigned long)mod->module_init_rx,
67083+ (unsigned long)mod->module_init_rx
67084+ + mod->init_size_rx);
67085+ flush_icache_range((unsigned long)mod->module_core_rx,
67086+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
67087
67088 set_fs(old_fs);
67089 }
67090@@ -2771,8 +2870,10 @@ static void module_deallocate(struct module *mod, struct load_info *info)
67091 {
67092 kfree(info->strmap);
67093 percpu_modfree(mod);
67094- module_free(mod, mod->module_init);
67095- module_free(mod, mod->module_core);
67096+ module_free_exec(mod, mod->module_init_rx);
67097+ module_free_exec(mod, mod->module_core_rx);
67098+ module_free(mod, mod->module_init_rw);
67099+ module_free(mod, mod->module_core_rw);
67100 }
67101
67102 int __weak module_finalize(const Elf_Ehdr *hdr,
67103@@ -2836,9 +2937,38 @@ static struct module *load_module(void __user *umod,
67104 if (err)
67105 goto free_unload;
67106
67107+ /* Now copy in args */
67108+ mod->args = strndup_user(uargs, ~0UL >> 1);
67109+ if (IS_ERR(mod->args)) {
67110+ err = PTR_ERR(mod->args);
67111+ goto free_unload;
67112+ }
67113+
67114 /* Set up MODINFO_ATTR fields */
67115 setup_modinfo(mod, &info);
67116
67117+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67118+ {
67119+ char *p, *p2;
67120+
67121+ if (strstr(mod->args, "grsec_modharden_netdev")) {
67122+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
67123+ err = -EPERM;
67124+ goto free_modinfo;
67125+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
67126+ p += strlen("grsec_modharden_normal");
67127+ p2 = strstr(p, "_");
67128+ if (p2) {
67129+ *p2 = '\0';
67130+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
67131+ *p2 = '_';
67132+ }
67133+ err = -EPERM;
67134+ goto free_modinfo;
67135+ }
67136+ }
67137+#endif
67138+
67139 /* Fix up syms, so that st_value is a pointer to location. */
67140 err = simplify_symbols(mod, &info);
67141 if (err < 0)
67142@@ -2854,13 +2984,6 @@ static struct module *load_module(void __user *umod,
67143
67144 flush_module_icache(mod);
67145
67146- /* Now copy in args */
67147- mod->args = strndup_user(uargs, ~0UL >> 1);
67148- if (IS_ERR(mod->args)) {
67149- err = PTR_ERR(mod->args);
67150- goto free_arch_cleanup;
67151- }
67152-
67153 /* Mark state as coming so strong_try_module_get() ignores us. */
67154 mod->state = MODULE_STATE_COMING;
67155
67156@@ -2920,11 +3043,10 @@ static struct module *load_module(void __user *umod,
67157 unlock:
67158 mutex_unlock(&module_mutex);
67159 synchronize_sched();
67160- kfree(mod->args);
67161- free_arch_cleanup:
67162 module_arch_cleanup(mod);
67163 free_modinfo:
67164 free_modinfo(mod);
67165+ kfree(mod->args);
67166 free_unload:
67167 module_unload_free(mod);
67168 free_module:
67169@@ -2965,16 +3087,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67170 MODULE_STATE_COMING, mod);
67171
67172 /* Set RO and NX regions for core */
67173- set_section_ro_nx(mod->module_core,
67174- mod->core_text_size,
67175- mod->core_ro_size,
67176- mod->core_size);
67177+ set_section_ro_nx(mod->module_core_rx,
67178+ mod->core_size_rx,
67179+ mod->core_size_rx,
67180+ mod->core_size_rx);
67181
67182 /* Set RO and NX regions for init */
67183- set_section_ro_nx(mod->module_init,
67184- mod->init_text_size,
67185- mod->init_ro_size,
67186- mod->init_size);
67187+ set_section_ro_nx(mod->module_init_rx,
67188+ mod->init_size_rx,
67189+ mod->init_size_rx,
67190+ mod->init_size_rx);
67191
67192 do_mod_ctors(mod);
67193 /* Start the module */
67194@@ -3020,11 +3142,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67195 mod->strtab = mod->core_strtab;
67196 #endif
67197 unset_module_init_ro_nx(mod);
67198- module_free(mod, mod->module_init);
67199- mod->module_init = NULL;
67200- mod->init_size = 0;
67201- mod->init_ro_size = 0;
67202- mod->init_text_size = 0;
67203+ module_free(mod, mod->module_init_rw);
67204+ module_free_exec(mod, mod->module_init_rx);
67205+ mod->module_init_rw = NULL;
67206+ mod->module_init_rx = NULL;
67207+ mod->init_size_rw = 0;
67208+ mod->init_size_rx = 0;
67209 mutex_unlock(&module_mutex);
67210
67211 return 0;
67212@@ -3055,10 +3178,16 @@ static const char *get_ksymbol(struct module *mod,
67213 unsigned long nextval;
67214
67215 /* At worse, next value is at end of module */
67216- if (within_module_init(addr, mod))
67217- nextval = (unsigned long)mod->module_init+mod->init_text_size;
67218+ if (within_module_init_rx(addr, mod))
67219+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
67220+ else if (within_module_init_rw(addr, mod))
67221+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
67222+ else if (within_module_core_rx(addr, mod))
67223+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
67224+ else if (within_module_core_rw(addr, mod))
67225+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
67226 else
67227- nextval = (unsigned long)mod->module_core+mod->core_text_size;
67228+ return NULL;
67229
67230 /* Scan for closest preceding symbol, and next symbol. (ELF
67231 starts real symbols at 1). */
67232@@ -3304,7 +3433,7 @@ static int m_show(struct seq_file *m, void *p)
67233 char buf[8];
67234
67235 seq_printf(m, "%s %u",
67236- mod->name, mod->init_size + mod->core_size);
67237+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
67238 print_unload_info(m, mod);
67239
67240 /* Informative for users. */
67241@@ -3313,7 +3442,7 @@ static int m_show(struct seq_file *m, void *p)
67242 mod->state == MODULE_STATE_COMING ? "Loading":
67243 "Live");
67244 /* Used by oprofile and other similar tools. */
67245- seq_printf(m, " 0x%pK", mod->module_core);
67246+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
67247
67248 /* Taints info */
67249 if (mod->taints)
67250@@ -3349,7 +3478,17 @@ static const struct file_operations proc_modules_operations = {
67251
67252 static int __init proc_modules_init(void)
67253 {
67254+#ifndef CONFIG_GRKERNSEC_HIDESYM
67255+#ifdef CONFIG_GRKERNSEC_PROC_USER
67256+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
67257+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
67258+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
67259+#else
67260 proc_create("modules", 0, NULL, &proc_modules_operations);
67261+#endif
67262+#else
67263+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
67264+#endif
67265 return 0;
67266 }
67267 module_init(proc_modules_init);
67268@@ -3408,12 +3547,12 @@ struct module *__module_address(unsigned long addr)
67269 {
67270 struct module *mod;
67271
67272- if (addr < module_addr_min || addr > module_addr_max)
67273+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
67274+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
67275 return NULL;
67276
67277 list_for_each_entry_rcu(mod, &modules, list)
67278- if (within_module_core(addr, mod)
67279- || within_module_init(addr, mod))
67280+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
67281 return mod;
67282 return NULL;
67283 }
67284@@ -3447,11 +3586,20 @@ bool is_module_text_address(unsigned long addr)
67285 */
67286 struct module *__module_text_address(unsigned long addr)
67287 {
67288- struct module *mod = __module_address(addr);
67289+ struct module *mod;
67290+
67291+#ifdef CONFIG_X86_32
67292+ addr = ktla_ktva(addr);
67293+#endif
67294+
67295+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
67296+ return NULL;
67297+
67298+ mod = __module_address(addr);
67299+
67300 if (mod) {
67301 /* Make sure it's within the text section. */
67302- if (!within(addr, mod->module_init, mod->init_text_size)
67303- && !within(addr, mod->module_core, mod->core_text_size))
67304+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
67305 mod = NULL;
67306 }
67307 return mod;
67308diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
67309index 73da83a..fe46e99 100644
67310--- a/kernel/mutex-debug.c
67311+++ b/kernel/mutex-debug.c
67312@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
67313 }
67314
67315 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67316- struct thread_info *ti)
67317+ struct task_struct *task)
67318 {
67319 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
67320
67321 /* Mark the current thread as blocked on the lock: */
67322- ti->task->blocked_on = waiter;
67323+ task->blocked_on = waiter;
67324 }
67325
67326 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67327- struct thread_info *ti)
67328+ struct task_struct *task)
67329 {
67330 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
67331- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
67332- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
67333- ti->task->blocked_on = NULL;
67334+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
67335+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
67336+ task->blocked_on = NULL;
67337
67338 list_del_init(&waiter->list);
67339 waiter->task = NULL;
67340diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
67341index 0799fd3..d06ae3b 100644
67342--- a/kernel/mutex-debug.h
67343+++ b/kernel/mutex-debug.h
67344@@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
67345 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
67346 extern void debug_mutex_add_waiter(struct mutex *lock,
67347 struct mutex_waiter *waiter,
67348- struct thread_info *ti);
67349+ struct task_struct *task);
67350 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67351- struct thread_info *ti);
67352+ struct task_struct *task);
67353 extern void debug_mutex_unlock(struct mutex *lock);
67354 extern void debug_mutex_init(struct mutex *lock, const char *name,
67355 struct lock_class_key *key);
67356diff --git a/kernel/mutex.c b/kernel/mutex.c
67357index d607ed5..58d0a52 100644
67358--- a/kernel/mutex.c
67359+++ b/kernel/mutex.c
67360@@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67361 spin_lock_mutex(&lock->wait_lock, flags);
67362
67363 debug_mutex_lock_common(lock, &waiter);
67364- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
67365+ debug_mutex_add_waiter(lock, &waiter, task);
67366
67367 /* add waiting tasks to the end of the waitqueue (FIFO): */
67368 list_add_tail(&waiter.list, &lock->wait_list);
67369@@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67370 * TASK_UNINTERRUPTIBLE case.)
67371 */
67372 if (unlikely(signal_pending_state(state, task))) {
67373- mutex_remove_waiter(lock, &waiter,
67374- task_thread_info(task));
67375+ mutex_remove_waiter(lock, &waiter, task);
67376 mutex_release(&lock->dep_map, 1, ip);
67377 spin_unlock_mutex(&lock->wait_lock, flags);
67378
67379@@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67380 done:
67381 lock_acquired(&lock->dep_map, ip);
67382 /* got the lock - rejoice! */
67383- mutex_remove_waiter(lock, &waiter, current_thread_info());
67384+ mutex_remove_waiter(lock, &waiter, task);
67385 mutex_set_owner(lock);
67386
67387 /* set it to 0 if there are no waiters left: */
67388diff --git a/kernel/padata.c b/kernel/padata.c
67389index b91941d..0871d60 100644
67390--- a/kernel/padata.c
67391+++ b/kernel/padata.c
67392@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_instance *pinst,
67393 padata->pd = pd;
67394 padata->cb_cpu = cb_cpu;
67395
67396- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
67397- atomic_set(&pd->seq_nr, -1);
67398+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
67399+ atomic_set_unchecked(&pd->seq_nr, -1);
67400
67401- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
67402+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
67403
67404 target_cpu = padata_cpu_hash(padata);
67405 queue = per_cpu_ptr(pd->pqueue, target_cpu);
67406@@ -444,7 +444,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
67407 padata_init_pqueues(pd);
67408 padata_init_squeues(pd);
67409 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
67410- atomic_set(&pd->seq_nr, -1);
67411+ atomic_set_unchecked(&pd->seq_nr, -1);
67412 atomic_set(&pd->reorder_objects, 0);
67413 atomic_set(&pd->refcnt, 0);
67414 pd->pinst = pinst;
67415diff --git a/kernel/panic.c b/kernel/panic.c
67416index d7bb697..9ef9f19 100644
67417--- a/kernel/panic.c
67418+++ b/kernel/panic.c
67419@@ -371,7 +371,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
67420 const char *board;
67421
67422 printk(KERN_WARNING "------------[ cut here ]------------\n");
67423- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
67424+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
67425 board = dmi_get_system_info(DMI_PRODUCT_NAME);
67426 if (board)
67427 printk(KERN_WARNING "Hardware name: %s\n", board);
67428@@ -426,7 +426,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
67429 */
67430 void __stack_chk_fail(void)
67431 {
67432- panic("stack-protector: Kernel stack is corrupted in: %p\n",
67433+ dump_stack();
67434+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
67435 __builtin_return_address(0));
67436 }
67437 EXPORT_SYMBOL(__stack_chk_fail);
67438diff --git a/kernel/pid.c b/kernel/pid.c
67439index e432057..a2b2ac5 100644
67440--- a/kernel/pid.c
67441+++ b/kernel/pid.c
67442@@ -33,6 +33,7 @@
67443 #include <linux/rculist.h>
67444 #include <linux/bootmem.h>
67445 #include <linux/hash.h>
67446+#include <linux/security.h>
67447 #include <linux/pid_namespace.h>
67448 #include <linux/init_task.h>
67449 #include <linux/syscalls.h>
67450@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
67451
67452 int pid_max = PID_MAX_DEFAULT;
67453
67454-#define RESERVED_PIDS 300
67455+#define RESERVED_PIDS 500
67456
67457 int pid_max_min = RESERVED_PIDS + 1;
67458 int pid_max_max = PID_MAX_LIMIT;
67459@@ -418,8 +419,15 @@ EXPORT_SYMBOL(pid_task);
67460 */
67461 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
67462 {
67463+ struct task_struct *task;
67464+
67465 rcu_lockdep_assert(rcu_read_lock_held());
67466- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67467+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67468+
67469+ if (gr_pid_is_chrooted(task))
67470+ return NULL;
67471+
67472+ return task;
67473 }
67474
67475 struct task_struct *find_task_by_vpid(pid_t vnr)
67476@@ -427,6 +435,12 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
67477 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
67478 }
67479
67480+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
67481+{
67482+ rcu_lockdep_assert(rcu_read_lock_held());
67483+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
67484+}
67485+
67486 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
67487 {
67488 struct pid *pid;
67489diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
67490index 640ded8..3dafb85 100644
67491--- a/kernel/posix-cpu-timers.c
67492+++ b/kernel/posix-cpu-timers.c
67493@@ -6,6 +6,7 @@
67494 #include <linux/posix-timers.h>
67495 #include <linux/errno.h>
67496 #include <linux/math64.h>
67497+#include <linux/security.h>
67498 #include <asm/uaccess.h>
67499 #include <linux/kernel_stat.h>
67500 #include <trace/events/timer.h>
67501@@ -1606,14 +1607,14 @@ struct k_clock clock_posix_cpu = {
67502
67503 static __init int init_posix_cpu_timers(void)
67504 {
67505- struct k_clock process = {
67506+ static struct k_clock process = {
67507 .clock_getres = process_cpu_clock_getres,
67508 .clock_get = process_cpu_clock_get,
67509 .timer_create = process_cpu_timer_create,
67510 .nsleep = process_cpu_nsleep,
67511 .nsleep_restart = process_cpu_nsleep_restart,
67512 };
67513- struct k_clock thread = {
67514+ static struct k_clock thread = {
67515 .clock_getres = thread_cpu_clock_getres,
67516 .clock_get = thread_cpu_clock_get,
67517 .timer_create = thread_cpu_timer_create,
67518diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
67519index 4556182..9335419 100644
67520--- a/kernel/posix-timers.c
67521+++ b/kernel/posix-timers.c
67522@@ -43,6 +43,7 @@
67523 #include <linux/idr.h>
67524 #include <linux/posix-clock.h>
67525 #include <linux/posix-timers.h>
67526+#include <linux/grsecurity.h>
67527 #include <linux/syscalls.h>
67528 #include <linux/wait.h>
67529 #include <linux/workqueue.h>
67530@@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
67531 * which we beg off on and pass to do_sys_settimeofday().
67532 */
67533
67534-static struct k_clock posix_clocks[MAX_CLOCKS];
67535+static struct k_clock *posix_clocks[MAX_CLOCKS];
67536
67537 /*
67538 * These ones are defined below.
67539@@ -227,7 +228,7 @@ static int posix_get_boottime(const clockid_t which_clock, struct timespec *tp)
67540 */
67541 static __init int init_posix_timers(void)
67542 {
67543- struct k_clock clock_realtime = {
67544+ static struct k_clock clock_realtime = {
67545 .clock_getres = hrtimer_get_res,
67546 .clock_get = posix_clock_realtime_get,
67547 .clock_set = posix_clock_realtime_set,
67548@@ -239,7 +240,7 @@ static __init int init_posix_timers(void)
67549 .timer_get = common_timer_get,
67550 .timer_del = common_timer_del,
67551 };
67552- struct k_clock clock_monotonic = {
67553+ static struct k_clock clock_monotonic = {
67554 .clock_getres = hrtimer_get_res,
67555 .clock_get = posix_ktime_get_ts,
67556 .nsleep = common_nsleep,
67557@@ -249,19 +250,19 @@ static __init int init_posix_timers(void)
67558 .timer_get = common_timer_get,
67559 .timer_del = common_timer_del,
67560 };
67561- struct k_clock clock_monotonic_raw = {
67562+ static struct k_clock clock_monotonic_raw = {
67563 .clock_getres = hrtimer_get_res,
67564 .clock_get = posix_get_monotonic_raw,
67565 };
67566- struct k_clock clock_realtime_coarse = {
67567+ static struct k_clock clock_realtime_coarse = {
67568 .clock_getres = posix_get_coarse_res,
67569 .clock_get = posix_get_realtime_coarse,
67570 };
67571- struct k_clock clock_monotonic_coarse = {
67572+ static struct k_clock clock_monotonic_coarse = {
67573 .clock_getres = posix_get_coarse_res,
67574 .clock_get = posix_get_monotonic_coarse,
67575 };
67576- struct k_clock clock_boottime = {
67577+ static struct k_clock clock_boottime = {
67578 .clock_getres = hrtimer_get_res,
67579 .clock_get = posix_get_boottime,
67580 .nsleep = common_nsleep,
67581@@ -272,6 +273,8 @@ static __init int init_posix_timers(void)
67582 .timer_del = common_timer_del,
67583 };
67584
67585+ pax_track_stack();
67586+
67587 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
67588 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
67589 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
67590@@ -473,7 +476,7 @@ void posix_timers_register_clock(const clockid_t clock_id,
67591 return;
67592 }
67593
67594- posix_clocks[clock_id] = *new_clock;
67595+ posix_clocks[clock_id] = new_clock;
67596 }
67597 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
67598
67599@@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock(const clockid_t id)
67600 return (id & CLOCKFD_MASK) == CLOCKFD ?
67601 &clock_posix_dynamic : &clock_posix_cpu;
67602
67603- if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
67604+ if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
67605 return NULL;
67606- return &posix_clocks[id];
67607+ return posix_clocks[id];
67608 }
67609
67610 static int common_timer_create(struct k_itimer *new_timer)
67611@@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
67612 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
67613 return -EFAULT;
67614
67615+ /* only the CLOCK_REALTIME clock can be set, all other clocks
67616+ have their clock_set fptr set to a nosettime dummy function
67617+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
67618+ call common_clock_set, which calls do_sys_settimeofday, which
67619+ we hook
67620+ */
67621+
67622 return kc->clock_set(which_clock, &new_tp);
67623 }
67624
67625diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
67626index d523593..68197a4 100644
67627--- a/kernel/power/poweroff.c
67628+++ b/kernel/power/poweroff.c
67629@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
67630 .enable_mask = SYSRQ_ENABLE_BOOT,
67631 };
67632
67633-static int pm_sysrq_init(void)
67634+static int __init pm_sysrq_init(void)
67635 {
67636 register_sysrq_key('o', &sysrq_poweroff_op);
67637 return 0;
67638diff --git a/kernel/power/process.c b/kernel/power/process.c
67639index 0cf3a27..5481be4 100644
67640--- a/kernel/power/process.c
67641+++ b/kernel/power/process.c
67642@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_only)
67643 u64 elapsed_csecs64;
67644 unsigned int elapsed_csecs;
67645 bool wakeup = false;
67646+ bool timedout = false;
67647
67648 do_gettimeofday(&start);
67649
67650@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_only)
67651
67652 while (true) {
67653 todo = 0;
67654+ if (time_after(jiffies, end_time))
67655+ timedout = true;
67656 read_lock(&tasklist_lock);
67657 do_each_thread(g, p) {
67658 if (frozen(p) || !freezable(p))
67659@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_only)
67660 * try_to_stop() after schedule() in ptrace/signal
67661 * stop sees TIF_FREEZE.
67662 */
67663- if (!task_is_stopped_or_traced(p) &&
67664- !freezer_should_skip(p))
67665+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
67666 todo++;
67667+ if (timedout) {
67668+ printk(KERN_ERR "Task refusing to freeze:\n");
67669+ sched_show_task(p);
67670+ }
67671+ }
67672 } while_each_thread(g, p);
67673 read_unlock(&tasklist_lock);
67674
67675@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_only)
67676 todo += wq_busy;
67677 }
67678
67679- if (!todo || time_after(jiffies, end_time))
67680+ if (!todo || timedout)
67681 break;
67682
67683 if (pm_wakeup_pending()) {
67684diff --git a/kernel/printk.c b/kernel/printk.c
67685index 28a40d8..2411bec 100644
67686--- a/kernel/printk.c
67687+++ b/kernel/printk.c
67688@@ -313,6 +313,11 @@ static int check_syslog_permissions(int type, bool from_file)
67689 if (from_file && type != SYSLOG_ACTION_OPEN)
67690 return 0;
67691
67692+#ifdef CONFIG_GRKERNSEC_DMESG
67693+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
67694+ return -EPERM;
67695+#endif
67696+
67697 if (syslog_action_restricted(type)) {
67698 if (capable(CAP_SYSLOG))
67699 return 0;
67700diff --git a/kernel/profile.c b/kernel/profile.c
67701index 961b389..c451353 100644
67702--- a/kernel/profile.c
67703+++ b/kernel/profile.c
67704@@ -39,7 +39,7 @@ struct profile_hit {
67705 /* Oprofile timer tick hook */
67706 static int (*timer_hook)(struct pt_regs *) __read_mostly;
67707
67708-static atomic_t *prof_buffer;
67709+static atomic_unchecked_t *prof_buffer;
67710 static unsigned long prof_len, prof_shift;
67711
67712 int prof_on __read_mostly;
67713@@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
67714 hits[i].pc = 0;
67715 continue;
67716 }
67717- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67718+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67719 hits[i].hits = hits[i].pc = 0;
67720 }
67721 }
67722@@ -342,9 +342,9 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
67723 * Add the current hit(s) and flush the write-queue out
67724 * to the global buffer:
67725 */
67726- atomic_add(nr_hits, &prof_buffer[pc]);
67727+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
67728 for (i = 0; i < NR_PROFILE_HIT; ++i) {
67729- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67730+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67731 hits[i].pc = hits[i].hits = 0;
67732 }
67733 out:
67734@@ -419,7 +419,7 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
67735 {
67736 unsigned long pc;
67737 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
67738- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67739+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67740 }
67741 #endif /* !CONFIG_SMP */
67742
67743@@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
67744 return -EFAULT;
67745 buf++; p++; count--; read++;
67746 }
67747- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
67748+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
67749 if (copy_to_user(buf, (void *)pnt, count))
67750 return -EFAULT;
67751 read += count;
67752@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
67753 }
67754 #endif
67755 profile_discard_flip_buffers();
67756- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
67757+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
67758 return count;
67759 }
67760
67761diff --git a/kernel/ptrace.c b/kernel/ptrace.c
67762index a70d2a5..cbd4b4f 100644
67763--- a/kernel/ptrace.c
67764+++ b/kernel/ptrace.c
67765@@ -161,7 +161,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
67766 return ret;
67767 }
67768
67769-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67770+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
67771+ unsigned int log)
67772 {
67773 const struct cred *cred = current_cred(), *tcred;
67774
67775@@ -187,7 +188,8 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67776 cred->gid == tcred->sgid &&
67777 cred->gid == tcred->gid))
67778 goto ok;
67779- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
67780+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
67781+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
67782 goto ok;
67783 rcu_read_unlock();
67784 return -EPERM;
67785@@ -196,7 +198,9 @@ ok:
67786 smp_rmb();
67787 if (task->mm)
67788 dumpable = get_dumpable(task->mm);
67789- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
67790+ if (!dumpable &&
67791+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
67792+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
67793 return -EPERM;
67794
67795 return security_ptrace_access_check(task, mode);
67796@@ -206,7 +210,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
67797 {
67798 int err;
67799 task_lock(task);
67800- err = __ptrace_may_access(task, mode);
67801+ err = __ptrace_may_access(task, mode, 0);
67802+ task_unlock(task);
67803+ return !err;
67804+}
67805+
67806+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
67807+{
67808+ int err;
67809+ task_lock(task);
67810+ err = __ptrace_may_access(task, mode, 1);
67811 task_unlock(task);
67812 return !err;
67813 }
67814@@ -251,7 +264,7 @@ static int ptrace_attach(struct task_struct *task, long request,
67815 goto out;
67816
67817 task_lock(task);
67818- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
67819+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
67820 task_unlock(task);
67821 if (retval)
67822 goto unlock_creds;
67823@@ -266,7 +279,7 @@ static int ptrace_attach(struct task_struct *task, long request,
67824 task->ptrace = PT_PTRACED;
67825 if (seize)
67826 task->ptrace |= PT_SEIZED;
67827- if (task_ns_capable(task, CAP_SYS_PTRACE))
67828+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
67829 task->ptrace |= PT_PTRACE_CAP;
67830
67831 __ptrace_link(task, current);
67832@@ -461,6 +474,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
67833 {
67834 int copied = 0;
67835
67836+ pax_track_stack();
67837+
67838 while (len > 0) {
67839 char buf[128];
67840 int this_len, retval;
67841@@ -472,7 +487,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
67842 break;
67843 return -EIO;
67844 }
67845- if (copy_to_user(dst, buf, retval))
67846+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
67847 return -EFAULT;
67848 copied += retval;
67849 src += retval;
67850@@ -486,6 +501,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
67851 {
67852 int copied = 0;
67853
67854+ pax_track_stack();
67855+
67856 while (len > 0) {
67857 char buf[128];
67858 int this_len, retval;
67859@@ -669,10 +686,12 @@ int ptrace_request(struct task_struct *child, long request,
67860 bool seized = child->ptrace & PT_SEIZED;
67861 int ret = -EIO;
67862 siginfo_t siginfo, *si;
67863- void __user *datavp = (void __user *) data;
67864+ void __user *datavp = (__force void __user *) data;
67865 unsigned long __user *datalp = datavp;
67866 unsigned long flags;
67867
67868+ pax_track_stack();
67869+
67870 switch (request) {
67871 case PTRACE_PEEKTEXT:
67872 case PTRACE_PEEKDATA:
67873@@ -871,14 +890,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
67874 goto out;
67875 }
67876
67877+ if (gr_handle_ptrace(child, request)) {
67878+ ret = -EPERM;
67879+ goto out_put_task_struct;
67880+ }
67881+
67882 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
67883 ret = ptrace_attach(child, request, data);
67884 /*
67885 * Some architectures need to do book-keeping after
67886 * a ptrace attach.
67887 */
67888- if (!ret)
67889+ if (!ret) {
67890 arch_ptrace_attach(child);
67891+ gr_audit_ptrace(child);
67892+ }
67893 goto out_put_task_struct;
67894 }
67895
67896@@ -904,7 +930,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
67897 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
67898 if (copied != sizeof(tmp))
67899 return -EIO;
67900- return put_user(tmp, (unsigned long __user *)data);
67901+ return put_user(tmp, (__force unsigned long __user *)data);
67902 }
67903
67904 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
67905@@ -927,6 +953,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
67906 siginfo_t siginfo;
67907 int ret;
67908
67909+ pax_track_stack();
67910+
67911 switch (request) {
67912 case PTRACE_PEEKTEXT:
67913 case PTRACE_PEEKDATA:
67914@@ -1014,14 +1042,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
67915 goto out;
67916 }
67917
67918+ if (gr_handle_ptrace(child, request)) {
67919+ ret = -EPERM;
67920+ goto out_put_task_struct;
67921+ }
67922+
67923 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
67924 ret = ptrace_attach(child, request, data);
67925 /*
67926 * Some architectures need to do book-keeping after
67927 * a ptrace attach.
67928 */
67929- if (!ret)
67930+ if (!ret) {
67931 arch_ptrace_attach(child);
67932+ gr_audit_ptrace(child);
67933+ }
67934 goto out_put_task_struct;
67935 }
67936
67937diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
67938index 98f51b1..30b950c 100644
67939--- a/kernel/rcutorture.c
67940+++ b/kernel/rcutorture.c
67941@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
67942 { 0 };
67943 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
67944 { 0 };
67945-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67946-static atomic_t n_rcu_torture_alloc;
67947-static atomic_t n_rcu_torture_alloc_fail;
67948-static atomic_t n_rcu_torture_free;
67949-static atomic_t n_rcu_torture_mberror;
67950-static atomic_t n_rcu_torture_error;
67951+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67952+static atomic_unchecked_t n_rcu_torture_alloc;
67953+static atomic_unchecked_t n_rcu_torture_alloc_fail;
67954+static atomic_unchecked_t n_rcu_torture_free;
67955+static atomic_unchecked_t n_rcu_torture_mberror;
67956+static atomic_unchecked_t n_rcu_torture_error;
67957 static long n_rcu_torture_boost_ktrerror;
67958 static long n_rcu_torture_boost_rterror;
67959 static long n_rcu_torture_boost_failure;
67960@@ -223,11 +223,11 @@ rcu_torture_alloc(void)
67961
67962 spin_lock_bh(&rcu_torture_lock);
67963 if (list_empty(&rcu_torture_freelist)) {
67964- atomic_inc(&n_rcu_torture_alloc_fail);
67965+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
67966 spin_unlock_bh(&rcu_torture_lock);
67967 return NULL;
67968 }
67969- atomic_inc(&n_rcu_torture_alloc);
67970+ atomic_inc_unchecked(&n_rcu_torture_alloc);
67971 p = rcu_torture_freelist.next;
67972 list_del_init(p);
67973 spin_unlock_bh(&rcu_torture_lock);
67974@@ -240,7 +240,7 @@ rcu_torture_alloc(void)
67975 static void
67976 rcu_torture_free(struct rcu_torture *p)
67977 {
67978- atomic_inc(&n_rcu_torture_free);
67979+ atomic_inc_unchecked(&n_rcu_torture_free);
67980 spin_lock_bh(&rcu_torture_lock);
67981 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
67982 spin_unlock_bh(&rcu_torture_lock);
67983@@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p)
67984 i = rp->rtort_pipe_count;
67985 if (i > RCU_TORTURE_PIPE_LEN)
67986 i = RCU_TORTURE_PIPE_LEN;
67987- atomic_inc(&rcu_torture_wcount[i]);
67988+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67989 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67990 rp->rtort_mbtest = 0;
67991 rcu_torture_free(rp);
67992@@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
67993 i = rp->rtort_pipe_count;
67994 if (i > RCU_TORTURE_PIPE_LEN)
67995 i = RCU_TORTURE_PIPE_LEN;
67996- atomic_inc(&rcu_torture_wcount[i]);
67997+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67998 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67999 rp->rtort_mbtest = 0;
68000 list_del(&rp->rtort_free);
68001@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
68002 i = old_rp->rtort_pipe_count;
68003 if (i > RCU_TORTURE_PIPE_LEN)
68004 i = RCU_TORTURE_PIPE_LEN;
68005- atomic_inc(&rcu_torture_wcount[i]);
68006+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
68007 old_rp->rtort_pipe_count++;
68008 cur_ops->deferred_free(old_rp);
68009 }
68010@@ -950,7 +950,7 @@ static void rcu_torture_timer(unsigned long unused)
68011 return;
68012 }
68013 if (p->rtort_mbtest == 0)
68014- atomic_inc(&n_rcu_torture_mberror);
68015+ atomic_inc_unchecked(&n_rcu_torture_mberror);
68016 spin_lock(&rand_lock);
68017 cur_ops->read_delay(&rand);
68018 n_rcu_torture_timers++;
68019@@ -1011,7 +1011,7 @@ rcu_torture_reader(void *arg)
68020 continue;
68021 }
68022 if (p->rtort_mbtest == 0)
68023- atomic_inc(&n_rcu_torture_mberror);
68024+ atomic_inc_unchecked(&n_rcu_torture_mberror);
68025 cur_ops->read_delay(&rand);
68026 preempt_disable();
68027 pipe_count = p->rtort_pipe_count;
68028@@ -1070,16 +1070,16 @@ rcu_torture_printk(char *page)
68029 rcu_torture_current,
68030 rcu_torture_current_version,
68031 list_empty(&rcu_torture_freelist),
68032- atomic_read(&n_rcu_torture_alloc),
68033- atomic_read(&n_rcu_torture_alloc_fail),
68034- atomic_read(&n_rcu_torture_free),
68035- atomic_read(&n_rcu_torture_mberror),
68036+ atomic_read_unchecked(&n_rcu_torture_alloc),
68037+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
68038+ atomic_read_unchecked(&n_rcu_torture_free),
68039+ atomic_read_unchecked(&n_rcu_torture_mberror),
68040 n_rcu_torture_boost_ktrerror,
68041 n_rcu_torture_boost_rterror,
68042 n_rcu_torture_boost_failure,
68043 n_rcu_torture_boosts,
68044 n_rcu_torture_timers);
68045- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
68046+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
68047 n_rcu_torture_boost_ktrerror != 0 ||
68048 n_rcu_torture_boost_rterror != 0 ||
68049 n_rcu_torture_boost_failure != 0)
68050@@ -1087,7 +1087,7 @@ rcu_torture_printk(char *page)
68051 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
68052 if (i > 1) {
68053 cnt += sprintf(&page[cnt], "!!! ");
68054- atomic_inc(&n_rcu_torture_error);
68055+ atomic_inc_unchecked(&n_rcu_torture_error);
68056 WARN_ON_ONCE(1);
68057 }
68058 cnt += sprintf(&page[cnt], "Reader Pipe: ");
68059@@ -1101,7 +1101,7 @@ rcu_torture_printk(char *page)
68060 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
68061 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68062 cnt += sprintf(&page[cnt], " %d",
68063- atomic_read(&rcu_torture_wcount[i]));
68064+ atomic_read_unchecked(&rcu_torture_wcount[i]));
68065 }
68066 cnt += sprintf(&page[cnt], "\n");
68067 if (cur_ops->stats)
68068@@ -1410,7 +1410,7 @@ rcu_torture_cleanup(void)
68069
68070 if (cur_ops->cleanup)
68071 cur_ops->cleanup();
68072- if (atomic_read(&n_rcu_torture_error))
68073+ if (atomic_read_unchecked(&n_rcu_torture_error))
68074 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
68075 else
68076 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
68077@@ -1474,17 +1474,17 @@ rcu_torture_init(void)
68078
68079 rcu_torture_current = NULL;
68080 rcu_torture_current_version = 0;
68081- atomic_set(&n_rcu_torture_alloc, 0);
68082- atomic_set(&n_rcu_torture_alloc_fail, 0);
68083- atomic_set(&n_rcu_torture_free, 0);
68084- atomic_set(&n_rcu_torture_mberror, 0);
68085- atomic_set(&n_rcu_torture_error, 0);
68086+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
68087+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
68088+ atomic_set_unchecked(&n_rcu_torture_free, 0);
68089+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
68090+ atomic_set_unchecked(&n_rcu_torture_error, 0);
68091 n_rcu_torture_boost_ktrerror = 0;
68092 n_rcu_torture_boost_rterror = 0;
68093 n_rcu_torture_boost_failure = 0;
68094 n_rcu_torture_boosts = 0;
68095 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
68096- atomic_set(&rcu_torture_wcount[i], 0);
68097+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
68098 for_each_possible_cpu(cpu) {
68099 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68100 per_cpu(rcu_torture_count, cpu)[i] = 0;
68101diff --git a/kernel/rcutree.c b/kernel/rcutree.c
68102index ba06207..85d8ba8 100644
68103--- a/kernel/rcutree.c
68104+++ b/kernel/rcutree.c
68105@@ -356,9 +356,9 @@ void rcu_enter_nohz(void)
68106 }
68107 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68108 smp_mb__before_atomic_inc(); /* See above. */
68109- atomic_inc(&rdtp->dynticks);
68110+ atomic_inc_unchecked(&rdtp->dynticks);
68111 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
68112- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68113+ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68114 local_irq_restore(flags);
68115
68116 /* If the interrupt queued a callback, get out of dyntick mode. */
68117@@ -387,10 +387,10 @@ void rcu_exit_nohz(void)
68118 return;
68119 }
68120 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
68121- atomic_inc(&rdtp->dynticks);
68122+ atomic_inc_unchecked(&rdtp->dynticks);
68123 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68124 smp_mb__after_atomic_inc(); /* See above. */
68125- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68126+ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68127 local_irq_restore(flags);
68128 }
68129
68130@@ -406,14 +406,14 @@ void rcu_nmi_enter(void)
68131 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
68132
68133 if (rdtp->dynticks_nmi_nesting == 0 &&
68134- (atomic_read(&rdtp->dynticks) & 0x1))
68135+ (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
68136 return;
68137 rdtp->dynticks_nmi_nesting++;
68138 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
68139- atomic_inc(&rdtp->dynticks);
68140+ atomic_inc_unchecked(&rdtp->dynticks);
68141 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68142 smp_mb__after_atomic_inc(); /* See above. */
68143- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68144+ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68145 }
68146
68147 /**
68148@@ -432,9 +432,9 @@ void rcu_nmi_exit(void)
68149 return;
68150 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68151 smp_mb__before_atomic_inc(); /* See above. */
68152- atomic_inc(&rdtp->dynticks);
68153+ atomic_inc_unchecked(&rdtp->dynticks);
68154 smp_mb__after_atomic_inc(); /* Force delay to next write. */
68155- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68156+ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68157 }
68158
68159 /**
68160@@ -469,7 +469,7 @@ void rcu_irq_exit(void)
68161 */
68162 static int dyntick_save_progress_counter(struct rcu_data *rdp)
68163 {
68164- rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
68165+ rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68166 return 0;
68167 }
68168
68169@@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
68170 unsigned long curr;
68171 unsigned long snap;
68172
68173- curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks);
68174+ curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68175 snap = (unsigned long)rdp->dynticks_snap;
68176
68177 /*
68178@@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
68179 /*
68180 * Do softirq processing for the current CPU.
68181 */
68182-static void rcu_process_callbacks(struct softirq_action *unused)
68183+static void rcu_process_callbacks(void)
68184 {
68185 __rcu_process_callbacks(&rcu_sched_state,
68186 &__get_cpu_var(rcu_sched_data));
68187diff --git a/kernel/rcutree.h b/kernel/rcutree.h
68188index 01b2ccd..4f5d80a 100644
68189--- a/kernel/rcutree.h
68190+++ b/kernel/rcutree.h
68191@@ -86,7 +86,7 @@
68192 struct rcu_dynticks {
68193 int dynticks_nesting; /* Track irq/process nesting level. */
68194 int dynticks_nmi_nesting; /* Track NMI nesting level. */
68195- atomic_t dynticks; /* Even value for dynticks-idle, else odd. */
68196+ atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */
68197 };
68198
68199 /* RCU's kthread states for tracing. */
68200diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
68201index 8aafbb8..2fca109 100644
68202--- a/kernel/rcutree_plugin.h
68203+++ b/kernel/rcutree_plugin.h
68204@@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void)
68205
68206 /* Clean up and exit. */
68207 smp_mb(); /* ensure expedited GP seen before counter increment. */
68208- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
68209+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
68210 unlock_mb_ret:
68211 mutex_unlock(&sync_rcu_preempt_exp_mutex);
68212 mb_ret:
68213@@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expedited);
68214
68215 #else /* #ifndef CONFIG_SMP */
68216
68217-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
68218-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
68219+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
68220+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
68221
68222 static int synchronize_sched_expedited_cpu_stop(void *data)
68223 {
68224@@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void)
68225 int firstsnap, s, snap, trycount = 0;
68226
68227 /* Note that atomic_inc_return() implies full memory barrier. */
68228- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
68229+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
68230 get_online_cpus();
68231
68232 /*
68233@@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void)
68234 }
68235
68236 /* Check to see if someone else did our work for us. */
68237- s = atomic_read(&sync_sched_expedited_done);
68238+ s = atomic_read_unchecked(&sync_sched_expedited_done);
68239 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
68240 smp_mb(); /* ensure test happens before caller kfree */
68241 return;
68242@@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void)
68243 * grace period works for us.
68244 */
68245 get_online_cpus();
68246- snap = atomic_read(&sync_sched_expedited_started) - 1;
68247+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
68248 smp_mb(); /* ensure read is before try_stop_cpus(). */
68249 }
68250
68251@@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void)
68252 * than we did beat us to the punch.
68253 */
68254 do {
68255- s = atomic_read(&sync_sched_expedited_done);
68256+ s = atomic_read_unchecked(&sync_sched_expedited_done);
68257 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
68258 smp_mb(); /* ensure test happens before caller kfree */
68259 break;
68260 }
68261- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
68262+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
68263
68264 put_online_cpus();
68265 }
68266@@ -1953,7 +1953,7 @@ int rcu_needs_cpu(int cpu)
68267 for_each_online_cpu(thatcpu) {
68268 if (thatcpu == cpu)
68269 continue;
68270- snap = atomic_add_return(0, &per_cpu(rcu_dynticks,
68271+ snap = atomic_add_return_unchecked(0, &per_cpu(rcu_dynticks,
68272 thatcpu).dynticks);
68273 smp_mb(); /* Order sampling of snap with end of grace period. */
68274 if ((snap & 0x1) != 0) {
68275diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
68276index 3b0c098..43ba2d8 100644
68277--- a/kernel/rcutree_trace.c
68278+++ b/kernel/rcutree_trace.c
68279@@ -74,7 +74,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
68280 rdp->qs_pending);
68281 #ifdef CONFIG_NO_HZ
68282 seq_printf(m, " dt=%d/%d/%d df=%lu",
68283- atomic_read(&rdp->dynticks->dynticks),
68284+ atomic_read_unchecked(&rdp->dynticks->dynticks),
68285 rdp->dynticks->dynticks_nesting,
68286 rdp->dynticks->dynticks_nmi_nesting,
68287 rdp->dynticks_fqs);
68288@@ -148,7 +148,7 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
68289 rdp->qs_pending);
68290 #ifdef CONFIG_NO_HZ
68291 seq_printf(m, ",%d,%d,%d,%lu",
68292- atomic_read(&rdp->dynticks->dynticks),
68293+ atomic_read_unchecked(&rdp->dynticks->dynticks),
68294 rdp->dynticks->dynticks_nesting,
68295 rdp->dynticks->dynticks_nmi_nesting,
68296 rdp->dynticks_fqs);
68297diff --git a/kernel/relay.c b/kernel/relay.c
68298index 859ea5a..096e2fe 100644
68299--- a/kernel/relay.c
68300+++ b/kernel/relay.c
68301@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
68302 };
68303 ssize_t ret;
68304
68305+ pax_track_stack();
68306+
68307 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
68308 return 0;
68309 if (splice_grow_spd(pipe, &spd))
68310diff --git a/kernel/resource.c b/kernel/resource.c
68311index c8dc249..f1e2359 100644
68312--- a/kernel/resource.c
68313+++ b/kernel/resource.c
68314@@ -141,8 +141,18 @@ static const struct file_operations proc_iomem_operations = {
68315
68316 static int __init ioresources_init(void)
68317 {
68318+#ifdef CONFIG_GRKERNSEC_PROC_ADD
68319+#ifdef CONFIG_GRKERNSEC_PROC_USER
68320+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
68321+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
68322+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68323+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
68324+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
68325+#endif
68326+#else
68327 proc_create("ioports", 0, NULL, &proc_ioports_operations);
68328 proc_create("iomem", 0, NULL, &proc_iomem_operations);
68329+#endif
68330 return 0;
68331 }
68332 __initcall(ioresources_init);
68333diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
68334index 5c9ccd3..a35e22b 100644
68335--- a/kernel/rtmutex-tester.c
68336+++ b/kernel/rtmutex-tester.c
68337@@ -20,7 +20,7 @@
68338 #define MAX_RT_TEST_MUTEXES 8
68339
68340 static spinlock_t rttest_lock;
68341-static atomic_t rttest_event;
68342+static atomic_unchecked_t rttest_event;
68343
68344 struct test_thread_data {
68345 int opcode;
68346@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68347
68348 case RTTEST_LOCKCONT:
68349 td->mutexes[td->opdata] = 1;
68350- td->event = atomic_add_return(1, &rttest_event);
68351+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68352 return 0;
68353
68354 case RTTEST_RESET:
68355@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68356 return 0;
68357
68358 case RTTEST_RESETEVENT:
68359- atomic_set(&rttest_event, 0);
68360+ atomic_set_unchecked(&rttest_event, 0);
68361 return 0;
68362
68363 default:
68364@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68365 return ret;
68366
68367 td->mutexes[id] = 1;
68368- td->event = atomic_add_return(1, &rttest_event);
68369+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68370 rt_mutex_lock(&mutexes[id]);
68371- td->event = atomic_add_return(1, &rttest_event);
68372+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68373 td->mutexes[id] = 4;
68374 return 0;
68375
68376@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68377 return ret;
68378
68379 td->mutexes[id] = 1;
68380- td->event = atomic_add_return(1, &rttest_event);
68381+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68382 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
68383- td->event = atomic_add_return(1, &rttest_event);
68384+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68385 td->mutexes[id] = ret ? 0 : 4;
68386 return ret ? -EINTR : 0;
68387
68388@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68389 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
68390 return ret;
68391
68392- td->event = atomic_add_return(1, &rttest_event);
68393+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68394 rt_mutex_unlock(&mutexes[id]);
68395- td->event = atomic_add_return(1, &rttest_event);
68396+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68397 td->mutexes[id] = 0;
68398 return 0;
68399
68400@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68401 break;
68402
68403 td->mutexes[dat] = 2;
68404- td->event = atomic_add_return(1, &rttest_event);
68405+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68406 break;
68407
68408 default:
68409@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68410 return;
68411
68412 td->mutexes[dat] = 3;
68413- td->event = atomic_add_return(1, &rttest_event);
68414+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68415 break;
68416
68417 case RTTEST_LOCKNOWAIT:
68418@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68419 return;
68420
68421 td->mutexes[dat] = 1;
68422- td->event = atomic_add_return(1, &rttest_event);
68423+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68424 return;
68425
68426 default:
68427diff --git a/kernel/sched.c b/kernel/sched.c
68428index b50b0f0..1c6c591 100644
68429--- a/kernel/sched.c
68430+++ b/kernel/sched.c
68431@@ -4264,6 +4264,8 @@ static void __sched __schedule(void)
68432 struct rq *rq;
68433 int cpu;
68434
68435+ pax_track_stack();
68436+
68437 need_resched:
68438 preempt_disable();
68439 cpu = smp_processor_id();
68440@@ -4950,6 +4952,8 @@ int can_nice(const struct task_struct *p, const int nice)
68441 /* convert nice value [19,-20] to rlimit style value [1,40] */
68442 int nice_rlim = 20 - nice;
68443
68444+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
68445+
68446 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
68447 capable(CAP_SYS_NICE));
68448 }
68449@@ -4983,7 +4987,8 @@ SYSCALL_DEFINE1(nice, int, increment)
68450 if (nice > 19)
68451 nice = 19;
68452
68453- if (increment < 0 && !can_nice(current, nice))
68454+ if (increment < 0 && (!can_nice(current, nice) ||
68455+ gr_handle_chroot_nice()))
68456 return -EPERM;
68457
68458 retval = security_task_setnice(current, nice);
68459@@ -5127,6 +5132,7 @@ recheck:
68460 unsigned long rlim_rtprio =
68461 task_rlimit(p, RLIMIT_RTPRIO);
68462
68463+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
68464 /* can't set/change the rt policy */
68465 if (policy != p->policy && !rlim_rtprio)
68466 return -EPERM;
68467diff --git a/kernel/sched_autogroup.c b/kernel/sched_autogroup.c
68468index 429242f..d7cca82 100644
68469--- a/kernel/sched_autogroup.c
68470+++ b/kernel/sched_autogroup.c
68471@@ -7,7 +7,7 @@
68472
68473 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
68474 static struct autogroup autogroup_default;
68475-static atomic_t autogroup_seq_nr;
68476+static atomic_unchecked_t autogroup_seq_nr;
68477
68478 static void __init autogroup_init(struct task_struct *init_task)
68479 {
68480@@ -78,7 +78,7 @@ static inline struct autogroup *autogroup_create(void)
68481
68482 kref_init(&ag->kref);
68483 init_rwsem(&ag->lock);
68484- ag->id = atomic_inc_return(&autogroup_seq_nr);
68485+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
68486 ag->tg = tg;
68487 #ifdef CONFIG_RT_GROUP_SCHED
68488 /*
68489diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
68490index bc8ee99..b6f6492 100644
68491--- a/kernel/sched_fair.c
68492+++ b/kernel/sched_fair.c
68493@@ -4062,7 +4062,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
68494 * run_rebalance_domains is triggered when needed from the scheduler tick.
68495 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
68496 */
68497-static void run_rebalance_domains(struct softirq_action *h)
68498+static void run_rebalance_domains(void)
68499 {
68500 int this_cpu = smp_processor_id();
68501 struct rq *this_rq = cpu_rq(this_cpu);
68502diff --git a/kernel/signal.c b/kernel/signal.c
68503index 291c970..304bd03 100644
68504--- a/kernel/signal.c
68505+++ b/kernel/signal.c
68506@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cachep;
68507
68508 int print_fatal_signals __read_mostly;
68509
68510-static void __user *sig_handler(struct task_struct *t, int sig)
68511+static __sighandler_t sig_handler(struct task_struct *t, int sig)
68512 {
68513 return t->sighand->action[sig - 1].sa.sa_handler;
68514 }
68515
68516-static int sig_handler_ignored(void __user *handler, int sig)
68517+static int sig_handler_ignored(__sighandler_t handler, int sig)
68518 {
68519 /* Is it explicitly or implicitly ignored? */
68520 return handler == SIG_IGN ||
68521@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
68522 static int sig_task_ignored(struct task_struct *t, int sig,
68523 int from_ancestor_ns)
68524 {
68525- void __user *handler;
68526+ __sighandler_t handler;
68527
68528 handler = sig_handler(t, sig);
68529
68530@@ -364,6 +364,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
68531 atomic_inc(&user->sigpending);
68532 rcu_read_unlock();
68533
68534+ if (!override_rlimit)
68535+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
68536+
68537 if (override_rlimit ||
68538 atomic_read(&user->sigpending) <=
68539 task_rlimit(t, RLIMIT_SIGPENDING)) {
68540@@ -488,7 +491,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
68541
68542 int unhandled_signal(struct task_struct *tsk, int sig)
68543 {
68544- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
68545+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
68546 if (is_global_init(tsk))
68547 return 1;
68548 if (handler != SIG_IGN && handler != SIG_DFL)
68549@@ -815,6 +818,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
68550 }
68551 }
68552
68553+ /* allow glibc communication via tgkill to other threads in our
68554+ thread group */
68555+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
68556+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
68557+ && gr_handle_signal(t, sig))
68558+ return -EPERM;
68559+
68560 return security_task_kill(t, info, sig, 0);
68561 }
68562
68563@@ -1165,7 +1175,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
68564 return send_signal(sig, info, p, 1);
68565 }
68566
68567-static int
68568+int
68569 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68570 {
68571 return send_signal(sig, info, t, 0);
68572@@ -1202,6 +1212,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68573 unsigned long int flags;
68574 int ret, blocked, ignored;
68575 struct k_sigaction *action;
68576+ int is_unhandled = 0;
68577
68578 spin_lock_irqsave(&t->sighand->siglock, flags);
68579 action = &t->sighand->action[sig-1];
68580@@ -1216,9 +1227,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68581 }
68582 if (action->sa.sa_handler == SIG_DFL)
68583 t->signal->flags &= ~SIGNAL_UNKILLABLE;
68584+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
68585+ is_unhandled = 1;
68586 ret = specific_send_sig_info(sig, info, t);
68587 spin_unlock_irqrestore(&t->sighand->siglock, flags);
68588
68589+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
68590+ normal operation */
68591+ if (is_unhandled) {
68592+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
68593+ gr_handle_crash(t, sig);
68594+ }
68595+
68596 return ret;
68597 }
68598
68599@@ -1285,8 +1305,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
68600 ret = check_kill_permission(sig, info, p);
68601 rcu_read_unlock();
68602
68603- if (!ret && sig)
68604+ if (!ret && sig) {
68605 ret = do_send_sig_info(sig, info, p, true);
68606+ if (!ret)
68607+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
68608+ }
68609
68610 return ret;
68611 }
68612@@ -1909,6 +1932,8 @@ static void ptrace_do_notify(int signr, int exit_code, int why)
68613 {
68614 siginfo_t info;
68615
68616+ pax_track_stack();
68617+
68618 memset(&info, 0, sizeof info);
68619 info.si_signo = signr;
68620 info.si_code = exit_code;
68621@@ -2748,7 +2773,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
68622 int error = -ESRCH;
68623
68624 rcu_read_lock();
68625- p = find_task_by_vpid(pid);
68626+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
68627+ /* allow glibc communication via tgkill to other threads in our
68628+ thread group */
68629+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
68630+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
68631+ p = find_task_by_vpid_unrestricted(pid);
68632+ else
68633+#endif
68634+ p = find_task_by_vpid(pid);
68635 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
68636 error = check_kill_permission(sig, info, p);
68637 /*
68638diff --git a/kernel/smp.c b/kernel/smp.c
68639index fb67dfa..f819e2e 100644
68640--- a/kernel/smp.c
68641+++ b/kernel/smp.c
68642@@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait)
68643 }
68644 EXPORT_SYMBOL(smp_call_function);
68645
68646-void ipi_call_lock(void)
68647+void ipi_call_lock(void) __acquires(call_function.lock)
68648 {
68649 raw_spin_lock(&call_function.lock);
68650 }
68651
68652-void ipi_call_unlock(void)
68653+void ipi_call_unlock(void) __releases(call_function.lock)
68654 {
68655 raw_spin_unlock(&call_function.lock);
68656 }
68657
68658-void ipi_call_lock_irq(void)
68659+void ipi_call_lock_irq(void) __acquires(call_function.lock)
68660 {
68661 raw_spin_lock_irq(&call_function.lock);
68662 }
68663
68664-void ipi_call_unlock_irq(void)
68665+void ipi_call_unlock_irq(void) __releases(call_function.lock)
68666 {
68667 raw_spin_unlock_irq(&call_function.lock);
68668 }
68669diff --git a/kernel/softirq.c b/kernel/softirq.c
68670index fca82c3..1db9690 100644
68671--- a/kernel/softirq.c
68672+++ b/kernel/softirq.c
68673@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
68674
68675 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
68676
68677-char *softirq_to_name[NR_SOFTIRQS] = {
68678+const char * const softirq_to_name[NR_SOFTIRQS] = {
68679 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
68680 "TASKLET", "SCHED", "HRTIMER", "RCU"
68681 };
68682@@ -235,7 +235,7 @@ restart:
68683 kstat_incr_softirqs_this_cpu(vec_nr);
68684
68685 trace_softirq_entry(vec_nr);
68686- h->action(h);
68687+ h->action();
68688 trace_softirq_exit(vec_nr);
68689 if (unlikely(prev_count != preempt_count())) {
68690 printk(KERN_ERR "huh, entered softirq %u %s %p"
68691@@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr)
68692 local_irq_restore(flags);
68693 }
68694
68695-void open_softirq(int nr, void (*action)(struct softirq_action *))
68696+void open_softirq(int nr, void (*action)(void))
68697 {
68698- softirq_vec[nr].action = action;
68699+ pax_open_kernel();
68700+ *(void **)&softirq_vec[nr].action = action;
68701+ pax_close_kernel();
68702 }
68703
68704 /*
68705@@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
68706
68707 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
68708
68709-static void tasklet_action(struct softirq_action *a)
68710+static void tasklet_action(void)
68711 {
68712 struct tasklet_struct *list;
68713
68714@@ -476,7 +478,7 @@ static void tasklet_action(struct softirq_action *a)
68715 }
68716 }
68717
68718-static void tasklet_hi_action(struct softirq_action *a)
68719+static void tasklet_hi_action(void)
68720 {
68721 struct tasklet_struct *list;
68722
68723diff --git a/kernel/sys.c b/kernel/sys.c
68724index 1dbbe69..e96e1dd 100644
68725--- a/kernel/sys.c
68726+++ b/kernel/sys.c
68727@@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
68728 error = -EACCES;
68729 goto out;
68730 }
68731+
68732+ if (gr_handle_chroot_setpriority(p, niceval)) {
68733+ error = -EACCES;
68734+ goto out;
68735+ }
68736+
68737 no_nice = security_task_setnice(p, niceval);
68738 if (no_nice) {
68739 error = no_nice;
68740@@ -571,6 +577,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
68741 goto error;
68742 }
68743
68744+ if (gr_check_group_change(new->gid, new->egid, -1))
68745+ goto error;
68746+
68747 if (rgid != (gid_t) -1 ||
68748 (egid != (gid_t) -1 && egid != old->gid))
68749 new->sgid = new->egid;
68750@@ -600,6 +609,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
68751 old = current_cred();
68752
68753 retval = -EPERM;
68754+
68755+ if (gr_check_group_change(gid, gid, gid))
68756+ goto error;
68757+
68758 if (nsown_capable(CAP_SETGID))
68759 new->gid = new->egid = new->sgid = new->fsgid = gid;
68760 else if (gid == old->gid || gid == old->sgid)
68761@@ -687,6 +700,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
68762 goto error;
68763 }
68764
68765+ if (gr_check_user_change(new->uid, new->euid, -1))
68766+ goto error;
68767+
68768 if (new->uid != old->uid) {
68769 retval = set_user(new);
68770 if (retval < 0)
68771@@ -731,6 +747,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
68772 old = current_cred();
68773
68774 retval = -EPERM;
68775+
68776+ if (gr_check_crash_uid(uid))
68777+ goto error;
68778+ if (gr_check_user_change(uid, uid, uid))
68779+ goto error;
68780+
68781 if (nsown_capable(CAP_SETUID)) {
68782 new->suid = new->uid = uid;
68783 if (uid != old->uid) {
68784@@ -785,6 +807,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
68785 goto error;
68786 }
68787
68788+ if (gr_check_user_change(ruid, euid, -1))
68789+ goto error;
68790+
68791 if (ruid != (uid_t) -1) {
68792 new->uid = ruid;
68793 if (ruid != old->uid) {
68794@@ -849,6 +874,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
68795 goto error;
68796 }
68797
68798+ if (gr_check_group_change(rgid, egid, -1))
68799+ goto error;
68800+
68801 if (rgid != (gid_t) -1)
68802 new->gid = rgid;
68803 if (egid != (gid_t) -1)
68804@@ -895,6 +923,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68805 old = current_cred();
68806 old_fsuid = old->fsuid;
68807
68808+ if (gr_check_user_change(-1, -1, uid))
68809+ goto error;
68810+
68811 if (uid == old->uid || uid == old->euid ||
68812 uid == old->suid || uid == old->fsuid ||
68813 nsown_capable(CAP_SETUID)) {
68814@@ -905,6 +936,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68815 }
68816 }
68817
68818+error:
68819 abort_creds(new);
68820 return old_fsuid;
68821
68822@@ -931,12 +963,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
68823 if (gid == old->gid || gid == old->egid ||
68824 gid == old->sgid || gid == old->fsgid ||
68825 nsown_capable(CAP_SETGID)) {
68826+ if (gr_check_group_change(-1, -1, gid))
68827+ goto error;
68828+
68829 if (gid != old_fsgid) {
68830 new->fsgid = gid;
68831 goto change_okay;
68832 }
68833 }
68834
68835+error:
68836 abort_creds(new);
68837 return old_fsgid;
68838
68839@@ -1188,7 +1224,10 @@ static int override_release(char __user *release, int len)
68840 }
68841 v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
68842 snprintf(buf, len, "2.6.%u%s", v, rest);
68843- ret = copy_to_user(release, buf, len);
68844+ if (len > sizeof(buf))
68845+ ret = -EFAULT;
68846+ else
68847+ ret = copy_to_user(release, buf, len);
68848 }
68849 return ret;
68850 }
68851@@ -1242,19 +1281,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
68852 return -EFAULT;
68853
68854 down_read(&uts_sem);
68855- error = __copy_to_user(&name->sysname, &utsname()->sysname,
68856+ error = __copy_to_user(name->sysname, &utsname()->sysname,
68857 __OLD_UTS_LEN);
68858 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
68859- error |= __copy_to_user(&name->nodename, &utsname()->nodename,
68860+ error |= __copy_to_user(name->nodename, &utsname()->nodename,
68861 __OLD_UTS_LEN);
68862 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
68863- error |= __copy_to_user(&name->release, &utsname()->release,
68864+ error |= __copy_to_user(name->release, &utsname()->release,
68865 __OLD_UTS_LEN);
68866 error |= __put_user(0, name->release + __OLD_UTS_LEN);
68867- error |= __copy_to_user(&name->version, &utsname()->version,
68868+ error |= __copy_to_user(name->version, &utsname()->version,
68869 __OLD_UTS_LEN);
68870 error |= __put_user(0, name->version + __OLD_UTS_LEN);
68871- error |= __copy_to_user(&name->machine, &utsname()->machine,
68872+ error |= __copy_to_user(name->machine, &utsname()->machine,
68873 __OLD_UTS_LEN);
68874 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
68875 up_read(&uts_sem);
68876@@ -1717,7 +1756,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
68877 error = get_dumpable(me->mm);
68878 break;
68879 case PR_SET_DUMPABLE:
68880- if (arg2 < 0 || arg2 > 1) {
68881+ if (arg2 > 1) {
68882 error = -EINVAL;
68883 break;
68884 }
68885diff --git a/kernel/sysctl.c b/kernel/sysctl.c
68886index 11d65b5..6957b37 100644
68887--- a/kernel/sysctl.c
68888+++ b/kernel/sysctl.c
68889@@ -85,6 +85,13 @@
68890
68891
68892 #if defined(CONFIG_SYSCTL)
68893+#include <linux/grsecurity.h>
68894+#include <linux/grinternal.h>
68895+
68896+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
68897+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
68898+ const int op);
68899+extern int gr_handle_chroot_sysctl(const int op);
68900
68901 /* External variables not in a header file. */
68902 extern int sysctl_overcommit_memory;
68903@@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
68904 }
68905
68906 #endif
68907+extern struct ctl_table grsecurity_table[];
68908
68909 static struct ctl_table root_table[];
68910 static struct ctl_table_root sysctl_table_root;
68911@@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[];
68912 int sysctl_legacy_va_layout;
68913 #endif
68914
68915+#ifdef CONFIG_PAX_SOFTMODE
68916+static ctl_table pax_table[] = {
68917+ {
68918+ .procname = "softmode",
68919+ .data = &pax_softmode,
68920+ .maxlen = sizeof(unsigned int),
68921+ .mode = 0600,
68922+ .proc_handler = &proc_dointvec,
68923+ },
68924+
68925+ { }
68926+};
68927+#endif
68928+
68929 /* The default sysctl tables: */
68930
68931 static struct ctl_table root_table[] = {
68932@@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000;
68933 #endif
68934
68935 static struct ctl_table kern_table[] = {
68936+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
68937+ {
68938+ .procname = "grsecurity",
68939+ .mode = 0500,
68940+ .child = grsecurity_table,
68941+ },
68942+#endif
68943+
68944+#ifdef CONFIG_PAX_SOFTMODE
68945+ {
68946+ .procname = "pax",
68947+ .mode = 0500,
68948+ .child = pax_table,
68949+ },
68950+#endif
68951+
68952 {
68953 .procname = "sched_child_runs_first",
68954 .data = &sysctl_sched_child_runs_first,
68955@@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = {
68956 .data = &modprobe_path,
68957 .maxlen = KMOD_PATH_LEN,
68958 .mode = 0644,
68959- .proc_handler = proc_dostring,
68960+ .proc_handler = proc_dostring_modpriv,
68961 },
68962 {
68963 .procname = "modules_disabled",
68964@@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = {
68965 .extra1 = &zero,
68966 .extra2 = &one,
68967 },
68968+#endif
68969 {
68970 .procname = "kptr_restrict",
68971 .data = &kptr_restrict,
68972 .maxlen = sizeof(int),
68973 .mode = 0644,
68974 .proc_handler = proc_dmesg_restrict,
68975+#ifdef CONFIG_GRKERNSEC_HIDESYM
68976+ .extra1 = &two,
68977+#else
68978 .extra1 = &zero,
68979+#endif
68980 .extra2 = &two,
68981 },
68982-#endif
68983 {
68984 .procname = "ngroups_max",
68985 .data = &ngroups_max,
68986@@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = {
68987 .proc_handler = proc_dointvec_minmax,
68988 .extra1 = &zero,
68989 },
68990+ {
68991+ .procname = "heap_stack_gap",
68992+ .data = &sysctl_heap_stack_gap,
68993+ .maxlen = sizeof(sysctl_heap_stack_gap),
68994+ .mode = 0644,
68995+ .proc_handler = proc_doulongvec_minmax,
68996+ },
68997 #else
68998 {
68999 .procname = "nr_trim_pages",
69000@@ -1709,6 +1758,17 @@ static int test_perm(int mode, int op)
69001 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
69002 {
69003 int mode;
69004+ int error;
69005+
69006+ if (table->parent != NULL && table->parent->procname != NULL &&
69007+ table->procname != NULL &&
69008+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
69009+ return -EACCES;
69010+ if (gr_handle_chroot_sysctl(op))
69011+ return -EACCES;
69012+ error = gr_handle_sysctl(table, op);
69013+ if (error)
69014+ return error;
69015
69016 if (root->permissions)
69017 mode = root->permissions(root, current->nsproxy, table);
69018@@ -2113,6 +2173,16 @@ int proc_dostring(struct ctl_table *table, int write,
69019 buffer, lenp, ppos);
69020 }
69021
69022+int proc_dostring_modpriv(struct ctl_table *table, int write,
69023+ void __user *buffer, size_t *lenp, loff_t *ppos)
69024+{
69025+ if (write && !capable(CAP_SYS_MODULE))
69026+ return -EPERM;
69027+
69028+ return _proc_do_string(table->data, table->maxlen, write,
69029+ buffer, lenp, ppos);
69030+}
69031+
69032 static size_t proc_skip_spaces(char **buf)
69033 {
69034 size_t ret;
69035@@ -2218,6 +2288,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
69036 len = strlen(tmp);
69037 if (len > *size)
69038 len = *size;
69039+ if (len > sizeof(tmp))
69040+ len = sizeof(tmp);
69041 if (copy_to_user(*buf, tmp, len))
69042 return -EFAULT;
69043 *size -= len;
69044@@ -2534,8 +2606,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
69045 *i = val;
69046 } else {
69047 val = convdiv * (*i) / convmul;
69048- if (!first)
69049+ if (!first) {
69050 err = proc_put_char(&buffer, &left, '\t');
69051+ if (err)
69052+ break;
69053+ }
69054 err = proc_put_long(&buffer, &left, val, false);
69055 if (err)
69056 break;
69057@@ -2930,6 +3005,12 @@ int proc_dostring(struct ctl_table *table, int write,
69058 return -ENOSYS;
69059 }
69060
69061+int proc_dostring_modpriv(struct ctl_table *table, int write,
69062+ void __user *buffer, size_t *lenp, loff_t *ppos)
69063+{
69064+ return -ENOSYS;
69065+}
69066+
69067 int proc_dointvec(struct ctl_table *table, int write,
69068 void __user *buffer, size_t *lenp, loff_t *ppos)
69069 {
69070@@ -2986,6 +3067,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
69071 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
69072 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
69073 EXPORT_SYMBOL(proc_dostring);
69074+EXPORT_SYMBOL(proc_dostring_modpriv);
69075 EXPORT_SYMBOL(proc_doulongvec_minmax);
69076 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
69077 EXPORT_SYMBOL(register_sysctl_table);
69078diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
69079index e8bffbe..82bf0a4 100644
69080--- a/kernel/sysctl_binary.c
69081+++ b/kernel/sysctl_binary.c
69082@@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
69083 int i;
69084
69085 set_fs(KERNEL_DS);
69086- result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69087+ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69088 set_fs(old_fs);
69089 if (result < 0)
69090 goto out_kfree;
69091@@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *file,
69092 }
69093
69094 set_fs(KERNEL_DS);
69095- result = vfs_write(file, buffer, str - buffer, &pos);
69096+ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69097 set_fs(old_fs);
69098 if (result < 0)
69099 goto out_kfree;
69100@@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file *file,
69101 int i;
69102
69103 set_fs(KERNEL_DS);
69104- result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69105+ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69106 set_fs(old_fs);
69107 if (result < 0)
69108 goto out_kfree;
69109@@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file *file,
69110 }
69111
69112 set_fs(KERNEL_DS);
69113- result = vfs_write(file, buffer, str - buffer, &pos);
69114+ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69115 set_fs(old_fs);
69116 if (result < 0)
69117 goto out_kfree;
69118@@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *file,
69119 int i;
69120
69121 set_fs(KERNEL_DS);
69122- result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69123+ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69124 set_fs(old_fs);
69125 if (result < 0)
69126 goto out;
69127@@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69128 __le16 dnaddr;
69129
69130 set_fs(KERNEL_DS);
69131- result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69132+ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69133 set_fs(old_fs);
69134 if (result < 0)
69135 goto out;
69136@@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69137 le16_to_cpu(dnaddr) & 0x3ff);
69138
69139 set_fs(KERNEL_DS);
69140- result = vfs_write(file, buf, len, &pos);
69141+ result = vfs_write(file, (const char __force_user *)buf, len, &pos);
69142 set_fs(old_fs);
69143 if (result < 0)
69144 goto out;
69145@@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
69146
69147 fput(file);
69148 out_putname:
69149- putname(pathname);
69150+ __putname(pathname);
69151 out:
69152 return result;
69153 }
69154diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
69155index 362da65..ab8ef8c 100644
69156--- a/kernel/sysctl_check.c
69157+++ b/kernel/sysctl_check.c
69158@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
69159 set_fail(&fail, table, "Directory with extra2");
69160 } else {
69161 if ((table->proc_handler == proc_dostring) ||
69162+ (table->proc_handler == proc_dostring_modpriv) ||
69163 (table->proc_handler == proc_dointvec) ||
69164 (table->proc_handler == proc_dointvec_minmax) ||
69165 (table->proc_handler == proc_dointvec_jiffies) ||
69166diff --git a/kernel/taskstats.c b/kernel/taskstats.c
69167index e660464..c8b9e67 100644
69168--- a/kernel/taskstats.c
69169+++ b/kernel/taskstats.c
69170@@ -27,9 +27,12 @@
69171 #include <linux/cgroup.h>
69172 #include <linux/fs.h>
69173 #include <linux/file.h>
69174+#include <linux/grsecurity.h>
69175 #include <net/genetlink.h>
69176 #include <linux/atomic.h>
69177
69178+extern int gr_is_taskstats_denied(int pid);
69179+
69180 /*
69181 * Maximum length of a cpumask that can be specified in
69182 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
69183@@ -556,6 +559,9 @@ err:
69184
69185 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
69186 {
69187+ if (gr_is_taskstats_denied(current->pid))
69188+ return -EACCES;
69189+
69190 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
69191 return cmd_attr_register_cpumask(info);
69192 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
69193diff --git a/kernel/time.c b/kernel/time.c
69194index d776062..fa8d186 100644
69195--- a/kernel/time.c
69196+++ b/kernel/time.c
69197@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
69198 return error;
69199
69200 if (tz) {
69201+ /* we log in do_settimeofday called below, so don't log twice
69202+ */
69203+ if (!tv)
69204+ gr_log_timechange();
69205+
69206 /* SMP safe, global irq locking makes it work. */
69207 sys_tz = *tz;
69208 update_vsyscall_tz();
69209diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
69210index 8b70c76..923e9f5 100644
69211--- a/kernel/time/alarmtimer.c
69212+++ b/kernel/time/alarmtimer.c
69213@@ -693,7 +693,7 @@ static int __init alarmtimer_init(void)
69214 {
69215 int error = 0;
69216 int i;
69217- struct k_clock alarm_clock = {
69218+ static struct k_clock alarm_clock = {
69219 .clock_getres = alarm_clock_getres,
69220 .clock_get = alarm_clock_get,
69221 .timer_create = alarm_timer_create,
69222diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
69223index 7a90d02..6d8585a 100644
69224--- a/kernel/time/tick-broadcast.c
69225+++ b/kernel/time/tick-broadcast.c
69226@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
69227 * then clear the broadcast bit.
69228 */
69229 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
69230- int cpu = smp_processor_id();
69231+ cpu = smp_processor_id();
69232
69233 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
69234 tick_broadcast_clear_oneshot(cpu);
69235diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
69236index 6f9798b..f8c4087 100644
69237--- a/kernel/time/timekeeping.c
69238+++ b/kernel/time/timekeeping.c
69239@@ -14,6 +14,7 @@
69240 #include <linux/init.h>
69241 #include <linux/mm.h>
69242 #include <linux/sched.h>
69243+#include <linux/grsecurity.h>
69244 #include <linux/syscore_ops.h>
69245 #include <linux/clocksource.h>
69246 #include <linux/jiffies.h>
69247@@ -365,6 +366,8 @@ int do_settimeofday(const struct timespec *tv)
69248 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
69249 return -EINVAL;
69250
69251+ gr_log_timechange();
69252+
69253 write_seqlock_irqsave(&xtime_lock, flags);
69254
69255 timekeeping_forward_now();
69256diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
69257index 3258455..f35227d 100644
69258--- a/kernel/time/timer_list.c
69259+++ b/kernel/time/timer_list.c
69260@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
69261
69262 static void print_name_offset(struct seq_file *m, void *sym)
69263 {
69264+#ifdef CONFIG_GRKERNSEC_HIDESYM
69265+ SEQ_printf(m, "<%p>", NULL);
69266+#else
69267 char symname[KSYM_NAME_LEN];
69268
69269 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
69270 SEQ_printf(m, "<%pK>", sym);
69271 else
69272 SEQ_printf(m, "%s", symname);
69273+#endif
69274 }
69275
69276 static void
69277@@ -112,7 +116,11 @@ next_one:
69278 static void
69279 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
69280 {
69281+#ifdef CONFIG_GRKERNSEC_HIDESYM
69282+ SEQ_printf(m, " .base: %p\n", NULL);
69283+#else
69284 SEQ_printf(m, " .base: %pK\n", base);
69285+#endif
69286 SEQ_printf(m, " .index: %d\n",
69287 base->index);
69288 SEQ_printf(m, " .resolution: %Lu nsecs\n",
69289@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs(void)
69290 {
69291 struct proc_dir_entry *pe;
69292
69293+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69294+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
69295+#else
69296 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
69297+#endif
69298 if (!pe)
69299 return -ENOMEM;
69300 return 0;
69301diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
69302index a5d0a3a..60c7948 100644
69303--- a/kernel/time/timer_stats.c
69304+++ b/kernel/time/timer_stats.c
69305@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
69306 static unsigned long nr_entries;
69307 static struct entry entries[MAX_ENTRIES];
69308
69309-static atomic_t overflow_count;
69310+static atomic_unchecked_t overflow_count;
69311
69312 /*
69313 * The entries are in a hash-table, for fast lookup:
69314@@ -140,7 +140,7 @@ static void reset_entries(void)
69315 nr_entries = 0;
69316 memset(entries, 0, sizeof(entries));
69317 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
69318- atomic_set(&overflow_count, 0);
69319+ atomic_set_unchecked(&overflow_count, 0);
69320 }
69321
69322 static struct entry *alloc_entry(void)
69323@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
69324 if (likely(entry))
69325 entry->count++;
69326 else
69327- atomic_inc(&overflow_count);
69328+ atomic_inc_unchecked(&overflow_count);
69329
69330 out_unlock:
69331 raw_spin_unlock_irqrestore(lock, flags);
69332@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
69333
69334 static void print_name_offset(struct seq_file *m, unsigned long addr)
69335 {
69336+#ifdef CONFIG_GRKERNSEC_HIDESYM
69337+ seq_printf(m, "<%p>", NULL);
69338+#else
69339 char symname[KSYM_NAME_LEN];
69340
69341 if (lookup_symbol_name(addr, symname) < 0)
69342 seq_printf(m, "<%p>", (void *)addr);
69343 else
69344 seq_printf(m, "%s", symname);
69345+#endif
69346 }
69347
69348 static int tstats_show(struct seq_file *m, void *v)
69349@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
69350
69351 seq_puts(m, "Timer Stats Version: v0.2\n");
69352 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
69353- if (atomic_read(&overflow_count))
69354+ if (atomic_read_unchecked(&overflow_count))
69355 seq_printf(m, "Overflow: %d entries\n",
69356- atomic_read(&overflow_count));
69357+ atomic_read_unchecked(&overflow_count));
69358
69359 for (i = 0; i < nr_entries; i++) {
69360 entry = entries + i;
69361@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(void)
69362 {
69363 struct proc_dir_entry *pe;
69364
69365+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69366+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
69367+#else
69368 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
69369+#endif
69370 if (!pe)
69371 return -ENOMEM;
69372 return 0;
69373diff --git a/kernel/timer.c b/kernel/timer.c
69374index 8cff361..0fb5cd8 100644
69375--- a/kernel/timer.c
69376+++ b/kernel/timer.c
69377@@ -1304,7 +1304,7 @@ void update_process_times(int user_tick)
69378 /*
69379 * This function runs timers and the timer-tq in bottom half context.
69380 */
69381-static void run_timer_softirq(struct softirq_action *h)
69382+static void run_timer_softirq(void)
69383 {
69384 struct tvec_base *base = __this_cpu_read(tvec_bases);
69385
69386diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
69387index 7c910a5..8b72104 100644
69388--- a/kernel/trace/blktrace.c
69389+++ b/kernel/trace/blktrace.c
69390@@ -323,7 +323,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
69391 struct blk_trace *bt = filp->private_data;
69392 char buf[16];
69393
69394- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
69395+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
69396
69397 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
69398 }
69399@@ -388,7 +388,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
69400 return 1;
69401
69402 bt = buf->chan->private_data;
69403- atomic_inc(&bt->dropped);
69404+ atomic_inc_unchecked(&bt->dropped);
69405 return 0;
69406 }
69407
69408@@ -489,7 +489,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
69409
69410 bt->dir = dir;
69411 bt->dev = dev;
69412- atomic_set(&bt->dropped, 0);
69413+ atomic_set_unchecked(&bt->dropped, 0);
69414
69415 ret = -EIO;
69416 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
69417diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
69418index 48d3762..3b61fce 100644
69419--- a/kernel/trace/ftrace.c
69420+++ b/kernel/trace/ftrace.c
69421@@ -1584,12 +1584,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
69422 if (unlikely(ftrace_disabled))
69423 return 0;
69424
69425+ ret = ftrace_arch_code_modify_prepare();
69426+ FTRACE_WARN_ON(ret);
69427+ if (ret)
69428+ return 0;
69429+
69430 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
69431+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
69432 if (ret) {
69433 ftrace_bug(ret, ip);
69434- return 0;
69435 }
69436- return 1;
69437+ return ret ? 0 : 1;
69438 }
69439
69440 /*
69441@@ -2606,7 +2611,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
69442
69443 int
69444 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
69445- void *data)
69446+ void *data)
69447 {
69448 struct ftrace_func_probe *entry;
69449 struct ftrace_page *pg;
69450diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
69451index 17a2d44..85907e2 100644
69452--- a/kernel/trace/trace.c
69453+++ b/kernel/trace/trace.c
69454@@ -3451,6 +3451,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
69455 size_t rem;
69456 unsigned int i;
69457
69458+ pax_track_stack();
69459+
69460 if (splice_grow_spd(pipe, &spd))
69461 return -ENOMEM;
69462
69463@@ -3926,6 +3928,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
69464 int entries, size, i;
69465 size_t ret;
69466
69467+ pax_track_stack();
69468+
69469 if (splice_grow_spd(pipe, &spd))
69470 return -ENOMEM;
69471
69472@@ -4093,10 +4097,9 @@ static const struct file_operations tracing_dyn_info_fops = {
69473 };
69474 #endif
69475
69476-static struct dentry *d_tracer;
69477-
69478 struct dentry *tracing_init_dentry(void)
69479 {
69480+ static struct dentry *d_tracer;
69481 static int once;
69482
69483 if (d_tracer)
69484@@ -4116,10 +4119,9 @@ struct dentry *tracing_init_dentry(void)
69485 return d_tracer;
69486 }
69487
69488-static struct dentry *d_percpu;
69489-
69490 struct dentry *tracing_dentry_percpu(void)
69491 {
69492+ static struct dentry *d_percpu;
69493 static int once;
69494 struct dentry *d_tracer;
69495
69496diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
69497index c212a7f..7b02394 100644
69498--- a/kernel/trace/trace_events.c
69499+++ b/kernel/trace/trace_events.c
69500@@ -1299,10 +1299,6 @@ static LIST_HEAD(ftrace_module_file_list);
69501 struct ftrace_module_file_ops {
69502 struct list_head list;
69503 struct module *mod;
69504- struct file_operations id;
69505- struct file_operations enable;
69506- struct file_operations format;
69507- struct file_operations filter;
69508 };
69509
69510 static struct ftrace_module_file_ops *
69511@@ -1323,17 +1319,12 @@ trace_create_file_ops(struct module *mod)
69512
69513 file_ops->mod = mod;
69514
69515- file_ops->id = ftrace_event_id_fops;
69516- file_ops->id.owner = mod;
69517-
69518- file_ops->enable = ftrace_enable_fops;
69519- file_ops->enable.owner = mod;
69520-
69521- file_ops->filter = ftrace_event_filter_fops;
69522- file_ops->filter.owner = mod;
69523-
69524- file_ops->format = ftrace_event_format_fops;
69525- file_ops->format.owner = mod;
69526+ pax_open_kernel();
69527+ *(void **)&mod->trace_id.owner = mod;
69528+ *(void **)&mod->trace_enable.owner = mod;
69529+ *(void **)&mod->trace_filter.owner = mod;
69530+ *(void **)&mod->trace_format.owner = mod;
69531+ pax_close_kernel();
69532
69533 list_add(&file_ops->list, &ftrace_module_file_list);
69534
69535@@ -1357,8 +1348,8 @@ static void trace_module_add_events(struct module *mod)
69536
69537 for_each_event(call, start, end) {
69538 __trace_add_event_call(*call, mod,
69539- &file_ops->id, &file_ops->enable,
69540- &file_ops->filter, &file_ops->format);
69541+ &mod->trace_id, &mod->trace_enable,
69542+ &mod->trace_filter, &mod->trace_format);
69543 }
69544 }
69545
69546diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
69547index 00d527c..7c5b1a3 100644
69548--- a/kernel/trace/trace_kprobe.c
69549+++ b/kernel/trace/trace_kprobe.c
69550@@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69551 long ret;
69552 int maxlen = get_rloc_len(*(u32 *)dest);
69553 u8 *dst = get_rloc_data(dest);
69554- u8 *src = addr;
69555+ const u8 __user *src = (const u8 __force_user *)addr;
69556 mm_segment_t old_fs = get_fs();
69557 if (!maxlen)
69558 return;
69559@@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69560 pagefault_disable();
69561 do
69562 ret = __copy_from_user_inatomic(dst++, src++, 1);
69563- while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
69564+ while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen);
69565 dst[-1] = '\0';
69566 pagefault_enable();
69567 set_fs(old_fs);
69568@@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69569 ((u8 *)get_rloc_data(dest))[0] = '\0';
69570 *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
69571 } else
69572- *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
69573+ *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr,
69574 get_rloc_offs(*(u32 *)dest));
69575 }
69576 /* Return the length of string -- including null terminal byte */
69577@@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string_size)(struct pt_regs *regs,
69578 set_fs(KERNEL_DS);
69579 pagefault_disable();
69580 do {
69581- ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
69582+ ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1);
69583 len++;
69584 } while (c && ret == 0 && len < MAX_STRING_SIZE);
69585 pagefault_enable();
69586diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
69587index fd3c8aa..5f324a6 100644
69588--- a/kernel/trace/trace_mmiotrace.c
69589+++ b/kernel/trace/trace_mmiotrace.c
69590@@ -24,7 +24,7 @@ struct header_iter {
69591 static struct trace_array *mmio_trace_array;
69592 static bool overrun_detected;
69593 static unsigned long prev_overruns;
69594-static atomic_t dropped_count;
69595+static atomic_unchecked_t dropped_count;
69596
69597 static void mmio_reset_data(struct trace_array *tr)
69598 {
69599@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iterator *iter)
69600
69601 static unsigned long count_overruns(struct trace_iterator *iter)
69602 {
69603- unsigned long cnt = atomic_xchg(&dropped_count, 0);
69604+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
69605 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
69606
69607 if (over > prev_overruns)
69608@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
69609 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
69610 sizeof(*entry), 0, pc);
69611 if (!event) {
69612- atomic_inc(&dropped_count);
69613+ atomic_inc_unchecked(&dropped_count);
69614 return;
69615 }
69616 entry = ring_buffer_event_data(event);
69617@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
69618 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
69619 sizeof(*entry), 0, pc);
69620 if (!event) {
69621- atomic_inc(&dropped_count);
69622+ atomic_inc_unchecked(&dropped_count);
69623 return;
69624 }
69625 entry = ring_buffer_event_data(event);
69626diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
69627index 5199930..26c73a0 100644
69628--- a/kernel/trace/trace_output.c
69629+++ b/kernel/trace/trace_output.c
69630@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
69631
69632 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
69633 if (!IS_ERR(p)) {
69634- p = mangle_path(s->buffer + s->len, p, "\n");
69635+ p = mangle_path(s->buffer + s->len, p, "\n\\");
69636 if (p) {
69637 s->len = p - s->buffer;
69638 return 1;
69639diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
69640index 77575b3..6e623d1 100644
69641--- a/kernel/trace/trace_stack.c
69642+++ b/kernel/trace/trace_stack.c
69643@@ -50,7 +50,7 @@ static inline void check_stack(void)
69644 return;
69645
69646 /* we do not handle interrupt stacks yet */
69647- if (!object_is_on_stack(&this_size))
69648+ if (!object_starts_on_stack(&this_size))
69649 return;
69650
69651 local_irq_save(flags);
69652diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
69653index 209b379..7f76423 100644
69654--- a/kernel/trace/trace_workqueue.c
69655+++ b/kernel/trace/trace_workqueue.c
69656@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
69657 int cpu;
69658 pid_t pid;
69659 /* Can be inserted from interrupt or user context, need to be atomic */
69660- atomic_t inserted;
69661+ atomic_unchecked_t inserted;
69662 /*
69663 * Don't need to be atomic, works are serialized in a single workqueue thread
69664 * on a single CPU.
69665@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
69666 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
69667 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
69668 if (node->pid == wq_thread->pid) {
69669- atomic_inc(&node->inserted);
69670+ atomic_inc_unchecked(&node->inserted);
69671 goto found;
69672 }
69673 }
69674@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
69675 tsk = get_pid_task(pid, PIDTYPE_PID);
69676 if (tsk) {
69677 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
69678- atomic_read(&cws->inserted), cws->executed,
69679+ atomic_read_unchecked(&cws->inserted), cws->executed,
69680 tsk->comm);
69681 put_task_struct(tsk);
69682 }
69683diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
69684index c0cb9c4..f33aa89 100644
69685--- a/lib/Kconfig.debug
69686+++ b/lib/Kconfig.debug
69687@@ -1091,6 +1091,7 @@ config LATENCYTOP
69688 depends on DEBUG_KERNEL
69689 depends on STACKTRACE_SUPPORT
69690 depends on PROC_FS
69691+ depends on !GRKERNSEC_HIDESYM
69692 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
69693 select KALLSYMS
69694 select KALLSYMS_ALL
69695diff --git a/lib/bitmap.c b/lib/bitmap.c
69696index 2f4412e..a557e27 100644
69697--- a/lib/bitmap.c
69698+++ b/lib/bitmap.c
69699@@ -419,7 +419,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
69700 {
69701 int c, old_c, totaldigits, ndigits, nchunks, nbits;
69702 u32 chunk;
69703- const char __user *ubuf = buf;
69704+ const char __user *ubuf = (const char __force_user *)buf;
69705
69706 bitmap_zero(maskp, nmaskbits);
69707
69708@@ -504,7 +504,7 @@ int bitmap_parse_user(const char __user *ubuf,
69709 {
69710 if (!access_ok(VERIFY_READ, ubuf, ulen))
69711 return -EFAULT;
69712- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
69713+ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
69714 }
69715 EXPORT_SYMBOL(bitmap_parse_user);
69716
69717@@ -594,7 +594,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
69718 {
69719 unsigned a, b;
69720 int c, old_c, totaldigits;
69721- const char __user *ubuf = buf;
69722+ const char __user *ubuf = (const char __force_user *)buf;
69723 int exp_digit, in_range;
69724
69725 totaldigits = c = 0;
69726@@ -694,7 +694,7 @@ int bitmap_parselist_user(const char __user *ubuf,
69727 {
69728 if (!access_ok(VERIFY_READ, ubuf, ulen))
69729 return -EFAULT;
69730- return __bitmap_parselist((const char *)ubuf,
69731+ return __bitmap_parselist((const char __force_kernel *)ubuf,
69732 ulen, 1, maskp, nmaskbits);
69733 }
69734 EXPORT_SYMBOL(bitmap_parselist_user);
69735diff --git a/lib/bug.c b/lib/bug.c
69736index 1955209..cbbb2ad 100644
69737--- a/lib/bug.c
69738+++ b/lib/bug.c
69739@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
69740 return BUG_TRAP_TYPE_NONE;
69741
69742 bug = find_bug(bugaddr);
69743+ if (!bug)
69744+ return BUG_TRAP_TYPE_NONE;
69745
69746 file = NULL;
69747 line = 0;
69748diff --git a/lib/debugobjects.c b/lib/debugobjects.c
69749index a78b7c6..2c73084 100644
69750--- a/lib/debugobjects.c
69751+++ b/lib/debugobjects.c
69752@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
69753 if (limit > 4)
69754 return;
69755
69756- is_on_stack = object_is_on_stack(addr);
69757+ is_on_stack = object_starts_on_stack(addr);
69758 if (is_on_stack == onstack)
69759 return;
69760
69761diff --git a/lib/devres.c b/lib/devres.c
69762index 7c0e953..f642b5c 100644
69763--- a/lib/devres.c
69764+++ b/lib/devres.c
69765@@ -80,7 +80,7 @@ EXPORT_SYMBOL(devm_ioremap_nocache);
69766 void devm_iounmap(struct device *dev, void __iomem *addr)
69767 {
69768 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
69769- (void *)addr));
69770+ (void __force *)addr));
69771 iounmap(addr);
69772 }
69773 EXPORT_SYMBOL(devm_iounmap);
69774@@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
69775 {
69776 ioport_unmap(addr);
69777 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
69778- devm_ioport_map_match, (void *)addr));
69779+ devm_ioport_map_match, (void __force *)addr));
69780 }
69781 EXPORT_SYMBOL(devm_ioport_unmap);
69782
69783diff --git a/lib/dma-debug.c b/lib/dma-debug.c
69784index db07bfd..719b5ab 100644
69785--- a/lib/dma-debug.c
69786+++ b/lib/dma-debug.c
69787@@ -870,7 +870,7 @@ out:
69788
69789 static void check_for_stack(struct device *dev, void *addr)
69790 {
69791- if (object_is_on_stack(addr))
69792+ if (object_starts_on_stack(addr))
69793 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
69794 "stack [addr=%p]\n", addr);
69795 }
69796diff --git a/lib/extable.c b/lib/extable.c
69797index 4cac81e..63e9b8f 100644
69798--- a/lib/extable.c
69799+++ b/lib/extable.c
69800@@ -13,6 +13,7 @@
69801 #include <linux/init.h>
69802 #include <linux/sort.h>
69803 #include <asm/uaccess.h>
69804+#include <asm/pgtable.h>
69805
69806 #ifndef ARCH_HAS_SORT_EXTABLE
69807 /*
69808@@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const void *b)
69809 void sort_extable(struct exception_table_entry *start,
69810 struct exception_table_entry *finish)
69811 {
69812+ pax_open_kernel();
69813 sort(start, finish - start, sizeof(struct exception_table_entry),
69814 cmp_ex, NULL);
69815+ pax_close_kernel();
69816 }
69817
69818 #ifdef CONFIG_MODULES
69819diff --git a/lib/inflate.c b/lib/inflate.c
69820index 013a761..c28f3fc 100644
69821--- a/lib/inflate.c
69822+++ b/lib/inflate.c
69823@@ -269,7 +269,7 @@ static void free(void *where)
69824 malloc_ptr = free_mem_ptr;
69825 }
69826 #else
69827-#define malloc(a) kmalloc(a, GFP_KERNEL)
69828+#define malloc(a) kmalloc((a), GFP_KERNEL)
69829 #define free(a) kfree(a)
69830 #endif
69831
69832diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
69833index bd2bea9..6b3c95e 100644
69834--- a/lib/is_single_threaded.c
69835+++ b/lib/is_single_threaded.c
69836@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
69837 struct task_struct *p, *t;
69838 bool ret;
69839
69840+ if (!mm)
69841+ return true;
69842+
69843 if (atomic_read(&task->signal->live) != 1)
69844 return false;
69845
69846diff --git a/lib/kref.c b/lib/kref.c
69847index 3efb882..8492f4c 100644
69848--- a/lib/kref.c
69849+++ b/lib/kref.c
69850@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
69851 */
69852 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
69853 {
69854- WARN_ON(release == NULL);
69855+ BUG_ON(release == NULL);
69856 WARN_ON(release == (void (*)(struct kref *))kfree);
69857
69858 if (atomic_dec_and_test(&kref->refcount)) {
69859diff --git a/lib/radix-tree.c b/lib/radix-tree.c
69860index a2f9da5..3bcadb6 100644
69861--- a/lib/radix-tree.c
69862+++ b/lib/radix-tree.c
69863@@ -80,7 +80,7 @@ struct radix_tree_preload {
69864 int nr;
69865 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
69866 };
69867-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
69868+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
69869
69870 static inline void *ptr_to_indirect(void *ptr)
69871 {
69872diff --git a/lib/vsprintf.c b/lib/vsprintf.c
69873index d7222a9..2172edc 100644
69874--- a/lib/vsprintf.c
69875+++ b/lib/vsprintf.c
69876@@ -16,6 +16,9 @@
69877 * - scnprintf and vscnprintf
69878 */
69879
69880+#ifdef CONFIG_GRKERNSEC_HIDESYM
69881+#define __INCLUDED_BY_HIDESYM 1
69882+#endif
69883 #include <stdarg.h>
69884 #include <linux/module.h>
69885 #include <linux/types.h>
69886@@ -432,7 +435,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
69887 char sym[KSYM_SYMBOL_LEN];
69888 if (ext == 'B')
69889 sprint_backtrace(sym, value);
69890- else if (ext != 'f' && ext != 's')
69891+ else if (ext != 'f' && ext != 's' && ext != 'a')
69892 sprint_symbol(sym, value);
69893 else
69894 kallsyms_lookup(value, NULL, NULL, NULL, sym);
69895@@ -796,7 +799,11 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
69896 return string(buf, end, uuid, spec);
69897 }
69898
69899+#ifdef CONFIG_GRKERNSEC_HIDESYM
69900+int kptr_restrict __read_mostly = 2;
69901+#else
69902 int kptr_restrict __read_mostly;
69903+#endif
69904
69905 /*
69906 * Show a '%p' thing. A kernel extension is that the '%p' is followed
69907@@ -810,6 +817,8 @@ int kptr_restrict __read_mostly;
69908 * - 'S' For symbolic direct pointers with offset
69909 * - 's' For symbolic direct pointers without offset
69910 * - 'B' For backtraced symbolic direct pointers with offset
69911+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
69912+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
69913 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
69914 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
69915 * - 'M' For a 6-byte MAC address, it prints the address in the
69916@@ -854,12 +863,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
69917 {
69918 if (!ptr && *fmt != 'K') {
69919 /*
69920- * Print (null) with the same width as a pointer so it makes
69921+ * Print (nil) with the same width as a pointer so it makes
69922 * tabular output look nice.
69923 */
69924 if (spec.field_width == -1)
69925 spec.field_width = 2 * sizeof(void *);
69926- return string(buf, end, "(null)", spec);
69927+ return string(buf, end, "(nil)", spec);
69928 }
69929
69930 switch (*fmt) {
69931@@ -869,6 +878,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
69932 /* Fallthrough */
69933 case 'S':
69934 case 's':
69935+#ifdef CONFIG_GRKERNSEC_HIDESYM
69936+ break;
69937+#else
69938+ return symbol_string(buf, end, ptr, spec, *fmt);
69939+#endif
69940+ case 'A':
69941+ case 'a':
69942 case 'B':
69943 return symbol_string(buf, end, ptr, spec, *fmt);
69944 case 'R':
69945@@ -1627,11 +1643,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
69946 typeof(type) value; \
69947 if (sizeof(type) == 8) { \
69948 args = PTR_ALIGN(args, sizeof(u32)); \
69949- *(u32 *)&value = *(u32 *)args; \
69950- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
69951+ *(u32 *)&value = *(const u32 *)args; \
69952+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
69953 } else { \
69954 args = PTR_ALIGN(args, sizeof(type)); \
69955- value = *(typeof(type) *)args; \
69956+ value = *(const typeof(type) *)args; \
69957 } \
69958 args += sizeof(type); \
69959 value; \
69960@@ -1694,7 +1710,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
69961 case FORMAT_TYPE_STR: {
69962 const char *str_arg = args;
69963 args += strlen(str_arg) + 1;
69964- str = string(str, end, (char *)str_arg, spec);
69965+ str = string(str, end, str_arg, spec);
69966 break;
69967 }
69968
69969diff --git a/localversion-grsec b/localversion-grsec
69970new file mode 100644
69971index 0000000..7cd6065
69972--- /dev/null
69973+++ b/localversion-grsec
69974@@ -0,0 +1 @@
69975+-grsec
69976diff --git a/mm/Kconfig b/mm/Kconfig
69977index f2f1ca1..0645f06 100644
69978--- a/mm/Kconfig
69979+++ b/mm/Kconfig
69980@@ -238,10 +238,10 @@ config KSM
69981 root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
69982
69983 config DEFAULT_MMAP_MIN_ADDR
69984- int "Low address space to protect from user allocation"
69985+ int "Low address space to protect from user allocation"
69986 depends on MMU
69987- default 4096
69988- help
69989+ default 65536
69990+ help
69991 This is the portion of low virtual memory which should be protected
69992 from userspace allocation. Keeping a user from writing to low pages
69993 can help reduce the impact of kernel NULL pointer bugs.
69994diff --git a/mm/filemap.c b/mm/filemap.c
69995index 7771871..91bcdb4 100644
69996--- a/mm/filemap.c
69997+++ b/mm/filemap.c
69998@@ -1784,7 +1784,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
69999 struct address_space *mapping = file->f_mapping;
70000
70001 if (!mapping->a_ops->readpage)
70002- return -ENOEXEC;
70003+ return -ENODEV;
70004 file_accessed(file);
70005 vma->vm_ops = &generic_file_vm_ops;
70006 vma->vm_flags |= VM_CAN_NONLINEAR;
70007@@ -2190,6 +2190,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
70008 *pos = i_size_read(inode);
70009
70010 if (limit != RLIM_INFINITY) {
70011+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
70012 if (*pos >= limit) {
70013 send_sig(SIGXFSZ, current, 0);
70014 return -EFBIG;
70015diff --git a/mm/fremap.c b/mm/fremap.c
70016index b8e0e2d..076e171 100644
70017--- a/mm/fremap.c
70018+++ b/mm/fremap.c
70019@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
70020 retry:
70021 vma = find_vma(mm, start);
70022
70023+#ifdef CONFIG_PAX_SEGMEXEC
70024+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
70025+ goto out;
70026+#endif
70027+
70028 /*
70029 * Make sure the vma is shared, that it supports prefaulting,
70030 * and that the remapped range is valid and fully within
70031diff --git a/mm/highmem.c b/mm/highmem.c
70032index 5ef672c..d7660f4 100644
70033--- a/mm/highmem.c
70034+++ b/mm/highmem.c
70035@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
70036 * So no dangers, even with speculative execution.
70037 */
70038 page = pte_page(pkmap_page_table[i]);
70039+ pax_open_kernel();
70040 pte_clear(&init_mm, (unsigned long)page_address(page),
70041 &pkmap_page_table[i]);
70042-
70043+ pax_close_kernel();
70044 set_page_address(page, NULL);
70045 need_flush = 1;
70046 }
70047@@ -186,9 +187,11 @@ start:
70048 }
70049 }
70050 vaddr = PKMAP_ADDR(last_pkmap_nr);
70051+
70052+ pax_open_kernel();
70053 set_pte_at(&init_mm, vaddr,
70054 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
70055-
70056+ pax_close_kernel();
70057 pkmap_count[last_pkmap_nr] = 1;
70058 set_page_address(page, (void *)vaddr);
70059
70060diff --git a/mm/huge_memory.c b/mm/huge_memory.c
70061index d819d93..468e18f 100644
70062--- a/mm/huge_memory.c
70063+++ b/mm/huge_memory.c
70064@@ -702,7 +702,7 @@ out:
70065 * run pte_offset_map on the pmd, if an huge pmd could
70066 * materialize from under us from a different thread.
70067 */
70068- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
70069+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
70070 return VM_FAULT_OOM;
70071 /* if an huge pmd materialized from under us just retry later */
70072 if (unlikely(pmd_trans_huge(*pmd)))
70073@@ -829,7 +829,7 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
70074
70075 for (i = 0; i < HPAGE_PMD_NR; i++) {
70076 copy_user_highpage(pages[i], page + i,
70077- haddr + PAGE_SHIFT*i, vma);
70078+ haddr + PAGE_SIZE*i, vma);
70079 __SetPageUptodate(pages[i]);
70080 cond_resched();
70081 }
70082diff --git a/mm/hugetlb.c b/mm/hugetlb.c
70083index 73f17c0..fef0140 100644
70084--- a/mm/hugetlb.c
70085+++ b/mm/hugetlb.c
70086@@ -2347,6 +2347,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
70087 return 1;
70088 }
70089
70090+#ifdef CONFIG_PAX_SEGMEXEC
70091+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
70092+{
70093+ struct mm_struct *mm = vma->vm_mm;
70094+ struct vm_area_struct *vma_m;
70095+ unsigned long address_m;
70096+ pte_t *ptep_m;
70097+
70098+ vma_m = pax_find_mirror_vma(vma);
70099+ if (!vma_m)
70100+ return;
70101+
70102+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70103+ address_m = address + SEGMEXEC_TASK_SIZE;
70104+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
70105+ get_page(page_m);
70106+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
70107+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
70108+}
70109+#endif
70110+
70111 /*
70112 * Hugetlb_cow() should be called with page lock of the original hugepage held.
70113 */
70114@@ -2450,6 +2471,11 @@ retry_avoidcopy:
70115 make_huge_pte(vma, new_page, 1));
70116 page_remove_rmap(old_page);
70117 hugepage_add_new_anon_rmap(new_page, vma, address);
70118+
70119+#ifdef CONFIG_PAX_SEGMEXEC
70120+ pax_mirror_huge_pte(vma, address, new_page);
70121+#endif
70122+
70123 /* Make the old page be freed below */
70124 new_page = old_page;
70125 mmu_notifier_invalidate_range_end(mm,
70126@@ -2601,6 +2627,10 @@ retry:
70127 && (vma->vm_flags & VM_SHARED)));
70128 set_huge_pte_at(mm, address, ptep, new_pte);
70129
70130+#ifdef CONFIG_PAX_SEGMEXEC
70131+ pax_mirror_huge_pte(vma, address, page);
70132+#endif
70133+
70134 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
70135 /* Optimization, do the COW without a second fault */
70136 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
70137@@ -2630,6 +2660,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70138 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
70139 struct hstate *h = hstate_vma(vma);
70140
70141+#ifdef CONFIG_PAX_SEGMEXEC
70142+ struct vm_area_struct *vma_m;
70143+#endif
70144+
70145 ptep = huge_pte_offset(mm, address);
70146 if (ptep) {
70147 entry = huge_ptep_get(ptep);
70148@@ -2641,6 +2675,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70149 VM_FAULT_SET_HINDEX(h - hstates);
70150 }
70151
70152+#ifdef CONFIG_PAX_SEGMEXEC
70153+ vma_m = pax_find_mirror_vma(vma);
70154+ if (vma_m) {
70155+ unsigned long address_m;
70156+
70157+ if (vma->vm_start > vma_m->vm_start) {
70158+ address_m = address;
70159+ address -= SEGMEXEC_TASK_SIZE;
70160+ vma = vma_m;
70161+ h = hstate_vma(vma);
70162+ } else
70163+ address_m = address + SEGMEXEC_TASK_SIZE;
70164+
70165+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
70166+ return VM_FAULT_OOM;
70167+ address_m &= HPAGE_MASK;
70168+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
70169+ }
70170+#endif
70171+
70172 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
70173 if (!ptep)
70174 return VM_FAULT_OOM;
70175diff --git a/mm/internal.h b/mm/internal.h
70176index 2189af4..f2ca332 100644
70177--- a/mm/internal.h
70178+++ b/mm/internal.h
70179@@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page);
70180 * in mm/page_alloc.c
70181 */
70182 extern void __free_pages_bootmem(struct page *page, unsigned int order);
70183+extern void free_compound_page(struct page *page);
70184 extern void prep_compound_page(struct page *page, unsigned long order);
70185 #ifdef CONFIG_MEMORY_FAILURE
70186 extern bool is_free_buddy_page(struct page *page);
70187diff --git a/mm/kmemleak.c b/mm/kmemleak.c
70188index d6880f5..ed77913 100644
70189--- a/mm/kmemleak.c
70190+++ b/mm/kmemleak.c
70191@@ -357,7 +357,7 @@ static void print_unreferenced(struct seq_file *seq,
70192
70193 for (i = 0; i < object->trace_len; i++) {
70194 void *ptr = (void *)object->trace[i];
70195- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
70196+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
70197 }
70198 }
70199
70200diff --git a/mm/maccess.c b/mm/maccess.c
70201index 4cee182..e00511d 100644
70202--- a/mm/maccess.c
70203+++ b/mm/maccess.c
70204@@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
70205 set_fs(KERNEL_DS);
70206 pagefault_disable();
70207 ret = __copy_from_user_inatomic(dst,
70208- (__force const void __user *)src, size);
70209+ (const void __force_user *)src, size);
70210 pagefault_enable();
70211 set_fs(old_fs);
70212
70213@@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
70214
70215 set_fs(KERNEL_DS);
70216 pagefault_disable();
70217- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
70218+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
70219 pagefault_enable();
70220 set_fs(old_fs);
70221
70222diff --git a/mm/madvise.c b/mm/madvise.c
70223index 74bf193..feb6fd3 100644
70224--- a/mm/madvise.c
70225+++ b/mm/madvise.c
70226@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
70227 pgoff_t pgoff;
70228 unsigned long new_flags = vma->vm_flags;
70229
70230+#ifdef CONFIG_PAX_SEGMEXEC
70231+ struct vm_area_struct *vma_m;
70232+#endif
70233+
70234 switch (behavior) {
70235 case MADV_NORMAL:
70236 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
70237@@ -110,6 +114,13 @@ success:
70238 /*
70239 * vm_flags is protected by the mmap_sem held in write mode.
70240 */
70241+
70242+#ifdef CONFIG_PAX_SEGMEXEC
70243+ vma_m = pax_find_mirror_vma(vma);
70244+ if (vma_m)
70245+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
70246+#endif
70247+
70248 vma->vm_flags = new_flags;
70249
70250 out:
70251@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
70252 struct vm_area_struct ** prev,
70253 unsigned long start, unsigned long end)
70254 {
70255+
70256+#ifdef CONFIG_PAX_SEGMEXEC
70257+ struct vm_area_struct *vma_m;
70258+#endif
70259+
70260 *prev = vma;
70261 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
70262 return -EINVAL;
70263@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
70264 zap_page_range(vma, start, end - start, &details);
70265 } else
70266 zap_page_range(vma, start, end - start, NULL);
70267+
70268+#ifdef CONFIG_PAX_SEGMEXEC
70269+ vma_m = pax_find_mirror_vma(vma);
70270+ if (vma_m) {
70271+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
70272+ struct zap_details details = {
70273+ .nonlinear_vma = vma_m,
70274+ .last_index = ULONG_MAX,
70275+ };
70276+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
70277+ } else
70278+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
70279+ }
70280+#endif
70281+
70282 return 0;
70283 }
70284
70285@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
70286 if (end < start)
70287 goto out;
70288
70289+#ifdef CONFIG_PAX_SEGMEXEC
70290+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
70291+ if (end > SEGMEXEC_TASK_SIZE)
70292+ goto out;
70293+ } else
70294+#endif
70295+
70296+ if (end > TASK_SIZE)
70297+ goto out;
70298+
70299 error = 0;
70300 if (end == start)
70301 goto out;
70302diff --git a/mm/memory-failure.c b/mm/memory-failure.c
70303index 2b43ba0..fc09657 100644
70304--- a/mm/memory-failure.c
70305+++ b/mm/memory-failure.c
70306@@ -60,7 +60,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
70307
70308 int sysctl_memory_failure_recovery __read_mostly = 1;
70309
70310-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70311+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70312
70313 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
70314
70315@@ -201,7 +201,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
70316 si.si_signo = SIGBUS;
70317 si.si_errno = 0;
70318 si.si_code = BUS_MCEERR_AO;
70319- si.si_addr = (void *)addr;
70320+ si.si_addr = (void __user *)addr;
70321 #ifdef __ARCH_SI_TRAPNO
70322 si.si_trapno = trapno;
70323 #endif
70324@@ -1009,7 +1009,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70325 }
70326
70327 nr_pages = 1 << compound_trans_order(hpage);
70328- atomic_long_add(nr_pages, &mce_bad_pages);
70329+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
70330
70331 /*
70332 * We need/can do nothing about count=0 pages.
70333@@ -1039,7 +1039,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70334 if (!PageHWPoison(hpage)
70335 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
70336 || (p != hpage && TestSetPageHWPoison(hpage))) {
70337- atomic_long_sub(nr_pages, &mce_bad_pages);
70338+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70339 return 0;
70340 }
70341 set_page_hwpoison_huge_page(hpage);
70342@@ -1097,7 +1097,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70343 }
70344 if (hwpoison_filter(p)) {
70345 if (TestClearPageHWPoison(p))
70346- atomic_long_sub(nr_pages, &mce_bad_pages);
70347+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70348 unlock_page(hpage);
70349 put_page(hpage);
70350 return 0;
70351@@ -1314,7 +1314,7 @@ int unpoison_memory(unsigned long pfn)
70352 return 0;
70353 }
70354 if (TestClearPageHWPoison(p))
70355- atomic_long_sub(nr_pages, &mce_bad_pages);
70356+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70357 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
70358 return 0;
70359 }
70360@@ -1328,7 +1328,7 @@ int unpoison_memory(unsigned long pfn)
70361 */
70362 if (TestClearPageHWPoison(page)) {
70363 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
70364- atomic_long_sub(nr_pages, &mce_bad_pages);
70365+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70366 freeit = 1;
70367 if (PageHuge(page))
70368 clear_page_hwpoison_huge_page(page);
70369@@ -1441,7 +1441,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
70370 }
70371 done:
70372 if (!PageHWPoison(hpage))
70373- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
70374+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
70375 set_page_hwpoison_huge_page(hpage);
70376 dequeue_hwpoisoned_huge_page(hpage);
70377 /* keep elevated page count for bad page */
70378@@ -1572,7 +1572,7 @@ int soft_offline_page(struct page *page, int flags)
70379 return ret;
70380
70381 done:
70382- atomic_long_add(1, &mce_bad_pages);
70383+ atomic_long_add_unchecked(1, &mce_bad_pages);
70384 SetPageHWPoison(page);
70385 /* keep elevated page count for bad page */
70386 return ret;
70387diff --git a/mm/memory.c b/mm/memory.c
70388index b2b8731..6080174 100644
70389--- a/mm/memory.c
70390+++ b/mm/memory.c
70391@@ -457,8 +457,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
70392 return;
70393
70394 pmd = pmd_offset(pud, start);
70395+
70396+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
70397 pud_clear(pud);
70398 pmd_free_tlb(tlb, pmd, start);
70399+#endif
70400+
70401 }
70402
70403 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70404@@ -489,9 +493,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70405 if (end - 1 > ceiling - 1)
70406 return;
70407
70408+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
70409 pud = pud_offset(pgd, start);
70410 pgd_clear(pgd);
70411 pud_free_tlb(tlb, pud, start);
70412+#endif
70413+
70414 }
70415
70416 /*
70417@@ -1566,12 +1573,6 @@ no_page_table:
70418 return page;
70419 }
70420
70421-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
70422-{
70423- return stack_guard_page_start(vma, addr) ||
70424- stack_guard_page_end(vma, addr+PAGE_SIZE);
70425-}
70426-
70427 /**
70428 * __get_user_pages() - pin user pages in memory
70429 * @tsk: task_struct of target task
70430@@ -1644,10 +1645,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70431 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
70432 i = 0;
70433
70434- do {
70435+ while (nr_pages) {
70436 struct vm_area_struct *vma;
70437
70438- vma = find_extend_vma(mm, start);
70439+ vma = find_vma(mm, start);
70440 if (!vma && in_gate_area(mm, start)) {
70441 unsigned long pg = start & PAGE_MASK;
70442 pgd_t *pgd;
70443@@ -1695,7 +1696,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70444 goto next_page;
70445 }
70446
70447- if (!vma ||
70448+ if (!vma || start < vma->vm_start ||
70449 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
70450 !(vm_flags & vma->vm_flags))
70451 return i ? : -EFAULT;
70452@@ -1722,11 +1723,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70453 int ret;
70454 unsigned int fault_flags = 0;
70455
70456- /* For mlock, just skip the stack guard page. */
70457- if (foll_flags & FOLL_MLOCK) {
70458- if (stack_guard_page(vma, start))
70459- goto next_page;
70460- }
70461 if (foll_flags & FOLL_WRITE)
70462 fault_flags |= FAULT_FLAG_WRITE;
70463 if (nonblocking)
70464@@ -1800,7 +1796,7 @@ next_page:
70465 start += PAGE_SIZE;
70466 nr_pages--;
70467 } while (nr_pages && start < vma->vm_end);
70468- } while (nr_pages);
70469+ }
70470 return i;
70471 }
70472 EXPORT_SYMBOL(__get_user_pages);
70473@@ -2007,6 +2003,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
70474 page_add_file_rmap(page);
70475 set_pte_at(mm, addr, pte, mk_pte(page, prot));
70476
70477+#ifdef CONFIG_PAX_SEGMEXEC
70478+ pax_mirror_file_pte(vma, addr, page, ptl);
70479+#endif
70480+
70481 retval = 0;
70482 pte_unmap_unlock(pte, ptl);
70483 return retval;
70484@@ -2041,10 +2041,22 @@ out:
70485 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
70486 struct page *page)
70487 {
70488+
70489+#ifdef CONFIG_PAX_SEGMEXEC
70490+ struct vm_area_struct *vma_m;
70491+#endif
70492+
70493 if (addr < vma->vm_start || addr >= vma->vm_end)
70494 return -EFAULT;
70495 if (!page_count(page))
70496 return -EINVAL;
70497+
70498+#ifdef CONFIG_PAX_SEGMEXEC
70499+ vma_m = pax_find_mirror_vma(vma);
70500+ if (vma_m)
70501+ vma_m->vm_flags |= VM_INSERTPAGE;
70502+#endif
70503+
70504 vma->vm_flags |= VM_INSERTPAGE;
70505 return insert_page(vma, addr, page, vma->vm_page_prot);
70506 }
70507@@ -2130,6 +2142,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
70508 unsigned long pfn)
70509 {
70510 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
70511+ BUG_ON(vma->vm_mirror);
70512
70513 if (addr < vma->vm_start || addr >= vma->vm_end)
70514 return -EFAULT;
70515@@ -2445,6 +2458,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
70516 copy_user_highpage(dst, src, va, vma);
70517 }
70518
70519+#ifdef CONFIG_PAX_SEGMEXEC
70520+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
70521+{
70522+ struct mm_struct *mm = vma->vm_mm;
70523+ spinlock_t *ptl;
70524+ pte_t *pte, entry;
70525+
70526+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
70527+ entry = *pte;
70528+ if (!pte_present(entry)) {
70529+ if (!pte_none(entry)) {
70530+ BUG_ON(pte_file(entry));
70531+ free_swap_and_cache(pte_to_swp_entry(entry));
70532+ pte_clear_not_present_full(mm, address, pte, 0);
70533+ }
70534+ } else {
70535+ struct page *page;
70536+
70537+ flush_cache_page(vma, address, pte_pfn(entry));
70538+ entry = ptep_clear_flush(vma, address, pte);
70539+ BUG_ON(pte_dirty(entry));
70540+ page = vm_normal_page(vma, address, entry);
70541+ if (page) {
70542+ update_hiwater_rss(mm);
70543+ if (PageAnon(page))
70544+ dec_mm_counter_fast(mm, MM_ANONPAGES);
70545+ else
70546+ dec_mm_counter_fast(mm, MM_FILEPAGES);
70547+ page_remove_rmap(page);
70548+ page_cache_release(page);
70549+ }
70550+ }
70551+ pte_unmap_unlock(pte, ptl);
70552+}
70553+
70554+/* PaX: if vma is mirrored, synchronize the mirror's PTE
70555+ *
70556+ * the ptl of the lower mapped page is held on entry and is not released on exit
70557+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
70558+ */
70559+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70560+{
70561+ struct mm_struct *mm = vma->vm_mm;
70562+ unsigned long address_m;
70563+ spinlock_t *ptl_m;
70564+ struct vm_area_struct *vma_m;
70565+ pmd_t *pmd_m;
70566+ pte_t *pte_m, entry_m;
70567+
70568+ BUG_ON(!page_m || !PageAnon(page_m));
70569+
70570+ vma_m = pax_find_mirror_vma(vma);
70571+ if (!vma_m)
70572+ return;
70573+
70574+ BUG_ON(!PageLocked(page_m));
70575+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70576+ address_m = address + SEGMEXEC_TASK_SIZE;
70577+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70578+ pte_m = pte_offset_map(pmd_m, address_m);
70579+ ptl_m = pte_lockptr(mm, pmd_m);
70580+ if (ptl != ptl_m) {
70581+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70582+ if (!pte_none(*pte_m))
70583+ goto out;
70584+ }
70585+
70586+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70587+ page_cache_get(page_m);
70588+ page_add_anon_rmap(page_m, vma_m, address_m);
70589+ inc_mm_counter_fast(mm, MM_ANONPAGES);
70590+ set_pte_at(mm, address_m, pte_m, entry_m);
70591+ update_mmu_cache(vma_m, address_m, entry_m);
70592+out:
70593+ if (ptl != ptl_m)
70594+ spin_unlock(ptl_m);
70595+ pte_unmap(pte_m);
70596+ unlock_page(page_m);
70597+}
70598+
70599+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70600+{
70601+ struct mm_struct *mm = vma->vm_mm;
70602+ unsigned long address_m;
70603+ spinlock_t *ptl_m;
70604+ struct vm_area_struct *vma_m;
70605+ pmd_t *pmd_m;
70606+ pte_t *pte_m, entry_m;
70607+
70608+ BUG_ON(!page_m || PageAnon(page_m));
70609+
70610+ vma_m = pax_find_mirror_vma(vma);
70611+ if (!vma_m)
70612+ return;
70613+
70614+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70615+ address_m = address + SEGMEXEC_TASK_SIZE;
70616+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70617+ pte_m = pte_offset_map(pmd_m, address_m);
70618+ ptl_m = pte_lockptr(mm, pmd_m);
70619+ if (ptl != ptl_m) {
70620+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70621+ if (!pte_none(*pte_m))
70622+ goto out;
70623+ }
70624+
70625+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70626+ page_cache_get(page_m);
70627+ page_add_file_rmap(page_m);
70628+ inc_mm_counter_fast(mm, MM_FILEPAGES);
70629+ set_pte_at(mm, address_m, pte_m, entry_m);
70630+ update_mmu_cache(vma_m, address_m, entry_m);
70631+out:
70632+ if (ptl != ptl_m)
70633+ spin_unlock(ptl_m);
70634+ pte_unmap(pte_m);
70635+}
70636+
70637+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
70638+{
70639+ struct mm_struct *mm = vma->vm_mm;
70640+ unsigned long address_m;
70641+ spinlock_t *ptl_m;
70642+ struct vm_area_struct *vma_m;
70643+ pmd_t *pmd_m;
70644+ pte_t *pte_m, entry_m;
70645+
70646+ vma_m = pax_find_mirror_vma(vma);
70647+ if (!vma_m)
70648+ return;
70649+
70650+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70651+ address_m = address + SEGMEXEC_TASK_SIZE;
70652+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70653+ pte_m = pte_offset_map(pmd_m, address_m);
70654+ ptl_m = pte_lockptr(mm, pmd_m);
70655+ if (ptl != ptl_m) {
70656+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70657+ if (!pte_none(*pte_m))
70658+ goto out;
70659+ }
70660+
70661+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
70662+ set_pte_at(mm, address_m, pte_m, entry_m);
70663+out:
70664+ if (ptl != ptl_m)
70665+ spin_unlock(ptl_m);
70666+ pte_unmap(pte_m);
70667+}
70668+
70669+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
70670+{
70671+ struct page *page_m;
70672+ pte_t entry;
70673+
70674+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
70675+ goto out;
70676+
70677+ entry = *pte;
70678+ page_m = vm_normal_page(vma, address, entry);
70679+ if (!page_m)
70680+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
70681+ else if (PageAnon(page_m)) {
70682+ if (pax_find_mirror_vma(vma)) {
70683+ pte_unmap_unlock(pte, ptl);
70684+ lock_page(page_m);
70685+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
70686+ if (pte_same(entry, *pte))
70687+ pax_mirror_anon_pte(vma, address, page_m, ptl);
70688+ else
70689+ unlock_page(page_m);
70690+ }
70691+ } else
70692+ pax_mirror_file_pte(vma, address, page_m, ptl);
70693+
70694+out:
70695+ pte_unmap_unlock(pte, ptl);
70696+}
70697+#endif
70698+
70699 /*
70700 * This routine handles present pages, when users try to write
70701 * to a shared page. It is done by copying the page to a new address
70702@@ -2656,6 +2849,12 @@ gotten:
70703 */
70704 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70705 if (likely(pte_same(*page_table, orig_pte))) {
70706+
70707+#ifdef CONFIG_PAX_SEGMEXEC
70708+ if (pax_find_mirror_vma(vma))
70709+ BUG_ON(!trylock_page(new_page));
70710+#endif
70711+
70712 if (old_page) {
70713 if (!PageAnon(old_page)) {
70714 dec_mm_counter_fast(mm, MM_FILEPAGES);
70715@@ -2707,6 +2906,10 @@ gotten:
70716 page_remove_rmap(old_page);
70717 }
70718
70719+#ifdef CONFIG_PAX_SEGMEXEC
70720+ pax_mirror_anon_pte(vma, address, new_page, ptl);
70721+#endif
70722+
70723 /* Free the old page.. */
70724 new_page = old_page;
70725 ret |= VM_FAULT_WRITE;
70726@@ -2986,6 +3189,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
70727 swap_free(entry);
70728 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
70729 try_to_free_swap(page);
70730+
70731+#ifdef CONFIG_PAX_SEGMEXEC
70732+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
70733+#endif
70734+
70735 unlock_page(page);
70736 if (swapcache) {
70737 /*
70738@@ -3009,6 +3217,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
70739
70740 /* No need to invalidate - it was non-present before */
70741 update_mmu_cache(vma, address, page_table);
70742+
70743+#ifdef CONFIG_PAX_SEGMEXEC
70744+ pax_mirror_anon_pte(vma, address, page, ptl);
70745+#endif
70746+
70747 unlock:
70748 pte_unmap_unlock(page_table, ptl);
70749 out:
70750@@ -3028,40 +3241,6 @@ out_release:
70751 }
70752
70753 /*
70754- * This is like a special single-page "expand_{down|up}wards()",
70755- * except we must first make sure that 'address{-|+}PAGE_SIZE'
70756- * doesn't hit another vma.
70757- */
70758-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
70759-{
70760- address &= PAGE_MASK;
70761- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
70762- struct vm_area_struct *prev = vma->vm_prev;
70763-
70764- /*
70765- * Is there a mapping abutting this one below?
70766- *
70767- * That's only ok if it's the same stack mapping
70768- * that has gotten split..
70769- */
70770- if (prev && prev->vm_end == address)
70771- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
70772-
70773- expand_downwards(vma, address - PAGE_SIZE);
70774- }
70775- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
70776- struct vm_area_struct *next = vma->vm_next;
70777-
70778- /* As VM_GROWSDOWN but s/below/above/ */
70779- if (next && next->vm_start == address + PAGE_SIZE)
70780- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
70781-
70782- expand_upwards(vma, address + PAGE_SIZE);
70783- }
70784- return 0;
70785-}
70786-
70787-/*
70788 * We enter with non-exclusive mmap_sem (to exclude vma changes,
70789 * but allow concurrent faults), and pte mapped but not yet locked.
70790 * We return with mmap_sem still held, but pte unmapped and unlocked.
70791@@ -3070,27 +3249,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
70792 unsigned long address, pte_t *page_table, pmd_t *pmd,
70793 unsigned int flags)
70794 {
70795- struct page *page;
70796+ struct page *page = NULL;
70797 spinlock_t *ptl;
70798 pte_t entry;
70799
70800- pte_unmap(page_table);
70801-
70802- /* Check if we need to add a guard page to the stack */
70803- if (check_stack_guard_page(vma, address) < 0)
70804- return VM_FAULT_SIGBUS;
70805-
70806- /* Use the zero-page for reads */
70807 if (!(flags & FAULT_FLAG_WRITE)) {
70808 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
70809 vma->vm_page_prot));
70810- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70811+ ptl = pte_lockptr(mm, pmd);
70812+ spin_lock(ptl);
70813 if (!pte_none(*page_table))
70814 goto unlock;
70815 goto setpte;
70816 }
70817
70818 /* Allocate our own private page. */
70819+ pte_unmap(page_table);
70820+
70821 if (unlikely(anon_vma_prepare(vma)))
70822 goto oom;
70823 page = alloc_zeroed_user_highpage_movable(vma, address);
70824@@ -3109,6 +3284,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
70825 if (!pte_none(*page_table))
70826 goto release;
70827
70828+#ifdef CONFIG_PAX_SEGMEXEC
70829+ if (pax_find_mirror_vma(vma))
70830+ BUG_ON(!trylock_page(page));
70831+#endif
70832+
70833 inc_mm_counter_fast(mm, MM_ANONPAGES);
70834 page_add_new_anon_rmap(page, vma, address);
70835 setpte:
70836@@ -3116,6 +3296,12 @@ setpte:
70837
70838 /* No need to invalidate - it was non-present before */
70839 update_mmu_cache(vma, address, page_table);
70840+
70841+#ifdef CONFIG_PAX_SEGMEXEC
70842+ if (page)
70843+ pax_mirror_anon_pte(vma, address, page, ptl);
70844+#endif
70845+
70846 unlock:
70847 pte_unmap_unlock(page_table, ptl);
70848 return 0;
70849@@ -3259,6 +3445,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70850 */
70851 /* Only go through if we didn't race with anybody else... */
70852 if (likely(pte_same(*page_table, orig_pte))) {
70853+
70854+#ifdef CONFIG_PAX_SEGMEXEC
70855+ if (anon && pax_find_mirror_vma(vma))
70856+ BUG_ON(!trylock_page(page));
70857+#endif
70858+
70859 flush_icache_page(vma, page);
70860 entry = mk_pte(page, vma->vm_page_prot);
70861 if (flags & FAULT_FLAG_WRITE)
70862@@ -3278,6 +3470,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70863
70864 /* no need to invalidate: a not-present page won't be cached */
70865 update_mmu_cache(vma, address, page_table);
70866+
70867+#ifdef CONFIG_PAX_SEGMEXEC
70868+ if (anon)
70869+ pax_mirror_anon_pte(vma, address, page, ptl);
70870+ else
70871+ pax_mirror_file_pte(vma, address, page, ptl);
70872+#endif
70873+
70874 } else {
70875 if (cow_page)
70876 mem_cgroup_uncharge_page(cow_page);
70877@@ -3431,6 +3631,12 @@ int handle_pte_fault(struct mm_struct *mm,
70878 if (flags & FAULT_FLAG_WRITE)
70879 flush_tlb_fix_spurious_fault(vma, address);
70880 }
70881+
70882+#ifdef CONFIG_PAX_SEGMEXEC
70883+ pax_mirror_pte(vma, address, pte, pmd, ptl);
70884+ return 0;
70885+#endif
70886+
70887 unlock:
70888 pte_unmap_unlock(pte, ptl);
70889 return 0;
70890@@ -3447,6 +3653,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70891 pmd_t *pmd;
70892 pte_t *pte;
70893
70894+#ifdef CONFIG_PAX_SEGMEXEC
70895+ struct vm_area_struct *vma_m;
70896+#endif
70897+
70898 __set_current_state(TASK_RUNNING);
70899
70900 count_vm_event(PGFAULT);
70901@@ -3458,6 +3668,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70902 if (unlikely(is_vm_hugetlb_page(vma)))
70903 return hugetlb_fault(mm, vma, address, flags);
70904
70905+#ifdef CONFIG_PAX_SEGMEXEC
70906+ vma_m = pax_find_mirror_vma(vma);
70907+ if (vma_m) {
70908+ unsigned long address_m;
70909+ pgd_t *pgd_m;
70910+ pud_t *pud_m;
70911+ pmd_t *pmd_m;
70912+
70913+ if (vma->vm_start > vma_m->vm_start) {
70914+ address_m = address;
70915+ address -= SEGMEXEC_TASK_SIZE;
70916+ vma = vma_m;
70917+ } else
70918+ address_m = address + SEGMEXEC_TASK_SIZE;
70919+
70920+ pgd_m = pgd_offset(mm, address_m);
70921+ pud_m = pud_alloc(mm, pgd_m, address_m);
70922+ if (!pud_m)
70923+ return VM_FAULT_OOM;
70924+ pmd_m = pmd_alloc(mm, pud_m, address_m);
70925+ if (!pmd_m)
70926+ return VM_FAULT_OOM;
70927+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
70928+ return VM_FAULT_OOM;
70929+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
70930+ }
70931+#endif
70932+
70933 pgd = pgd_offset(mm, address);
70934 pud = pud_alloc(mm, pgd, address);
70935 if (!pud)
70936@@ -3487,7 +3725,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70937 * run pte_offset_map on the pmd, if an huge pmd could
70938 * materialize from under us from a different thread.
70939 */
70940- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
70941+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
70942 return VM_FAULT_OOM;
70943 /* if an huge pmd materialized from under us just retry later */
70944 if (unlikely(pmd_trans_huge(*pmd)))
70945@@ -3591,7 +3829,7 @@ static int __init gate_vma_init(void)
70946 gate_vma.vm_start = FIXADDR_USER_START;
70947 gate_vma.vm_end = FIXADDR_USER_END;
70948 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
70949- gate_vma.vm_page_prot = __P101;
70950+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
70951 /*
70952 * Make sure the vDSO gets into every core dump.
70953 * Dumping its contents makes post-mortem fully interpretable later
70954diff --git a/mm/mempolicy.c b/mm/mempolicy.c
70955index 9c51f9f..f2b1c49 100644
70956--- a/mm/mempolicy.c
70957+++ b/mm/mempolicy.c
70958@@ -636,20 +636,33 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
70959 struct vm_area_struct *prev;
70960 struct vm_area_struct *vma;
70961 int err = 0;
70962+ pgoff_t pgoff;
70963 unsigned long vmstart;
70964 unsigned long vmend;
70965
70966+#ifdef CONFIG_PAX_SEGMEXEC
70967+ struct vm_area_struct *vma_m;
70968+#endif
70969+
70970 vma = find_vma_prev(mm, start, &prev);
70971 if (!vma || vma->vm_start > start)
70972 return -EFAULT;
70973
70974+ if (start > vma->vm_start)
70975+ prev = vma;
70976+
70977 for (; vma && vma->vm_start < end; prev = vma, vma = next) {
70978 next = vma->vm_next;
70979 vmstart = max(start, vma->vm_start);
70980 vmend = min(end, vma->vm_end);
70981
70982+ if (mpol_equal(vma_policy(vma), new_pol))
70983+ continue;
70984+
70985+ pgoff = vma->vm_pgoff +
70986+ ((vmstart - vma->vm_start) >> PAGE_SHIFT);
70987 prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags,
70988- vma->anon_vma, vma->vm_file, vma->vm_pgoff,
70989+ vma->anon_vma, vma->vm_file, pgoff,
70990 new_pol);
70991 if (prev) {
70992 vma = prev;
70993@@ -669,6 +682,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
70994 err = policy_vma(vma, new_pol);
70995 if (err)
70996 goto out;
70997+
70998+#ifdef CONFIG_PAX_SEGMEXEC
70999+ vma_m = pax_find_mirror_vma(vma);
71000+ if (vma_m) {
71001+ err = policy_vma(vma_m, new_pol);
71002+ if (err)
71003+ goto out;
71004+ }
71005+#endif
71006+
71007 }
71008
71009 out:
71010@@ -1102,6 +1125,17 @@ static long do_mbind(unsigned long start, unsigned long len,
71011
71012 if (end < start)
71013 return -EINVAL;
71014+
71015+#ifdef CONFIG_PAX_SEGMEXEC
71016+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
71017+ if (end > SEGMEXEC_TASK_SIZE)
71018+ return -EINVAL;
71019+ } else
71020+#endif
71021+
71022+ if (end > TASK_SIZE)
71023+ return -EINVAL;
71024+
71025 if (end == start)
71026 return 0;
71027
71028@@ -1320,6 +1354,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
71029 if (!mm)
71030 goto out;
71031
71032+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
71033+ if (mm != current->mm &&
71034+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
71035+ err = -EPERM;
71036+ goto out;
71037+ }
71038+#endif
71039+
71040 /*
71041 * Check if this process has the right to modify the specified
71042 * process. The right exists if the process has administrative
71043@@ -1329,8 +1371,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
71044 rcu_read_lock();
71045 tcred = __task_cred(task);
71046 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
71047- cred->uid != tcred->suid && cred->uid != tcred->uid &&
71048- !capable(CAP_SYS_NICE)) {
71049+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
71050 rcu_read_unlock();
71051 err = -EPERM;
71052 goto out;
71053diff --git a/mm/migrate.c b/mm/migrate.c
71054index 14d0a6a..0360908 100644
71055--- a/mm/migrate.c
71056+++ b/mm/migrate.c
71057@@ -866,9 +866,9 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
71058
71059 if (anon_vma)
71060 put_anon_vma(anon_vma);
71061-out:
71062 unlock_page(hpage);
71063
71064+out:
71065 if (rc != -EAGAIN) {
71066 list_del(&hpage->lru);
71067 put_page(hpage);
71068@@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
71069 unsigned long chunk_start;
71070 int err;
71071
71072+ pax_track_stack();
71073+
71074 task_nodes = cpuset_mems_allowed(task);
71075
71076 err = -ENOMEM;
71077@@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
71078 if (!mm)
71079 return -EINVAL;
71080
71081+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
71082+ if (mm != current->mm &&
71083+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
71084+ err = -EPERM;
71085+ goto out;
71086+ }
71087+#endif
71088+
71089 /*
71090 * Check if this process has the right to modify the specified
71091 * process. The right exists if the process has administrative
71092@@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
71093 rcu_read_lock();
71094 tcred = __task_cred(task);
71095 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
71096- cred->uid != tcred->suid && cred->uid != tcred->uid &&
71097- !capable(CAP_SYS_NICE)) {
71098+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
71099 rcu_read_unlock();
71100 err = -EPERM;
71101 goto out;
71102diff --git a/mm/mlock.c b/mm/mlock.c
71103index 048260c..57f4a4e 100644
71104--- a/mm/mlock.c
71105+++ b/mm/mlock.c
71106@@ -13,6 +13,7 @@
71107 #include <linux/pagemap.h>
71108 #include <linux/mempolicy.h>
71109 #include <linux/syscalls.h>
71110+#include <linux/security.h>
71111 #include <linux/sched.h>
71112 #include <linux/module.h>
71113 #include <linux/rmap.h>
71114@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
71115 return -EINVAL;
71116 if (end == start)
71117 return 0;
71118+ if (end > TASK_SIZE)
71119+ return -EINVAL;
71120+
71121 vma = find_vma_prev(current->mm, start, &prev);
71122 if (!vma || vma->vm_start > start)
71123 return -ENOMEM;
71124@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
71125 for (nstart = start ; ; ) {
71126 vm_flags_t newflags;
71127
71128+#ifdef CONFIG_PAX_SEGMEXEC
71129+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71130+ break;
71131+#endif
71132+
71133 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
71134
71135 newflags = vma->vm_flags | VM_LOCKED;
71136@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
71137 lock_limit >>= PAGE_SHIFT;
71138
71139 /* check against resource limits */
71140+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
71141 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
71142 error = do_mlock(start, len, 1);
71143 up_write(&current->mm->mmap_sem);
71144@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
71145 static int do_mlockall(int flags)
71146 {
71147 struct vm_area_struct * vma, * prev = NULL;
71148- unsigned int def_flags = 0;
71149
71150 if (flags & MCL_FUTURE)
71151- def_flags = VM_LOCKED;
71152- current->mm->def_flags = def_flags;
71153+ current->mm->def_flags |= VM_LOCKED;
71154+ else
71155+ current->mm->def_flags &= ~VM_LOCKED;
71156 if (flags == MCL_FUTURE)
71157 goto out;
71158
71159 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
71160 vm_flags_t newflags;
71161
71162+#ifdef CONFIG_PAX_SEGMEXEC
71163+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71164+ break;
71165+#endif
71166+
71167+ BUG_ON(vma->vm_end > TASK_SIZE);
71168 newflags = vma->vm_flags | VM_LOCKED;
71169 if (!(flags & MCL_CURRENT))
71170 newflags &= ~VM_LOCKED;
71171@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
71172 lock_limit >>= PAGE_SHIFT;
71173
71174 ret = -ENOMEM;
71175+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
71176 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
71177 capable(CAP_IPC_LOCK))
71178 ret = do_mlockall(flags);
71179diff --git a/mm/mmap.c b/mm/mmap.c
71180index a65efd4..17d61ff 100644
71181--- a/mm/mmap.c
71182+++ b/mm/mmap.c
71183@@ -46,6 +46,16 @@
71184 #define arch_rebalance_pgtables(addr, len) (addr)
71185 #endif
71186
71187+static inline void verify_mm_writelocked(struct mm_struct *mm)
71188+{
71189+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
71190+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
71191+ up_read(&mm->mmap_sem);
71192+ BUG();
71193+ }
71194+#endif
71195+}
71196+
71197 static void unmap_region(struct mm_struct *mm,
71198 struct vm_area_struct *vma, struct vm_area_struct *prev,
71199 unsigned long start, unsigned long end);
71200@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struct *mm,
71201 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
71202 *
71203 */
71204-pgprot_t protection_map[16] = {
71205+pgprot_t protection_map[16] __read_only = {
71206 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
71207 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
71208 };
71209
71210-pgprot_t vm_get_page_prot(unsigned long vm_flags)
71211+pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
71212 {
71213- return __pgprot(pgprot_val(protection_map[vm_flags &
71214+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
71215 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
71216 pgprot_val(arch_vm_get_page_prot(vm_flags)));
71217+
71218+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71219+ if (!(__supported_pte_mask & _PAGE_NX) &&
71220+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
71221+ (vm_flags & (VM_READ | VM_WRITE)))
71222+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
71223+#endif
71224+
71225+ return prot;
71226 }
71227 EXPORT_SYMBOL(vm_get_page_prot);
71228
71229 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
71230 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
71231 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
71232+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
71233 /*
71234 * Make sure vm_committed_as in one cacheline and not cacheline shared with
71235 * other variables. It can be updated by several CPUs frequently.
71236@@ -228,6 +248,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
71237 struct vm_area_struct *next = vma->vm_next;
71238
71239 might_sleep();
71240+ BUG_ON(vma->vm_mirror);
71241 if (vma->vm_ops && vma->vm_ops->close)
71242 vma->vm_ops->close(vma);
71243 if (vma->vm_file) {
71244@@ -272,6 +293,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
71245 * not page aligned -Ram Gupta
71246 */
71247 rlim = rlimit(RLIMIT_DATA);
71248+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
71249 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
71250 (mm->end_data - mm->start_data) > rlim)
71251 goto out;
71252@@ -689,6 +711,12 @@ static int
71253 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
71254 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
71255 {
71256+
71257+#ifdef CONFIG_PAX_SEGMEXEC
71258+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
71259+ return 0;
71260+#endif
71261+
71262 if (is_mergeable_vma(vma, file, vm_flags) &&
71263 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
71264 if (vma->vm_pgoff == vm_pgoff)
71265@@ -708,6 +736,12 @@ static int
71266 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
71267 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
71268 {
71269+
71270+#ifdef CONFIG_PAX_SEGMEXEC
71271+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
71272+ return 0;
71273+#endif
71274+
71275 if (is_mergeable_vma(vma, file, vm_flags) &&
71276 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
71277 pgoff_t vm_pglen;
71278@@ -750,13 +784,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
71279 struct vm_area_struct *vma_merge(struct mm_struct *mm,
71280 struct vm_area_struct *prev, unsigned long addr,
71281 unsigned long end, unsigned long vm_flags,
71282- struct anon_vma *anon_vma, struct file *file,
71283+ struct anon_vma *anon_vma, struct file *file,
71284 pgoff_t pgoff, struct mempolicy *policy)
71285 {
71286 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
71287 struct vm_area_struct *area, *next;
71288 int err;
71289
71290+#ifdef CONFIG_PAX_SEGMEXEC
71291+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
71292+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
71293+
71294+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
71295+#endif
71296+
71297 /*
71298 * We later require that vma->vm_flags == vm_flags,
71299 * so this tests vma->vm_flags & VM_SPECIAL, too.
71300@@ -772,6 +813,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71301 if (next && next->vm_end == end) /* cases 6, 7, 8 */
71302 next = next->vm_next;
71303
71304+#ifdef CONFIG_PAX_SEGMEXEC
71305+ if (prev)
71306+ prev_m = pax_find_mirror_vma(prev);
71307+ if (area)
71308+ area_m = pax_find_mirror_vma(area);
71309+ if (next)
71310+ next_m = pax_find_mirror_vma(next);
71311+#endif
71312+
71313 /*
71314 * Can it merge with the predecessor?
71315 */
71316@@ -791,9 +841,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71317 /* cases 1, 6 */
71318 err = vma_adjust(prev, prev->vm_start,
71319 next->vm_end, prev->vm_pgoff, NULL);
71320- } else /* cases 2, 5, 7 */
71321+
71322+#ifdef CONFIG_PAX_SEGMEXEC
71323+ if (!err && prev_m)
71324+ err = vma_adjust(prev_m, prev_m->vm_start,
71325+ next_m->vm_end, prev_m->vm_pgoff, NULL);
71326+#endif
71327+
71328+ } else { /* cases 2, 5, 7 */
71329 err = vma_adjust(prev, prev->vm_start,
71330 end, prev->vm_pgoff, NULL);
71331+
71332+#ifdef CONFIG_PAX_SEGMEXEC
71333+ if (!err && prev_m)
71334+ err = vma_adjust(prev_m, prev_m->vm_start,
71335+ end_m, prev_m->vm_pgoff, NULL);
71336+#endif
71337+
71338+ }
71339 if (err)
71340 return NULL;
71341 khugepaged_enter_vma_merge(prev);
71342@@ -807,12 +872,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71343 mpol_equal(policy, vma_policy(next)) &&
71344 can_vma_merge_before(next, vm_flags,
71345 anon_vma, file, pgoff+pglen)) {
71346- if (prev && addr < prev->vm_end) /* case 4 */
71347+ if (prev && addr < prev->vm_end) { /* case 4 */
71348 err = vma_adjust(prev, prev->vm_start,
71349 addr, prev->vm_pgoff, NULL);
71350- else /* cases 3, 8 */
71351+
71352+#ifdef CONFIG_PAX_SEGMEXEC
71353+ if (!err && prev_m)
71354+ err = vma_adjust(prev_m, prev_m->vm_start,
71355+ addr_m, prev_m->vm_pgoff, NULL);
71356+#endif
71357+
71358+ } else { /* cases 3, 8 */
71359 err = vma_adjust(area, addr, next->vm_end,
71360 next->vm_pgoff - pglen, NULL);
71361+
71362+#ifdef CONFIG_PAX_SEGMEXEC
71363+ if (!err && area_m)
71364+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
71365+ next_m->vm_pgoff - pglen, NULL);
71366+#endif
71367+
71368+ }
71369 if (err)
71370 return NULL;
71371 khugepaged_enter_vma_merge(area);
71372@@ -921,14 +1001,11 @@ none:
71373 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
71374 struct file *file, long pages)
71375 {
71376- const unsigned long stack_flags
71377- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
71378-
71379 if (file) {
71380 mm->shared_vm += pages;
71381 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
71382 mm->exec_vm += pages;
71383- } else if (flags & stack_flags)
71384+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
71385 mm->stack_vm += pages;
71386 if (flags & (VM_RESERVED|VM_IO))
71387 mm->reserved_vm += pages;
71388@@ -955,7 +1032,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71389 * (the exception is when the underlying filesystem is noexec
71390 * mounted, in which case we dont add PROT_EXEC.)
71391 */
71392- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
71393+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
71394 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
71395 prot |= PROT_EXEC;
71396
71397@@ -981,7 +1058,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71398 /* Obtain the address to map to. we verify (or select) it and ensure
71399 * that it represents a valid section of the address space.
71400 */
71401- addr = get_unmapped_area(file, addr, len, pgoff, flags);
71402+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
71403 if (addr & ~PAGE_MASK)
71404 return addr;
71405
71406@@ -992,6 +1069,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71407 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
71408 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
71409
71410+#ifdef CONFIG_PAX_MPROTECT
71411+ if (mm->pax_flags & MF_PAX_MPROTECT) {
71412+#ifndef CONFIG_PAX_MPROTECT_COMPAT
71413+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
71414+ gr_log_rwxmmap(file);
71415+
71416+#ifdef CONFIG_PAX_EMUPLT
71417+ vm_flags &= ~VM_EXEC;
71418+#else
71419+ return -EPERM;
71420+#endif
71421+
71422+ }
71423+
71424+ if (!(vm_flags & VM_EXEC))
71425+ vm_flags &= ~VM_MAYEXEC;
71426+#else
71427+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
71428+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
71429+#endif
71430+ else
71431+ vm_flags &= ~VM_MAYWRITE;
71432+ }
71433+#endif
71434+
71435+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71436+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
71437+ vm_flags &= ~VM_PAGEEXEC;
71438+#endif
71439+
71440 if (flags & MAP_LOCKED)
71441 if (!can_do_mlock())
71442 return -EPERM;
71443@@ -1003,6 +1110,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71444 locked += mm->locked_vm;
71445 lock_limit = rlimit(RLIMIT_MEMLOCK);
71446 lock_limit >>= PAGE_SHIFT;
71447+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71448 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
71449 return -EAGAIN;
71450 }
71451@@ -1073,6 +1181,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71452 if (error)
71453 return error;
71454
71455+ if (!gr_acl_handle_mmap(file, prot))
71456+ return -EACCES;
71457+
71458 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
71459 }
71460 EXPORT_SYMBOL(do_mmap_pgoff);
71461@@ -1153,7 +1264,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
71462 vm_flags_t vm_flags = vma->vm_flags;
71463
71464 /* If it was private or non-writable, the write bit is already clear */
71465- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
71466+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
71467 return 0;
71468
71469 /* The backer wishes to know when pages are first written to? */
71470@@ -1202,14 +1313,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
71471 unsigned long charged = 0;
71472 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
71473
71474+#ifdef CONFIG_PAX_SEGMEXEC
71475+ struct vm_area_struct *vma_m = NULL;
71476+#endif
71477+
71478+ /*
71479+ * mm->mmap_sem is required to protect against another thread
71480+ * changing the mappings in case we sleep.
71481+ */
71482+ verify_mm_writelocked(mm);
71483+
71484 /* Clear old maps */
71485 error = -ENOMEM;
71486-munmap_back:
71487 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71488 if (vma && vma->vm_start < addr + len) {
71489 if (do_munmap(mm, addr, len))
71490 return -ENOMEM;
71491- goto munmap_back;
71492+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71493+ BUG_ON(vma && vma->vm_start < addr + len);
71494 }
71495
71496 /* Check against address space limit. */
71497@@ -1258,6 +1379,16 @@ munmap_back:
71498 goto unacct_error;
71499 }
71500
71501+#ifdef CONFIG_PAX_SEGMEXEC
71502+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
71503+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
71504+ if (!vma_m) {
71505+ error = -ENOMEM;
71506+ goto free_vma;
71507+ }
71508+ }
71509+#endif
71510+
71511 vma->vm_mm = mm;
71512 vma->vm_start = addr;
71513 vma->vm_end = addr + len;
71514@@ -1281,6 +1412,19 @@ munmap_back:
71515 error = file->f_op->mmap(file, vma);
71516 if (error)
71517 goto unmap_and_free_vma;
71518+
71519+#ifdef CONFIG_PAX_SEGMEXEC
71520+ if (vma_m && (vm_flags & VM_EXECUTABLE))
71521+ added_exe_file_vma(mm);
71522+#endif
71523+
71524+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71525+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
71526+ vma->vm_flags |= VM_PAGEEXEC;
71527+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
71528+ }
71529+#endif
71530+
71531 if (vm_flags & VM_EXECUTABLE)
71532 added_exe_file_vma(mm);
71533
71534@@ -1316,6 +1460,11 @@ munmap_back:
71535 vma_link(mm, vma, prev, rb_link, rb_parent);
71536 file = vma->vm_file;
71537
71538+#ifdef CONFIG_PAX_SEGMEXEC
71539+ if (vma_m)
71540+ BUG_ON(pax_mirror_vma(vma_m, vma));
71541+#endif
71542+
71543 /* Once vma denies write, undo our temporary denial count */
71544 if (correct_wcount)
71545 atomic_inc(&inode->i_writecount);
71546@@ -1324,6 +1473,7 @@ out:
71547
71548 mm->total_vm += len >> PAGE_SHIFT;
71549 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
71550+ track_exec_limit(mm, addr, addr + len, vm_flags);
71551 if (vm_flags & VM_LOCKED) {
71552 if (!mlock_vma_pages_range(vma, addr, addr + len))
71553 mm->locked_vm += (len >> PAGE_SHIFT);
71554@@ -1341,6 +1491,12 @@ unmap_and_free_vma:
71555 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
71556 charged = 0;
71557 free_vma:
71558+
71559+#ifdef CONFIG_PAX_SEGMEXEC
71560+ if (vma_m)
71561+ kmem_cache_free(vm_area_cachep, vma_m);
71562+#endif
71563+
71564 kmem_cache_free(vm_area_cachep, vma);
71565 unacct_error:
71566 if (charged)
71567@@ -1348,6 +1504,44 @@ unacct_error:
71568 return error;
71569 }
71570
71571+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
71572+{
71573+ if (!vma) {
71574+#ifdef CONFIG_STACK_GROWSUP
71575+ if (addr > sysctl_heap_stack_gap)
71576+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
71577+ else
71578+ vma = find_vma(current->mm, 0);
71579+ if (vma && (vma->vm_flags & VM_GROWSUP))
71580+ return false;
71581+#endif
71582+ return true;
71583+ }
71584+
71585+ if (addr + len > vma->vm_start)
71586+ return false;
71587+
71588+ if (vma->vm_flags & VM_GROWSDOWN)
71589+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
71590+#ifdef CONFIG_STACK_GROWSUP
71591+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
71592+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
71593+#endif
71594+
71595+ return true;
71596+}
71597+
71598+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
71599+{
71600+ if (vma->vm_start < len)
71601+ return -ENOMEM;
71602+ if (!(vma->vm_flags & VM_GROWSDOWN))
71603+ return vma->vm_start - len;
71604+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
71605+ return vma->vm_start - len - sysctl_heap_stack_gap;
71606+ return -ENOMEM;
71607+}
71608+
71609 /* Get an address range which is currently unmapped.
71610 * For shmat() with addr=0.
71611 *
71612@@ -1374,18 +1568,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
71613 if (flags & MAP_FIXED)
71614 return addr;
71615
71616+#ifdef CONFIG_PAX_RANDMMAP
71617+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71618+#endif
71619+
71620 if (addr) {
71621 addr = PAGE_ALIGN(addr);
71622- vma = find_vma(mm, addr);
71623- if (TASK_SIZE - len >= addr &&
71624- (!vma || addr + len <= vma->vm_start))
71625- return addr;
71626+ if (TASK_SIZE - len >= addr) {
71627+ vma = find_vma(mm, addr);
71628+ if (check_heap_stack_gap(vma, addr, len))
71629+ return addr;
71630+ }
71631 }
71632 if (len > mm->cached_hole_size) {
71633- start_addr = addr = mm->free_area_cache;
71634+ start_addr = addr = mm->free_area_cache;
71635 } else {
71636- start_addr = addr = TASK_UNMAPPED_BASE;
71637- mm->cached_hole_size = 0;
71638+ start_addr = addr = mm->mmap_base;
71639+ mm->cached_hole_size = 0;
71640 }
71641
71642 full_search:
71643@@ -1396,34 +1595,40 @@ full_search:
71644 * Start a new search - just in case we missed
71645 * some holes.
71646 */
71647- if (start_addr != TASK_UNMAPPED_BASE) {
71648- addr = TASK_UNMAPPED_BASE;
71649- start_addr = addr;
71650+ if (start_addr != mm->mmap_base) {
71651+ start_addr = addr = mm->mmap_base;
71652 mm->cached_hole_size = 0;
71653 goto full_search;
71654 }
71655 return -ENOMEM;
71656 }
71657- if (!vma || addr + len <= vma->vm_start) {
71658- /*
71659- * Remember the place where we stopped the search:
71660- */
71661- mm->free_area_cache = addr + len;
71662- return addr;
71663- }
71664+ if (check_heap_stack_gap(vma, addr, len))
71665+ break;
71666 if (addr + mm->cached_hole_size < vma->vm_start)
71667 mm->cached_hole_size = vma->vm_start - addr;
71668 addr = vma->vm_end;
71669 }
71670+
71671+ /*
71672+ * Remember the place where we stopped the search:
71673+ */
71674+ mm->free_area_cache = addr + len;
71675+ return addr;
71676 }
71677 #endif
71678
71679 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
71680 {
71681+
71682+#ifdef CONFIG_PAX_SEGMEXEC
71683+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71684+ return;
71685+#endif
71686+
71687 /*
71688 * Is this a new hole at the lowest possible address?
71689 */
71690- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
71691+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
71692 mm->free_area_cache = addr;
71693 mm->cached_hole_size = ~0UL;
71694 }
71695@@ -1441,7 +1646,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71696 {
71697 struct vm_area_struct *vma;
71698 struct mm_struct *mm = current->mm;
71699- unsigned long addr = addr0;
71700+ unsigned long base = mm->mmap_base, addr = addr0;
71701
71702 /* requested length too big for entire address space */
71703 if (len > TASK_SIZE)
71704@@ -1450,13 +1655,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71705 if (flags & MAP_FIXED)
71706 return addr;
71707
71708+#ifdef CONFIG_PAX_RANDMMAP
71709+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71710+#endif
71711+
71712 /* requesting a specific address */
71713 if (addr) {
71714 addr = PAGE_ALIGN(addr);
71715- vma = find_vma(mm, addr);
71716- if (TASK_SIZE - len >= addr &&
71717- (!vma || addr + len <= vma->vm_start))
71718- return addr;
71719+ if (TASK_SIZE - len >= addr) {
71720+ vma = find_vma(mm, addr);
71721+ if (check_heap_stack_gap(vma, addr, len))
71722+ return addr;
71723+ }
71724 }
71725
71726 /* check if free_area_cache is useful for us */
71727@@ -1471,7 +1681,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71728 /* make sure it can fit in the remaining address space */
71729 if (addr > len) {
71730 vma = find_vma(mm, addr-len);
71731- if (!vma || addr <= vma->vm_start)
71732+ if (check_heap_stack_gap(vma, addr - len, len))
71733 /* remember the address as a hint for next time */
71734 return (mm->free_area_cache = addr-len);
71735 }
71736@@ -1488,7 +1698,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71737 * return with success:
71738 */
71739 vma = find_vma(mm, addr);
71740- if (!vma || addr+len <= vma->vm_start)
71741+ if (check_heap_stack_gap(vma, addr, len))
71742 /* remember the address as a hint for next time */
71743 return (mm->free_area_cache = addr);
71744
71745@@ -1497,8 +1707,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71746 mm->cached_hole_size = vma->vm_start - addr;
71747
71748 /* try just below the current vma->vm_start */
71749- addr = vma->vm_start-len;
71750- } while (len < vma->vm_start);
71751+ addr = skip_heap_stack_gap(vma, len);
71752+ } while (!IS_ERR_VALUE(addr));
71753
71754 bottomup:
71755 /*
71756@@ -1507,13 +1717,21 @@ bottomup:
71757 * can happen with large stack limits and large mmap()
71758 * allocations.
71759 */
71760+ mm->mmap_base = TASK_UNMAPPED_BASE;
71761+
71762+#ifdef CONFIG_PAX_RANDMMAP
71763+ if (mm->pax_flags & MF_PAX_RANDMMAP)
71764+ mm->mmap_base += mm->delta_mmap;
71765+#endif
71766+
71767+ mm->free_area_cache = mm->mmap_base;
71768 mm->cached_hole_size = ~0UL;
71769- mm->free_area_cache = TASK_UNMAPPED_BASE;
71770 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
71771 /*
71772 * Restore the topdown base:
71773 */
71774- mm->free_area_cache = mm->mmap_base;
71775+ mm->mmap_base = base;
71776+ mm->free_area_cache = base;
71777 mm->cached_hole_size = ~0UL;
71778
71779 return addr;
71780@@ -1522,6 +1740,12 @@ bottomup:
71781
71782 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71783 {
71784+
71785+#ifdef CONFIG_PAX_SEGMEXEC
71786+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71787+ return;
71788+#endif
71789+
71790 /*
71791 * Is this a new hole at the highest possible address?
71792 */
71793@@ -1529,8 +1753,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71794 mm->free_area_cache = addr;
71795
71796 /* dont allow allocations above current base */
71797- if (mm->free_area_cache > mm->mmap_base)
71798+ if (mm->free_area_cache > mm->mmap_base) {
71799 mm->free_area_cache = mm->mmap_base;
71800+ mm->cached_hole_size = ~0UL;
71801+ }
71802 }
71803
71804 unsigned long
71805@@ -1638,6 +1864,28 @@ out:
71806 return prev ? prev->vm_next : vma;
71807 }
71808
71809+#ifdef CONFIG_PAX_SEGMEXEC
71810+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
71811+{
71812+ struct vm_area_struct *vma_m;
71813+
71814+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
71815+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
71816+ BUG_ON(vma->vm_mirror);
71817+ return NULL;
71818+ }
71819+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
71820+ vma_m = vma->vm_mirror;
71821+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
71822+ BUG_ON(vma->vm_file != vma_m->vm_file);
71823+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
71824+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
71825+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
71826+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
71827+ return vma_m;
71828+}
71829+#endif
71830+
71831 /*
71832 * Verify that the stack growth is acceptable and
71833 * update accounting. This is shared with both the
71834@@ -1654,6 +1902,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71835 return -ENOMEM;
71836
71837 /* Stack limit test */
71838+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
71839 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
71840 return -ENOMEM;
71841
71842@@ -1664,6 +1913,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71843 locked = mm->locked_vm + grow;
71844 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
71845 limit >>= PAGE_SHIFT;
71846+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71847 if (locked > limit && !capable(CAP_IPC_LOCK))
71848 return -ENOMEM;
71849 }
71850@@ -1694,37 +1944,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71851 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
71852 * vma is the last one with address > vma->vm_end. Have to extend vma.
71853 */
71854+#ifndef CONFIG_IA64
71855+static
71856+#endif
71857 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71858 {
71859 int error;
71860+ bool locknext;
71861
71862 if (!(vma->vm_flags & VM_GROWSUP))
71863 return -EFAULT;
71864
71865+ /* Also guard against wrapping around to address 0. */
71866+ if (address < PAGE_ALIGN(address+1))
71867+ address = PAGE_ALIGN(address+1);
71868+ else
71869+ return -ENOMEM;
71870+
71871 /*
71872 * We must make sure the anon_vma is allocated
71873 * so that the anon_vma locking is not a noop.
71874 */
71875 if (unlikely(anon_vma_prepare(vma)))
71876 return -ENOMEM;
71877+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
71878+ if (locknext && anon_vma_prepare(vma->vm_next))
71879+ return -ENOMEM;
71880 vma_lock_anon_vma(vma);
71881+ if (locknext)
71882+ vma_lock_anon_vma(vma->vm_next);
71883
71884 /*
71885 * vma->vm_start/vm_end cannot change under us because the caller
71886 * is required to hold the mmap_sem in read mode. We need the
71887- * anon_vma lock to serialize against concurrent expand_stacks.
71888- * Also guard against wrapping around to address 0.
71889+ * anon_vma locks to serialize against concurrent expand_stacks
71890+ * and expand_upwards.
71891 */
71892- if (address < PAGE_ALIGN(address+4))
71893- address = PAGE_ALIGN(address+4);
71894- else {
71895- vma_unlock_anon_vma(vma);
71896- return -ENOMEM;
71897- }
71898 error = 0;
71899
71900 /* Somebody else might have raced and expanded it already */
71901- if (address > vma->vm_end) {
71902+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
71903+ error = -ENOMEM;
71904+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
71905 unsigned long size, grow;
71906
71907 size = address - vma->vm_start;
71908@@ -1739,6 +2000,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71909 }
71910 }
71911 }
71912+ if (locknext)
71913+ vma_unlock_anon_vma(vma->vm_next);
71914 vma_unlock_anon_vma(vma);
71915 khugepaged_enter_vma_merge(vma);
71916 return error;
71917@@ -1752,6 +2015,8 @@ int expand_downwards(struct vm_area_struct *vma,
71918 unsigned long address)
71919 {
71920 int error;
71921+ bool lockprev = false;
71922+ struct vm_area_struct *prev;
71923
71924 /*
71925 * We must make sure the anon_vma is allocated
71926@@ -1765,6 +2030,15 @@ int expand_downwards(struct vm_area_struct *vma,
71927 if (error)
71928 return error;
71929
71930+ prev = vma->vm_prev;
71931+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
71932+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
71933+#endif
71934+ if (lockprev && anon_vma_prepare(prev))
71935+ return -ENOMEM;
71936+ if (lockprev)
71937+ vma_lock_anon_vma(prev);
71938+
71939 vma_lock_anon_vma(vma);
71940
71941 /*
71942@@ -1774,9 +2048,17 @@ int expand_downwards(struct vm_area_struct *vma,
71943 */
71944
71945 /* Somebody else might have raced and expanded it already */
71946- if (address < vma->vm_start) {
71947+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
71948+ error = -ENOMEM;
71949+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
71950 unsigned long size, grow;
71951
71952+#ifdef CONFIG_PAX_SEGMEXEC
71953+ struct vm_area_struct *vma_m;
71954+
71955+ vma_m = pax_find_mirror_vma(vma);
71956+#endif
71957+
71958 size = vma->vm_end - address;
71959 grow = (vma->vm_start - address) >> PAGE_SHIFT;
71960
71961@@ -1786,11 +2068,22 @@ int expand_downwards(struct vm_area_struct *vma,
71962 if (!error) {
71963 vma->vm_start = address;
71964 vma->vm_pgoff -= grow;
71965+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
71966+
71967+#ifdef CONFIG_PAX_SEGMEXEC
71968+ if (vma_m) {
71969+ vma_m->vm_start -= grow << PAGE_SHIFT;
71970+ vma_m->vm_pgoff -= grow;
71971+ }
71972+#endif
71973+
71974 perf_event_mmap(vma);
71975 }
71976 }
71977 }
71978 vma_unlock_anon_vma(vma);
71979+ if (lockprev)
71980+ vma_unlock_anon_vma(prev);
71981 khugepaged_enter_vma_merge(vma);
71982 return error;
71983 }
71984@@ -1860,6 +2153,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
71985 do {
71986 long nrpages = vma_pages(vma);
71987
71988+#ifdef CONFIG_PAX_SEGMEXEC
71989+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
71990+ vma = remove_vma(vma);
71991+ continue;
71992+ }
71993+#endif
71994+
71995 mm->total_vm -= nrpages;
71996 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
71997 vma = remove_vma(vma);
71998@@ -1905,6 +2205,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
71999 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
72000 vma->vm_prev = NULL;
72001 do {
72002+
72003+#ifdef CONFIG_PAX_SEGMEXEC
72004+ if (vma->vm_mirror) {
72005+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
72006+ vma->vm_mirror->vm_mirror = NULL;
72007+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
72008+ vma->vm_mirror = NULL;
72009+ }
72010+#endif
72011+
72012 rb_erase(&vma->vm_rb, &mm->mm_rb);
72013 mm->map_count--;
72014 tail_vma = vma;
72015@@ -1933,14 +2243,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72016 struct vm_area_struct *new;
72017 int err = -ENOMEM;
72018
72019+#ifdef CONFIG_PAX_SEGMEXEC
72020+ struct vm_area_struct *vma_m, *new_m = NULL;
72021+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
72022+#endif
72023+
72024 if (is_vm_hugetlb_page(vma) && (addr &
72025 ~(huge_page_mask(hstate_vma(vma)))))
72026 return -EINVAL;
72027
72028+#ifdef CONFIG_PAX_SEGMEXEC
72029+ vma_m = pax_find_mirror_vma(vma);
72030+#endif
72031+
72032 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
72033 if (!new)
72034 goto out_err;
72035
72036+#ifdef CONFIG_PAX_SEGMEXEC
72037+ if (vma_m) {
72038+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
72039+ if (!new_m) {
72040+ kmem_cache_free(vm_area_cachep, new);
72041+ goto out_err;
72042+ }
72043+ }
72044+#endif
72045+
72046 /* most fields are the same, copy all, and then fixup */
72047 *new = *vma;
72048
72049@@ -1953,6 +2282,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72050 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
72051 }
72052
72053+#ifdef CONFIG_PAX_SEGMEXEC
72054+ if (vma_m) {
72055+ *new_m = *vma_m;
72056+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
72057+ new_m->vm_mirror = new;
72058+ new->vm_mirror = new_m;
72059+
72060+ if (new_below)
72061+ new_m->vm_end = addr_m;
72062+ else {
72063+ new_m->vm_start = addr_m;
72064+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
72065+ }
72066+ }
72067+#endif
72068+
72069 pol = mpol_dup(vma_policy(vma));
72070 if (IS_ERR(pol)) {
72071 err = PTR_ERR(pol);
72072@@ -1978,6 +2323,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72073 else
72074 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
72075
72076+#ifdef CONFIG_PAX_SEGMEXEC
72077+ if (!err && vma_m) {
72078+ if (anon_vma_clone(new_m, vma_m))
72079+ goto out_free_mpol;
72080+
72081+ mpol_get(pol);
72082+ vma_set_policy(new_m, pol);
72083+
72084+ if (new_m->vm_file) {
72085+ get_file(new_m->vm_file);
72086+ if (vma_m->vm_flags & VM_EXECUTABLE)
72087+ added_exe_file_vma(mm);
72088+ }
72089+
72090+ if (new_m->vm_ops && new_m->vm_ops->open)
72091+ new_m->vm_ops->open(new_m);
72092+
72093+ if (new_below)
72094+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
72095+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
72096+ else
72097+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
72098+
72099+ if (err) {
72100+ if (new_m->vm_ops && new_m->vm_ops->close)
72101+ new_m->vm_ops->close(new_m);
72102+ if (new_m->vm_file) {
72103+ if (vma_m->vm_flags & VM_EXECUTABLE)
72104+ removed_exe_file_vma(mm);
72105+ fput(new_m->vm_file);
72106+ }
72107+ mpol_put(pol);
72108+ }
72109+ }
72110+#endif
72111+
72112 /* Success. */
72113 if (!err)
72114 return 0;
72115@@ -1990,10 +2371,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72116 removed_exe_file_vma(mm);
72117 fput(new->vm_file);
72118 }
72119- unlink_anon_vmas(new);
72120 out_free_mpol:
72121 mpol_put(pol);
72122 out_free_vma:
72123+
72124+#ifdef CONFIG_PAX_SEGMEXEC
72125+ if (new_m) {
72126+ unlink_anon_vmas(new_m);
72127+ kmem_cache_free(vm_area_cachep, new_m);
72128+ }
72129+#endif
72130+
72131+ unlink_anon_vmas(new);
72132 kmem_cache_free(vm_area_cachep, new);
72133 out_err:
72134 return err;
72135@@ -2006,6 +2395,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72136 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72137 unsigned long addr, int new_below)
72138 {
72139+
72140+#ifdef CONFIG_PAX_SEGMEXEC
72141+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72142+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
72143+ if (mm->map_count >= sysctl_max_map_count-1)
72144+ return -ENOMEM;
72145+ } else
72146+#endif
72147+
72148 if (mm->map_count >= sysctl_max_map_count)
72149 return -ENOMEM;
72150
72151@@ -2017,11 +2415,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72152 * work. This now handles partial unmappings.
72153 * Jeremy Fitzhardinge <jeremy@goop.org>
72154 */
72155+#ifdef CONFIG_PAX_SEGMEXEC
72156 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72157 {
72158+ int ret = __do_munmap(mm, start, len);
72159+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
72160+ return ret;
72161+
72162+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
72163+}
72164+
72165+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72166+#else
72167+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72168+#endif
72169+{
72170 unsigned long end;
72171 struct vm_area_struct *vma, *prev, *last;
72172
72173+ /*
72174+ * mm->mmap_sem is required to protect against another thread
72175+ * changing the mappings in case we sleep.
72176+ */
72177+ verify_mm_writelocked(mm);
72178+
72179 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
72180 return -EINVAL;
72181
72182@@ -2096,6 +2513,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72183 /* Fix up all other VM information */
72184 remove_vma_list(mm, vma);
72185
72186+ track_exec_limit(mm, start, end, 0UL);
72187+
72188 return 0;
72189 }
72190
72191@@ -2108,22 +2527,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
72192
72193 profile_munmap(addr);
72194
72195+#ifdef CONFIG_PAX_SEGMEXEC
72196+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
72197+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
72198+ return -EINVAL;
72199+#endif
72200+
72201 down_write(&mm->mmap_sem);
72202 ret = do_munmap(mm, addr, len);
72203 up_write(&mm->mmap_sem);
72204 return ret;
72205 }
72206
72207-static inline void verify_mm_writelocked(struct mm_struct *mm)
72208-{
72209-#ifdef CONFIG_DEBUG_VM
72210- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72211- WARN_ON(1);
72212- up_read(&mm->mmap_sem);
72213- }
72214-#endif
72215-}
72216-
72217 /*
72218 * this is really a simplified "do_mmap". it only handles
72219 * anonymous maps. eventually we may be able to do some
72220@@ -2137,6 +2552,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72221 struct rb_node ** rb_link, * rb_parent;
72222 pgoff_t pgoff = addr >> PAGE_SHIFT;
72223 int error;
72224+ unsigned long charged;
72225
72226 len = PAGE_ALIGN(len);
72227 if (!len)
72228@@ -2148,16 +2564,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72229
72230 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
72231
72232+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
72233+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
72234+ flags &= ~VM_EXEC;
72235+
72236+#ifdef CONFIG_PAX_MPROTECT
72237+ if (mm->pax_flags & MF_PAX_MPROTECT)
72238+ flags &= ~VM_MAYEXEC;
72239+#endif
72240+
72241+ }
72242+#endif
72243+
72244 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
72245 if (error & ~PAGE_MASK)
72246 return error;
72247
72248+ charged = len >> PAGE_SHIFT;
72249+
72250 /*
72251 * mlock MCL_FUTURE?
72252 */
72253 if (mm->def_flags & VM_LOCKED) {
72254 unsigned long locked, lock_limit;
72255- locked = len >> PAGE_SHIFT;
72256+ locked = charged;
72257 locked += mm->locked_vm;
72258 lock_limit = rlimit(RLIMIT_MEMLOCK);
72259 lock_limit >>= PAGE_SHIFT;
72260@@ -2174,22 +2604,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72261 /*
72262 * Clear old maps. this also does some error checking for us
72263 */
72264- munmap_back:
72265 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72266 if (vma && vma->vm_start < addr + len) {
72267 if (do_munmap(mm, addr, len))
72268 return -ENOMEM;
72269- goto munmap_back;
72270+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72271+ BUG_ON(vma && vma->vm_start < addr + len);
72272 }
72273
72274 /* Check against address space limits *after* clearing old maps... */
72275- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
72276+ if (!may_expand_vm(mm, charged))
72277 return -ENOMEM;
72278
72279 if (mm->map_count > sysctl_max_map_count)
72280 return -ENOMEM;
72281
72282- if (security_vm_enough_memory(len >> PAGE_SHIFT))
72283+ if (security_vm_enough_memory(charged))
72284 return -ENOMEM;
72285
72286 /* Can we just expand an old private anonymous mapping? */
72287@@ -2203,7 +2633,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72288 */
72289 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72290 if (!vma) {
72291- vm_unacct_memory(len >> PAGE_SHIFT);
72292+ vm_unacct_memory(charged);
72293 return -ENOMEM;
72294 }
72295
72296@@ -2217,11 +2647,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72297 vma_link(mm, vma, prev, rb_link, rb_parent);
72298 out:
72299 perf_event_mmap(vma);
72300- mm->total_vm += len >> PAGE_SHIFT;
72301+ mm->total_vm += charged;
72302 if (flags & VM_LOCKED) {
72303 if (!mlock_vma_pages_range(vma, addr, addr + len))
72304- mm->locked_vm += (len >> PAGE_SHIFT);
72305+ mm->locked_vm += charged;
72306 }
72307+ track_exec_limit(mm, addr, addr + len, flags);
72308 return addr;
72309 }
72310
72311@@ -2268,8 +2699,10 @@ void exit_mmap(struct mm_struct *mm)
72312 * Walk the list again, actually closing and freeing it,
72313 * with preemption enabled, without holding any MM locks.
72314 */
72315- while (vma)
72316+ while (vma) {
72317+ vma->vm_mirror = NULL;
72318 vma = remove_vma(vma);
72319+ }
72320
72321 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
72322 }
72323@@ -2283,6 +2716,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
72324 struct vm_area_struct * __vma, * prev;
72325 struct rb_node ** rb_link, * rb_parent;
72326
72327+#ifdef CONFIG_PAX_SEGMEXEC
72328+ struct vm_area_struct *vma_m = NULL;
72329+#endif
72330+
72331+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
72332+ return -EPERM;
72333+
72334 /*
72335 * The vm_pgoff of a purely anonymous vma should be irrelevant
72336 * until its first write fault, when page's anon_vma and index
72337@@ -2305,7 +2745,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
72338 if ((vma->vm_flags & VM_ACCOUNT) &&
72339 security_vm_enough_memory_mm(mm, vma_pages(vma)))
72340 return -ENOMEM;
72341+
72342+#ifdef CONFIG_PAX_SEGMEXEC
72343+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
72344+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72345+ if (!vma_m)
72346+ return -ENOMEM;
72347+ }
72348+#endif
72349+
72350 vma_link(mm, vma, prev, rb_link, rb_parent);
72351+
72352+#ifdef CONFIG_PAX_SEGMEXEC
72353+ if (vma_m)
72354+ BUG_ON(pax_mirror_vma(vma_m, vma));
72355+#endif
72356+
72357 return 0;
72358 }
72359
72360@@ -2323,6 +2778,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
72361 struct rb_node **rb_link, *rb_parent;
72362 struct mempolicy *pol;
72363
72364+ BUG_ON(vma->vm_mirror);
72365+
72366 /*
72367 * If anonymous vma has not yet been faulted, update new pgoff
72368 * to match new location, to increase its chance of merging.
72369@@ -2373,6 +2830,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
72370 return NULL;
72371 }
72372
72373+#ifdef CONFIG_PAX_SEGMEXEC
72374+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
72375+{
72376+ struct vm_area_struct *prev_m;
72377+ struct rb_node **rb_link_m, *rb_parent_m;
72378+ struct mempolicy *pol_m;
72379+
72380+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
72381+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
72382+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
72383+ *vma_m = *vma;
72384+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
72385+ if (anon_vma_clone(vma_m, vma))
72386+ return -ENOMEM;
72387+ pol_m = vma_policy(vma_m);
72388+ mpol_get(pol_m);
72389+ vma_set_policy(vma_m, pol_m);
72390+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
72391+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
72392+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
72393+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
72394+ if (vma_m->vm_file)
72395+ get_file(vma_m->vm_file);
72396+ if (vma_m->vm_ops && vma_m->vm_ops->open)
72397+ vma_m->vm_ops->open(vma_m);
72398+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
72399+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
72400+ vma_m->vm_mirror = vma;
72401+ vma->vm_mirror = vma_m;
72402+ return 0;
72403+}
72404+#endif
72405+
72406 /*
72407 * Return true if the calling process may expand its vm space by the passed
72408 * number of pages
72409@@ -2383,7 +2873,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
72410 unsigned long lim;
72411
72412 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
72413-
72414+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
72415 if (cur + npages > lim)
72416 return 0;
72417 return 1;
72418@@ -2454,6 +2944,22 @@ int install_special_mapping(struct mm_struct *mm,
72419 vma->vm_start = addr;
72420 vma->vm_end = addr + len;
72421
72422+#ifdef CONFIG_PAX_MPROTECT
72423+ if (mm->pax_flags & MF_PAX_MPROTECT) {
72424+#ifndef CONFIG_PAX_MPROTECT_COMPAT
72425+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
72426+ return -EPERM;
72427+ if (!(vm_flags & VM_EXEC))
72428+ vm_flags &= ~VM_MAYEXEC;
72429+#else
72430+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72431+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72432+#endif
72433+ else
72434+ vm_flags &= ~VM_MAYWRITE;
72435+ }
72436+#endif
72437+
72438 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
72439 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72440
72441diff --git a/mm/mprotect.c b/mm/mprotect.c
72442index 5a688a2..27e031c 100644
72443--- a/mm/mprotect.c
72444+++ b/mm/mprotect.c
72445@@ -23,10 +23,16 @@
72446 #include <linux/mmu_notifier.h>
72447 #include <linux/migrate.h>
72448 #include <linux/perf_event.h>
72449+
72450+#ifdef CONFIG_PAX_MPROTECT
72451+#include <linux/elf.h>
72452+#endif
72453+
72454 #include <asm/uaccess.h>
72455 #include <asm/pgtable.h>
72456 #include <asm/cacheflush.h>
72457 #include <asm/tlbflush.h>
72458+#include <asm/mmu_context.h>
72459
72460 #ifndef pgprot_modify
72461 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
72462@@ -141,6 +147,48 @@ static void change_protection(struct vm_area_struct *vma,
72463 flush_tlb_range(vma, start, end);
72464 }
72465
72466+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72467+/* called while holding the mmap semaphor for writing except stack expansion */
72468+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
72469+{
72470+ unsigned long oldlimit, newlimit = 0UL;
72471+
72472+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
72473+ return;
72474+
72475+ spin_lock(&mm->page_table_lock);
72476+ oldlimit = mm->context.user_cs_limit;
72477+ if ((prot & VM_EXEC) && oldlimit < end)
72478+ /* USER_CS limit moved up */
72479+ newlimit = end;
72480+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
72481+ /* USER_CS limit moved down */
72482+ newlimit = start;
72483+
72484+ if (newlimit) {
72485+ mm->context.user_cs_limit = newlimit;
72486+
72487+#ifdef CONFIG_SMP
72488+ wmb();
72489+ cpus_clear(mm->context.cpu_user_cs_mask);
72490+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
72491+#endif
72492+
72493+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
72494+ }
72495+ spin_unlock(&mm->page_table_lock);
72496+ if (newlimit == end) {
72497+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
72498+
72499+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
72500+ if (is_vm_hugetlb_page(vma))
72501+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
72502+ else
72503+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
72504+ }
72505+}
72506+#endif
72507+
72508 int
72509 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72510 unsigned long start, unsigned long end, unsigned long newflags)
72511@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72512 int error;
72513 int dirty_accountable = 0;
72514
72515+#ifdef CONFIG_PAX_SEGMEXEC
72516+ struct vm_area_struct *vma_m = NULL;
72517+ unsigned long start_m, end_m;
72518+
72519+ start_m = start + SEGMEXEC_TASK_SIZE;
72520+ end_m = end + SEGMEXEC_TASK_SIZE;
72521+#endif
72522+
72523 if (newflags == oldflags) {
72524 *pprev = vma;
72525 return 0;
72526 }
72527
72528+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
72529+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
72530+
72531+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
72532+ return -ENOMEM;
72533+
72534+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
72535+ return -ENOMEM;
72536+ }
72537+
72538 /*
72539 * If we make a private mapping writable we increase our commit;
72540 * but (without finer accounting) cannot reduce our commit if we
72541@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72542 }
72543 }
72544
72545+#ifdef CONFIG_PAX_SEGMEXEC
72546+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
72547+ if (start != vma->vm_start) {
72548+ error = split_vma(mm, vma, start, 1);
72549+ if (error)
72550+ goto fail;
72551+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
72552+ *pprev = (*pprev)->vm_next;
72553+ }
72554+
72555+ if (end != vma->vm_end) {
72556+ error = split_vma(mm, vma, end, 0);
72557+ if (error)
72558+ goto fail;
72559+ }
72560+
72561+ if (pax_find_mirror_vma(vma)) {
72562+ error = __do_munmap(mm, start_m, end_m - start_m);
72563+ if (error)
72564+ goto fail;
72565+ } else {
72566+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72567+ if (!vma_m) {
72568+ error = -ENOMEM;
72569+ goto fail;
72570+ }
72571+ vma->vm_flags = newflags;
72572+ error = pax_mirror_vma(vma_m, vma);
72573+ if (error) {
72574+ vma->vm_flags = oldflags;
72575+ goto fail;
72576+ }
72577+ }
72578+ }
72579+#endif
72580+
72581 /*
72582 * First try to merge with previous and/or next vma.
72583 */
72584@@ -204,9 +306,21 @@ success:
72585 * vm_flags and vm_page_prot are protected by the mmap_sem
72586 * held in write mode.
72587 */
72588+
72589+#ifdef CONFIG_PAX_SEGMEXEC
72590+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
72591+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
72592+#endif
72593+
72594 vma->vm_flags = newflags;
72595+
72596+#ifdef CONFIG_PAX_MPROTECT
72597+ if (mm->binfmt && mm->binfmt->handle_mprotect)
72598+ mm->binfmt->handle_mprotect(vma, newflags);
72599+#endif
72600+
72601 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
72602- vm_get_page_prot(newflags));
72603+ vm_get_page_prot(vma->vm_flags));
72604
72605 if (vma_wants_writenotify(vma)) {
72606 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
72607@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72608 end = start + len;
72609 if (end <= start)
72610 return -ENOMEM;
72611+
72612+#ifdef CONFIG_PAX_SEGMEXEC
72613+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
72614+ if (end > SEGMEXEC_TASK_SIZE)
72615+ return -EINVAL;
72616+ } else
72617+#endif
72618+
72619+ if (end > TASK_SIZE)
72620+ return -EINVAL;
72621+
72622 if (!arch_validate_prot(prot))
72623 return -EINVAL;
72624
72625@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72626 /*
72627 * Does the application expect PROT_READ to imply PROT_EXEC:
72628 */
72629- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72630+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72631 prot |= PROT_EXEC;
72632
72633 vm_flags = calc_vm_prot_bits(prot);
72634@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72635 if (start > vma->vm_start)
72636 prev = vma;
72637
72638+#ifdef CONFIG_PAX_MPROTECT
72639+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
72640+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
72641+#endif
72642+
72643 for (nstart = start ; ; ) {
72644 unsigned long newflags;
72645
72646@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72647
72648 /* newflags >> 4 shift VM_MAY% in place of VM_% */
72649 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
72650+ if (prot & (PROT_WRITE | PROT_EXEC))
72651+ gr_log_rwxmprotect(vma->vm_file);
72652+
72653+ error = -EACCES;
72654+ goto out;
72655+ }
72656+
72657+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
72658 error = -EACCES;
72659 goto out;
72660 }
72661@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72662 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
72663 if (error)
72664 goto out;
72665+
72666+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
72667+
72668 nstart = tmp;
72669
72670 if (nstart < prev->vm_end)
72671diff --git a/mm/mremap.c b/mm/mremap.c
72672index 506fa44..ccc0ba9 100644
72673--- a/mm/mremap.c
72674+++ b/mm/mremap.c
72675@@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
72676 continue;
72677 pte = ptep_clear_flush(vma, old_addr, old_pte);
72678 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
72679+
72680+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72681+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
72682+ pte = pte_exprotect(pte);
72683+#endif
72684+
72685 set_pte_at(mm, new_addr, new_pte, pte);
72686 }
72687
72688@@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
72689 if (is_vm_hugetlb_page(vma))
72690 goto Einval;
72691
72692+#ifdef CONFIG_PAX_SEGMEXEC
72693+ if (pax_find_mirror_vma(vma))
72694+ goto Einval;
72695+#endif
72696+
72697 /* We can't remap across vm area boundaries */
72698 if (old_len > vma->vm_end - addr)
72699 goto Efault;
72700@@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned long addr,
72701 unsigned long ret = -EINVAL;
72702 unsigned long charged = 0;
72703 unsigned long map_flags;
72704+ unsigned long pax_task_size = TASK_SIZE;
72705
72706 if (new_addr & ~PAGE_MASK)
72707 goto out;
72708
72709- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
72710+#ifdef CONFIG_PAX_SEGMEXEC
72711+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
72712+ pax_task_size = SEGMEXEC_TASK_SIZE;
72713+#endif
72714+
72715+ pax_task_size -= PAGE_SIZE;
72716+
72717+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
72718 goto out;
72719
72720 /* Check if the location we're moving into overlaps the
72721 * old location at all, and fail if it does.
72722 */
72723- if ((new_addr <= addr) && (new_addr+new_len) > addr)
72724- goto out;
72725-
72726- if ((addr <= new_addr) && (addr+old_len) > new_addr)
72727+ if (addr + old_len > new_addr && new_addr + new_len > addr)
72728 goto out;
72729
72730 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72731@@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long addr,
72732 struct vm_area_struct *vma;
72733 unsigned long ret = -EINVAL;
72734 unsigned long charged = 0;
72735+ unsigned long pax_task_size = TASK_SIZE;
72736
72737 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
72738 goto out;
72739@@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long addr,
72740 if (!new_len)
72741 goto out;
72742
72743+#ifdef CONFIG_PAX_SEGMEXEC
72744+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
72745+ pax_task_size = SEGMEXEC_TASK_SIZE;
72746+#endif
72747+
72748+ pax_task_size -= PAGE_SIZE;
72749+
72750+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
72751+ old_len > pax_task_size || addr > pax_task_size-old_len)
72752+ goto out;
72753+
72754 if (flags & MREMAP_FIXED) {
72755 if (flags & MREMAP_MAYMOVE)
72756 ret = mremap_to(addr, old_len, new_addr, new_len);
72757@@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long addr,
72758 addr + new_len);
72759 }
72760 ret = addr;
72761+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
72762 goto out;
72763 }
72764 }
72765@@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long addr,
72766 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72767 if (ret)
72768 goto out;
72769+
72770+ map_flags = vma->vm_flags;
72771 ret = move_vma(vma, addr, old_len, new_len, new_addr);
72772+ if (!(ret & ~PAGE_MASK)) {
72773+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
72774+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
72775+ }
72776 }
72777 out:
72778 if (ret & ~PAGE_MASK)
72779diff --git a/mm/nobootmem.c b/mm/nobootmem.c
72780index 6e93dc7..c98df0c 100644
72781--- a/mm/nobootmem.c
72782+++ b/mm/nobootmem.c
72783@@ -110,19 +110,30 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
72784 unsigned long __init free_all_memory_core_early(int nodeid)
72785 {
72786 int i;
72787- u64 start, end;
72788+ u64 start, end, startrange, endrange;
72789 unsigned long count = 0;
72790- struct range *range = NULL;
72791+ struct range *range = NULL, rangerange = { 0, 0 };
72792 int nr_range;
72793
72794 nr_range = get_free_all_memory_range(&range, nodeid);
72795+ startrange = __pa(range) >> PAGE_SHIFT;
72796+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
72797
72798 for (i = 0; i < nr_range; i++) {
72799 start = range[i].start;
72800 end = range[i].end;
72801+ if (start <= endrange && startrange < end) {
72802+ BUG_ON(rangerange.start | rangerange.end);
72803+ rangerange = range[i];
72804+ continue;
72805+ }
72806 count += end - start;
72807 __free_pages_memory(start, end);
72808 }
72809+ start = rangerange.start;
72810+ end = rangerange.end;
72811+ count += end - start;
72812+ __free_pages_memory(start, end);
72813
72814 return count;
72815 }
72816diff --git a/mm/nommu.c b/mm/nommu.c
72817index 4358032..e79b99f 100644
72818--- a/mm/nommu.c
72819+++ b/mm/nommu.c
72820@@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72821 int sysctl_overcommit_ratio = 50; /* default is 50% */
72822 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
72823 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
72824-int heap_stack_gap = 0;
72825
72826 atomic_long_t mmap_pages_allocated;
72827
72828@@ -825,15 +824,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
72829 EXPORT_SYMBOL(find_vma);
72830
72831 /*
72832- * find a VMA
72833- * - we don't extend stack VMAs under NOMMU conditions
72834- */
72835-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
72836-{
72837- return find_vma(mm, addr);
72838-}
72839-
72840-/*
72841 * expand a stack to a given address
72842 * - not supported under NOMMU conditions
72843 */
72844@@ -1553,6 +1543,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72845
72846 /* most fields are the same, copy all, and then fixup */
72847 *new = *vma;
72848+ INIT_LIST_HEAD(&new->anon_vma_chain);
72849 *region = *vma->vm_region;
72850 new->vm_region = region;
72851
72852diff --git a/mm/oom_kill.c b/mm/oom_kill.c
72853index 626303b..e9a1785 100644
72854--- a/mm/oom_kill.c
72855+++ b/mm/oom_kill.c
72856@@ -162,7 +162,7 @@ static bool oom_unkillable_task(struct task_struct *p,
72857 unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
72858 const nodemask_t *nodemask, unsigned long totalpages)
72859 {
72860- int points;
72861+ long points;
72862
72863 if (oom_unkillable_task(p, mem, nodemask))
72864 return 0;
72865diff --git a/mm/page_alloc.c b/mm/page_alloc.c
72866index e8fae15..18c0442 100644
72867--- a/mm/page_alloc.c
72868+++ b/mm/page_alloc.c
72869@@ -340,7 +340,7 @@ out:
72870 * This usage means that zero-order pages may not be compound.
72871 */
72872
72873-static void free_compound_page(struct page *page)
72874+void free_compound_page(struct page *page)
72875 {
72876 __free_pages_ok(page, compound_order(page));
72877 }
72878@@ -653,6 +653,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
72879 int i;
72880 int bad = 0;
72881
72882+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72883+ unsigned long index = 1UL << order;
72884+#endif
72885+
72886 trace_mm_page_free_direct(page, order);
72887 kmemcheck_free_shadow(page, order);
72888
72889@@ -668,6 +672,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
72890 debug_check_no_obj_freed(page_address(page),
72891 PAGE_SIZE << order);
72892 }
72893+
72894+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72895+ for (; index; --index)
72896+ sanitize_highpage(page + index - 1);
72897+#endif
72898+
72899 arch_free_page(page, order);
72900 kernel_map_pages(page, 1 << order, 0);
72901
72902@@ -783,8 +793,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
72903 arch_alloc_page(page, order);
72904 kernel_map_pages(page, 1 << order, 1);
72905
72906+#ifndef CONFIG_PAX_MEMORY_SANITIZE
72907 if (gfp_flags & __GFP_ZERO)
72908 prep_zero_page(page, order, gfp_flags);
72909+#endif
72910
72911 if (order && (gfp_flags & __GFP_COMP))
72912 prep_compound_page(page, order);
72913@@ -2539,6 +2551,8 @@ void show_free_areas(unsigned int filter)
72914 int cpu;
72915 struct zone *zone;
72916
72917+ pax_track_stack();
72918+
72919 for_each_populated_zone(zone) {
72920 if (skip_free_areas_node(filter, zone_to_nid(zone)))
72921 continue;
72922@@ -3350,7 +3364,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
72923 unsigned long pfn;
72924
72925 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
72926+#ifdef CONFIG_X86_32
72927+ /* boot failures in VMware 8 on 32bit vanilla since
72928+ this change */
72929+ if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
72930+#else
72931 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
72932+#endif
72933 return 1;
72934 }
72935 return 0;
72936diff --git a/mm/percpu.c b/mm/percpu.c
72937index 93b5a7c..28d642c 100644
72938--- a/mm/percpu.c
72939+++ b/mm/percpu.c
72940@@ -121,7 +121,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
72941 static unsigned int pcpu_high_unit_cpu __read_mostly;
72942
72943 /* the address of the first chunk which starts with the kernel static area */
72944-void *pcpu_base_addr __read_mostly;
72945+void *pcpu_base_addr __read_only;
72946 EXPORT_SYMBOL_GPL(pcpu_base_addr);
72947
72948 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
72949diff --git a/mm/rmap.c b/mm/rmap.c
72950index 8005080..198c2cd 100644
72951--- a/mm/rmap.c
72952+++ b/mm/rmap.c
72953@@ -152,6 +152,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72954 struct anon_vma *anon_vma = vma->anon_vma;
72955 struct anon_vma_chain *avc;
72956
72957+#ifdef CONFIG_PAX_SEGMEXEC
72958+ struct anon_vma_chain *avc_m = NULL;
72959+#endif
72960+
72961 might_sleep();
72962 if (unlikely(!anon_vma)) {
72963 struct mm_struct *mm = vma->vm_mm;
72964@@ -161,6 +165,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72965 if (!avc)
72966 goto out_enomem;
72967
72968+#ifdef CONFIG_PAX_SEGMEXEC
72969+ avc_m = anon_vma_chain_alloc(GFP_KERNEL);
72970+ if (!avc_m)
72971+ goto out_enomem_free_avc;
72972+#endif
72973+
72974 anon_vma = find_mergeable_anon_vma(vma);
72975 allocated = NULL;
72976 if (!anon_vma) {
72977@@ -174,6 +184,21 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72978 /* page_table_lock to protect against threads */
72979 spin_lock(&mm->page_table_lock);
72980 if (likely(!vma->anon_vma)) {
72981+
72982+#ifdef CONFIG_PAX_SEGMEXEC
72983+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
72984+
72985+ if (vma_m) {
72986+ BUG_ON(vma_m->anon_vma);
72987+ vma_m->anon_vma = anon_vma;
72988+ avc_m->anon_vma = anon_vma;
72989+ avc_m->vma = vma;
72990+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
72991+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
72992+ avc_m = NULL;
72993+ }
72994+#endif
72995+
72996 vma->anon_vma = anon_vma;
72997 avc->anon_vma = anon_vma;
72998 avc->vma = vma;
72999@@ -187,12 +212,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73000
73001 if (unlikely(allocated))
73002 put_anon_vma(allocated);
73003+
73004+#ifdef CONFIG_PAX_SEGMEXEC
73005+ if (unlikely(avc_m))
73006+ anon_vma_chain_free(avc_m);
73007+#endif
73008+
73009 if (unlikely(avc))
73010 anon_vma_chain_free(avc);
73011 }
73012 return 0;
73013
73014 out_enomem_free_avc:
73015+
73016+#ifdef CONFIG_PAX_SEGMEXEC
73017+ if (avc_m)
73018+ anon_vma_chain_free(avc_m);
73019+#endif
73020+
73021 anon_vma_chain_free(avc);
73022 out_enomem:
73023 return -ENOMEM;
73024@@ -243,7 +280,7 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
73025 * Attach the anon_vmas from src to dst.
73026 * Returns 0 on success, -ENOMEM on failure.
73027 */
73028-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
73029+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
73030 {
73031 struct anon_vma_chain *avc, *pavc;
73032 struct anon_vma *root = NULL;
73033@@ -276,7 +313,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
73034 * the corresponding VMA in the parent process is attached to.
73035 * Returns 0 on success, non-zero on failure.
73036 */
73037-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
73038+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
73039 {
73040 struct anon_vma_chain *avc;
73041 struct anon_vma *anon_vma;
73042diff --git a/mm/shmem.c b/mm/shmem.c
73043index 32f6763..431c405 100644
73044--- a/mm/shmem.c
73045+++ b/mm/shmem.c
73046@@ -31,7 +31,7 @@
73047 #include <linux/module.h>
73048 #include <linux/swap.h>
73049
73050-static struct vfsmount *shm_mnt;
73051+struct vfsmount *shm_mnt;
73052
73053 #ifdef CONFIG_SHMEM
73054 /*
73055@@ -74,7 +74,7 @@ static struct vfsmount *shm_mnt;
73056 #define BOGO_DIRENT_SIZE 20
73057
73058 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
73059-#define SHORT_SYMLINK_LEN 128
73060+#define SHORT_SYMLINK_LEN 64
73061
73062 struct shmem_xattr {
73063 struct list_head list; /* anchored by shmem_inode_info->xattr_list */
73064@@ -769,6 +769,8 @@ static struct page *shmem_swapin(swp_entry_t swap, gfp_t gfp,
73065 struct mempolicy mpol, *spol;
73066 struct vm_area_struct pvma;
73067
73068+ pax_track_stack();
73069+
73070 spol = mpol_cond_copy(&mpol,
73071 mpol_shared_policy_lookup(&info->policy, index));
73072
73073@@ -2149,8 +2151,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
73074 int err = -ENOMEM;
73075
73076 /* Round up to L1_CACHE_BYTES to resist false sharing */
73077- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
73078- L1_CACHE_BYTES), GFP_KERNEL);
73079+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
73080 if (!sbinfo)
73081 return -ENOMEM;
73082
73083diff --git a/mm/slab.c b/mm/slab.c
73084index 893c76d..a742de2 100644
73085--- a/mm/slab.c
73086+++ b/mm/slab.c
73087@@ -151,7 +151,7 @@
73088
73089 /* Legal flag mask for kmem_cache_create(). */
73090 #if DEBUG
73091-# define CREATE_MASK (SLAB_RED_ZONE | \
73092+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
73093 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
73094 SLAB_CACHE_DMA | \
73095 SLAB_STORE_USER | \
73096@@ -159,7 +159,7 @@
73097 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
73098 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
73099 #else
73100-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
73101+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
73102 SLAB_CACHE_DMA | \
73103 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
73104 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
73105@@ -288,7 +288,7 @@ struct kmem_list3 {
73106 * Need this for bootstrapping a per node allocator.
73107 */
73108 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
73109-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
73110+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
73111 #define CACHE_CACHE 0
73112 #define SIZE_AC MAX_NUMNODES
73113 #define SIZE_L3 (2 * MAX_NUMNODES)
73114@@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
73115 if ((x)->max_freeable < i) \
73116 (x)->max_freeable = i; \
73117 } while (0)
73118-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
73119-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
73120-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
73121-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
73122+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
73123+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
73124+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
73125+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
73126 #else
73127 #define STATS_INC_ACTIVE(x) do { } while (0)
73128 #define STATS_DEC_ACTIVE(x) do { } while (0)
73129@@ -538,7 +538,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
73130 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
73131 */
73132 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
73133- const struct slab *slab, void *obj)
73134+ const struct slab *slab, const void *obj)
73135 {
73136 u32 offset = (obj - slab->s_mem);
73137 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
73138@@ -564,7 +564,7 @@ struct cache_names {
73139 static struct cache_names __initdata cache_names[] = {
73140 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
73141 #include <linux/kmalloc_sizes.h>
73142- {NULL,}
73143+ {NULL}
73144 #undef CACHE
73145 };
73146
73147@@ -1572,7 +1572,7 @@ void __init kmem_cache_init(void)
73148 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
73149 sizes[INDEX_AC].cs_size,
73150 ARCH_KMALLOC_MINALIGN,
73151- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73152+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73153 NULL);
73154
73155 if (INDEX_AC != INDEX_L3) {
73156@@ -1580,7 +1580,7 @@ void __init kmem_cache_init(void)
73157 kmem_cache_create(names[INDEX_L3].name,
73158 sizes[INDEX_L3].cs_size,
73159 ARCH_KMALLOC_MINALIGN,
73160- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73161+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73162 NULL);
73163 }
73164
73165@@ -1598,7 +1598,7 @@ void __init kmem_cache_init(void)
73166 sizes->cs_cachep = kmem_cache_create(names->name,
73167 sizes->cs_size,
73168 ARCH_KMALLOC_MINALIGN,
73169- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73170+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73171 NULL);
73172 }
73173 #ifdef CONFIG_ZONE_DMA
73174@@ -4327,10 +4327,10 @@ static int s_show(struct seq_file *m, void *p)
73175 }
73176 /* cpu stats */
73177 {
73178- unsigned long allochit = atomic_read(&cachep->allochit);
73179- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
73180- unsigned long freehit = atomic_read(&cachep->freehit);
73181- unsigned long freemiss = atomic_read(&cachep->freemiss);
73182+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
73183+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
73184+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
73185+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
73186
73187 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
73188 allochit, allocmiss, freehit, freemiss);
73189@@ -4587,15 +4587,70 @@ static const struct file_operations proc_slabstats_operations = {
73190
73191 static int __init slab_proc_init(void)
73192 {
73193- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
73194+ mode_t gr_mode = S_IRUGO;
73195+
73196+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73197+ gr_mode = S_IRUSR;
73198+#endif
73199+
73200+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
73201 #ifdef CONFIG_DEBUG_SLAB_LEAK
73202- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
73203+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
73204 #endif
73205 return 0;
73206 }
73207 module_init(slab_proc_init);
73208 #endif
73209
73210+void check_object_size(const void *ptr, unsigned long n, bool to)
73211+{
73212+
73213+#ifdef CONFIG_PAX_USERCOPY
73214+ struct page *page;
73215+ struct kmem_cache *cachep = NULL;
73216+ struct slab *slabp;
73217+ unsigned int objnr;
73218+ unsigned long offset;
73219+ const char *type;
73220+
73221+ if (!n)
73222+ return;
73223+
73224+ type = "<null>";
73225+ if (ZERO_OR_NULL_PTR(ptr))
73226+ goto report;
73227+
73228+ if (!virt_addr_valid(ptr))
73229+ return;
73230+
73231+ page = virt_to_head_page(ptr);
73232+
73233+ type = "<process stack>";
73234+ if (!PageSlab(page)) {
73235+ if (object_is_on_stack(ptr, n) == -1)
73236+ goto report;
73237+ return;
73238+ }
73239+
73240+ cachep = page_get_cache(page);
73241+ type = cachep->name;
73242+ if (!(cachep->flags & SLAB_USERCOPY))
73243+ goto report;
73244+
73245+ slabp = page_get_slab(page);
73246+ objnr = obj_to_index(cachep, slabp, ptr);
73247+ BUG_ON(objnr >= cachep->num);
73248+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
73249+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
73250+ return;
73251+
73252+report:
73253+ pax_report_usercopy(ptr, n, to, type);
73254+#endif
73255+
73256+}
73257+EXPORT_SYMBOL(check_object_size);
73258+
73259 /**
73260 * ksize - get the actual amount of memory allocated for a given object
73261 * @objp: Pointer to the object
73262diff --git a/mm/slob.c b/mm/slob.c
73263index bf39181..727f7a3 100644
73264--- a/mm/slob.c
73265+++ b/mm/slob.c
73266@@ -29,7 +29,7 @@
73267 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
73268 * alloc_pages() directly, allocating compound pages so the page order
73269 * does not have to be separately tracked, and also stores the exact
73270- * allocation size in page->private so that it can be used to accurately
73271+ * allocation size in slob_page->size so that it can be used to accurately
73272 * provide ksize(). These objects are detected in kfree() because slob_page()
73273 * is false for them.
73274 *
73275@@ -58,6 +58,7 @@
73276 */
73277
73278 #include <linux/kernel.h>
73279+#include <linux/sched.h>
73280 #include <linux/slab.h>
73281 #include <linux/mm.h>
73282 #include <linux/swap.h> /* struct reclaim_state */
73283@@ -102,7 +103,8 @@ struct slob_page {
73284 unsigned long flags; /* mandatory */
73285 atomic_t _count; /* mandatory */
73286 slobidx_t units; /* free units left in page */
73287- unsigned long pad[2];
73288+ unsigned long pad[1];
73289+ unsigned long size; /* size when >=PAGE_SIZE */
73290 slob_t *free; /* first free slob_t in page */
73291 struct list_head list; /* linked list of free pages */
73292 };
73293@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
73294 */
73295 static inline int is_slob_page(struct slob_page *sp)
73296 {
73297- return PageSlab((struct page *)sp);
73298+ return PageSlab((struct page *)sp) && !sp->size;
73299 }
73300
73301 static inline void set_slob_page(struct slob_page *sp)
73302@@ -150,7 +152,7 @@ static inline void clear_slob_page(struct slob_page *sp)
73303
73304 static inline struct slob_page *slob_page(const void *addr)
73305 {
73306- return (struct slob_page *)virt_to_page(addr);
73307+ return (struct slob_page *)virt_to_head_page(addr);
73308 }
73309
73310 /*
73311@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
73312 /*
73313 * Return the size of a slob block.
73314 */
73315-static slobidx_t slob_units(slob_t *s)
73316+static slobidx_t slob_units(const slob_t *s)
73317 {
73318 if (s->units > 0)
73319 return s->units;
73320@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
73321 /*
73322 * Return the next free slob block pointer after this one.
73323 */
73324-static slob_t *slob_next(slob_t *s)
73325+static slob_t *slob_next(const slob_t *s)
73326 {
73327 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
73328 slobidx_t next;
73329@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
73330 /*
73331 * Returns true if s is the last free block in its page.
73332 */
73333-static int slob_last(slob_t *s)
73334+static int slob_last(const slob_t *s)
73335 {
73336 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
73337 }
73338@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
73339 if (!page)
73340 return NULL;
73341
73342+ set_slob_page(page);
73343 return page_address(page);
73344 }
73345
73346@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
73347 if (!b)
73348 return NULL;
73349 sp = slob_page(b);
73350- set_slob_page(sp);
73351
73352 spin_lock_irqsave(&slob_lock, flags);
73353 sp->units = SLOB_UNITS(PAGE_SIZE);
73354 sp->free = b;
73355+ sp->size = 0;
73356 INIT_LIST_HEAD(&sp->list);
73357 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
73358 set_slob_page_free(sp, slob_list);
73359@@ -476,10 +479,9 @@ out:
73360 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
73361 */
73362
73363-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73364+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
73365 {
73366- unsigned int *m;
73367- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73368+ slob_t *m;
73369 void *ret;
73370
73371 gfp &= gfp_allowed_mask;
73372@@ -494,7 +496,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73373
73374 if (!m)
73375 return NULL;
73376- *m = size;
73377+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
73378+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
73379+ m[0].units = size;
73380+ m[1].units = align;
73381 ret = (void *)m + align;
73382
73383 trace_kmalloc_node(_RET_IP_, ret,
73384@@ -506,16 +511,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73385 gfp |= __GFP_COMP;
73386 ret = slob_new_pages(gfp, order, node);
73387 if (ret) {
73388- struct page *page;
73389- page = virt_to_page(ret);
73390- page->private = size;
73391+ struct slob_page *sp;
73392+ sp = slob_page(ret);
73393+ sp->size = size;
73394 }
73395
73396 trace_kmalloc_node(_RET_IP_, ret,
73397 size, PAGE_SIZE << order, gfp, node);
73398 }
73399
73400- kmemleak_alloc(ret, size, 1, gfp);
73401+ return ret;
73402+}
73403+
73404+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73405+{
73406+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73407+ void *ret = __kmalloc_node_align(size, gfp, node, align);
73408+
73409+ if (!ZERO_OR_NULL_PTR(ret))
73410+ kmemleak_alloc(ret, size, 1, gfp);
73411 return ret;
73412 }
73413 EXPORT_SYMBOL(__kmalloc_node);
73414@@ -533,13 +547,92 @@ void kfree(const void *block)
73415 sp = slob_page(block);
73416 if (is_slob_page(sp)) {
73417 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73418- unsigned int *m = (unsigned int *)(block - align);
73419- slob_free(m, *m + align);
73420- } else
73421+ slob_t *m = (slob_t *)(block - align);
73422+ slob_free(m, m[0].units + align);
73423+ } else {
73424+ clear_slob_page(sp);
73425+ free_slob_page(sp);
73426+ sp->size = 0;
73427 put_page(&sp->page);
73428+ }
73429 }
73430 EXPORT_SYMBOL(kfree);
73431
73432+void check_object_size(const void *ptr, unsigned long n, bool to)
73433+{
73434+
73435+#ifdef CONFIG_PAX_USERCOPY
73436+ struct slob_page *sp;
73437+ const slob_t *free;
73438+ const void *base;
73439+ unsigned long flags;
73440+ const char *type;
73441+
73442+ if (!n)
73443+ return;
73444+
73445+ type = "<null>";
73446+ if (ZERO_OR_NULL_PTR(ptr))
73447+ goto report;
73448+
73449+ if (!virt_addr_valid(ptr))
73450+ return;
73451+
73452+ type = "<process stack>";
73453+ sp = slob_page(ptr);
73454+ if (!PageSlab((struct page*)sp)) {
73455+ if (object_is_on_stack(ptr, n) == -1)
73456+ goto report;
73457+ return;
73458+ }
73459+
73460+ type = "<slob>";
73461+ if (sp->size) {
73462+ base = page_address(&sp->page);
73463+ if (base <= ptr && n <= sp->size - (ptr - base))
73464+ return;
73465+ goto report;
73466+ }
73467+
73468+ /* some tricky double walking to find the chunk */
73469+ spin_lock_irqsave(&slob_lock, flags);
73470+ base = (void *)((unsigned long)ptr & PAGE_MASK);
73471+ free = sp->free;
73472+
73473+ while (!slob_last(free) && (void *)free <= ptr) {
73474+ base = free + slob_units(free);
73475+ free = slob_next(free);
73476+ }
73477+
73478+ while (base < (void *)free) {
73479+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
73480+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
73481+ int offset;
73482+
73483+ if (ptr < base + align)
73484+ break;
73485+
73486+ offset = ptr - base - align;
73487+ if (offset >= m) {
73488+ base += size;
73489+ continue;
73490+ }
73491+
73492+ if (n > m - offset)
73493+ break;
73494+
73495+ spin_unlock_irqrestore(&slob_lock, flags);
73496+ return;
73497+ }
73498+
73499+ spin_unlock_irqrestore(&slob_lock, flags);
73500+report:
73501+ pax_report_usercopy(ptr, n, to, type);
73502+#endif
73503+
73504+}
73505+EXPORT_SYMBOL(check_object_size);
73506+
73507 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
73508 size_t ksize(const void *block)
73509 {
73510@@ -552,10 +645,10 @@ size_t ksize(const void *block)
73511 sp = slob_page(block);
73512 if (is_slob_page(sp)) {
73513 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73514- unsigned int *m = (unsigned int *)(block - align);
73515- return SLOB_UNITS(*m) * SLOB_UNIT;
73516+ slob_t *m = (slob_t *)(block - align);
73517+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
73518 } else
73519- return sp->page.private;
73520+ return sp->size;
73521 }
73522 EXPORT_SYMBOL(ksize);
73523
73524@@ -571,8 +664,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73525 {
73526 struct kmem_cache *c;
73527
73528+#ifdef CONFIG_PAX_USERCOPY
73529+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
73530+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
73531+#else
73532 c = slob_alloc(sizeof(struct kmem_cache),
73533 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
73534+#endif
73535
73536 if (c) {
73537 c->name = name;
73538@@ -614,17 +712,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
73539
73540 lockdep_trace_alloc(flags);
73541
73542+#ifdef CONFIG_PAX_USERCOPY
73543+ b = __kmalloc_node_align(c->size, flags, node, c->align);
73544+#else
73545 if (c->size < PAGE_SIZE) {
73546 b = slob_alloc(c->size, flags, c->align, node);
73547 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73548 SLOB_UNITS(c->size) * SLOB_UNIT,
73549 flags, node);
73550 } else {
73551+ struct slob_page *sp;
73552+
73553 b = slob_new_pages(flags, get_order(c->size), node);
73554+ sp = slob_page(b);
73555+ sp->size = c->size;
73556 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73557 PAGE_SIZE << get_order(c->size),
73558 flags, node);
73559 }
73560+#endif
73561
73562 if (c->ctor)
73563 c->ctor(b);
73564@@ -636,10 +742,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
73565
73566 static void __kmem_cache_free(void *b, int size)
73567 {
73568- if (size < PAGE_SIZE)
73569+ struct slob_page *sp = slob_page(b);
73570+
73571+ if (is_slob_page(sp))
73572 slob_free(b, size);
73573- else
73574+ else {
73575+ clear_slob_page(sp);
73576+ free_slob_page(sp);
73577+ sp->size = 0;
73578 slob_free_pages(b, get_order(size));
73579+ }
73580 }
73581
73582 static void kmem_rcu_free(struct rcu_head *head)
73583@@ -652,17 +764,31 @@ static void kmem_rcu_free(struct rcu_head *head)
73584
73585 void kmem_cache_free(struct kmem_cache *c, void *b)
73586 {
73587+ int size = c->size;
73588+
73589+#ifdef CONFIG_PAX_USERCOPY
73590+ if (size + c->align < PAGE_SIZE) {
73591+ size += c->align;
73592+ b -= c->align;
73593+ }
73594+#endif
73595+
73596 kmemleak_free_recursive(b, c->flags);
73597 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
73598 struct slob_rcu *slob_rcu;
73599- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
73600- slob_rcu->size = c->size;
73601+ slob_rcu = b + (size - sizeof(struct slob_rcu));
73602+ slob_rcu->size = size;
73603 call_rcu(&slob_rcu->head, kmem_rcu_free);
73604 } else {
73605- __kmem_cache_free(b, c->size);
73606+ __kmem_cache_free(b, size);
73607 }
73608
73609+#ifdef CONFIG_PAX_USERCOPY
73610+ trace_kfree(_RET_IP_, b);
73611+#else
73612 trace_kmem_cache_free(_RET_IP_, b);
73613+#endif
73614+
73615 }
73616 EXPORT_SYMBOL(kmem_cache_free);
73617
73618diff --git a/mm/slub.c b/mm/slub.c
73619index 7c54fe8..0bb4ac5 100644
73620--- a/mm/slub.c
73621+++ b/mm/slub.c
73622@@ -208,7 +208,7 @@ struct track {
73623
73624 enum track_item { TRACK_ALLOC, TRACK_FREE };
73625
73626-#ifdef CONFIG_SYSFS
73627+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73628 static int sysfs_slab_add(struct kmem_cache *);
73629 static int sysfs_slab_alias(struct kmem_cache *, const char *);
73630 static void sysfs_slab_remove(struct kmem_cache *);
73631@@ -556,7 +556,7 @@ static void print_track(const char *s, struct track *t)
73632 if (!t->addr)
73633 return;
73634
73635- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
73636+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
73637 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
73638 #ifdef CONFIG_STACKTRACE
73639 {
73640@@ -2456,6 +2456,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
73641
73642 page = virt_to_head_page(x);
73643
73644+ BUG_ON(!PageSlab(page));
73645+
73646 slab_free(s, page, x, _RET_IP_);
73647
73648 trace_kmem_cache_free(_RET_IP_, x);
73649@@ -2489,7 +2491,7 @@ static int slub_min_objects;
73650 * Merge control. If this is set then no merging of slab caches will occur.
73651 * (Could be removed. This was introduced to pacify the merge skeptics.)
73652 */
73653-static int slub_nomerge;
73654+static int slub_nomerge = 1;
73655
73656 /*
73657 * Calculate the order of allocation given an slab object size.
73658@@ -2912,7 +2914,7 @@ static int kmem_cache_open(struct kmem_cache *s,
73659 * list to avoid pounding the page allocator excessively.
73660 */
73661 set_min_partial(s, ilog2(s->size));
73662- s->refcount = 1;
73663+ atomic_set(&s->refcount, 1);
73664 #ifdef CONFIG_NUMA
73665 s->remote_node_defrag_ratio = 1000;
73666 #endif
73667@@ -3017,8 +3019,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
73668 void kmem_cache_destroy(struct kmem_cache *s)
73669 {
73670 down_write(&slub_lock);
73671- s->refcount--;
73672- if (!s->refcount) {
73673+ if (atomic_dec_and_test(&s->refcount)) {
73674 list_del(&s->list);
73675 if (kmem_cache_close(s)) {
73676 printk(KERN_ERR "SLUB %s: %s called for cache that "
73677@@ -3228,6 +3229,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
73678 EXPORT_SYMBOL(__kmalloc_node);
73679 #endif
73680
73681+void check_object_size(const void *ptr, unsigned long n, bool to)
73682+{
73683+
73684+#ifdef CONFIG_PAX_USERCOPY
73685+ struct page *page;
73686+ struct kmem_cache *s = NULL;
73687+ unsigned long offset;
73688+ const char *type;
73689+
73690+ if (!n)
73691+ return;
73692+
73693+ type = "<null>";
73694+ if (ZERO_OR_NULL_PTR(ptr))
73695+ goto report;
73696+
73697+ if (!virt_addr_valid(ptr))
73698+ return;
73699+
73700+ page = virt_to_head_page(ptr);
73701+
73702+ type = "<process stack>";
73703+ if (!PageSlab(page)) {
73704+ if (object_is_on_stack(ptr, n) == -1)
73705+ goto report;
73706+ return;
73707+ }
73708+
73709+ s = page->slab;
73710+ type = s->name;
73711+ if (!(s->flags & SLAB_USERCOPY))
73712+ goto report;
73713+
73714+ offset = (ptr - page_address(page)) % s->size;
73715+ if (offset <= s->objsize && n <= s->objsize - offset)
73716+ return;
73717+
73718+report:
73719+ pax_report_usercopy(ptr, n, to, type);
73720+#endif
73721+
73722+}
73723+EXPORT_SYMBOL(check_object_size);
73724+
73725 size_t ksize(const void *object)
73726 {
73727 struct page *page;
73728@@ -3502,7 +3547,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
73729 int node;
73730
73731 list_add(&s->list, &slab_caches);
73732- s->refcount = -1;
73733+ atomic_set(&s->refcount, -1);
73734
73735 for_each_node_state(node, N_NORMAL_MEMORY) {
73736 struct kmem_cache_node *n = get_node(s, node);
73737@@ -3619,17 +3664,17 @@ void __init kmem_cache_init(void)
73738
73739 /* Caches that are not of the two-to-the-power-of size */
73740 if (KMALLOC_MIN_SIZE <= 32) {
73741- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
73742+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
73743 caches++;
73744 }
73745
73746 if (KMALLOC_MIN_SIZE <= 64) {
73747- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
73748+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
73749 caches++;
73750 }
73751
73752 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
73753- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
73754+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
73755 caches++;
73756 }
73757
73758@@ -3697,7 +3742,7 @@ static int slab_unmergeable(struct kmem_cache *s)
73759 /*
73760 * We may have set a slab to be unmergeable during bootstrap.
73761 */
73762- if (s->refcount < 0)
73763+ if (atomic_read(&s->refcount) < 0)
73764 return 1;
73765
73766 return 0;
73767@@ -3756,7 +3801,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73768 down_write(&slub_lock);
73769 s = find_mergeable(size, align, flags, name, ctor);
73770 if (s) {
73771- s->refcount++;
73772+ atomic_inc(&s->refcount);
73773 /*
73774 * Adjust the object sizes so that we clear
73775 * the complete object on kzalloc.
73776@@ -3765,7 +3810,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73777 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
73778
73779 if (sysfs_slab_alias(s, name)) {
73780- s->refcount--;
73781+ atomic_dec(&s->refcount);
73782 goto err;
73783 }
73784 up_write(&slub_lock);
73785@@ -3893,7 +3938,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
73786 }
73787 #endif
73788
73789-#ifdef CONFIG_SYSFS
73790+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73791 static int count_inuse(struct page *page)
73792 {
73793 return page->inuse;
73794@@ -4280,12 +4325,12 @@ static void resiliency_test(void)
73795 validate_slab_cache(kmalloc_caches[9]);
73796 }
73797 #else
73798-#ifdef CONFIG_SYSFS
73799+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73800 static void resiliency_test(void) {};
73801 #endif
73802 #endif
73803
73804-#ifdef CONFIG_SYSFS
73805+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73806 enum slab_stat_type {
73807 SL_ALL, /* All slabs */
73808 SL_PARTIAL, /* Only partially allocated slabs */
73809@@ -4495,7 +4540,7 @@ SLAB_ATTR_RO(ctor);
73810
73811 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
73812 {
73813- return sprintf(buf, "%d\n", s->refcount - 1);
73814+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
73815 }
73816 SLAB_ATTR_RO(aliases);
73817
73818@@ -5025,6 +5070,7 @@ static char *create_unique_id(struct kmem_cache *s)
73819 return name;
73820 }
73821
73822+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73823 static int sysfs_slab_add(struct kmem_cache *s)
73824 {
73825 int err;
73826@@ -5087,6 +5133,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
73827 kobject_del(&s->kobj);
73828 kobject_put(&s->kobj);
73829 }
73830+#endif
73831
73832 /*
73833 * Need to buffer aliases during bootup until sysfs becomes
73834@@ -5100,6 +5147,7 @@ struct saved_alias {
73835
73836 static struct saved_alias *alias_list;
73837
73838+#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73839 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
73840 {
73841 struct saved_alias *al;
73842@@ -5122,6 +5170,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
73843 alias_list = al;
73844 return 0;
73845 }
73846+#endif
73847
73848 static int __init slab_sysfs_init(void)
73849 {
73850@@ -5257,7 +5306,13 @@ static const struct file_operations proc_slabinfo_operations = {
73851
73852 static int __init slab_proc_init(void)
73853 {
73854- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
73855+ mode_t gr_mode = S_IRUGO;
73856+
73857+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73858+ gr_mode = S_IRUSR;
73859+#endif
73860+
73861+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
73862 return 0;
73863 }
73864 module_init(slab_proc_init);
73865diff --git a/mm/swap.c b/mm/swap.c
73866index 87627f1..8a9eb34 100644
73867--- a/mm/swap.c
73868+++ b/mm/swap.c
73869@@ -31,6 +31,7 @@
73870 #include <linux/backing-dev.h>
73871 #include <linux/memcontrol.h>
73872 #include <linux/gfp.h>
73873+#include <linux/hugetlb.h>
73874
73875 #include "internal.h"
73876
73877@@ -71,6 +72,8 @@ static void __put_compound_page(struct page *page)
73878
73879 __page_cache_release(page);
73880 dtor = get_compound_page_dtor(page);
73881+ if (!PageHuge(page))
73882+ BUG_ON(dtor != free_compound_page);
73883 (*dtor)(page);
73884 }
73885
73886diff --git a/mm/swapfile.c b/mm/swapfile.c
73887index 17bc224..1677059 100644
73888--- a/mm/swapfile.c
73889+++ b/mm/swapfile.c
73890@@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex);
73891
73892 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
73893 /* Activity counter to indicate that a swapon or swapoff has occurred */
73894-static atomic_t proc_poll_event = ATOMIC_INIT(0);
73895+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
73896
73897 static inline unsigned char swap_count(unsigned char ent)
73898 {
73899@@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
73900 }
73901 filp_close(swap_file, NULL);
73902 err = 0;
73903- atomic_inc(&proc_poll_event);
73904+ atomic_inc_unchecked(&proc_poll_event);
73905 wake_up_interruptible(&proc_poll_wait);
73906
73907 out_dput:
73908@@ -1687,8 +1687,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
73909
73910 poll_wait(file, &proc_poll_wait, wait);
73911
73912- if (seq->poll_event != atomic_read(&proc_poll_event)) {
73913- seq->poll_event = atomic_read(&proc_poll_event);
73914+ if (seq->poll_event != atomic_read_unchecked(&proc_poll_event)) {
73915+ seq->poll_event = atomic_read_unchecked(&proc_poll_event);
73916 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
73917 }
73918
73919@@ -1786,7 +1786,7 @@ static int swaps_open(struct inode *inode, struct file *file)
73920 return ret;
73921
73922 seq = file->private_data;
73923- seq->poll_event = atomic_read(&proc_poll_event);
73924+ seq->poll_event = atomic_read_unchecked(&proc_poll_event);
73925 return 0;
73926 }
73927
73928@@ -2124,7 +2124,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
73929 (p->flags & SWP_DISCARDABLE) ? "D" : "");
73930
73931 mutex_unlock(&swapon_mutex);
73932- atomic_inc(&proc_poll_event);
73933+ atomic_inc_unchecked(&proc_poll_event);
73934 wake_up_interruptible(&proc_poll_wait);
73935
73936 if (S_ISREG(inode->i_mode))
73937diff --git a/mm/util.c b/mm/util.c
73938index 88ea1bd..0f1dfdb 100644
73939--- a/mm/util.c
73940+++ b/mm/util.c
73941@@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user);
73942 * allocated buffer. Use this if you don't want to free the buffer immediately
73943 * like, for example, with RCU.
73944 */
73945+#undef __krealloc
73946 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
73947 {
73948 void *ret;
73949@@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc);
73950 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
73951 * %NULL pointer, the object pointed to is freed.
73952 */
73953+#undef krealloc
73954 void *krealloc(const void *p, size_t new_size, gfp_t flags)
73955 {
73956 void *ret;
73957@@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
73958 void arch_pick_mmap_layout(struct mm_struct *mm)
73959 {
73960 mm->mmap_base = TASK_UNMAPPED_BASE;
73961+
73962+#ifdef CONFIG_PAX_RANDMMAP
73963+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73964+ mm->mmap_base += mm->delta_mmap;
73965+#endif
73966+
73967 mm->get_unmapped_area = arch_get_unmapped_area;
73968 mm->unmap_area = arch_unmap_area;
73969 }
73970diff --git a/mm/vmalloc.c b/mm/vmalloc.c
73971index 3a65d6f7..39d5e33 100644
73972--- a/mm/vmalloc.c
73973+++ b/mm/vmalloc.c
73974@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
73975
73976 pte = pte_offset_kernel(pmd, addr);
73977 do {
73978- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73979- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73980+
73981+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73982+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
73983+ BUG_ON(!pte_exec(*pte));
73984+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
73985+ continue;
73986+ }
73987+#endif
73988+
73989+ {
73990+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73991+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73992+ }
73993 } while (pte++, addr += PAGE_SIZE, addr != end);
73994 }
73995
73996@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
73997 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
73998 {
73999 pte_t *pte;
74000+ int ret = -ENOMEM;
74001
74002 /*
74003 * nr is a running index into the array which helps higher level
74004@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
74005 pte = pte_alloc_kernel(pmd, addr);
74006 if (!pte)
74007 return -ENOMEM;
74008+
74009+ pax_open_kernel();
74010 do {
74011 struct page *page = pages[*nr];
74012
74013- if (WARN_ON(!pte_none(*pte)))
74014- return -EBUSY;
74015- if (WARN_ON(!page))
74016- return -ENOMEM;
74017+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74018+ if (pgprot_val(prot) & _PAGE_NX)
74019+#endif
74020+
74021+ if (WARN_ON(!pte_none(*pte))) {
74022+ ret = -EBUSY;
74023+ goto out;
74024+ }
74025+ if (WARN_ON(!page)) {
74026+ ret = -ENOMEM;
74027+ goto out;
74028+ }
74029 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
74030 (*nr)++;
74031 } while (pte++, addr += PAGE_SIZE, addr != end);
74032- return 0;
74033+ ret = 0;
74034+out:
74035+ pax_close_kernel();
74036+ return ret;
74037 }
74038
74039 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
74040@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void *x)
74041 * and fall back on vmalloc() if that fails. Others
74042 * just put it in the vmalloc space.
74043 */
74044-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
74045+#ifdef CONFIG_MODULES
74046+#ifdef MODULES_VADDR
74047 unsigned long addr = (unsigned long)x;
74048 if (addr >= MODULES_VADDR && addr < MODULES_END)
74049 return 1;
74050 #endif
74051+
74052+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74053+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
74054+ return 1;
74055+#endif
74056+
74057+#endif
74058+
74059 return is_vmalloc_addr(x);
74060 }
74061
74062@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
74063
74064 if (!pgd_none(*pgd)) {
74065 pud_t *pud = pud_offset(pgd, addr);
74066+#ifdef CONFIG_X86
74067+ if (!pud_large(*pud))
74068+#endif
74069 if (!pud_none(*pud)) {
74070 pmd_t *pmd = pmd_offset(pud, addr);
74071+#ifdef CONFIG_X86
74072+ if (!pmd_large(*pmd))
74073+#endif
74074 if (!pmd_none(*pmd)) {
74075 pte_t *ptep, pte;
74076
74077@@ -1290,10 +1330,20 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
74078 unsigned long align, unsigned long flags, unsigned long start,
74079 unsigned long end, int node, gfp_t gfp_mask, void *caller)
74080 {
74081- static struct vmap_area *va;
74082+ struct vmap_area *va;
74083 struct vm_struct *area;
74084
74085 BUG_ON(in_interrupt());
74086+
74087+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74088+ if (flags & VM_KERNEXEC) {
74089+ if (start != VMALLOC_START || end != VMALLOC_END)
74090+ return NULL;
74091+ start = (unsigned long)MODULES_EXEC_VADDR;
74092+ end = (unsigned long)MODULES_EXEC_END;
74093+ }
74094+#endif
74095+
74096 if (flags & VM_IOREMAP) {
74097 int bit = fls(size);
74098
74099@@ -1526,6 +1576,11 @@ void *vmap(struct page **pages, unsigned int count,
74100 if (count > totalram_pages)
74101 return NULL;
74102
74103+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74104+ if (!(pgprot_val(prot) & _PAGE_NX))
74105+ flags |= VM_KERNEXEC;
74106+#endif
74107+
74108 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
74109 __builtin_return_address(0));
74110 if (!area)
74111@@ -1627,6 +1682,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
74112 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
74113 return NULL;
74114
74115+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74116+ if (!(pgprot_val(prot) & _PAGE_NX))
74117+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
74118+ VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
74119+ else
74120+#endif
74121+
74122 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
74123 start, end, node, gfp_mask, caller);
74124
74125@@ -1674,6 +1736,7 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
74126 gfp_mask, prot, node, caller);
74127 }
74128
74129+#undef __vmalloc
74130 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
74131 {
74132 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
74133@@ -1697,6 +1760,7 @@ static inline void *__vmalloc_node_flags(unsigned long size,
74134 * For tight control over page level allocator and protection flags
74135 * use __vmalloc() instead.
74136 */
74137+#undef vmalloc
74138 void *vmalloc(unsigned long size)
74139 {
74140 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
74141@@ -1713,6 +1777,7 @@ EXPORT_SYMBOL(vmalloc);
74142 * For tight control over page level allocator and protection flags
74143 * use __vmalloc() instead.
74144 */
74145+#undef vzalloc
74146 void *vzalloc(unsigned long size)
74147 {
74148 return __vmalloc_node_flags(size, -1,
74149@@ -1727,6 +1792,7 @@ EXPORT_SYMBOL(vzalloc);
74150 * The resulting memory area is zeroed so it can be mapped to userspace
74151 * without leaking data.
74152 */
74153+#undef vmalloc_user
74154 void *vmalloc_user(unsigned long size)
74155 {
74156 struct vm_struct *area;
74157@@ -1754,6 +1820,7 @@ EXPORT_SYMBOL(vmalloc_user);
74158 * For tight control over page level allocator and protection flags
74159 * use __vmalloc() instead.
74160 */
74161+#undef vmalloc_node
74162 void *vmalloc_node(unsigned long size, int node)
74163 {
74164 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
74165@@ -1773,6 +1840,7 @@ EXPORT_SYMBOL(vmalloc_node);
74166 * For tight control over page level allocator and protection flags
74167 * use __vmalloc_node() instead.
74168 */
74169+#undef vzalloc_node
74170 void *vzalloc_node(unsigned long size, int node)
74171 {
74172 return __vmalloc_node_flags(size, node,
74173@@ -1795,10 +1863,10 @@ EXPORT_SYMBOL(vzalloc_node);
74174 * For tight control over page level allocator and protection flags
74175 * use __vmalloc() instead.
74176 */
74177-
74178+#undef vmalloc_exec
74179 void *vmalloc_exec(unsigned long size)
74180 {
74181- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
74182+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
74183 -1, __builtin_return_address(0));
74184 }
74185
74186@@ -1817,6 +1885,7 @@ void *vmalloc_exec(unsigned long size)
74187 * Allocate enough 32bit PA addressable pages to cover @size from the
74188 * page level allocator and map them into contiguous kernel virtual space.
74189 */
74190+#undef vmalloc_32
74191 void *vmalloc_32(unsigned long size)
74192 {
74193 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
74194@@ -1831,6 +1900,7 @@ EXPORT_SYMBOL(vmalloc_32);
74195 * The resulting memory area is 32bit addressable and zeroed so it can be
74196 * mapped to userspace without leaking data.
74197 */
74198+#undef vmalloc_32_user
74199 void *vmalloc_32_user(unsigned long size)
74200 {
74201 struct vm_struct *area;
74202@@ -2093,6 +2163,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
74203 unsigned long uaddr = vma->vm_start;
74204 unsigned long usize = vma->vm_end - vma->vm_start;
74205
74206+ BUG_ON(vma->vm_mirror);
74207+
74208 if ((PAGE_SIZE-1) & (unsigned long)addr)
74209 return -EINVAL;
74210
74211diff --git a/mm/vmstat.c b/mm/vmstat.c
74212index d52b13d..381d1ac 100644
74213--- a/mm/vmstat.c
74214+++ b/mm/vmstat.c
74215@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
74216 *
74217 * vm_stat contains the global counters
74218 */
74219-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
74220+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
74221 EXPORT_SYMBOL(vm_stat);
74222
74223 #ifdef CONFIG_SMP
74224@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
74225 v = p->vm_stat_diff[i];
74226 p->vm_stat_diff[i] = 0;
74227 local_irq_restore(flags);
74228- atomic_long_add(v, &zone->vm_stat[i]);
74229+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
74230 global_diff[i] += v;
74231 #ifdef CONFIG_NUMA
74232 /* 3 seconds idle till flush */
74233@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
74234
74235 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
74236 if (global_diff[i])
74237- atomic_long_add(global_diff[i], &vm_stat[i]);
74238+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
74239 }
74240
74241 #endif
74242@@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void)
74243 start_cpu_timer(cpu);
74244 #endif
74245 #ifdef CONFIG_PROC_FS
74246- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
74247- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
74248- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
74249- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
74250+ {
74251+ mode_t gr_mode = S_IRUGO;
74252+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74253+ gr_mode = S_IRUSR;
74254+#endif
74255+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
74256+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
74257+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
74258+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
74259+#else
74260+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
74261+#endif
74262+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
74263+ }
74264 #endif
74265 return 0;
74266 }
74267diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
74268index 8970ba1..e3361fe 100644
74269--- a/net/8021q/vlan.c
74270+++ b/net/8021q/vlan.c
74271@@ -588,8 +588,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
74272 err = -EPERM;
74273 if (!capable(CAP_NET_ADMIN))
74274 break;
74275- if ((args.u.name_type >= 0) &&
74276- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
74277+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
74278 struct vlan_net *vn;
74279
74280 vn = net_generic(net, vlan_net_id);
74281diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
74282index fdfdb57..38d368c 100644
74283--- a/net/9p/trans_fd.c
74284+++ b/net/9p/trans_fd.c
74285@@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
74286 oldfs = get_fs();
74287 set_fs(get_ds());
74288 /* The cast to a user pointer is valid due to the set_fs() */
74289- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
74290+ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
74291 set_fs(oldfs);
74292
74293 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
74294diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
74295index e317583..3c8aeaf 100644
74296--- a/net/9p/trans_virtio.c
74297+++ b/net/9p/trans_virtio.c
74298@@ -327,7 +327,7 @@ req_retry_pinned:
74299 } else {
74300 char *pbuf;
74301 if (req->tc->pubuf)
74302- pbuf = (__force char *) req->tc->pubuf;
74303+ pbuf = (char __force_kernel *) req->tc->pubuf;
74304 else
74305 pbuf = req->tc->pkbuf;
74306 outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
74307@@ -357,7 +357,7 @@ req_retry_pinned:
74308 } else {
74309 char *pbuf;
74310 if (req->tc->pubuf)
74311- pbuf = (__force char *) req->tc->pubuf;
74312+ pbuf = (char __force_kernel *) req->tc->pubuf;
74313 else
74314 pbuf = req->tc->pkbuf;
74315
74316diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
74317index f41f026..fe76ea8 100644
74318--- a/net/atm/atm_misc.c
74319+++ b/net/atm/atm_misc.c
74320@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int truesize)
74321 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
74322 return 1;
74323 atm_return(vcc, truesize);
74324- atomic_inc(&vcc->stats->rx_drop);
74325+ atomic_inc_unchecked(&vcc->stats->rx_drop);
74326 return 0;
74327 }
74328 EXPORT_SYMBOL(atm_charge);
74329@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
74330 }
74331 }
74332 atm_return(vcc, guess);
74333- atomic_inc(&vcc->stats->rx_drop);
74334+ atomic_inc_unchecked(&vcc->stats->rx_drop);
74335 return NULL;
74336 }
74337 EXPORT_SYMBOL(atm_alloc_charge);
74338@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
74339
74340 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
74341 {
74342-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
74343+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
74344 __SONET_ITEMS
74345 #undef __HANDLE_ITEM
74346 }
74347@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
74348
74349 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
74350 {
74351-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
74352+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
74353 __SONET_ITEMS
74354 #undef __HANDLE_ITEM
74355 }
74356diff --git a/net/atm/lec.h b/net/atm/lec.h
74357index dfc0719..47c5322 100644
74358--- a/net/atm/lec.h
74359+++ b/net/atm/lec.h
74360@@ -48,7 +48,7 @@ struct lane2_ops {
74361 const u8 *tlvs, u32 sizeoftlvs);
74362 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
74363 const u8 *tlvs, u32 sizeoftlvs);
74364-};
74365+} __no_const;
74366
74367 /*
74368 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
74369diff --git a/net/atm/mpc.h b/net/atm/mpc.h
74370index 0919a88..a23d54e 100644
74371--- a/net/atm/mpc.h
74372+++ b/net/atm/mpc.h
74373@@ -33,7 +33,7 @@ struct mpoa_client {
74374 struct mpc_parameters parameters; /* parameters for this client */
74375
74376 const struct net_device_ops *old_ops;
74377- struct net_device_ops new_ops;
74378+ net_device_ops_no_const new_ops;
74379 };
74380
74381
74382diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
74383index d1b2d9a..7cc2219 100644
74384--- a/net/atm/mpoa_caches.c
74385+++ b/net/atm/mpoa_caches.c
74386@@ -255,6 +255,8 @@ static void check_resolving_entries(struct mpoa_client *client)
74387 struct timeval now;
74388 struct k_message msg;
74389
74390+ pax_track_stack();
74391+
74392 do_gettimeofday(&now);
74393
74394 read_lock_bh(&client->ingress_lock);
74395diff --git a/net/atm/proc.c b/net/atm/proc.c
74396index 0d020de..011c7bb 100644
74397--- a/net/atm/proc.c
74398+++ b/net/atm/proc.c
74399@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
74400 const struct k_atm_aal_stats *stats)
74401 {
74402 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
74403- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
74404- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
74405- atomic_read(&stats->rx_drop));
74406+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
74407+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
74408+ atomic_read_unchecked(&stats->rx_drop));
74409 }
74410
74411 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
74412diff --git a/net/atm/resources.c b/net/atm/resources.c
74413index 23f45ce..c748f1a 100644
74414--- a/net/atm/resources.c
74415+++ b/net/atm/resources.c
74416@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
74417 static void copy_aal_stats(struct k_atm_aal_stats *from,
74418 struct atm_aal_stats *to)
74419 {
74420-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
74421+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
74422 __AAL_STAT_ITEMS
74423 #undef __HANDLE_ITEM
74424 }
74425@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
74426 static void subtract_aal_stats(struct k_atm_aal_stats *from,
74427 struct atm_aal_stats *to)
74428 {
74429-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
74430+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
74431 __AAL_STAT_ITEMS
74432 #undef __HANDLE_ITEM
74433 }
74434diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
74435index db7aacf..991e539 100644
74436--- a/net/batman-adv/hard-interface.c
74437+++ b/net/batman-adv/hard-interface.c
74438@@ -347,8 +347,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
74439 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
74440 dev_add_pack(&hard_iface->batman_adv_ptype);
74441
74442- atomic_set(&hard_iface->seqno, 1);
74443- atomic_set(&hard_iface->frag_seqno, 1);
74444+ atomic_set_unchecked(&hard_iface->seqno, 1);
74445+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
74446 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
74447 hard_iface->net_dev->name);
74448
74449diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
74450index 0f32c81..82d1895 100644
74451--- a/net/batman-adv/routing.c
74452+++ b/net/batman-adv/routing.c
74453@@ -656,7 +656,7 @@ void receive_bat_packet(const struct ethhdr *ethhdr,
74454 return;
74455
74456 /* could be changed by schedule_own_packet() */
74457- if_incoming_seqno = atomic_read(&if_incoming->seqno);
74458+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
74459
74460 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
74461
74462diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
74463index 58d1447..2a66c8c 100644
74464--- a/net/batman-adv/send.c
74465+++ b/net/batman-adv/send.c
74466@@ -326,7 +326,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
74467
74468 /* change sequence number to network order */
74469 batman_packet->seqno =
74470- htonl((uint32_t)atomic_read(&hard_iface->seqno));
74471+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
74472
74473 batman_packet->ttvn = atomic_read(&bat_priv->ttvn);
74474 batman_packet->tt_crc = htons((uint16_t)atomic_read(&bat_priv->tt_crc));
74475@@ -343,7 +343,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
74476 else
74477 batman_packet->gw_flags = NO_FLAGS;
74478
74479- atomic_inc(&hard_iface->seqno);
74480+ atomic_inc_unchecked(&hard_iface->seqno);
74481
74482 slide_own_bcast_window(hard_iface);
74483 send_time = own_send_time(bat_priv);
74484diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
74485index 05dd351..2ecd19b 100644
74486--- a/net/batman-adv/soft-interface.c
74487+++ b/net/batman-adv/soft-interface.c
74488@@ -632,7 +632,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
74489
74490 /* set broadcast sequence number */
74491 bcast_packet->seqno =
74492- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
74493+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
74494
74495 add_bcast_packet_to_list(bat_priv, skb, 1);
74496
74497@@ -824,7 +824,7 @@ struct net_device *softif_create(const char *name)
74498 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
74499
74500 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
74501- atomic_set(&bat_priv->bcast_seqno, 1);
74502+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
74503 atomic_set(&bat_priv->ttvn, 0);
74504 atomic_set(&bat_priv->tt_local_changes, 0);
74505 atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
74506diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
74507index 51a0db7..b8a62be 100644
74508--- a/net/batman-adv/types.h
74509+++ b/net/batman-adv/types.h
74510@@ -38,8 +38,8 @@ struct hard_iface {
74511 int16_t if_num;
74512 char if_status;
74513 struct net_device *net_dev;
74514- atomic_t seqno;
74515- atomic_t frag_seqno;
74516+ atomic_unchecked_t seqno;
74517+ atomic_unchecked_t frag_seqno;
74518 unsigned char *packet_buff;
74519 int packet_len;
74520 struct kobject *hardif_obj;
74521@@ -153,7 +153,7 @@ struct bat_priv {
74522 atomic_t orig_interval; /* uint */
74523 atomic_t hop_penalty; /* uint */
74524 atomic_t log_level; /* uint */
74525- atomic_t bcast_seqno;
74526+ atomic_unchecked_t bcast_seqno;
74527 atomic_t bcast_queue_left;
74528 atomic_t batman_queue_left;
74529 atomic_t ttvn; /* tranlation table version number */
74530diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
74531index 32b125f..f1447e0 100644
74532--- a/net/batman-adv/unicast.c
74533+++ b/net/batman-adv/unicast.c
74534@@ -264,7 +264,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
74535 frag1->flags = UNI_FRAG_HEAD | large_tail;
74536 frag2->flags = large_tail;
74537
74538- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
74539+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
74540 frag1->seqno = htons(seqno - 1);
74541 frag2->seqno = htons(seqno);
74542
74543diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
74544index ea7f031..0615edc 100644
74545--- a/net/bluetooth/hci_conn.c
74546+++ b/net/bluetooth/hci_conn.c
74547@@ -218,7 +218,7 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
74548 cp.handle = cpu_to_le16(conn->handle);
74549 memcpy(cp.ltk, ltk, sizeof(cp.ltk));
74550 cp.ediv = ediv;
74551- memcpy(cp.rand, rand, sizeof(rand));
74552+ memcpy(cp.rand, rand, sizeof(cp.rand));
74553
74554 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
74555 }
74556@@ -234,7 +234,7 @@ void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
74557 memset(&cp, 0, sizeof(cp));
74558
74559 cp.handle = cpu_to_le16(conn->handle);
74560- memcpy(cp.ltk, ltk, sizeof(ltk));
74561+ memcpy(cp.ltk, ltk, sizeof(cp.ltk));
74562
74563 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
74564 }
74565diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
74566index e79ff75..215b57d 100644
74567--- a/net/bridge/br_multicast.c
74568+++ b/net/bridge/br_multicast.c
74569@@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
74570 nexthdr = ip6h->nexthdr;
74571 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
74572
74573- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
74574+ if (nexthdr != IPPROTO_ICMPV6)
74575 return 0;
74576
74577 /* Okay, we found ICMPv6 header */
74578diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
74579index 5864cc4..94cab18 100644
74580--- a/net/bridge/netfilter/ebtables.c
74581+++ b/net/bridge/netfilter/ebtables.c
74582@@ -1513,7 +1513,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
74583 tmp.valid_hooks = t->table->valid_hooks;
74584 }
74585 mutex_unlock(&ebt_mutex);
74586- if (copy_to_user(user, &tmp, *len) != 0){
74587+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
74588 BUGPRINT("c2u Didn't work\n");
74589 ret = -EFAULT;
74590 break;
74591@@ -1781,6 +1781,8 @@ static int compat_copy_everything_to_user(struct ebt_table *t,
74592 int ret;
74593 void __user *pos;
74594
74595+ pax_track_stack();
74596+
74597 memset(&tinfo, 0, sizeof(tinfo));
74598
74599 if (cmd == EBT_SO_GET_ENTRIES) {
74600diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
74601index a986280..13444a1 100644
74602--- a/net/caif/caif_socket.c
74603+++ b/net/caif/caif_socket.c
74604@@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
74605 #ifdef CONFIG_DEBUG_FS
74606 struct debug_fs_counter {
74607 atomic_t caif_nr_socks;
74608- atomic_t caif_sock_create;
74609- atomic_t num_connect_req;
74610- atomic_t num_connect_resp;
74611- atomic_t num_connect_fail_resp;
74612- atomic_t num_disconnect;
74613- atomic_t num_remote_shutdown_ind;
74614- atomic_t num_tx_flow_off_ind;
74615- atomic_t num_tx_flow_on_ind;
74616- atomic_t num_rx_flow_off;
74617- atomic_t num_rx_flow_on;
74618+ atomic_unchecked_t caif_sock_create;
74619+ atomic_unchecked_t num_connect_req;
74620+ atomic_unchecked_t num_connect_resp;
74621+ atomic_unchecked_t num_connect_fail_resp;
74622+ atomic_unchecked_t num_disconnect;
74623+ atomic_unchecked_t num_remote_shutdown_ind;
74624+ atomic_unchecked_t num_tx_flow_off_ind;
74625+ atomic_unchecked_t num_tx_flow_on_ind;
74626+ atomic_unchecked_t num_rx_flow_off;
74627+ atomic_unchecked_t num_rx_flow_on;
74628 };
74629 static struct debug_fs_counter cnt;
74630 #define dbfs_atomic_inc(v) atomic_inc_return(v)
74631+#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v)
74632 #define dbfs_atomic_dec(v) atomic_dec_return(v)
74633 #else
74634 #define dbfs_atomic_inc(v) 0
74635@@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74636 atomic_read(&cf_sk->sk.sk_rmem_alloc),
74637 sk_rcvbuf_lowwater(cf_sk));
74638 set_rx_flow_off(cf_sk);
74639- dbfs_atomic_inc(&cnt.num_rx_flow_off);
74640+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
74641 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
74642 }
74643
74644@@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74645 set_rx_flow_off(cf_sk);
74646 if (net_ratelimit())
74647 pr_debug("sending flow OFF due to rmem_schedule\n");
74648- dbfs_atomic_inc(&cnt.num_rx_flow_off);
74649+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
74650 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
74651 }
74652 skb->dev = NULL;
74653@@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer *layr,
74654 switch (flow) {
74655 case CAIF_CTRLCMD_FLOW_ON_IND:
74656 /* OK from modem to start sending again */
74657- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
74658+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
74659 set_tx_flow_on(cf_sk);
74660 cf_sk->sk.sk_state_change(&cf_sk->sk);
74661 break;
74662
74663 case CAIF_CTRLCMD_FLOW_OFF_IND:
74664 /* Modem asks us to shut up */
74665- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
74666+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
74667 set_tx_flow_off(cf_sk);
74668 cf_sk->sk.sk_state_change(&cf_sk->sk);
74669 break;
74670@@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74671 /* We're now connected */
74672 caif_client_register_refcnt(&cf_sk->layer,
74673 cfsk_hold, cfsk_put);
74674- dbfs_atomic_inc(&cnt.num_connect_resp);
74675+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
74676 cf_sk->sk.sk_state = CAIF_CONNECTED;
74677 set_tx_flow_on(cf_sk);
74678 cf_sk->sk.sk_state_change(&cf_sk->sk);
74679@@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74680
74681 case CAIF_CTRLCMD_INIT_FAIL_RSP:
74682 /* Connect request failed */
74683- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
74684+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
74685 cf_sk->sk.sk_err = ECONNREFUSED;
74686 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
74687 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
74688@@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74689
74690 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
74691 /* Modem has closed this connection, or device is down. */
74692- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
74693+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
74694 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
74695 cf_sk->sk.sk_err = ECONNRESET;
74696 set_rx_flow_on(cf_sk);
74697@@ -297,7 +298,7 @@ static void caif_check_flow_release(struct sock *sk)
74698 return;
74699
74700 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
74701- dbfs_atomic_inc(&cnt.num_rx_flow_on);
74702+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
74703 set_rx_flow_on(cf_sk);
74704 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
74705 }
74706@@ -854,7 +855,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
74707 /*ifindex = id of the interface.*/
74708 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
74709
74710- dbfs_atomic_inc(&cnt.num_connect_req);
74711+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
74712 cf_sk->layer.receive = caif_sktrecv_cb;
74713
74714 err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
74715@@ -943,7 +944,7 @@ static int caif_release(struct socket *sock)
74716 spin_unlock_bh(&sk->sk_receive_queue.lock);
74717 sock->sk = NULL;
74718
74719- dbfs_atomic_inc(&cnt.num_disconnect);
74720+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
74721
74722 WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
74723 if (cf_sk->debugfs_socket_dir != NULL)
74724@@ -1122,7 +1123,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
74725 cf_sk->conn_req.protocol = protocol;
74726 /* Increase the number of sockets created. */
74727 dbfs_atomic_inc(&cnt.caif_nr_socks);
74728- num = dbfs_atomic_inc(&cnt.caif_sock_create);
74729+ num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create);
74730 #ifdef CONFIG_DEBUG_FS
74731 if (!IS_ERR(debugfsdir)) {
74732
74733diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
74734index e22671b..6598ea0 100644
74735--- a/net/caif/cfctrl.c
74736+++ b/net/caif/cfctrl.c
74737@@ -9,6 +9,7 @@
74738 #include <linux/stddef.h>
74739 #include <linux/spinlock.h>
74740 #include <linux/slab.h>
74741+#include <linux/sched.h>
74742 #include <net/caif/caif_layer.h>
74743 #include <net/caif/cfpkt.h>
74744 #include <net/caif/cfctrl.h>
74745@@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void)
74746 dev_info.id = 0xff;
74747 memset(this, 0, sizeof(*this));
74748 cfsrvl_init(&this->serv, 0, &dev_info, false);
74749- atomic_set(&this->req_seq_no, 1);
74750- atomic_set(&this->rsp_seq_no, 1);
74751+ atomic_set_unchecked(&this->req_seq_no, 1);
74752+ atomic_set_unchecked(&this->rsp_seq_no, 1);
74753 this->serv.layer.receive = cfctrl_recv;
74754 sprintf(this->serv.layer.name, "ctrl");
74755 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
74756@@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl,
74757 struct cfctrl_request_info *req)
74758 {
74759 spin_lock_bh(&ctrl->info_list_lock);
74760- atomic_inc(&ctrl->req_seq_no);
74761- req->sequence_no = atomic_read(&ctrl->req_seq_no);
74762+ atomic_inc_unchecked(&ctrl->req_seq_no);
74763+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
74764 list_add_tail(&req->list, &ctrl->list);
74765 spin_unlock_bh(&ctrl->info_list_lock);
74766 }
74767@@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
74768 if (p != first)
74769 pr_warn("Requests are not received in order\n");
74770
74771- atomic_set(&ctrl->rsp_seq_no,
74772+ atomic_set_unchecked(&ctrl->rsp_seq_no,
74773 p->sequence_no);
74774 list_del(&p->list);
74775 goto out;
74776@@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
74777 struct cfctrl *cfctrl = container_obj(layer);
74778 struct cfctrl_request_info rsp, *req;
74779
74780+ pax_track_stack();
74781
74782 cfpkt_extr_head(pkt, &cmdrsp, 1);
74783 cmd = cmdrsp & CFCTRL_CMD_MASK;
74784diff --git a/net/compat.c b/net/compat.c
74785index c578d93..257fab7 100644
74786--- a/net/compat.c
74787+++ b/net/compat.c
74788@@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
74789 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
74790 __get_user(kmsg->msg_flags, &umsg->msg_flags))
74791 return -EFAULT;
74792- kmsg->msg_name = compat_ptr(tmp1);
74793- kmsg->msg_iov = compat_ptr(tmp2);
74794- kmsg->msg_control = compat_ptr(tmp3);
74795+ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
74796+ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
74797+ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
74798 return 0;
74799 }
74800
74801@@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74802
74803 if (kern_msg->msg_namelen) {
74804 if (mode == VERIFY_READ) {
74805- int err = move_addr_to_kernel(kern_msg->msg_name,
74806+ int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
74807 kern_msg->msg_namelen,
74808 kern_address);
74809 if (err < 0)
74810@@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74811 kern_msg->msg_name = NULL;
74812
74813 tot_len = iov_from_user_compat_to_kern(kern_iov,
74814- (struct compat_iovec __user *)kern_msg->msg_iov,
74815+ (struct compat_iovec __force_user *)kern_msg->msg_iov,
74816 kern_msg->msg_iovlen);
74817 if (tot_len >= 0)
74818 kern_msg->msg_iov = kern_iov;
74819@@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74820
74821 #define CMSG_COMPAT_FIRSTHDR(msg) \
74822 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
74823- (struct compat_cmsghdr __user *)((msg)->msg_control) : \
74824+ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
74825 (struct compat_cmsghdr __user *)NULL)
74826
74827 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
74828 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
74829 (ucmlen) <= (unsigned long) \
74830 ((mhdr)->msg_controllen - \
74831- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
74832+ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
74833
74834 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
74835 struct compat_cmsghdr __user *cmsg, int cmsg_len)
74836 {
74837 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
74838- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
74839+ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
74840 msg->msg_controllen)
74841 return NULL;
74842 return (struct compat_cmsghdr __user *)ptr;
74843@@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
74844 {
74845 struct compat_timeval ctv;
74846 struct compat_timespec cts[3];
74847- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
74848+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
74849 struct compat_cmsghdr cmhdr;
74850 int cmlen;
74851
74852@@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
74853
74854 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
74855 {
74856- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
74857+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
74858 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
74859 int fdnum = scm->fp->count;
74860 struct file **fp = scm->fp->fp;
74861@@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
74862 return -EFAULT;
74863 old_fs = get_fs();
74864 set_fs(KERNEL_DS);
74865- err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
74866+ err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
74867 set_fs(old_fs);
74868
74869 return err;
74870@@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
74871 len = sizeof(ktime);
74872 old_fs = get_fs();
74873 set_fs(KERNEL_DS);
74874- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
74875+ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
74876 set_fs(old_fs);
74877
74878 if (!err) {
74879@@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74880 case MCAST_JOIN_GROUP:
74881 case MCAST_LEAVE_GROUP:
74882 {
74883- struct compat_group_req __user *gr32 = (void *)optval;
74884+ struct compat_group_req __user *gr32 = (void __user *)optval;
74885 struct group_req __user *kgr =
74886 compat_alloc_user_space(sizeof(struct group_req));
74887 u32 interface;
74888@@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74889 case MCAST_BLOCK_SOURCE:
74890 case MCAST_UNBLOCK_SOURCE:
74891 {
74892- struct compat_group_source_req __user *gsr32 = (void *)optval;
74893+ struct compat_group_source_req __user *gsr32 = (void __user *)optval;
74894 struct group_source_req __user *kgsr = compat_alloc_user_space(
74895 sizeof(struct group_source_req));
74896 u32 interface;
74897@@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74898 }
74899 case MCAST_MSFILTER:
74900 {
74901- struct compat_group_filter __user *gf32 = (void *)optval;
74902+ struct compat_group_filter __user *gf32 = (void __user *)optval;
74903 struct group_filter __user *kgf;
74904 u32 interface, fmode, numsrc;
74905
74906@@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
74907 char __user *optval, int __user *optlen,
74908 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
74909 {
74910- struct compat_group_filter __user *gf32 = (void *)optval;
74911+ struct compat_group_filter __user *gf32 = (void __user *)optval;
74912 struct group_filter __user *kgf;
74913 int __user *koptlen;
74914 u32 interface, fmode, numsrc;
74915diff --git a/net/core/datagram.c b/net/core/datagram.c
74916index 18ac112..fe95ed9 100644
74917--- a/net/core/datagram.c
74918+++ b/net/core/datagram.c
74919@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
74920 }
74921
74922 kfree_skb(skb);
74923- atomic_inc(&sk->sk_drops);
74924+ atomic_inc_unchecked(&sk->sk_drops);
74925 sk_mem_reclaim_partial(sk);
74926
74927 return err;
74928diff --git a/net/core/dev.c b/net/core/dev.c
74929index ae5cf2d..2c950a1 100644
74930--- a/net/core/dev.c
74931+++ b/net/core/dev.c
74932@@ -1135,10 +1135,14 @@ void dev_load(struct net *net, const char *name)
74933 if (no_module && capable(CAP_NET_ADMIN))
74934 no_module = request_module("netdev-%s", name);
74935 if (no_module && capable(CAP_SYS_MODULE)) {
74936+#ifdef CONFIG_GRKERNSEC_MODHARDEN
74937+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
74938+#else
74939 if (!request_module("%s", name))
74940 pr_err("Loading kernel module for a network device "
74941 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
74942 "instead\n", name);
74943+#endif
74944 }
74945 }
74946 EXPORT_SYMBOL(dev_load);
74947@@ -1977,7 +1981,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
74948
74949 struct dev_gso_cb {
74950 void (*destructor)(struct sk_buff *skb);
74951-};
74952+} __no_const;
74953
74954 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
74955
74956@@ -2930,7 +2934,7 @@ int netif_rx_ni(struct sk_buff *skb)
74957 }
74958 EXPORT_SYMBOL(netif_rx_ni);
74959
74960-static void net_tx_action(struct softirq_action *h)
74961+static void net_tx_action(void)
74962 {
74963 struct softnet_data *sd = &__get_cpu_var(softnet_data);
74964
74965@@ -3779,7 +3783,7 @@ void netif_napi_del(struct napi_struct *napi)
74966 }
74967 EXPORT_SYMBOL(netif_napi_del);
74968
74969-static void net_rx_action(struct softirq_action *h)
74970+static void net_rx_action(void)
74971 {
74972 struct softnet_data *sd = &__get_cpu_var(softnet_data);
74973 unsigned long time_limit = jiffies + 2;
74974diff --git a/net/core/flow.c b/net/core/flow.c
74975index 555a456..de48421 100644
74976--- a/net/core/flow.c
74977+++ b/net/core/flow.c
74978@@ -61,7 +61,7 @@ struct flow_cache {
74979 struct timer_list rnd_timer;
74980 };
74981
74982-atomic_t flow_cache_genid = ATOMIC_INIT(0);
74983+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
74984 EXPORT_SYMBOL(flow_cache_genid);
74985 static struct flow_cache flow_cache_global;
74986 static struct kmem_cache *flow_cachep __read_mostly;
74987@@ -86,7 +86,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
74988
74989 static int flow_entry_valid(struct flow_cache_entry *fle)
74990 {
74991- if (atomic_read(&flow_cache_genid) != fle->genid)
74992+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
74993 return 0;
74994 if (fle->object && !fle->object->ops->check(fle->object))
74995 return 0;
74996@@ -259,7 +259,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
74997 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
74998 fcp->hash_count++;
74999 }
75000- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
75001+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
75002 flo = fle->object;
75003 if (!flo)
75004 goto ret_object;
75005@@ -280,7 +280,7 @@ nocache:
75006 }
75007 flo = resolver(net, key, family, dir, flo, ctx);
75008 if (fle) {
75009- fle->genid = atomic_read(&flow_cache_genid);
75010+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
75011 if (!IS_ERR(flo))
75012 fle->object = flo;
75013 else
75014diff --git a/net/core/iovec.c b/net/core/iovec.c
75015index c40f27e..7f49254 100644
75016--- a/net/core/iovec.c
75017+++ b/net/core/iovec.c
75018@@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
75019 if (m->msg_namelen) {
75020 if (mode == VERIFY_READ) {
75021 void __user *namep;
75022- namep = (void __user __force *) m->msg_name;
75023+ namep = (void __force_user *) m->msg_name;
75024 err = move_addr_to_kernel(namep, m->msg_namelen,
75025 address);
75026 if (err < 0)
75027@@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
75028 }
75029
75030 size = m->msg_iovlen * sizeof(struct iovec);
75031- if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
75032+ if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
75033 return -EFAULT;
75034
75035 m->msg_iov = iov;
75036diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
75037index 1683e5d..f3621f6 100644
75038--- a/net/core/net-sysfs.c
75039+++ b/net/core/net-sysfs.c
75040@@ -664,11 +664,14 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
75041 if (count) {
75042 int i;
75043
75044- if (count > 1<<30) {
75045- /* Enforce a limit to prevent overflow */
75046+ if (count > INT_MAX)
75047 return -EINVAL;
75048- }
75049 count = roundup_pow_of_two(count);
75050+ if (count > (ULONG_MAX - sizeof(struct rps_dev_flow_table))
75051+ / sizeof(struct rps_dev_flow)) {
75052+ /* Enforce a limit to prevent overflow */
75053+ return -EINVAL;
75054+ }
75055 table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));
75056 if (!table)
75057 return -ENOMEM;
75058diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
75059index 99d9e95..209bae2 100644
75060--- a/net/core/rtnetlink.c
75061+++ b/net/core/rtnetlink.c
75062@@ -57,7 +57,7 @@ struct rtnl_link {
75063 rtnl_doit_func doit;
75064 rtnl_dumpit_func dumpit;
75065 rtnl_calcit_func calcit;
75066-};
75067+} __no_const;
75068
75069 static DEFINE_MUTEX(rtnl_mutex);
75070 static u16 min_ifinfo_dump_size;
75071diff --git a/net/core/scm.c b/net/core/scm.c
75072index 811b53f..5d6c343 100644
75073--- a/net/core/scm.c
75074+++ b/net/core/scm.c
75075@@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send);
75076 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75077 {
75078 struct cmsghdr __user *cm
75079- = (__force struct cmsghdr __user *)msg->msg_control;
75080+ = (struct cmsghdr __force_user *)msg->msg_control;
75081 struct cmsghdr cmhdr;
75082 int cmlen = CMSG_LEN(len);
75083 int err;
75084@@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75085 err = -EFAULT;
75086 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
75087 goto out;
75088- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
75089+ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
75090 goto out;
75091 cmlen = CMSG_SPACE(len);
75092 if (msg->msg_controllen < cmlen)
75093@@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg);
75094 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75095 {
75096 struct cmsghdr __user *cm
75097- = (__force struct cmsghdr __user*)msg->msg_control;
75098+ = (struct cmsghdr __force_user *)msg->msg_control;
75099
75100 int fdmax = 0;
75101 int fdnum = scm->fp->count;
75102@@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75103 if (fdnum < fdmax)
75104 fdmax = fdnum;
75105
75106- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
75107+ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
75108 i++, cmfptr++)
75109 {
75110 int new_fd;
75111diff --git a/net/core/skbuff.c b/net/core/skbuff.c
75112index 387703f..035abcf 100644
75113--- a/net/core/skbuff.c
75114+++ b/net/core/skbuff.c
75115@@ -1650,6 +1650,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
75116 struct sock *sk = skb->sk;
75117 int ret = 0;
75118
75119+ pax_track_stack();
75120+
75121 if (splice_grow_spd(pipe, &spd))
75122 return -ENOMEM;
75123
75124diff --git a/net/core/sock.c b/net/core/sock.c
75125index 11d67b3..df26d4b 100644
75126--- a/net/core/sock.c
75127+++ b/net/core/sock.c
75128@@ -293,7 +293,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75129 */
75130 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
75131 (unsigned)sk->sk_rcvbuf) {
75132- atomic_inc(&sk->sk_drops);
75133+ atomic_inc_unchecked(&sk->sk_drops);
75134 trace_sock_rcvqueue_full(sk, skb);
75135 return -ENOMEM;
75136 }
75137@@ -303,7 +303,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75138 return err;
75139
75140 if (!sk_rmem_schedule(sk, skb->truesize)) {
75141- atomic_inc(&sk->sk_drops);
75142+ atomic_inc_unchecked(&sk->sk_drops);
75143 return -ENOBUFS;
75144 }
75145
75146@@ -323,7 +323,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75147 skb_dst_force(skb);
75148
75149 spin_lock_irqsave(&list->lock, flags);
75150- skb->dropcount = atomic_read(&sk->sk_drops);
75151+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
75152 __skb_queue_tail(list, skb);
75153 spin_unlock_irqrestore(&list->lock, flags);
75154
75155@@ -343,7 +343,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
75156 skb->dev = NULL;
75157
75158 if (sk_rcvqueues_full(sk, skb)) {
75159- atomic_inc(&sk->sk_drops);
75160+ atomic_inc_unchecked(&sk->sk_drops);
75161 goto discard_and_relse;
75162 }
75163 if (nested)
75164@@ -361,7 +361,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
75165 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
75166 } else if (sk_add_backlog(sk, skb)) {
75167 bh_unlock_sock(sk);
75168- atomic_inc(&sk->sk_drops);
75169+ atomic_inc_unchecked(&sk->sk_drops);
75170 goto discard_and_relse;
75171 }
75172
75173@@ -924,7 +924,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75174 if (len > sizeof(peercred))
75175 len = sizeof(peercred);
75176 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
75177- if (copy_to_user(optval, &peercred, len))
75178+ if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
75179 return -EFAULT;
75180 goto lenout;
75181 }
75182@@ -937,7 +937,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75183 return -ENOTCONN;
75184 if (lv < len)
75185 return -EINVAL;
75186- if (copy_to_user(optval, address, len))
75187+ if (len > sizeof(address) || copy_to_user(optval, address, len))
75188 return -EFAULT;
75189 goto lenout;
75190 }
75191@@ -970,7 +970,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75192
75193 if (len > lv)
75194 len = lv;
75195- if (copy_to_user(optval, &v, len))
75196+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
75197 return -EFAULT;
75198 lenout:
75199 if (put_user(len, optlen))
75200@@ -2029,7 +2029,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
75201 */
75202 smp_wmb();
75203 atomic_set(&sk->sk_refcnt, 1);
75204- atomic_set(&sk->sk_drops, 0);
75205+ atomic_set_unchecked(&sk->sk_drops, 0);
75206 }
75207 EXPORT_SYMBOL(sock_init_data);
75208
75209diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
75210index 02e75d1..9a57a7c 100644
75211--- a/net/decnet/sysctl_net_decnet.c
75212+++ b/net/decnet/sysctl_net_decnet.c
75213@@ -174,7 +174,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
75214
75215 if (len > *lenp) len = *lenp;
75216
75217- if (copy_to_user(buffer, addr, len))
75218+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
75219 return -EFAULT;
75220
75221 *lenp = len;
75222@@ -237,7 +237,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
75223
75224 if (len > *lenp) len = *lenp;
75225
75226- if (copy_to_user(buffer, devname, len))
75227+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
75228 return -EFAULT;
75229
75230 *lenp = len;
75231diff --git a/net/econet/Kconfig b/net/econet/Kconfig
75232index 39a2d29..f39c0fe 100644
75233--- a/net/econet/Kconfig
75234+++ b/net/econet/Kconfig
75235@@ -4,7 +4,7 @@
75236
75237 config ECONET
75238 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
75239- depends on EXPERIMENTAL && INET
75240+ depends on EXPERIMENTAL && INET && BROKEN
75241 ---help---
75242 Econet is a fairly old and slow networking protocol mainly used by
75243 Acorn computers to access file and print servers. It uses native
75244diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
75245index 92fc5f6..b790d91 100644
75246--- a/net/ipv4/fib_frontend.c
75247+++ b/net/ipv4/fib_frontend.c
75248@@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
75249 #ifdef CONFIG_IP_ROUTE_MULTIPATH
75250 fib_sync_up(dev);
75251 #endif
75252- atomic_inc(&net->ipv4.dev_addr_genid);
75253+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75254 rt_cache_flush(dev_net(dev), -1);
75255 break;
75256 case NETDEV_DOWN:
75257 fib_del_ifaddr(ifa, NULL);
75258- atomic_inc(&net->ipv4.dev_addr_genid);
75259+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75260 if (ifa->ifa_dev->ifa_list == NULL) {
75261 /* Last address was deleted from this interface.
75262 * Disable IP.
75263@@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
75264 #ifdef CONFIG_IP_ROUTE_MULTIPATH
75265 fib_sync_up(dev);
75266 #endif
75267- atomic_inc(&net->ipv4.dev_addr_genid);
75268+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75269 rt_cache_flush(dev_net(dev), -1);
75270 break;
75271 case NETDEV_DOWN:
75272diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
75273index 80106d8..232e898 100644
75274--- a/net/ipv4/fib_semantics.c
75275+++ b/net/ipv4/fib_semantics.c
75276@@ -699,7 +699,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh)
75277 nh->nh_saddr = inet_select_addr(nh->nh_dev,
75278 nh->nh_gw,
75279 nh->nh_parent->fib_scope);
75280- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
75281+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
75282
75283 return nh->nh_saddr;
75284 }
75285diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
75286index 389a2e6..ac1c1de 100644
75287--- a/net/ipv4/inet_diag.c
75288+++ b/net/ipv4/inet_diag.c
75289@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct sock *sk,
75290 r->idiag_retrans = 0;
75291
75292 r->id.idiag_if = sk->sk_bound_dev_if;
75293+
75294+#ifdef CONFIG_GRKERNSEC_HIDESYM
75295+ r->id.idiag_cookie[0] = 0;
75296+ r->id.idiag_cookie[1] = 0;
75297+#else
75298 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
75299 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
75300+#endif
75301
75302 r->id.idiag_sport = inet->inet_sport;
75303 r->id.idiag_dport = inet->inet_dport;
75304@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
75305 r->idiag_family = tw->tw_family;
75306 r->idiag_retrans = 0;
75307 r->id.idiag_if = tw->tw_bound_dev_if;
75308+
75309+#ifdef CONFIG_GRKERNSEC_HIDESYM
75310+ r->id.idiag_cookie[0] = 0;
75311+ r->id.idiag_cookie[1] = 0;
75312+#else
75313 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
75314 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
75315+#endif
75316+
75317 r->id.idiag_sport = tw->tw_sport;
75318 r->id.idiag_dport = tw->tw_dport;
75319 r->id.idiag_src[0] = tw->tw_rcv_saddr;
75320@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
75321 if (sk == NULL)
75322 goto unlock;
75323
75324+#ifndef CONFIG_GRKERNSEC_HIDESYM
75325 err = -ESTALE;
75326 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
75327 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
75328 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
75329 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
75330 goto out;
75331+#endif
75332
75333 err = -ENOMEM;
75334 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
75335@@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
75336 r->idiag_retrans = req->retrans;
75337
75338 r->id.idiag_if = sk->sk_bound_dev_if;
75339+
75340+#ifdef CONFIG_GRKERNSEC_HIDESYM
75341+ r->id.idiag_cookie[0] = 0;
75342+ r->id.idiag_cookie[1] = 0;
75343+#else
75344 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
75345 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
75346+#endif
75347
75348 tmo = req->expires - jiffies;
75349 if (tmo < 0)
75350diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
75351index 984ec65..97ac518 100644
75352--- a/net/ipv4/inet_hashtables.c
75353+++ b/net/ipv4/inet_hashtables.c
75354@@ -18,12 +18,15 @@
75355 #include <linux/sched.h>
75356 #include <linux/slab.h>
75357 #include <linux/wait.h>
75358+#include <linux/security.h>
75359
75360 #include <net/inet_connection_sock.h>
75361 #include <net/inet_hashtables.h>
75362 #include <net/secure_seq.h>
75363 #include <net/ip.h>
75364
75365+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
75366+
75367 /*
75368 * Allocate and initialize a new local port bind bucket.
75369 * The bindhash mutex for snum's hash chain must be held here.
75370@@ -530,6 +533,8 @@ ok:
75371 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
75372 spin_unlock(&head->lock);
75373
75374+ gr_update_task_in_ip_table(current, inet_sk(sk));
75375+
75376 if (tw) {
75377 inet_twsk_deschedule(tw, death_row);
75378 while (twrefcnt) {
75379diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
75380index 86f13c67..0bce60f 100644
75381--- a/net/ipv4/inetpeer.c
75382+++ b/net/ipv4/inetpeer.c
75383@@ -400,6 +400,8 @@ struct inet_peer *inet_getpeer(const struct inetpeer_addr *daddr, int create)
75384 unsigned int sequence;
75385 int invalidated, gccnt = 0;
75386
75387+ pax_track_stack();
75388+
75389 /* Attempt a lockless lookup first.
75390 * Because of a concurrent writer, we might not find an existing entry.
75391 */
75392@@ -436,8 +438,8 @@ relookup:
75393 if (p) {
75394 p->daddr = *daddr;
75395 atomic_set(&p->refcnt, 1);
75396- atomic_set(&p->rid, 0);
75397- atomic_set(&p->ip_id_count,
75398+ atomic_set_unchecked(&p->rid, 0);
75399+ atomic_set_unchecked(&p->ip_id_count,
75400 (daddr->family == AF_INET) ?
75401 secure_ip_id(daddr->addr.a4) :
75402 secure_ipv6_id(daddr->addr.a6));
75403diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
75404index 0e0ab98..2ed7dd5 100644
75405--- a/net/ipv4/ip_fragment.c
75406+++ b/net/ipv4/ip_fragment.c
75407@@ -316,7 +316,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
75408 return 0;
75409
75410 start = qp->rid;
75411- end = atomic_inc_return(&peer->rid);
75412+ end = atomic_inc_return_unchecked(&peer->rid);
75413 qp->rid = end;
75414
75415 rc = qp->q.fragments && (end - start) > max;
75416diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
75417index 8905e92..0b179fb 100644
75418--- a/net/ipv4/ip_sockglue.c
75419+++ b/net/ipv4/ip_sockglue.c
75420@@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75421 int val;
75422 int len;
75423
75424+ pax_track_stack();
75425+
75426 if (level != SOL_IP)
75427 return -EOPNOTSUPP;
75428
75429@@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75430 len = min_t(unsigned int, len, opt->optlen);
75431 if (put_user(len, optlen))
75432 return -EFAULT;
75433- if (copy_to_user(optval, opt->__data, len))
75434+ if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
75435+ copy_to_user(optval, opt->__data, len))
75436 return -EFAULT;
75437 return 0;
75438 }
75439@@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75440 if (sk->sk_type != SOCK_STREAM)
75441 return -ENOPROTOOPT;
75442
75443- msg.msg_control = optval;
75444+ msg.msg_control = (void __force_kernel *)optval;
75445 msg.msg_controllen = len;
75446 msg.msg_flags = flags;
75447
75448diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
75449index 472a8c4..6507cd4 100644
75450--- a/net/ipv4/ipconfig.c
75451+++ b/net/ipv4/ipconfig.c
75452@@ -313,7 +313,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
75453
75454 mm_segment_t oldfs = get_fs();
75455 set_fs(get_ds());
75456- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
75457+ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
75458 set_fs(oldfs);
75459 return res;
75460 }
75461@@ -324,7 +324,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
75462
75463 mm_segment_t oldfs = get_fs();
75464 set_fs(get_ds());
75465- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
75466+ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
75467 set_fs(oldfs);
75468 return res;
75469 }
75470@@ -335,7 +335,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
75471
75472 mm_segment_t oldfs = get_fs();
75473 set_fs(get_ds());
75474- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
75475+ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
75476 set_fs(oldfs);
75477 return res;
75478 }
75479diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
75480index 076b7c8..9c8d038 100644
75481--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
75482+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
75483@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
75484
75485 *len = 0;
75486
75487- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
75488+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
75489 if (*octets == NULL) {
75490 if (net_ratelimit())
75491 pr_notice("OOM in bsalg (%d)\n", __LINE__);
75492diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
75493index 39b403f..8e6a0a8 100644
75494--- a/net/ipv4/ping.c
75495+++ b/net/ipv4/ping.c
75496@@ -837,7 +837,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
75497 sk_rmem_alloc_get(sp),
75498 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75499 atomic_read(&sp->sk_refcnt), sp,
75500- atomic_read(&sp->sk_drops), len);
75501+ atomic_read_unchecked(&sp->sk_drops), len);
75502 }
75503
75504 static int ping_seq_show(struct seq_file *seq, void *v)
75505diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
75506index 61714bd..c9cee6d 100644
75507--- a/net/ipv4/raw.c
75508+++ b/net/ipv4/raw.c
75509@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
75510 int raw_rcv(struct sock *sk, struct sk_buff *skb)
75511 {
75512 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
75513- atomic_inc(&sk->sk_drops);
75514+ atomic_inc_unchecked(&sk->sk_drops);
75515 kfree_skb(skb);
75516 return NET_RX_DROP;
75517 }
75518@@ -737,16 +737,20 @@ static int raw_init(struct sock *sk)
75519
75520 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
75521 {
75522+ struct icmp_filter filter;
75523+
75524 if (optlen > sizeof(struct icmp_filter))
75525 optlen = sizeof(struct icmp_filter);
75526- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
75527+ if (copy_from_user(&filter, optval, optlen))
75528 return -EFAULT;
75529+ raw_sk(sk)->filter = filter;
75530 return 0;
75531 }
75532
75533 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
75534 {
75535 int len, ret = -EFAULT;
75536+ struct icmp_filter filter;
75537
75538 if (get_user(len, optlen))
75539 goto out;
75540@@ -756,8 +760,8 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
75541 if (len > sizeof(struct icmp_filter))
75542 len = sizeof(struct icmp_filter);
75543 ret = -EFAULT;
75544- if (put_user(len, optlen) ||
75545- copy_to_user(optval, &raw_sk(sk)->filter, len))
75546+ filter = raw_sk(sk)->filter;
75547+ if (put_user(len, optlen) || len > sizeof filter || copy_to_user(optval, &filter, len))
75548 goto out;
75549 ret = 0;
75550 out: return ret;
75551@@ -985,7 +989,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
75552 sk_wmem_alloc_get(sp),
75553 sk_rmem_alloc_get(sp),
75554 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75555- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
75556+ atomic_read(&sp->sk_refcnt),
75557+#ifdef CONFIG_GRKERNSEC_HIDESYM
75558+ NULL,
75559+#else
75560+ sp,
75561+#endif
75562+ atomic_read_unchecked(&sp->sk_drops));
75563 }
75564
75565 static int raw_seq_show(struct seq_file *seq, void *v)
75566diff --git a/net/ipv4/route.c b/net/ipv4/route.c
75567index 05ac666c..82384a7 100644
75568--- a/net/ipv4/route.c
75569+++ b/net/ipv4/route.c
75570@@ -309,7 +309,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
75571
75572 static inline int rt_genid(struct net *net)
75573 {
75574- return atomic_read(&net->ipv4.rt_genid);
75575+ return atomic_read_unchecked(&net->ipv4.rt_genid);
75576 }
75577
75578 #ifdef CONFIG_PROC_FS
75579@@ -842,7 +842,7 @@ static void rt_cache_invalidate(struct net *net)
75580 unsigned char shuffle;
75581
75582 get_random_bytes(&shuffle, sizeof(shuffle));
75583- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
75584+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
75585 redirect_genid++;
75586 }
75587
75588@@ -2920,7 +2920,7 @@ static int rt_fill_info(struct net *net,
75589 error = rt->dst.error;
75590 if (peer) {
75591 inet_peer_refcheck(rt->peer);
75592- id = atomic_read(&peer->ip_id_count) & 0xffff;
75593+ id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
75594 if (peer->tcp_ts_stamp) {
75595 ts = peer->tcp_ts;
75596 tsage = get_seconds() - peer->tcp_ts_stamp;
75597diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
75598index 46febca..98b73a4 100644
75599--- a/net/ipv4/tcp.c
75600+++ b/net/ipv4/tcp.c
75601@@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
75602 int val;
75603 int err = 0;
75604
75605+ pax_track_stack();
75606+
75607 /* These are data/string values, all the others are ints */
75608 switch (optname) {
75609 case TCP_CONGESTION: {
75610@@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
75611 struct tcp_sock *tp = tcp_sk(sk);
75612 int val, len;
75613
75614+ pax_track_stack();
75615+
75616 if (get_user(len, optlen))
75617 return -EFAULT;
75618
75619diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
75620index 7963e03..c44f5d0 100644
75621--- a/net/ipv4/tcp_ipv4.c
75622+++ b/net/ipv4/tcp_ipv4.c
75623@@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
75624 int sysctl_tcp_low_latency __read_mostly;
75625 EXPORT_SYMBOL(sysctl_tcp_low_latency);
75626
75627+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75628+extern int grsec_enable_blackhole;
75629+#endif
75630
75631 #ifdef CONFIG_TCP_MD5SIG
75632 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
75633@@ -1622,6 +1625,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
75634 return 0;
75635
75636 reset:
75637+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75638+ if (!grsec_enable_blackhole)
75639+#endif
75640 tcp_v4_send_reset(rsk, skb);
75641 discard:
75642 kfree_skb(skb);
75643@@ -1684,12 +1690,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
75644 TCP_SKB_CB(skb)->sacked = 0;
75645
75646 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
75647- if (!sk)
75648+ if (!sk) {
75649+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75650+ ret = 1;
75651+#endif
75652 goto no_tcp_socket;
75653-
75654+ }
75655 process:
75656- if (sk->sk_state == TCP_TIME_WAIT)
75657+ if (sk->sk_state == TCP_TIME_WAIT) {
75658+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75659+ ret = 2;
75660+#endif
75661 goto do_time_wait;
75662+ }
75663
75664 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
75665 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
75666@@ -1739,6 +1752,10 @@ no_tcp_socket:
75667 bad_packet:
75668 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
75669 } else {
75670+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75671+ if (!grsec_enable_blackhole || (ret == 1 &&
75672+ (skb->dev->flags & IFF_LOOPBACK)))
75673+#endif
75674 tcp_v4_send_reset(NULL, skb);
75675 }
75676
75677@@ -2403,7 +2420,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
75678 0, /* non standard timer */
75679 0, /* open_requests have no inode */
75680 atomic_read(&sk->sk_refcnt),
75681+#ifdef CONFIG_GRKERNSEC_HIDESYM
75682+ NULL,
75683+#else
75684 req,
75685+#endif
75686 len);
75687 }
75688
75689@@ -2453,7 +2474,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
75690 sock_i_uid(sk),
75691 icsk->icsk_probes_out,
75692 sock_i_ino(sk),
75693- atomic_read(&sk->sk_refcnt), sk,
75694+ atomic_read(&sk->sk_refcnt),
75695+#ifdef CONFIG_GRKERNSEC_HIDESYM
75696+ NULL,
75697+#else
75698+ sk,
75699+#endif
75700 jiffies_to_clock_t(icsk->icsk_rto),
75701 jiffies_to_clock_t(icsk->icsk_ack.ato),
75702 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
75703@@ -2481,7 +2507,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
75704 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
75705 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
75706 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
75707- atomic_read(&tw->tw_refcnt), tw, len);
75708+ atomic_read(&tw->tw_refcnt),
75709+#ifdef CONFIG_GRKERNSEC_HIDESYM
75710+ NULL,
75711+#else
75712+ tw,
75713+#endif
75714+ len);
75715 }
75716
75717 #define TMPSZ 150
75718diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
75719index 0ce3d06..e182e59 100644
75720--- a/net/ipv4/tcp_minisocks.c
75721+++ b/net/ipv4/tcp_minisocks.c
75722@@ -27,6 +27,10 @@
75723 #include <net/inet_common.h>
75724 #include <net/xfrm.h>
75725
75726+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75727+extern int grsec_enable_blackhole;
75728+#endif
75729+
75730 int sysctl_tcp_syncookies __read_mostly = 1;
75731 EXPORT_SYMBOL(sysctl_tcp_syncookies);
75732
75733@@ -750,6 +754,10 @@ listen_overflow:
75734
75735 embryonic_reset:
75736 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
75737+
75738+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75739+ if (!grsec_enable_blackhole)
75740+#endif
75741 if (!(flg & TCP_FLAG_RST))
75742 req->rsk_ops->send_reset(sk, skb);
75743
75744diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
75745index 882e0b0..2eba47f 100644
75746--- a/net/ipv4/tcp_output.c
75747+++ b/net/ipv4/tcp_output.c
75748@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
75749 int mss;
75750 int s_data_desired = 0;
75751
75752+ pax_track_stack();
75753+
75754 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
75755 s_data_desired = cvp->s_data_desired;
75756 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
75757diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
75758index 85ee7eb..53277ab 100644
75759--- a/net/ipv4/tcp_probe.c
75760+++ b/net/ipv4/tcp_probe.c
75761@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
75762 if (cnt + width >= len)
75763 break;
75764
75765- if (copy_to_user(buf + cnt, tbuf, width))
75766+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
75767 return -EFAULT;
75768 cnt += width;
75769 }
75770diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
75771index ecd44b0..b32fba6 100644
75772--- a/net/ipv4/tcp_timer.c
75773+++ b/net/ipv4/tcp_timer.c
75774@@ -22,6 +22,10 @@
75775 #include <linux/gfp.h>
75776 #include <net/tcp.h>
75777
75778+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75779+extern int grsec_lastack_retries;
75780+#endif
75781+
75782 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
75783 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
75784 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
75785@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock *sk)
75786 }
75787 }
75788
75789+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75790+ if ((sk->sk_state == TCP_LAST_ACK) &&
75791+ (grsec_lastack_retries > 0) &&
75792+ (grsec_lastack_retries < retry_until))
75793+ retry_until = grsec_lastack_retries;
75794+#endif
75795+
75796 if (retransmits_timed_out(sk, retry_until,
75797 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
75798 /* Has it gone just too far? */
75799diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
75800index 1b5a193..bd354b0 100644
75801--- a/net/ipv4/udp.c
75802+++ b/net/ipv4/udp.c
75803@@ -86,6 +86,7 @@
75804 #include <linux/types.h>
75805 #include <linux/fcntl.h>
75806 #include <linux/module.h>
75807+#include <linux/security.h>
75808 #include <linux/socket.h>
75809 #include <linux/sockios.h>
75810 #include <linux/igmp.h>
75811@@ -108,6 +109,10 @@
75812 #include <trace/events/udp.h>
75813 #include "udp_impl.h"
75814
75815+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75816+extern int grsec_enable_blackhole;
75817+#endif
75818+
75819 struct udp_table udp_table __read_mostly;
75820 EXPORT_SYMBOL(udp_table);
75821
75822@@ -565,6 +570,9 @@ found:
75823 return s;
75824 }
75825
75826+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
75827+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
75828+
75829 /*
75830 * This routine is called by the ICMP module when it gets some
75831 * sort of error condition. If err < 0 then the socket should
75832@@ -856,9 +864,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
75833 dport = usin->sin_port;
75834 if (dport == 0)
75835 return -EINVAL;
75836+
75837+ err = gr_search_udp_sendmsg(sk, usin);
75838+ if (err)
75839+ return err;
75840 } else {
75841 if (sk->sk_state != TCP_ESTABLISHED)
75842 return -EDESTADDRREQ;
75843+
75844+ err = gr_search_udp_sendmsg(sk, NULL);
75845+ if (err)
75846+ return err;
75847+
75848 daddr = inet->inet_daddr;
75849 dport = inet->inet_dport;
75850 /* Open fast path for connected socket.
75851@@ -1099,7 +1116,7 @@ static unsigned int first_packet_length(struct sock *sk)
75852 udp_lib_checksum_complete(skb)) {
75853 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
75854 IS_UDPLITE(sk));
75855- atomic_inc(&sk->sk_drops);
75856+ atomic_inc_unchecked(&sk->sk_drops);
75857 __skb_unlink(skb, rcvq);
75858 __skb_queue_tail(&list_kill, skb);
75859 }
75860@@ -1185,6 +1202,10 @@ try_again:
75861 if (!skb)
75862 goto out;
75863
75864+ err = gr_search_udp_recvmsg(sk, skb);
75865+ if (err)
75866+ goto out_free;
75867+
75868 ulen = skb->len - sizeof(struct udphdr);
75869 if (len > ulen)
75870 len = ulen;
75871@@ -1485,7 +1506,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75872
75873 drop:
75874 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
75875- atomic_inc(&sk->sk_drops);
75876+ atomic_inc_unchecked(&sk->sk_drops);
75877 kfree_skb(skb);
75878 return -1;
75879 }
75880@@ -1504,7 +1525,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
75881 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
75882
75883 if (!skb1) {
75884- atomic_inc(&sk->sk_drops);
75885+ atomic_inc_unchecked(&sk->sk_drops);
75886 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
75887 IS_UDPLITE(sk));
75888 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
75889@@ -1673,6 +1694,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
75890 goto csum_error;
75891
75892 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
75893+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75894+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
75895+#endif
75896 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
75897
75898 /*
75899@@ -2100,8 +2124,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
75900 sk_wmem_alloc_get(sp),
75901 sk_rmem_alloc_get(sp),
75902 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75903- atomic_read(&sp->sk_refcnt), sp,
75904- atomic_read(&sp->sk_drops), len);
75905+ atomic_read(&sp->sk_refcnt),
75906+#ifdef CONFIG_GRKERNSEC_HIDESYM
75907+ NULL,
75908+#else
75909+ sp,
75910+#endif
75911+ atomic_read_unchecked(&sp->sk_drops), len);
75912 }
75913
75914 int udp4_seq_show(struct seq_file *seq, void *v)
75915diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
75916index 12368c5..fbf899f 100644
75917--- a/net/ipv6/addrconf.c
75918+++ b/net/ipv6/addrconf.c
75919@@ -2083,7 +2083,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
75920 p.iph.ihl = 5;
75921 p.iph.protocol = IPPROTO_IPV6;
75922 p.iph.ttl = 64;
75923- ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
75924+ ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
75925
75926 if (ops->ndo_do_ioctl) {
75927 mm_segment_t oldfs = get_fs();
75928diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
75929index 8a58e8c..8b5e631 100644
75930--- a/net/ipv6/inet6_connection_sock.c
75931+++ b/net/ipv6/inet6_connection_sock.c
75932@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
75933 #ifdef CONFIG_XFRM
75934 {
75935 struct rt6_info *rt = (struct rt6_info *)dst;
75936- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
75937+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
75938 }
75939 #endif
75940 }
75941@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
75942 #ifdef CONFIG_XFRM
75943 if (dst) {
75944 struct rt6_info *rt = (struct rt6_info *)dst;
75945- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
75946+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
75947 __sk_dst_reset(sk);
75948 dst = NULL;
75949 }
75950diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
75951index 2fbda5f..26ed683 100644
75952--- a/net/ipv6/ipv6_sockglue.c
75953+++ b/net/ipv6/ipv6_sockglue.c
75954@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
75955 int val, valbool;
75956 int retv = -ENOPROTOOPT;
75957
75958+ pax_track_stack();
75959+
75960 if (optval == NULL)
75961 val=0;
75962 else {
75963@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
75964 int len;
75965 int val;
75966
75967+ pax_track_stack();
75968+
75969 if (ip6_mroute_opt(optname))
75970 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
75971
75972@@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
75973 if (sk->sk_type != SOCK_STREAM)
75974 return -ENOPROTOOPT;
75975
75976- msg.msg_control = optval;
75977+ msg.msg_control = (void __force_kernel *)optval;
75978 msg.msg_controllen = len;
75979 msg.msg_flags = flags;
75980
75981diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
75982index 343852e..c92bd15 100644
75983--- a/net/ipv6/raw.c
75984+++ b/net/ipv6/raw.c
75985@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
75986 {
75987 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
75988 skb_checksum_complete(skb)) {
75989- atomic_inc(&sk->sk_drops);
75990+ atomic_inc_unchecked(&sk->sk_drops);
75991 kfree_skb(skb);
75992 return NET_RX_DROP;
75993 }
75994@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
75995 struct raw6_sock *rp = raw6_sk(sk);
75996
75997 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
75998- atomic_inc(&sk->sk_drops);
75999+ atomic_inc_unchecked(&sk->sk_drops);
76000 kfree_skb(skb);
76001 return NET_RX_DROP;
76002 }
76003@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
76004
76005 if (inet->hdrincl) {
76006 if (skb_checksum_complete(skb)) {
76007- atomic_inc(&sk->sk_drops);
76008+ atomic_inc_unchecked(&sk->sk_drops);
76009 kfree_skb(skb);
76010 return NET_RX_DROP;
76011 }
76012@@ -601,7 +601,7 @@ out:
76013 return err;
76014 }
76015
76016-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76017+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76018 struct flowi6 *fl6, struct dst_entry **dstp,
76019 unsigned int flags)
76020 {
76021@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
76022 u16 proto;
76023 int err;
76024
76025+ pax_track_stack();
76026+
76027 /* Rough check on arithmetic overflow,
76028 better check is made in ip6_append_data().
76029 */
76030@@ -909,12 +911,15 @@ do_confirm:
76031 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76032 char __user *optval, int optlen)
76033 {
76034+ struct icmp6_filter filter;
76035+
76036 switch (optname) {
76037 case ICMPV6_FILTER:
76038 if (optlen > sizeof(struct icmp6_filter))
76039 optlen = sizeof(struct icmp6_filter);
76040- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76041+ if (copy_from_user(&filter, optval, optlen))
76042 return -EFAULT;
76043+ raw6_sk(sk)->filter = filter;
76044 return 0;
76045 default:
76046 return -ENOPROTOOPT;
76047@@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76048 char __user *optval, int __user *optlen)
76049 {
76050 int len;
76051+ struct icmp6_filter filter;
76052
76053 switch (optname) {
76054 case ICMPV6_FILTER:
76055@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76056 len = sizeof(struct icmp6_filter);
76057 if (put_user(len, optlen))
76058 return -EFAULT;
76059- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76060+ filter = raw6_sk(sk)->filter;
76061+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
76062 return -EFAULT;
76063 return 0;
76064 default:
76065@@ -1245,7 +1252,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
76066 0, 0L, 0,
76067 sock_i_uid(sp), 0,
76068 sock_i_ino(sp),
76069- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76070+ atomic_read(&sp->sk_refcnt),
76071+#ifdef CONFIG_GRKERNSEC_HIDESYM
76072+ NULL,
76073+#else
76074+ sp,
76075+#endif
76076+ atomic_read_unchecked(&sp->sk_drops));
76077 }
76078
76079 static int raw6_seq_show(struct seq_file *seq, void *v)
76080diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
76081index 7b8fc57..c6185da 100644
76082--- a/net/ipv6/tcp_ipv6.c
76083+++ b/net/ipv6/tcp_ipv6.c
76084@@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
76085 }
76086 #endif
76087
76088+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76089+extern int grsec_enable_blackhole;
76090+#endif
76091+
76092 static void tcp_v6_hash(struct sock *sk)
76093 {
76094 if (sk->sk_state != TCP_CLOSE) {
76095@@ -1647,6 +1651,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
76096 return 0;
76097
76098 reset:
76099+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76100+ if (!grsec_enable_blackhole)
76101+#endif
76102 tcp_v6_send_reset(sk, skb);
76103 discard:
76104 if (opt_skb)
76105@@ -1726,12 +1733,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
76106 TCP_SKB_CB(skb)->sacked = 0;
76107
76108 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76109- if (!sk)
76110+ if (!sk) {
76111+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76112+ ret = 1;
76113+#endif
76114 goto no_tcp_socket;
76115+ }
76116
76117 process:
76118- if (sk->sk_state == TCP_TIME_WAIT)
76119+ if (sk->sk_state == TCP_TIME_WAIT) {
76120+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76121+ ret = 2;
76122+#endif
76123 goto do_time_wait;
76124+ }
76125
76126 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
76127 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76128@@ -1779,6 +1794,10 @@ no_tcp_socket:
76129 bad_packet:
76130 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76131 } else {
76132+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76133+ if (!grsec_enable_blackhole || (ret == 1 &&
76134+ (skb->dev->flags & IFF_LOOPBACK)))
76135+#endif
76136 tcp_v6_send_reset(NULL, skb);
76137 }
76138
76139@@ -2039,7 +2058,13 @@ static void get_openreq6(struct seq_file *seq,
76140 uid,
76141 0, /* non standard timer */
76142 0, /* open_requests have no inode */
76143- 0, req);
76144+ 0,
76145+#ifdef CONFIG_GRKERNSEC_HIDESYM
76146+ NULL
76147+#else
76148+ req
76149+#endif
76150+ );
76151 }
76152
76153 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76154@@ -2089,7 +2114,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76155 sock_i_uid(sp),
76156 icsk->icsk_probes_out,
76157 sock_i_ino(sp),
76158- atomic_read(&sp->sk_refcnt), sp,
76159+ atomic_read(&sp->sk_refcnt),
76160+#ifdef CONFIG_GRKERNSEC_HIDESYM
76161+ NULL,
76162+#else
76163+ sp,
76164+#endif
76165 jiffies_to_clock_t(icsk->icsk_rto),
76166 jiffies_to_clock_t(icsk->icsk_ack.ato),
76167 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
76168@@ -2124,7 +2154,13 @@ static void get_timewait6_sock(struct seq_file *seq,
76169 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76170 tw->tw_substate, 0, 0,
76171 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76172- atomic_read(&tw->tw_refcnt), tw);
76173+ atomic_read(&tw->tw_refcnt),
76174+#ifdef CONFIG_GRKERNSEC_HIDESYM
76175+ NULL
76176+#else
76177+ tw
76178+#endif
76179+ );
76180 }
76181
76182 static int tcp6_seq_show(struct seq_file *seq, void *v)
76183diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
76184index bb95e8e..ae0ee80 100644
76185--- a/net/ipv6/udp.c
76186+++ b/net/ipv6/udp.c
76187@@ -50,6 +50,10 @@
76188 #include <linux/seq_file.h>
76189 #include "udp_impl.h"
76190
76191+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76192+extern int grsec_enable_blackhole;
76193+#endif
76194+
76195 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76196 {
76197 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
76198@@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
76199
76200 return 0;
76201 drop:
76202- atomic_inc(&sk->sk_drops);
76203+ atomic_inc_unchecked(&sk->sk_drops);
76204 drop_no_sk_drops_inc:
76205 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76206 kfree_skb(skb);
76207@@ -624,7 +628,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
76208 continue;
76209 }
76210 drop:
76211- atomic_inc(&sk->sk_drops);
76212+ atomic_inc_unchecked(&sk->sk_drops);
76213 UDP6_INC_STATS_BH(sock_net(sk),
76214 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
76215 UDP6_INC_STATS_BH(sock_net(sk),
76216@@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76217 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76218 proto == IPPROTO_UDPLITE);
76219
76220+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76221+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76222+#endif
76223 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
76224
76225 kfree_skb(skb);
76226@@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76227 if (!sock_owned_by_user(sk))
76228 udpv6_queue_rcv_skb(sk, skb);
76229 else if (sk_add_backlog(sk, skb)) {
76230- atomic_inc(&sk->sk_drops);
76231+ atomic_inc_unchecked(&sk->sk_drops);
76232 bh_unlock_sock(sk);
76233 sock_put(sk);
76234 goto discard;
76235@@ -1406,8 +1413,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
76236 0, 0L, 0,
76237 sock_i_uid(sp), 0,
76238 sock_i_ino(sp),
76239- atomic_read(&sp->sk_refcnt), sp,
76240- atomic_read(&sp->sk_drops));
76241+ atomic_read(&sp->sk_refcnt),
76242+#ifdef CONFIG_GRKERNSEC_HIDESYM
76243+ NULL,
76244+#else
76245+ sp,
76246+#endif
76247+ atomic_read_unchecked(&sp->sk_drops));
76248 }
76249
76250 int udp6_seq_show(struct seq_file *seq, void *v)
76251diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
76252index b3cc8b3..baa02d0 100644
76253--- a/net/irda/ircomm/ircomm_tty.c
76254+++ b/net/irda/ircomm/ircomm_tty.c
76255@@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76256 add_wait_queue(&self->open_wait, &wait);
76257
76258 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
76259- __FILE__,__LINE__, tty->driver->name, self->open_count );
76260+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76261
76262 /* As far as I can see, we protect open_count - Jean II */
76263 spin_lock_irqsave(&self->spinlock, flags);
76264 if (!tty_hung_up_p(filp)) {
76265 extra_count = 1;
76266- self->open_count--;
76267+ local_dec(&self->open_count);
76268 }
76269 spin_unlock_irqrestore(&self->spinlock, flags);
76270- self->blocked_open++;
76271+ local_inc(&self->blocked_open);
76272
76273 while (1) {
76274 if (tty->termios->c_cflag & CBAUD) {
76275@@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76276 }
76277
76278 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
76279- __FILE__,__LINE__, tty->driver->name, self->open_count );
76280+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76281
76282 schedule();
76283 }
76284@@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76285 if (extra_count) {
76286 /* ++ is not atomic, so this should be protected - Jean II */
76287 spin_lock_irqsave(&self->spinlock, flags);
76288- self->open_count++;
76289+ local_inc(&self->open_count);
76290 spin_unlock_irqrestore(&self->spinlock, flags);
76291 }
76292- self->blocked_open--;
76293+ local_dec(&self->blocked_open);
76294
76295 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
76296- __FILE__,__LINE__, tty->driver->name, self->open_count);
76297+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
76298
76299 if (!retval)
76300 self->flags |= ASYNC_NORMAL_ACTIVE;
76301@@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
76302 }
76303 /* ++ is not atomic, so this should be protected - Jean II */
76304 spin_lock_irqsave(&self->spinlock, flags);
76305- self->open_count++;
76306+ local_inc(&self->open_count);
76307
76308 tty->driver_data = self;
76309 self->tty = tty;
76310 spin_unlock_irqrestore(&self->spinlock, flags);
76311
76312 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
76313- self->line, self->open_count);
76314+ self->line, local_read(&self->open_count));
76315
76316 /* Not really used by us, but lets do it anyway */
76317 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
76318@@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76319 return;
76320 }
76321
76322- if ((tty->count == 1) && (self->open_count != 1)) {
76323+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
76324 /*
76325 * Uh, oh. tty->count is 1, which means that the tty
76326 * structure will be freed. state->count should always
76327@@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76328 */
76329 IRDA_DEBUG(0, "%s(), bad serial port count; "
76330 "tty->count is 1, state->count is %d\n", __func__ ,
76331- self->open_count);
76332- self->open_count = 1;
76333+ local_read(&self->open_count));
76334+ local_set(&self->open_count, 1);
76335 }
76336
76337- if (--self->open_count < 0) {
76338+ if (local_dec_return(&self->open_count) < 0) {
76339 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
76340- __func__, self->line, self->open_count);
76341- self->open_count = 0;
76342+ __func__, self->line, local_read(&self->open_count));
76343+ local_set(&self->open_count, 0);
76344 }
76345- if (self->open_count) {
76346+ if (local_read(&self->open_count)) {
76347 spin_unlock_irqrestore(&self->spinlock, flags);
76348
76349 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
76350@@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76351 tty->closing = 0;
76352 self->tty = NULL;
76353
76354- if (self->blocked_open) {
76355+ if (local_read(&self->blocked_open)) {
76356 if (self->close_delay)
76357 schedule_timeout_interruptible(self->close_delay);
76358 wake_up_interruptible(&self->open_wait);
76359@@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
76360 spin_lock_irqsave(&self->spinlock, flags);
76361 self->flags &= ~ASYNC_NORMAL_ACTIVE;
76362 self->tty = NULL;
76363- self->open_count = 0;
76364+ local_set(&self->open_count, 0);
76365 spin_unlock_irqrestore(&self->spinlock, flags);
76366
76367 wake_up_interruptible(&self->open_wait);
76368@@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
76369 seq_putc(m, '\n');
76370
76371 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
76372- seq_printf(m, "Open count: %d\n", self->open_count);
76373+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
76374 seq_printf(m, "Max data size: %d\n", self->max_data_size);
76375 seq_printf(m, "Max header size: %d\n", self->max_header_size);
76376
76377diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
76378index e2013e4..edfc1e3 100644
76379--- a/net/iucv/af_iucv.c
76380+++ b/net/iucv/af_iucv.c
76381@@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct sock *sk)
76382
76383 write_lock_bh(&iucv_sk_list.lock);
76384
76385- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
76386+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
76387 while (__iucv_get_sock_by_name(name)) {
76388 sprintf(name, "%08x",
76389- atomic_inc_return(&iucv_sk_list.autobind_name));
76390+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
76391 }
76392
76393 write_unlock_bh(&iucv_sk_list.lock);
76394diff --git a/net/key/af_key.c b/net/key/af_key.c
76395index 1e733e9..c84de2f 100644
76396--- a/net/key/af_key.c
76397+++ b/net/key/af_key.c
76398@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
76399 struct xfrm_migrate m[XFRM_MAX_DEPTH];
76400 struct xfrm_kmaddress k;
76401
76402+ pax_track_stack();
76403+
76404 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
76405 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
76406 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
76407@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
76408 static u32 get_acqseq(void)
76409 {
76410 u32 res;
76411- static atomic_t acqseq;
76412+ static atomic_unchecked_t acqseq;
76413
76414 do {
76415- res = atomic_inc_return(&acqseq);
76416+ res = atomic_inc_return_unchecked(&acqseq);
76417 } while (!res);
76418 return res;
76419 }
76420diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
76421index 956b7e4..f01d328 100644
76422--- a/net/lapb/lapb_iface.c
76423+++ b/net/lapb/lapb_iface.c
76424@@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
76425 goto out;
76426
76427 lapb->dev = dev;
76428- lapb->callbacks = *callbacks;
76429+ lapb->callbacks = callbacks;
76430
76431 __lapb_insert_cb(lapb);
76432
76433@@ -380,32 +380,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
76434
76435 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
76436 {
76437- if (lapb->callbacks.connect_confirmation)
76438- lapb->callbacks.connect_confirmation(lapb->dev, reason);
76439+ if (lapb->callbacks->connect_confirmation)
76440+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
76441 }
76442
76443 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
76444 {
76445- if (lapb->callbacks.connect_indication)
76446- lapb->callbacks.connect_indication(lapb->dev, reason);
76447+ if (lapb->callbacks->connect_indication)
76448+ lapb->callbacks->connect_indication(lapb->dev, reason);
76449 }
76450
76451 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
76452 {
76453- if (lapb->callbacks.disconnect_confirmation)
76454- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
76455+ if (lapb->callbacks->disconnect_confirmation)
76456+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
76457 }
76458
76459 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
76460 {
76461- if (lapb->callbacks.disconnect_indication)
76462- lapb->callbacks.disconnect_indication(lapb->dev, reason);
76463+ if (lapb->callbacks->disconnect_indication)
76464+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
76465 }
76466
76467 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
76468 {
76469- if (lapb->callbacks.data_indication)
76470- return lapb->callbacks.data_indication(lapb->dev, skb);
76471+ if (lapb->callbacks->data_indication)
76472+ return lapb->callbacks->data_indication(lapb->dev, skb);
76473
76474 kfree_skb(skb);
76475 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
76476@@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
76477 {
76478 int used = 0;
76479
76480- if (lapb->callbacks.data_transmit) {
76481- lapb->callbacks.data_transmit(lapb->dev, skb);
76482+ if (lapb->callbacks->data_transmit) {
76483+ lapb->callbacks->data_transmit(lapb->dev, skb);
76484 used = 1;
76485 }
76486
76487diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
76488index a01d213..6a1f1ab 100644
76489--- a/net/mac80211/debugfs_sta.c
76490+++ b/net/mac80211/debugfs_sta.c
76491@@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
76492 struct tid_ampdu_rx *tid_rx;
76493 struct tid_ampdu_tx *tid_tx;
76494
76495+ pax_track_stack();
76496+
76497 rcu_read_lock();
76498
76499 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
76500@@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
76501 struct sta_info *sta = file->private_data;
76502 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
76503
76504+ pax_track_stack();
76505+
76506 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
76507 htc->ht_supported ? "" : "not ");
76508 if (htc->ht_supported) {
76509diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
76510index 9fab144..7f0fc14 100644
76511--- a/net/mac80211/ieee80211_i.h
76512+++ b/net/mac80211/ieee80211_i.h
76513@@ -27,6 +27,7 @@
76514 #include <net/ieee80211_radiotap.h>
76515 #include <net/cfg80211.h>
76516 #include <net/mac80211.h>
76517+#include <asm/local.h>
76518 #include "key.h"
76519 #include "sta_info.h"
76520
76521@@ -754,7 +755,7 @@ struct ieee80211_local {
76522 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
76523 spinlock_t queue_stop_reason_lock;
76524
76525- int open_count;
76526+ local_t open_count;
76527 int monitors, cooked_mntrs;
76528 /* number of interfaces with corresponding FIF_ flags */
76529 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
76530diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
76531index 556e7e6..120dcaf 100644
76532--- a/net/mac80211/iface.c
76533+++ b/net/mac80211/iface.c
76534@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76535 break;
76536 }
76537
76538- if (local->open_count == 0) {
76539+ if (local_read(&local->open_count) == 0) {
76540 res = drv_start(local);
76541 if (res)
76542 goto err_del_bss;
76543@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76544 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
76545
76546 if (!is_valid_ether_addr(dev->dev_addr)) {
76547- if (!local->open_count)
76548+ if (!local_read(&local->open_count))
76549 drv_stop(local);
76550 return -EADDRNOTAVAIL;
76551 }
76552@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76553 mutex_unlock(&local->mtx);
76554
76555 if (coming_up)
76556- local->open_count++;
76557+ local_inc(&local->open_count);
76558
76559 if (hw_reconf_flags) {
76560 ieee80211_hw_config(local, hw_reconf_flags);
76561@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76562 err_del_interface:
76563 drv_remove_interface(local, &sdata->vif);
76564 err_stop:
76565- if (!local->open_count)
76566+ if (!local_read(&local->open_count))
76567 drv_stop(local);
76568 err_del_bss:
76569 sdata->bss = NULL;
76570@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
76571 }
76572
76573 if (going_down)
76574- local->open_count--;
76575+ local_dec(&local->open_count);
76576
76577 switch (sdata->vif.type) {
76578 case NL80211_IFTYPE_AP_VLAN:
76579@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
76580
76581 ieee80211_recalc_ps(local, -1);
76582
76583- if (local->open_count == 0) {
76584+ if (local_read(&local->open_count) == 0) {
76585 if (local->ops->napi_poll)
76586 napi_disable(&local->napi);
76587 ieee80211_clear_tx_pending(local);
76588diff --git a/net/mac80211/main.c b/net/mac80211/main.c
76589index 3d90dad..36884d5 100644
76590--- a/net/mac80211/main.c
76591+++ b/net/mac80211/main.c
76592@@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
76593 local->hw.conf.power_level = power;
76594 }
76595
76596- if (changed && local->open_count) {
76597+ if (changed && local_read(&local->open_count)) {
76598 ret = drv_config(local, changed);
76599 /*
76600 * Goal:
76601diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
76602index 0f48368..d48e688 100644
76603--- a/net/mac80211/mlme.c
76604+++ b/net/mac80211/mlme.c
76605@@ -1464,6 +1464,8 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
76606 bool have_higher_than_11mbit = false;
76607 u16 ap_ht_cap_flags;
76608
76609+ pax_track_stack();
76610+
76611 /* AssocResp and ReassocResp have identical structure */
76612
76613 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
76614diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
76615index 6326d34..7225f61 100644
76616--- a/net/mac80211/pm.c
76617+++ b/net/mac80211/pm.c
76618@@ -34,7 +34,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76619 struct ieee80211_sub_if_data *sdata;
76620 struct sta_info *sta;
76621
76622- if (!local->open_count)
76623+ if (!local_read(&local->open_count))
76624 goto suspend;
76625
76626 ieee80211_scan_cancel(local);
76627@@ -72,7 +72,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76628 cancel_work_sync(&local->dynamic_ps_enable_work);
76629 del_timer_sync(&local->dynamic_ps_timer);
76630
76631- local->wowlan = wowlan && local->open_count;
76632+ local->wowlan = wowlan && local_read(&local->open_count);
76633 if (local->wowlan) {
76634 int err = drv_suspend(local, wowlan);
76635 if (err < 0) {
76636@@ -129,7 +129,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76637 }
76638
76639 /* stop hardware - this must stop RX */
76640- if (local->open_count)
76641+ if (local_read(&local->open_count))
76642 ieee80211_stop_device(local);
76643
76644 suspend:
76645diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
76646index 3d5a2cb..b17ad48 100644
76647--- a/net/mac80211/rate.c
76648+++ b/net/mac80211/rate.c
76649@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
76650
76651 ASSERT_RTNL();
76652
76653- if (local->open_count)
76654+ if (local_read(&local->open_count))
76655 return -EBUSY;
76656
76657 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
76658diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
76659index 4851e9e..d860e05 100644
76660--- a/net/mac80211/rc80211_pid_debugfs.c
76661+++ b/net/mac80211/rc80211_pid_debugfs.c
76662@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
76663
76664 spin_unlock_irqrestore(&events->lock, status);
76665
76666- if (copy_to_user(buf, pb, p))
76667+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
76668 return -EFAULT;
76669
76670 return p;
76671diff --git a/net/mac80211/util.c b/net/mac80211/util.c
76672index fd031e8..84fbfcf 100644
76673--- a/net/mac80211/util.c
76674+++ b/net/mac80211/util.c
76675@@ -1170,7 +1170,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
76676 drv_set_coverage_class(local, hw->wiphy->coverage_class);
76677
76678 /* everything else happens only if HW was up & running */
76679- if (!local->open_count)
76680+ if (!local_read(&local->open_count))
76681 goto wake_up;
76682
76683 /*
76684diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
76685index 32bff6d..d0cf986 100644
76686--- a/net/netfilter/Kconfig
76687+++ b/net/netfilter/Kconfig
76688@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
76689
76690 To compile it as a module, choose M here. If unsure, say N.
76691
76692+config NETFILTER_XT_MATCH_GRADM
76693+ tristate '"gradm" match support'
76694+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
76695+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
76696+ ---help---
76697+ The gradm match allows to match on grsecurity RBAC being enabled.
76698+ It is useful when iptables rules are applied early on bootup to
76699+ prevent connections to the machine (except from a trusted host)
76700+ while the RBAC system is disabled.
76701+
76702 config NETFILTER_XT_MATCH_HASHLIMIT
76703 tristate '"hashlimit" match support'
76704 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
76705diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
76706index 1a02853..5d8c22e 100644
76707--- a/net/netfilter/Makefile
76708+++ b/net/netfilter/Makefile
76709@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
76710 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
76711 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
76712 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
76713+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
76714 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
76715 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
76716 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
76717diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
76718index 12571fb..fb73976 100644
76719--- a/net/netfilter/ipvs/ip_vs_conn.c
76720+++ b/net/netfilter/ipvs/ip_vs_conn.c
76721@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
76722 /* Increase the refcnt counter of the dest */
76723 atomic_inc(&dest->refcnt);
76724
76725- conn_flags = atomic_read(&dest->conn_flags);
76726+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
76727 if (cp->protocol != IPPROTO_UDP)
76728 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
76729 /* Bind with the destination and its corresponding transmitter */
76730@@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
76731 atomic_set(&cp->refcnt, 1);
76732
76733 atomic_set(&cp->n_control, 0);
76734- atomic_set(&cp->in_pkts, 0);
76735+ atomic_set_unchecked(&cp->in_pkts, 0);
76736
76737 atomic_inc(&ipvs->conn_count);
76738 if (flags & IP_VS_CONN_F_NO_CPORT)
76739@@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
76740
76741 /* Don't drop the entry if its number of incoming packets is not
76742 located in [0, 8] */
76743- i = atomic_read(&cp->in_pkts);
76744+ i = atomic_read_unchecked(&cp->in_pkts);
76745 if (i > 8 || i < 0) return 0;
76746
76747 if (!todrop_rate[i]) return 0;
76748diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
76749index 4f77bb1..5d0bc26 100644
76750--- a/net/netfilter/ipvs/ip_vs_core.c
76751+++ b/net/netfilter/ipvs/ip_vs_core.c
76752@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
76753 ret = cp->packet_xmit(skb, cp, pd->pp);
76754 /* do not touch skb anymore */
76755
76756- atomic_inc(&cp->in_pkts);
76757+ atomic_inc_unchecked(&cp->in_pkts);
76758 ip_vs_conn_put(cp);
76759 return ret;
76760 }
76761@@ -1612,7 +1612,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
76762 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
76763 pkts = sysctl_sync_threshold(ipvs);
76764 else
76765- pkts = atomic_add_return(1, &cp->in_pkts);
76766+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
76767
76768 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
76769 cp->protocol == IPPROTO_SCTP) {
76770diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
76771index e3be48b..d658c8c 100644
76772--- a/net/netfilter/ipvs/ip_vs_ctl.c
76773+++ b/net/netfilter/ipvs/ip_vs_ctl.c
76774@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
76775 ip_vs_rs_hash(ipvs, dest);
76776 write_unlock_bh(&ipvs->rs_lock);
76777 }
76778- atomic_set(&dest->conn_flags, conn_flags);
76779+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
76780
76781 /* bind the service */
76782 if (!dest->svc) {
76783@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
76784 " %-7s %-6d %-10d %-10d\n",
76785 &dest->addr.in6,
76786 ntohs(dest->port),
76787- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
76788+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
76789 atomic_read(&dest->weight),
76790 atomic_read(&dest->activeconns),
76791 atomic_read(&dest->inactconns));
76792@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
76793 "%-7s %-6d %-10d %-10d\n",
76794 ntohl(dest->addr.ip),
76795 ntohs(dest->port),
76796- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
76797+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
76798 atomic_read(&dest->weight),
76799 atomic_read(&dest->activeconns),
76800 atomic_read(&dest->inactconns));
76801@@ -2285,6 +2285,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
76802 struct ip_vs_dest_user_kern udest;
76803 struct netns_ipvs *ipvs = net_ipvs(net);
76804
76805+ pax_track_stack();
76806+
76807 if (!capable(CAP_NET_ADMIN))
76808 return -EPERM;
76809
76810@@ -2508,7 +2510,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
76811
76812 entry.addr = dest->addr.ip;
76813 entry.port = dest->port;
76814- entry.conn_flags = atomic_read(&dest->conn_flags);
76815+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
76816 entry.weight = atomic_read(&dest->weight);
76817 entry.u_threshold = dest->u_threshold;
76818 entry.l_threshold = dest->l_threshold;
76819@@ -3041,7 +3043,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
76820 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
76821
76822 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
76823- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
76824+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
76825 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
76826 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
76827 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
76828diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
76829index 3cdd479..116afa8 100644
76830--- a/net/netfilter/ipvs/ip_vs_sync.c
76831+++ b/net/netfilter/ipvs/ip_vs_sync.c
76832@@ -649,7 +649,7 @@ control:
76833 * i.e only increment in_pkts for Templates.
76834 */
76835 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
76836- int pkts = atomic_add_return(1, &cp->in_pkts);
76837+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
76838
76839 if (pkts % sysctl_sync_period(ipvs) != 1)
76840 return;
76841@@ -795,7 +795,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
76842
76843 if (opt)
76844 memcpy(&cp->in_seq, opt, sizeof(*opt));
76845- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
76846+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
76847 cp->state = state;
76848 cp->old_state = cp->state;
76849 /*
76850diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
76851index ee319a4..8a285ee 100644
76852--- a/net/netfilter/ipvs/ip_vs_xmit.c
76853+++ b/net/netfilter/ipvs/ip_vs_xmit.c
76854@@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
76855 else
76856 rc = NF_ACCEPT;
76857 /* do not touch skb anymore */
76858- atomic_inc(&cp->in_pkts);
76859+ atomic_inc_unchecked(&cp->in_pkts);
76860 goto out;
76861 }
76862
76863@@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
76864 else
76865 rc = NF_ACCEPT;
76866 /* do not touch skb anymore */
76867- atomic_inc(&cp->in_pkts);
76868+ atomic_inc_unchecked(&cp->in_pkts);
76869 goto out;
76870 }
76871
76872diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
76873index 7dec88a..0996ce3 100644
76874--- a/net/netfilter/nf_conntrack_netlink.c
76875+++ b/net/netfilter/nf_conntrack_netlink.c
76876@@ -135,7 +135,7 @@ nla_put_failure:
76877 static inline int
76878 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
76879 {
76880- long timeout = (ct->timeout.expires - jiffies) / HZ;
76881+ long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;
76882
76883 if (timeout < 0)
76884 timeout = 0;
76885@@ -1638,7 +1638,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
76886 const struct nf_conntrack_expect *exp)
76887 {
76888 struct nf_conn *master = exp->master;
76889- long timeout = (exp->timeout.expires - jiffies) / HZ;
76890+ long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
76891 struct nf_conn_help *help;
76892
76893 if (timeout < 0)
76894diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
76895index 2d8158a..5dca296 100644
76896--- a/net/netfilter/nfnetlink_log.c
76897+++ b/net/netfilter/nfnetlink_log.c
76898@@ -70,7 +70,7 @@ struct nfulnl_instance {
76899 };
76900
76901 static DEFINE_SPINLOCK(instances_lock);
76902-static atomic_t global_seq;
76903+static atomic_unchecked_t global_seq;
76904
76905 #define INSTANCE_BUCKETS 16
76906 static struct hlist_head instance_table[INSTANCE_BUCKETS];
76907@@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_instance *inst,
76908 /* global sequence number */
76909 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
76910 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
76911- htonl(atomic_inc_return(&global_seq)));
76912+ htonl(atomic_inc_return_unchecked(&global_seq)));
76913
76914 if (data_len) {
76915 struct nlattr *nla;
76916diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
76917new file mode 100644
76918index 0000000..6905327
76919--- /dev/null
76920+++ b/net/netfilter/xt_gradm.c
76921@@ -0,0 +1,51 @@
76922+/*
76923+ * gradm match for netfilter
76924